Fable 5 Review: Node Routing Policy v2
Verdict
The Worker/Durable Object direction is correct, but v2 was not implementation-ready. It removed the peer-forward double-answer path while leaving authority failure, carrier timing, answer fencing, crash recovery, persistent mode, candidate fallback, and drain behavior unresolved.
Disposition and Current State
The normative
Node Routing Policy v3
incorporates the review decisions. Raw-body Telnyx signature/timestamp verification
was implemented at 3450bcab, and the L5 key/configuration gate was
implemented at 6b531686.
These commits are not deployed. The live runtime
remains clean property-flow SHA 9b4082d while
TELNYX_PUBLIC_KEY is provisioned. The Worker/Durable Object engine,
durable ownership ledger, persisted policy, automatic fallback, and routing dashboard
remain open implementation work. /routing-help.html is a non-operative
preview.
Highest-Severity Findings
| Priority | Finding | V3 decision |
|---|---|---|
| P0 | Public webhook can answer/hang up without verifying Telnyx. | Ship signature/timestamp verification and durable dedup as independent Phase 0. |
| P1 | DO outage had no degraded mode. | Retryable 503; never bypass ownership. |
| P1 | Retry/failover timing was unmeasured. | Same Worker authority for both URLs; DO redrive; carrier fixture before constants. |
| P1 | Late old-node delivery could answer after reassignment. | Expiring assertion, ownership epoch, and DO answer fence. |
| P1 | Crash after dedup insert could suppress all retries. | Recoverable event-processing state machine. |
| P1 | Volatile MODE defaults stable. | Persistent state; missing/invalid boots drained. |
| P1 | Candidate could receive arbitrary fallback traffic. | Explicit canaries only unless fallback-approved. |
| P1 | Drain kills active media. | Soft drain eligibility first; isolate only at zero active calls. |
Additional Corrections
- Reconnect-capable media-session token with one active generation.
- Query-string scrubbing at every logging layer.
- Canonical
config/phone-lines.yamland effective-config hash. - HMAC caller keys, bounded retention, and PII log audit.
- Separate Worker and per-node signing keys with rotation.
- Versioned Worker/DO migrations and rollback.
- Node-scoped L5 for Worker, M1, and M3.
Build Order
- Secure the current ingress boundary and measure carrier behavior.
- Fix persistent node state, identity, drain, registry, and keys.
- Build clean deployment and node-scoped L5.
- Build fenced Worker/DO ownership and rollback.
- Add policy UI, then run explicit-GO live drills.