Repository navigation
Open
Labels
app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)effort/mMedium: expected under 1 day of workMedium: expected under 1 day of workkind/infrastructureInfrastructure / host-portability workInfrastructure / host-portability workmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels addedpriority/highImportant and time-sensitiveImportant and time-sensitivequeue/blockedQueue or user escalation stateQueue or user escalation statequeue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queuesource/humanFiled directly by a humanFiled directly by a humanstatus/blockedQueue or user escalation stateQueue or user escalation statetask/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this itemwork/assignedQueue worker lifecycle stateQueue worker lifecycle state
Description
Follow-up to #2283. Implement fail-closed hosted signup/deployment configuration validation for configured jurisdiction and its restricted Durable Object namespace and R2 bucket. Consume deployed-account evidence from #2285; do not duplicate that PoC or imply a probe proves vendor residency guarantees.
Acceptance: production cannot enable signup or migration with missing/unverified jurisdiction, unsupported runtime/types, or missing mismatched bucket; explicit diagnostics and configuration tests cover unavailable US and no unrestricted fallback. Coordinate with the design doc on the #2283 branch.
Metadata
Metadata
Assignees
Labels
app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)effort/mMedium: expected under 1 day of workMedium: expected under 1 day of workkind/infrastructureInfrastructure / host-portability workInfrastructure / host-portability workmeta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels addedpriority/highImportant and time-sensitiveImportant and time-sensitivequeue/blockedQueue or user escalation stateQueue or user escalation statequeue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queuesource/humanFiled directly by a humanFiled directly by a humanstatus/blockedQueue or user escalation stateQueue or user escalation statetask/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this itemwork/assignedQueue worker lifecycle stateQueue worker lifecycle state
Activity
developing-today commentedon Nov 1, 2026
CODE-1298
dezren39 commentedon Nov 1, 2026
Intake review
Related: #2283 (parent, design doc on its branch), #2285 (deployed-account evidence — consumed, not duplicated), siblings #3399–#3402, #3404.
Notes: Inline Acceptance present (production cannot enable signup/migration with missing/unverified jurisdiction, unsupported runtime/types, or missing/mismatched bucket; diagnostics + config tests incl. unavailable-US and no unrestricted fallback). This is the gate that makes the rest of the set safe to ship — priority/high for sequencing.
Risks: Do not let the validation imply vendor residency guarantees beyond what #2285's PoC actually proves — the filing is explicit about that boundary.
Suggested approach: Config validation with explicit diagnostics per failure class; tests enumerated from the acceptance list one-to-one.
— fleet monitor intake (2026-11-01)
101 remaining items
dezren39 commentedon Nov 3, 2026
Handed off — task 5798 claimed by lane L (queue repo-health-code-pilot) and assigned to the opencode execution lane; the opencode claimant's bound session drives issue #3403 from here.
dezren39 commentedon Nov 3, 2026
🤖 Agent note · blocked / escalated
escalated-to-user, joining task 5800's block on the same chain. Fresh check 2026-11-03: issue id: PoC: verify DO jurisdiction mechanics and confirm vendor residency guarantees #2285's newest comment (2026-11-03T10:44Z) is not the deployed-account DO/R2 evidence this gate needs — it is an escalation asking Drew to authorize one scratch Cloudflare deployment (a scratch Worker +eu-jurisdiction R2 bucket, no user data) so the id: PoC: verify DO jurisdiction mechanics and confirm vendor residency guarantees #2285 Half 1 PoC can run. Until Drew says yes or no, the id: gate hosted jurisdiction provisioning on verified DO and R2 support #3403 Phase 0 gate cannot be built on verified evidence.developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 5798 (small_fix, blocked, priority 20) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
Gate update from queue task 6817: fresh triage of #2285 found it still OPEN, with no Drew authorization, PoC findings, or Cloudflare vendor response. Its gate has moved from needs-triage to an explicit
user/escalatedauthorization blocker; task 6817 is blockedescalated-to-user. No scratch resources were deployed and no vendor message was sent. Task 5798 remains blocked until Drew decides on the no-user-data scratch Worker/R2 deployment and the required evidence is recorded on #2285.Resume condition: #2285 publishes verified DO/R2 PoC results and the written vendor ask/answer or an explicit disposition; then revalidate this issue and its packet before implementation.
feat(id): hosted data-plane scaffold — binding-backed per-user Durabl…