feat(0190): cancel the key registry, with the measurement behind it - #232
Merged
Merged
Conversation
0190's first acceptance criterion was a decision, not a table. Measured against the production account rather than argued: - control plane is 10 rps / burst 40 for the whole account, non-adjustable, and GetApiKeys/GetApiKey/GetUsage all draw on that one bucket; - 14 days of CloudTrail is 961 calls, peaking at 12/s, and the top spender is CloudFormation, not visitors; - exactly one portal key exists and the portal is closed; - a cold dashboard load costs four control-plane calls, two of which are the same GetApiKeys run once by the reveal and once by the usage route. A registry could replace only those two — AWS holds the credential and the counter — so its ceiling is 4 to 2, while the in-process cache the usage route already runs takes warm loads to 0. It loses to code that is already in the tree. Premise 2 has no customer: 0191 states no stored timestamp is needed and nothing in the epic asks for prior-key history. Premise 3 holds technically, since ClickHouse is on Hetzner, but puts a durability-critical record on the volume that stalled 11.5 h on 2026-08-13 and still has no free-space alarm. Decisive and structural: 0158/0190's ReplacingMergeTree ORDER BY discord_user_id keeps one row per user, so the next issue would overwrite 0192's revocation row and reset the cap the epic forbids resetting. Building it would hand 0192 a shape that loses 0192's data. No DDL, no code, no IAM, no integration into 0187/0188/0191. Evidence and the two named re-open triggers are in the epic doc so this is not proposed a third time. 0194's costing criterion corrected while the numbers were in hand: it described the load as two calls; it is four.
0190's job was not only the verdict but the groundwork for whoever needs storage next. Cancelling the registry is not a ruling that the epic never stores anything: 0192 will, and it should not restart the question. Substrate is settled and recorded as settled: ClickHouse, per ADR 0007, because this project has no other store in the AWS account and one small table is the worst possible reason to break that ADR. Three things are left open for 0192 to decide, written into a new Storage section there: - the shape must be append-only, and explicitly NOT 0158's ReplacingMergeTree ORDER BY discord_user_id, which keeps one row per user and would let an issue overwrite a revoke; - write access does not exist and is not ours to grant. The api-handler reads as prices_reader, SELECT only; those grants are XML-managed in BE's services.xml; DDL is an operator action as default over the loopback port; and a broad DDL grant for the ingestion writer was already rejected under 0134. "ClickHouse already stands" is true of the cluster and false of the capability, and the grant negotiation is the item with cross-team lead time; - whether the record earns its cost at all, given 0192 is optional for Tranche 3 and has a cheaper documented fallback. Same three summarised in the epic doc beside the cancellation, so the decision reads as "not now, and here is where it lands" rather than "no".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.mdfiles.GetApiKeys/GetApiKey/GetUsageall draw on that one bucket); 14 days of CloudTrail is 961 calls peaking at 12/s with CloudFormation as the top spender, not visitors; one portal key exists and the portal is closed; a cold dashboard load costs four control-plane calls (~1.14 s), two of which are the sameGetApiKeysrun once by the reveal and once by the usage route.ReplacingMergeTree ORDER BY discord_user_idkeeps one row per user, so the next issue would overwrite 0192's revocation row and reset the cap the epic forbids resetting. Building it would hand 0192 a shape that loses 0192's data — written into 0192's notes so the trap is found before the shape is copied.docs/epics/self-service-onboarding.mdso this is not proposed a third time (0158 → 0190 → ?). 0194's costing criterion corrected while the numbers were in hand: it described the per-load footprint as two calls; it is four.