| 1 | # Astra: review region HA spec 2 (two-box regions), rev 1 |
| 2 | |
| 3 | Spec: `docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md` on branch `design-region-ha-two-box`. It builds on spec 1 (`docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md`), whose code is on main and dormant. |
| 4 | |
| 5 | Paul's rulings H1 to H24, and the section choices in §2, are settled. Don't reopen them. Judge whether the design achieves them safely, against the code on main. |
| 6 | |
| 7 | **Focus areas:** |
| 8 | 1. **Safety under the claim.** |
| 9 | - Can two boxes in a region ever run the same instance, or let a stale local copy win? |
| 10 | - Is §8's list of single-box assumptions complete? Grep main for others. |
| 11 | 2. **Boot and enrolment (§5).** |
| 12 | - Can a box take instances before it's hardened, configured or enrolled? |
| 13 | - Is H16's confirmation sound with the new read-only Auto Scaling describe? |
| 14 | - Is the SSM and KMS scope tight enough, given the `host_buckets` statements and the existing SSM Deny in `infra/modules/region-host/main.tf`? |
| 15 | 3. **Ingress (§6).** |
| 16 | - Is the NLB health answer correct and narrow? |
| 17 | - Do private-address forwarding and platform-route forwarding work with `internal/edge/homemap.go` and `edge.go`'s single-hop backhaul? |
| 18 | - Does anything break when the region's EIP moves to an NLB: GeoIP, rate limits, the IMDS `public-ipv4` that edges files publish, certificate issuance, or the domain check? |
| 19 | 4. **Placement (§7).** |
| 20 | - Are the eligibility rules and the unplaced state consistent with `internal/boxchoice` and `internal/hostops/executor.go`? |
| 21 | - Is `unplaced` representable in the claim's create intent without breaking recovery? |
| 22 | 5. **Rollout (§9).** |
| 23 | - Is the EIP cut-over sequence correct for AWS: an NLB subnet-mapping EIP can be set only at creation? |
| 24 | - Is the rollback real? |
| 25 | - Does the old box keep serving correctly as an NLB target? |
| 26 | 6. **Failure modes (§10).** Is anything missing or wrong? |
| 27 | 7. **The open questions in §13.** |
| 28 | |
| 29 | Give findings P1/P2/P3 with file:line, each with a concrete failure scenario. End with a verdict: ready for a plan, or not. |
| 30 | |
amadan