feat(cloud): honest liability — a two-number durability promise, gated against the code (0418) - #671
Open
crs48 wants to merge 14 commits into
Open
Conversation
added 6 commits
August 1, 2026 12:41
…lity promise Signed-off-by: xNet Test <test@xnet.dev>
…truth Adds DURABILITY_POSTURE + the SlaLevel->objective mapping to @xnetjs/entitlements so a published promise and the objective it is measured against can be asserted against each other in one place. Team moves best-effort -> 99.5: the pricing page was advertising '99.9% best-effort availability', a self-cancelling phrase over a tier whose SLA level backed no objective at all. A real 99.5% outranks a fictional 99.9%. 'blobs' is deliberately absent from every covered[] until 0288's sync sidecar ships, with a test that fails if it is added. Signed-off-by: xNet Test <test@xnet.dev>
Adds check:durability-claims: regenerates site/src/data/durability.ts from @xnetjs/entitlements and fails on drift, then scans product copy for availability figures no plan backs. site/ installs with --ignore-workspace and cannot import @xnetjs/*, so the mirror is unavoidable; what was avoidable is it rotting silently. Both failure arms verified to exit 1. Retires the '99.9% best-effort availability' claim on Team (now a real, catalog-backed 99.5%) and scopes the Personal backup claim to the database, since blobs are not replicated until 0288's sidecar ships. Signed-off-by: xNet Test <test@xnet.dev>
…er objectives Adds /cloud/durability (what is proven, what is drilled, what is known-broken) and /make-whole (refund on loss, no downtime credits), both rendering figures from the generated durability mirror. Terms gain a direct-damages cap (fees paid, trailing 24 months), an explicit non-excludable-rights carve-out, and a statement that Make-Whole is additive rather than a sole-and-exclusive remedy. The status page now explains each component in plain language and shows the per-tier objective table. Signed-off-by: xNet Test <test@xnet.dev>
Three claims-ledger entries: the restore drill as an enforced receipt, the no-unbacked-availability-claim gate, and the blob durability gap as disclosed honesty-debt with 0288 named as the ship path. Signed-off-by: xNet Test <test@xnet.dev>
…cloud durability promise (21/34) Deferred with reasons: 0288's blob sidecar and self-host restore belong to that exploration; the Copies indicator is blocked on a device registry that does not exist (author_did counts identities, not devices, so the number would be wrong in exactly the single-device case that matters); SLI persistence needs a storage design; jurisdiction and legal review are human decisions. Signed-off-by: xNet Test <test@xnet.dev>
|
Warning Review limit reached
Next review available in: 59 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (23)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ability-and-the-xnet-cloud-durability-p # Conflicts: # packages/telemetry/test/charter-claims-ledger.test.ts # site/public/llms-full.txt
Contributor
|
Preview: https://xnet.fyi/pr/671/app/ |
added 5 commits
August 1, 2026 13:57
…rigger
Review feedback on 0418:
- 12 months, not 24. Matches the annual billing cycle and halves aggregate
exposure; still extraordinary against an industry standard of ~10% of one
month. Encoded as MAKE_WHOLE_MONTHS in the durability posture so the pages
derive it, with a test pinning it inside the 24-month liability cap.
- Automatic, not claim-based. A claims process at the moment of maximum
customer anger is the worst possible design.
- Binary trigger: 'we lose your hub database and cannot restore it'. The
earlier wording turned on 'data covered by the Restore Commitment', which
invites a scope argument at the worst moment. The money was never the
exposure; the adjudication was.
Cancellation is stated positively — your plan runs to the end of the period
you paid for — rather than as 'fees are non-refundable'. No proration.
Also removes an unbacked claim the durability page had picked up ('the app
shows you how many copies exist') — the Copies indicator is deferred, so the
page now gives concrete advice instead of describing a feature that does not
exist. And the attachment disclosure is now accurate: ChunkManager has no
prune path, so the uploading device keeps its copy; the exposure is narrower
than 0288's headline and the page says so.
