Repository navigation
docs(security): record the multi-replica replay-guard residual - #14
Merged
Merged
Conversation
terraboops
force-pushed
the
docs/replay-residual
branch
from
September 27, 2026 08:52
e924bc7 to
4e642b6
Compare
terraboops
force-pushed
the
docs/replay-residual
branch
from
September 27, 2026 08:54
4e642b6 to
bf44e05
Compare
terraboops
changed the base branch from
fix/audience-allowlist
to
test/rotation-race-audit
September 27, 2026 08:54
The optional replay guard is per-process, so it protects a single backend instance. Behind more than one replica the in-memory guard gives false comfort; a horizontally scaled backend needs a shared store behind the ReplayGuard interface. State that plainly, and why no shared implementation ships here (it would force a datastore choice onto the generic library). Documented gap, not a hole — the deployed StatefulSet runs one replica. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SDfMmeRXGsanqzDDSjL1uU
terraboops
force-pushed
the
docs/replay-residual
branch
from
September 28, 2026 02:42
bf44e05 to
1aa4ca6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records the residual the replay-store discussion left open: the shipped replay guard is per-process, so behind >1 replica it's false comfort; a shared store behind the
ReplayGuardinterface is needed, and none ships here on purpose (it would force a datastore choice onto the generic library). Documented gap, not a hole — the deployed StatefulSet runsreplicas: 1. No merge — review only.🤖 Generated with Claude Code
https://claude.ai/code/session_01SDfMmeRXGsanqzDDSjL1uU