Review brief: platform GeoIP for apps

You are GPT-6 reviewing a design spec independently of its author. Your output is a findings report, not an edit. Do not modify any file.

What to read

1. The spec under review: docs/superpowers/specs/2026-10-06-platform-geoip-design.md. §0's rulings are Paul's and fixed. Report a mechanism that fails one; do not re-argue one.
2. The originating request: amadan discussion carlos/platform #241, quoted in the spec's §1. The nearest-region spec it builds on: docs/superpowers/specs/2026-10-01-nearest-region-default-design.md §6.
3. The code it fits into, in this worktree: - internal/geo/ (mmdb.go, point.go, tz.go), cmd/console/main.go (openGeoIP); - internal/edge/edge.go (ServeHTTP, the six proxies and their Rewrite functions, observeAnalytics defer), internal/edge/homemap.go (acceptHop, setForwarded, stripForwardedHeaders), internal/edge/analytics.go (clientIP, hopVerified), internal/edge/door.go, internal/edge/cache.go, internal/edge/certsync.go (the precedent for mirroring from the bucket), internal/edge/purge_header.go; - internal/tunnelclient/, internal/host/tunnel_client.go, internal/host/agent.go, internal/host/units/carlos-edge.service; - internal/release/store.go (Store), the S3 store; - internal/analytics/ (Day, Delta, Obs, flush and merge); - internal/console/authcli.go (cliRoute, roles, rate limiting), internal/console/alertwatch.go, system.go (the carlos system antivirus verbs as the precedent for operator verbs); - AGENTS.md.

What matters most

• Forgery. Find any path by which a client-chosen value reaches an app in an X-Carlos-Geo-* header: any proxy, hop, tunnel, door, upgrade or cache path the strip in §8 misses, or a way to get tunnelKey onto a request that did not arrive over the tunnel.
• Wrong location. Any path where the edge locates the wrong address (the box itself, the hub, a sender edge, a proxy) and sets headers that look authoritative.
• The hot swap (§5.3). Can a lookup ever run against a closed mapping? Any deadlock or starvation under load?
• The mirror and publish protocol (§3–§5). Races between publishers, between a publish and an edge poll, a deleted blob, a partially written file, disk filling, a box restarting mid-swap, the console box reading a file the edge is replacing.
• The feed (§10). Supply-chain risks in fetching and publishing a file every edge maps into memory; decompression limits; the monotonic rule; credential handling; behaviour when DB-IP or MaxMind change URLs.
• Cache interaction (§7, §8.2). Does setting headers before the cache lookup interact correctly with Vary, the 8-variant limit and purge?
• Licensing (§13). Is anything stated wrongly about DB-IP Lite's CC BY 4.0 terms or MaxMind's GeoLite2 EULA?
• Claims about the code. Every file:line and every "already exists" claim: check it. Report each one that is wrong.
• Completeness for planning. Anything an implementer would have to invent because the spec is silent.

Output

A numbered list of findings, most severe first, each with: severity (P1 = wrong or unsafe as written, P2 = gap an implementer would get wrong, P3 = clarity), the spec section, the code evidence with file:line, and a concrete fix. End with a one-line verdict: accept, or revise.

Later rounds

For round N > 1, first give a disposition table for every finding of the previous round (CODEX-FINDINGS-GEOIP-R<N-1>.md): resolved, partly resolved, or not resolved, with one line of evidence from the revised spec. Then report only NEW findings, numbered from 1. Decisions marked D in §0 are open to challenge on mechanism, not on whether to exist; R rulings are fixed.