From ff4da6f41e533a4bdd96919f363ddeb2793c49eb Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 04:16:48 +0000 Subject: [PATCH] docs(prd): bound heavy gateway operations --- docs/prds/0082-authoritative-failure-boundaries.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/prds/0082-authoritative-failure-boundaries.md b/docs/prds/0082-authoritative-failure-boundaries.md index 4d3429ac..15faf1c9 100644 --- a/docs/prds/0082-authoritative-failure-boundaries.md +++ b/docs/prds/0082-authoritative-failure-boundaries.md @@ -51,6 +51,9 @@ misleading behavior: 10. Cleanup executes the entire post-confirmation snapshot rather than the intersection with what the operator saw, and mutation failures are not reflected in the command result. +11. Git smart-HTTP can retain sixteen 100 MiB request bodies concurrently, + cleanup mutations have no subprocess deadline, and Firecracker signalling + failures bypass shared mutation accounting. These are one design problem: state used to authorize deletion, replacement, or resource allocation must be authoritative at the point of use. @@ -85,6 +88,9 @@ or resource allocation must be authoritative at the point of use. - Cleanup executes only resources present in both the displayed and current authoritative plans, attempts every approved mutation, and returns failure when any mutation does not complete. +- Git request bodies spool to disk behind a separate heavy-work semaphore; + cleanup commands have configurable deadlines; Firecracker signalling + failures aggregate while identity-verification uncertainty still aborts. - Unit tests cover PID/path reuse, partial backend enumeration, transient policy resolution failure, slow bodies, concurrency saturation, and stream closure races. @@ -160,6 +166,8 @@ reported through the supervisor's normal diagnostic channel. queries, and bounded Firecracker artifact transfers. 9. Mandatory authenticated secret storage, shared cleanup-plan intersection and mutation accounting, and contained Git backend process failures. +10. Disk-spooled and separately bounded Git bodies, cleanup command deadlines, + and classified Firecracker signalling failures. ## Open questions