Two-phase rollout for subnet↔zone moves #17

New Issue

2026-07-26T17:07:36+10:00

benvin commented

2026-07-26 17:07:36 +10:00

Problem. Adds fail closed mid-rollout (safe, per DESIGN.md §11.2), but
moving a subnet between zones is neither an add nor a remove. Mid-convergence,
device A enforces the new zone mapping while device B enforces the old one —
and the subnet can transiently match an old, broader rule on B. That's a
transient unintended permit, the one rollout direction the current design
doesn't make safe.

Proposal. Detect subnet moves at compile time and split them across two
generations: gen N adds the subnet's new-zone rules everywhere (union posture,
still fail-closed for anything newly permitted), gen N+1 removes the old-zone
association only after the fleet reports convergence on N. Minimum viable
version: refuse the single-step move with an error explaining the manual
two-apply sequence.

Acceptance. A test that moves a subnet from a permissive zone to a
restrictive one and asserts no intermediate generation ever widens access on
any device relative to both endpoints.

**Problem.** Adds fail closed mid-rollout (safe, per DESIGN.md §11.2), but moving a subnet between zones is neither an add nor a remove. Mid-convergence, device A enforces the new zone mapping while device B enforces the old one — and the subnet can transiently match an *old, broader* rule on B. That's a transient unintended **permit**, the one rollout direction the current design doesn't make safe. **Proposal.** Detect subnet moves at compile time and split them across two generations: gen N adds the subnet's new-zone rules everywhere (union posture, still fail-closed for anything newly permitted), gen N+1 removes the old-zone association only after the fleet reports convergence on N. Minimum viable version: refuse the single-step move with an error explaining the manual two-apply sequence. **Acceptance.** A test that moves a subnet from a permissive zone to a restrictive one and asserts no intermediate generation ever widens access on any device relative to both endpoints.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswallapi#17