Repository navigation
id: PoC: verify DO jurisdiction mechanics and confirm vendor residency guarantees #2285
Description
Follow-up C from the Durable Object jurisdiction investigation on #2061
(doc: doc/2026-10-29T11-43-02Z_investigation_do_jurisdiction_pinning/, §5 and §1.5).
Parent epic: #2056. Context: #2044.
Needs a Cloudflare account to deploy a scratch Worker — not doable from a repo-only worker session. Two halves: code mechanics (small PoC) and a written vendor ask (not code).
Half 1 — PoC (one deployed scratch Worker, no user data)
idFromName(name)vsjurisdiction("eu").idFromName(name)produce different IDs in this account (docs assert it; confirm).ctx.id.jurisdictionreads backeuinside the object, including from an alarm; confirm bothundefinedcases (unrestricted namespace; alarm scheduled before 2026-03-15).- A mismatched namespace/ID pair throws; an unrestricted namespace silently accepts a foreign ID (the failure mode the design guards against).
- Export from an
euobject, import into ausobject: signatures still verify (migration path). - R2: create an
eu-jurisdiction bucket, confirm the Worker binding needs thejurisdictionfield and that the S3 jurisdiction endpoint cannot reach outside the jurisdiction.
Half 2 — the written ask to Cloudflare (blocks any DPA that claims EU residency)
The docs guarantee the object "only run[s] and store[s] data within a region" and that it is never migrated out of the jurisdiction's data-centre list. They do not say that DO SQLite's storage replication path stays inside the jurisdiction:
- SQLite commits are forwarded to five follower machines, each in a different physical data center, and WAL batches/snapshots go to object storage (blog). No jurisdiction statement appears in that post.
- Point-in-time recovery / bookmark retention: jurisdiction-confined? Not documented either way.
- Does
fedrampjurisdiction for Durable Objects require a separate entitlement (R2's FedRAMP jurisdiction explicitly does; DO's docs say nothing)?
Ask Cloudflare support/account team in writing and record the answer on this issue. A negative or evasive answer changes the hosted edition's residency claim, so this is not optional polish.
Acceptance
- PoC results recorded as a comment (or short doc) with what was observed, including failures.
- The vendor answer, or the exact question as sent plus the date, recorded here.
- Any gap the answer exposes filed as an issue.
Acceptance criteria
- PoC results recorded here (or in a short doc): all five Half-1 mechanics confirmed or the failure recorded, including both ctx.id.jurisdiction undefined cases
- The Cloudflare written ask (Half 2) sent verbatim and dated on this issue; the vendor answer recorded when it arrives
- Any residency gap the answer exposes is filed as its own issue
Activity
developing-today commentedon Oct 29, 2026
CODE-1143
dezren39 commentedon Oct 29, 2026
Intake review
Related: #2061 (jurisdiction investigation, §5/§1.5), #2044, #2283/#2284 (sibling follow-ups A/B), epic #2056
Notes: Two halves: a small deployed-Worker PoC and a vendor ask. Needs a Cloudflare account — not doable from a repo-only session, per the body.
Risks: An evasive vendor answer changes the hosted edition's residency claim — treat Half 2 as blocking for any EU-residency DPA language.
Suggested approach: Half 1 via a scratch Worker on Drew's Cloudflare account; Half 2 via support/account team in writing.
🤖 Agent note · filed
meta/enrichedapplied. Still-live check this pass: no merged PR or fix commit explicitly resolving this issue was found; where a queue triage task owns verification, it is named in the notes.dezren39 commentedon Nov 3, 2026
Unblock read from task 5800 (queue triage of the #2285 → #3403 → #3399 chain). Posting here because #3399 Phase 1 is gated on this issue's evidence and has now parked twice (tasks 5798, 5800) without progress.
Correction to the "not doable from a repo-only worker session" premise. The OpenChamber execution host has
wrangleron PATH andCLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_IDpresent in the environment (names checked only — no values read). So Half 1's scratch-Worker PoC appears executable from here, not account-inaccessible. What is missing is not access but authorization: deploying a scratch Worker and aneu-jurisdiction R2 bucket creates billable/side-effecting resources on Drew's Cloudflare account.Decision required (Drew): authorize one scratch deployment under the
jurisdictionPoC (no user data), i.e. may an agent run #2285 Half 1 non-interactively on that account?Unblocks on yes: #2285 Half 1 evidence → #3403 phase 0 → #3399 phase 1 (this chain, 3 tasks). Half 2 (written vendor/residency ask) remains Drew's regardless — it is correspondence, not code, and it is the part that gates EU-residency DPA language.
Meanwhile: #3399 task 5800 is being blocked
escalated-to-user(not parked again) so the chain stops burning a 30-minute park cycle on an unchanged gate. Nothing in the repo was edited.developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 6817 (triage, queued, priority 50) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03
dezren39 commentedon Nov 3, 2026
Queue pickup — task 6817 (triage), OpenChamber scheduled lane. Revalidating #2285 and its Cloudflare authorization gate; no repo changes planned unless evidence shows they are needed.
dezren39 commentedon Nov 3, 2026
Triage verdict — authorization required; no PoC or vendor result yet
Fresh GitHub revalidation: #2285 remains OPEN and assigned to Drew. The latest substantive note (2026-11-03T10:44Z) asks Drew to authorize one scratch Worker plus an
eu-jurisdiction R2 bucket on the account. No authorization, deployed PoC findings, or vendor response has appeared since; no open PR for #2285 was found.The blocker is a user decision, not a code defect: deploying the requested scratch resources has account/billing side effects, and sending the written residency questions is external correspondence. This lane did not deploy resources or contact Cloudflare. Half 1 must verify all five mechanics in the issue (including the two undefined
ctx.id.jurisdictioncases); Half 2 must be sent in writing and its answer recorded before any EU-residency claim is treated as established.Decision needed from Drew: authorize or decline the one no-user-data scratch deployment described above, and handle/authorize the written vendor ask. Until then the residency gate remains unresolved; no vendor email is represented as sent. Queue task 6817 is blocked
escalated-to-user; labels now reflectqueue/blocked,status/blocked,user/escalated.feat(id): hosted data-plane scaffold — binding-backed per-user Durabl…