Signed-off-by: xNet Test <test@xnet.dev>
…ity-p' of https://github.com/crs48/xNet into claude/0418-honest-liability-and-the-xnet-cloud-durability-p
…ability-and-the-xnet-cloud-durability-p # Conflicts: # packages/entitlements/src/plans.ts # site/src/pages/terms.astro
0418_[-]_XNET_CLOUD_TO_PRODUCTION_BACKUPS_BILLING_DUNNING_AND_ONE_UI.md claimed 0418 three minutes earlier on a parallel branch (12:23 vs 12:26 on 2026-08-01) and has since merged to main. By the repo's tie-break rule -- earliest commit wins -- this document moves. Updates every citation in code, tests, the claims ledger, ADR-30, the CI job name and the generated site mirror, leaving the other exploration's 0418 references untouched. The two are complementary: that one covers billing, dunning and the read-only lifecycle; this one covers liability, SLAs and the durability promise. check:exploration-links passes (381 references checked). Signed-off-by: xNet Test <test@xnet.dev>
…ability-and-the-xnet-cloud-durability-p # Conflicts: # site/public/llms-full.txt # site/src/content/docs/docs/architecture/decisions.mdx
…ability-and-the-xnet-cloud-durability-p # Conflicts: # docs/explorations/STALE.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements exploration 0418 — 21/34 items, deferrals stated below.
The question
Can xNet Cloud ship with limited or no liability — telling early adopters plainly "we might lose your data"? Three findings said no, and pointed somewhere better.
That posture is legally ineffective (UK CRA 2015 s.47 makes satisfactory-quality rights non-excludable for paid digital content; "beta" is a description, not a shield). It is inaccurate — Litestream replication, an adversarially-tested restore drill, a freshness SLI and error budgets that gate our own deploys all already ship, invisibly. And it is a category error: it describes a system of record, but xNet Cloud is a managed replica of data whose master copy is on the customer's device.
So: make a small promise we can keep, attach the receipts, and name the gaps precisely.
A live drift this fixes
site/src/data/pricing.tsadvertised "99.9% best-effort availability" on Team — a self-cancelling phrase over a tier whoseSlaLevelresolved to no objective at all. Team now carries a real99.5SLA level the SLO layer holds us to. A real 99.5% outranks a fictional 99.9%.What landed
packages/entitlements/src/durability.ts— one source of truth for every public durability claim, beside the plan catalog so promise and objective are checkable together.sloForSlamoved here too.pnpm check:durability-claims— regenerates the site mirror and fails on drift, then scans product copy for availability figures no plan backs. Both failure arms verified to exit 1. Carries adurability-ok:escape hatch mirroring the Charter'shumane-ok:idiom, and deliberately skips blog essays (a gate that can't go green teaches people to ignore red)./cloud/durability— what is proven, what is drilled, what is known-broken. The gap list is generated, so a scope leaves the page only when replication actually covers it./make-whole— we refund loss, not downtime. Credits compensate the wrong event when the client keeps working offline, and a 10% credit on a $5/mo plan is 50 cents.The one real over-promise, now disclosed
Exploration 0288's blob sidecar is unshipped: Litestream covers the SQLite DB, but
dataDir/{blobs,files}is on the container volume only, so a cold demotion loses every attachment — while pricing said "Encrypted backup to object storage". That claim is now scoped to the database, and'blobs'is absent from everycovered[]with a test that fails if it's added.Deferred, with reasons
/healthreplicaCount, web-only inversionCOUNT(DISTINCT author_did)counts identities, not devices — it would say "3 copies" for three collaborators on one machine each, and "1" for one person on three. Shipping that would be the exact failure this PR exists to prevent.Charter §6
Improvement ✅, Vanish ✅, Sleep ✅. BATNA passes only conditionally — if managed durability ships while self-host BYO-S3 restore stays unbuilt, durability becomes a paid privilege. That 0288 item is a Charter precondition on this lane, not polish.
Verification
pnpm build,typecheck,lint(0 errors),test(11,810 passed),--project reliability(21 passed, incl. the restore drill's corrupted-copy case) all green. Gate teeth proven by injecting a fake99.99% uptimeclaim (exit 1), drifting the mirror (exit 1), and adding'blobs'tocovered(2 tests fail). Pages verified rendering in the browser.🤖 Generated with Claude Code