# Review brief: platform GeoIP for apps

You are GPT-6 reviewing a design spec independently of its author.
Your output is a findings report, not an edit. Do not modify any file.

## What to read

1. The spec under review:
   `docs/superpowers/specs/2026-10-06-platform-geoip-design.md`.
   §0's rulings are Paul's and fixed. Report a mechanism that fails one;
   do not re-argue one.
2. The originating request: amadan discussion carlos/platform #241, quoted
   in the spec's §1. The nearest-region spec it builds on:
   `docs/superpowers/specs/2026-10-01-nearest-region-default-design.md` §6.
3. The code it fits into, in this worktree:
   - `internal/geo/` (`mmdb.go`, `point.go`, `tz.go`), `cmd/console/main.go`
     (`openGeoIP`);
   - `internal/edge/edge.go` (`ServeHTTP`, the six proxies and their
     `Rewrite` functions, `observeAnalytics` defer), `internal/edge/homemap.go`
     (`acceptHop`, `setForwarded`, `stripForwardedHeaders`),
     `internal/edge/analytics.go` (`clientIP`, `hopVerified`),
     `internal/edge/door.go`, `internal/edge/cache.go`,
     `internal/edge/certsync.go` (the precedent for mirroring from the bucket),
     `internal/edge/purge_header.go`;
   - `internal/tunnelclient/`, `internal/host/tunnel_client.go`,
     `internal/host/agent.go`, `internal/host/units/carlos-edge.service`;
   - `internal/release/store.go` (`Store`), the S3 store;
   - `internal/analytics/` (`Day`, `Delta`, `Obs`, flush and merge);
   - `internal/console/authcli.go` (`cliRoute`, roles, rate limiting),
     `internal/console/alertwatch.go`, `system.go` (the `carlos system
     antivirus` verbs as the precedent for operator verbs);
   - `AGENTS.md`.

## What matters most

- **Forgery.** Find any path by which a client-chosen value reaches an app
  in an `X-Carlos-Geo-*` header: any proxy, hop, tunnel, door, upgrade or
  cache path the strip in §8 misses, or a way to get `tunnelKey` onto a
  request that did not arrive over the tunnel.
- **Wrong location.** Any path where the edge locates the wrong address
  (the box itself, the hub, a sender edge, a proxy) and sets headers that
  look authoritative.
- **The hot swap (§5.3).** Can a lookup ever run against a closed mapping?
  Any deadlock or starvation under load?
- **The mirror and publish protocol (§3–§5).** Races between publishers,
  between a publish and an edge poll, a deleted blob, a partially written
  file, disk filling, a box restarting mid-swap, the console box reading a
  file the edge is replacing.
- **The feed (§10).** Supply-chain risks in fetching and publishing a file
  every edge maps into memory; decompression limits; the monotonic rule;
  credential handling; behaviour when DB-IP or MaxMind change URLs.
- **Cache interaction (§7, §8.2).** Does setting headers before the cache
  lookup interact correctly with `Vary`, the 8-variant limit and purge?
- **Licensing (§13).** Is anything stated wrongly about DB-IP Lite's
  CC BY 4.0 terms or MaxMind's GeoLite2 EULA?
- **Claims about the code.** Every `file:line` and every "already exists"
  claim: check it. Report each one that is wrong.
- **Completeness for planning.** Anything an implementer would have to
  invent because the spec is silent.

## Output

A numbered list of findings, most severe first, each with: severity
(P1 = wrong or unsafe as written, P2 = gap an implementer would get wrong,
P3 = clarity), the spec section, the code evidence with file:line, and a
concrete fix. End with a one-line verdict: accept, or revise.

## Later rounds

For round N > 1, first give a disposition table for every finding of the
previous round (`CODEX-FINDINGS-GEOIP-R<N-1>.md`): resolved, partly
resolved, or not resolved, with one line of evidence from the revised
spec. Then report only NEW findings, numbered from 1. Decisions marked D
in §0 are open to challenge on mechanism, not on whether to exist; R
rulings are fixed.