| 1 | # Findings on the relay spec, revision 5 |
| 2 | |
| 3 | Reviewed by **GPT-6 (Codex), 2026-09-07**, fifth pass, against revision 5 at `600a8f1`, with Paul's rulings treated as fixed. Unedited apart from this note. Revision 6 records how the finding was taken. |
| 4 | |
| 5 | | Revision-4 finding | Disposition | Reason | |
| 6 | |---|---|---| |
| 7 | | R4-1 — Rotation publication fence | Closed | Lease ownership checked at each bucket write, combined with config CAS and per-app serialization, provides a buildable fence. | |
| 8 | | R4-2 — Acknowledgement identity | Closed | Comparing the full `username_suffix` per region distinguishes credentials across disable/re-enable. | |
| 9 | | R4-3 — Retirement after manual cutover | Partial | The formula includes late cutovers, but the prescribed restart cannot establish cutover for every unobservable route. | |
| 10 | |
| 11 | Reviewed commit `600a8f15912513eb4fb538a343a0877531b6fac3`, treating Paul’s six rulings as fixed. The cryptographic vector reproduces. [Pion v4.1.4’s API](https://pkg.go.dev/github.com/pion/turn/v4) and local authentication source were checked. No files were changed; no live TURN or EC2 tests were run. |
| 12 | |
| 13 | ## R5-1 — P2 — Rotation has no cutover path for externally managed TCP routes |
| 14 | |
| 15 | **Sections:** §2, config delivery; §5, rotation step 5. |
| 16 | |
| 17 | Rotation step 5 uses an activator-recorded `carlos restart` time as the cutover for TCP-address routes whose adoption config sync cannot observe. CARLOS does not necessarily control those processes. |
| 18 | |
| 19 | Consider a TCP-address route with file delivery enabled, but no socket, unit backing or named unit. Its external supervisor started the process with the old relay key. Rotation delivers the new file, but `carlos restart` cannot restart that supervisor: the activator has no child to bounce, and the root fallback cannot reach the external process. |
| 20 | |
| 21 | The required cutover therefore never arrives. Recording the restart request or a no-op as cutover instead would permit retirement while that process still mints old-key credentials. |
| 22 | |
| 23 | Routes **without config delivery**, also included in step 5, have an additional contradiction: their cutover requires a restart “after the file was delivered,” but no such delivery occurs. |
| 24 | |
| 25 | **Evidence:** The [retirement procedure](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/media-roadmap-spec/docs/superpowers/specs/2026-09-07-relay-stun-turn-design.md:557) requires these restart times. [TCP config delivery](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/media-roadmap-spec/internal/appconfig/syncexec.go:11) explicitly leaves process ownership with the external supervisor. [`Bounce`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/media-roadmap-spec/internal/activator/activator.go:872) affects only a running activator entry; [restart dispatch](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/media-roadmap-spec/internal/host/agent.go:2532) supplies no general external-supervisor mechanism. |
| 26 | |
| 27 | **Correction:** Define which route shapes can establish cutover. Either require managed delivery and a controllable restart path, or specify an external adoption acknowledgement bound to the newly issued identities. A route without delivery must remain a retirement blocker until that prerequisite is resolved. Preserve `max(rotation + 28h, latest cutover + 4h)`. |
| 28 | |
| 29 | Test an externally supervised TCP route with no named unit: a restart request must not establish cutover. Also test a route without config delivery. |
| 30 | |
| 31 | **Verdict: request changes.** No P1 remains. One P2 remains in the rotation cutover mechanism. |
amadan