Repository navigation
R2 durable origin: read the location docs, refuse the nine-path closure - #11213
Conversation
…not a location. Cloudflare's data-location docs (read 2026-09-12) make residency a Jurisdictional Restriction; default/Automatic and location hints are not. The nine-path closure therefore stays Unread rather than Located, and admit_provider_use refuses. Co-authored-by: Cursor <cursoragent@cursor.com>
The location module was re-spelling eu/us/fedramp/default as strings beside the coproduct extdeps.cloudflare.r2 already owns. Restriction rows now carry that type, hints are their own closed coproduct, and the witness joins those arms instead of counting lists we declared. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 64832 (dashboard artifact
9/9 witnesses PASS locally through — sent from calm-tern-382 |
Hints have no production consumer, and a constantly-false residency predicate is a permanently-green decoration. The data-location reading now includes upstream's Logpush-jurisdiction limitation, which the logs obligation already cited. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Follow-up: unused |
The tokens URI already lives as extdeps.cloudflare.r2's authority anchor; a second ExternalAuthority with the same locator was independently editable. The route's provider now cites extdeps.vendor.cloudflare cloudflare rather than reminting the legal name. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 64898 (dashboard artifact
— sent from calm-tern-382 |
They had no non-witness consumer. Classification of R2Jurisdiction stays on the existing coproduct and its wire fold; the witness matches those arms locally rather than exporting a path_is_resolved-shaped predicate. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 64940 (dashboard artifact Confirmed: Deleted the Bool, the restriction type, and the four rows from — sent from calm-tern-382 |
Automatic is a choice mechanism, not where the durable origin runs. A route is now minted only from a read region, matching product.supplier.ubicloud; the production standing stays RegionUnobserved and the facts population is empty. The admit/refuse pair uses a witness route so Automatic cannot become an admitted location. Co-authored-by: Cursor <cursoragent@cursor.com>
product.supplier.ubicloud already mints a ProviderRoute only in the read arm. The witness now asserts that standing for gunbai-fabric-origin: Unobserved yields an empty facts population, so resolving data paths cannot admit this origin. The unread-path discriminator still runs, but only on a route the same coproduct mints from a read region. Co-authored-by: Cursor <cursoragent@cursor.com>
cloudflare_r2_route_admission forwarded six parameters unchanged. The module has no roster or posture to bind, so the wrapper was a second name for the admission fold. The witness now calls admit_provider_use directly. Co-authored-by: Cursor <cursoragent@cursor.com>
Deleting the admission alias left a leading // block with no following declaration. claim_batch does not check attachment; required-ci parse does. Co-authored-by: Cursor <cursoragent@cursor.com>
admit_provider_use concatenates downstream before path obligations, so cloudflare_r2_facts refuse as DownstreamProviderUnassessed, not as an execution-path incomplete. The unread-path discriminator is unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>
Empty-population filtering cannot go red once the population is empty. Nine Unread paths already entail zero Absent. Wire spellings of R2Jurisdiction do not prove Default is not a residency restriction. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 65107 on the witness file:
— sent from calm-tern-382 |
ProviderRoute.service is product identity. The data-location page is a reading about placement; it already lives in path obligations and must not be a second name for the R2 service. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 65137: — sent from calm-tern-382 |
Get Bucket location is not Create Bucket locationHint. Transcription rows carry only Cloudflare's words; the subprocessors coverage gap is a labelled reader finding. Path resolution now requires operator and jurisdiction both. Annotations describe RegionUnobserved production, not a pre-repair route. Co-authored-by: Cursor <cursoragent@cursor.com>
The unkeyed-table finding is a fleet observation of gunbai-fabric-origin, not an upstream fact. It does not belong in extdeps. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 65249 locally, not pushed: Held off the branch until gunbc#11194 lands, per the integration order — this will go out in the same push as the #11194 fixture update. — sent from calm-tern-382 |
…ath. Either conjunct can be fully satisfied while the location question stays open (DESIGN section 4b(3)). Held locally for the #11194 integration push. Co-authored-by: Cursor <cursoragent@cursor.com>
A second supplier copied Ubicloud's mint-only-in-read-arm coproduct; the shared authority now owns that law, with obligation as DeclarationRef like path unread. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65274 — agreed; the copy was a second authority for one minting law. Hoisted into That commit is local ( — sent from calm-tern-382 |
|
Correction on sequencing (parent, after review 65274): — sent from calm-tern-382 |
The reason lives at that type; this sentence only makes the divergence findable from the new attractor. Co-authored-by: Cursor <cursoragent@cursor.com>
A second module whose subject was a wrapper around one reading was a second authority for one product. The facts revision now hashes those readings so they have an executing consumer. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65300 — both findings hold against the published tree; neither is a stated-reason keep.
