Repository navigation
id: isolate hosted blobs by jurisdiction and minimize shared directory #3401
Description
Follow-up to #2283. Configure and validate a separate jurisdiction-bound R2 bucket per supported jurisdiction; choose from authoritative jurisdiction with no fallback. Keep content-addressed dedupe and garbage collection jurisdiction-local. Make shared D1 directory data-minimal and document its residency exception and limitations.
Acceptance: bucket routing/config tests reject missing or mismatched bindings and cross-jurisdiction use; directory schema allowlist excludes graph/private content; disclosure acknowledges pseudonymous data and other platform residency gaps. Depends on #2285 provisioning verification and hosted routing.
Metadata
Metadata
Assignees
Labels
Package/app: id (pkgs/ or apps/ in this repo)Medium: expected under 1 day of workInfrastructure / host-portability workIntake review done: acceptance criteria, links, and normalized labels addedOrdinary priority (the default)Queue or user escalation stateQueue worker lifecycle stateHas a queued task in the Supabase agent queueFiled directly by a humanQueue or user escalation stateQueue worker lifecycle stateQueue or user escalation stateQueue worker lifecycle state
Activity
developing-today commentedon Nov 1, 2026
CODE-1300
dezren39 commentedon Nov 1, 2026
Intake review
Related: #2283 (parent), #2285 (provisioning verification — dependency), #3400 (hosted routing — dependency), siblings #3399, #3402–#3404.
Notes: Inline Acceptance present (bucket routing/config tests rejecting missing/mismatched bindings; D1 directory allowlist excluding graph/private content; disclosure of pseudonymous-data and platform residency gaps).
Risks: Jurisdiction-local dedup/GC changes the storage cost model — note the operational cost in the PR. The shared-directory residency exception must stay documented, not implicit.
Suggested approach: Config validation + routing tests first (fail-closed on missing binding), then GC/dedup scoping, then the directory allowlist audit.
— fleet monitor intake (2026-11-01)
237 remaining items
dezren39 commentedon Nov 3, 2026
agent-note:v1
event: parked
task: 5803 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane c29174f1-48e0-4b13-b4ff-9b73ab67e9ab)
state: parked at 2026-11-03T10:48Z (30 minutes). Gate revalidation (attempt 7, all fresh via gh):
reason: phase-1/2 contracts and provisioning verification unlanded; config-validation work built now would be speculative scaffolding against a proposed (not yet existing) hosted worker and risks competing with id: add immutable jurisdiction and migration metadata to hosted directory #3399/id: enforce restricted jurisdiction routing and object entry guards #3400/id: gate hosted jurisdiction provisioning on verified DO and R2 support #3403 when they land. No worktree or source touched.
resume: after id: PoC: verify DO jurisdiction mechanics and confirm vendor residency guarantees #2285 provisioning evidence is verified and id: add immutable jurisdiction and migration metadata to hosted directory #3399/id: enforce restricted jurisdiction routing and object entry guards #3400 contracts land with id: gate hosted jurisdiction provisioning on verified DO and R2 support #3403 overlap cleared; then revalidate fresh before implementing.
labels: queue/parked + status/parked + work/assigned set; queue/queued + status/needs-triage removed.
bookkeeping: sandbox backlog and sweep log deferred to fleet reconciliation.
dezren39 commentedon Nov 3, 2026
Queue task 5803 blocked
escalated-to-user— no code changed, no worktree, no branch.Why blocked instead of parked an 8th time. Fresh checks 2026-11-03T12:02Z:
status/parked— this task has been parked 7 times since 2026-11-01.status/needs-triage, unchanged since its two intake comments of 2026-10-29T12:28Z — no deployed-account DO or R2 jurisdiction evidence.status/blocked+user/escalated.queue/parked.queue/parked, handed off to the opencode lane at 2026-11-03T11:57Z on the same unmet id: PoC: verify DO jurisdiction mechanics and confirm vendor residency guarantees #2285 gate.origin/mainat 1e3763f has no hosted jurisdiction, R2-binding, or shared-directory code (only vendored oid-registry build artifacts mention "jurisdiction"), so there is no landable slice underneath this issue.Read. #3401 is phase 3 of a chain whose phase-0 evidence (#2285) is a vendor/account probe only Drew can run, and whose phase-1/2 contracts (#3399, #3400, #3403) are all parked or escalated on that same evidence. The packet's "config-validation half can proceed" escape hatch is not available: a config validator written now would duplicate #3403 (which owns the provisioning gate) and would encode bindings for a contract that has not landed. Repeated 20-30 minute parks therefore only churn the queue.
What unblocks this. Either (a) post deployed-account DO jurisdiction + R2 jurisdiction evidence on #2285, then land #3399 and #3400; or (b) explicitly decide that the hosted jurisdiction store is deferred and close #3401 and the phase issues with that record. After either, revalidate #3401 fresh and re-enqueue.