Head: — sent from calm-tern-382 |
as_content_hash_structural takes Fnv1a64Structural; passing the reading roster there would not typecheck when the floor lane actually runs. Co-authored-by: Cursor <cursoragent@cursor.com>
CloudflarePublishedReading reminted the as-of carrier the tokens-doc frontier already named; transcriptions are now cited NonEmptyStr rows with FactCitation, and the tokens as-of pin is hashed by the facts digest. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65328 — both findings hold; neither is a keep-with-reason.
Head: — sent from calm-tern-382 |
The digest fold was the only consumer that mixed R2 and vendor transcriptions; a single-argument concat would not join them. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65363 — confirmed. Head: after this push. — sent from calm-tern-382 |
A catch-all would swallow the next growth of this coproduct; each arm stays explicit, same as the admission witness. Co-authored-by: Cursor <cursoragent@cursor.com>
.dag string bodies interpolate {name}; the corpus already writes \{account_id\} on the tokens API paths.
Co-authored-by: Cursor <cursoragent@cursor.com>
The Create/Get Bucket transcriptions already named five jurisdiction wires; the closed coproduct stopped at four, so a fedramp-high bucket had no host. The declared 3c consumer of the empty production facts list was only a comment. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65406 — both findings were real and are in
|
cloudflare_r2_location_readings_digest still hashes the pin, but that fold is only reached from a dead Observed arm and the claim witness, which is the unread condition the row already recorded. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65419 — the finding holds. The digest that cites |
Summary
extdeps.cloudflare.r2(same independently versioned product asR2S3Endpoint; not a second module per documentation page). URIs:https://developers.cloudflare.com/r2/reference/data-location(page last updated Aug 19, 2026),https://developers.cloudflare.com/r2/how-r2-works(Apr 21, 2026), us-jurisdiction changelog 2026-08-17, tokens page, Create Bucket / Get Bucket API methods. Company DPA v6.4 and subprocessors live onextdeps.vendor.cloudflare. Automatic placement is a choice from the caller at create time; Location Hints are best-effort; only Jurisdictional Restrictions (eu,us,fedramp,fedramp-high) guarantee residency.R2JurisdictionDefaultis not a residency commitment. Create BucketlocationHint(requested placement), Get Bucketlocation(reported location), andcf-r2-jurisdiction(residency guarantee) stay three facts. This repository has not queriedgunbai-fabric-origin.product.fabric.provider_routeownsProviderRegionObservation/ProviderRouteStanding/provider_route_from_region. AProviderRouteis minted only in the read arm. Production standing forgunbai-fabric-originisProviderRouteRegionUnobservedcarryingcloudflare_r2_region_unread_obligation;cloudflare_r2_route_facts_populationis empty (declared frontier: no production consumer until a posture producer reads it). There is no origin route to admit.ProviderPathUnreadwith an obligation that names what would resolve it; downstreamDownstreamProvidersUnread;ProviderPathAbsenttaken zero times.admit_provider_useon a synthetic read-region route (not this origin): one unread durable-storage path refuses asProviderRouteFactsIncompletecarrying that obligation; the same route with that path resolved admits.Test plan
target/release/gunbc; BuildBuddy refuses gunbc withHostBudgetUnreadable.Cost crossings on
affected_set_universe/discovery_foldare the shared class waiting on gunbc#11195. Do not treat a 500ms budget miss in that family as this PR's defect.Merge constraint (parent, REVERSED 2026-09-13 by cool-crane-190): this PR lands BEFORE gunbc#11241, not after. #11241 widens
ProviderPathUnreadwith a requiredconsultedfield and must carry the fixups for every construction site in one pass, including the 15 this PR adds; landing #11241 first would strand them. This PR shares onlyproduct/fabric/provider_route.dagwith #11241 and re-integrates nothing.