check_run:
  id: SCALE-002
  status: pass
  evidence_collected: 4
  evidence_required: 2
  findings:
    - "The stateful-session hazard is structurally prevented in the shipped manifest: replicas: 1 with an inline rationale naming the check and the two legitimate scale-out routes — deploy/kubernetes.yaml:13-18. With a single pod there is no unaffined fan-out for a session to be lost to"
    - "A ready sticky-session manifest ships alongside it: deploy/ingress-sticky-sessions.yaml — Option A HAProxy `stick on req.hdr(Mcp-Session-Id)` with `stick-table type string len 64 size 100k expire 1h` (deploy/ingress-sticky-sessions.yaml:16-17), Option B NGINX Ingress cookie affinity with affinity-mode persistent and session-cookie-max-age 3600 (deploy/ingress-sticky-sessions.yaml:32-36)"
    - "Session lifetime is explicit in both variants (stick-table expire 1h; cookie max-age 3600s), satisfying the TTL criterion"
    - "The scale-out procedure is documented, not just implied: docs/deployment.md:50-62 ('Scaling out (SCALE-002)') states that session state is per-pod, lists affinity-on-Mcp-Session-Id and a shared session store as the two prerequisites, and only then permits raising replicas"
  gaps:
    - "Neither affinity manifest is applied by default — deploy/ingress-sticky-sessions.yaml is an example file ('Apply ONE of these ... after raising replicas', deploy/ingress-sticky-sessions.yaml:8). The guarantee therefore rests on the replicas: 1 discipline holding at operate time."
    - "No shared session store is implemented (Option C at deploy/ingress-sticky-sessions.yaml:50-55 is explicitly out of scope), so a pod restart drops all in-flight sessions; FastMCP's default in-memory session manager has no server-side TTL of its own."
    - "The Modus-3 failover test (same pod across five requests with a session id) has not been run and no test stands in for it."
  evaluator_notes: |
    Pass. The check asks that the session-affinity problem be solved rather than
    ignored; here it is solved by constraint (single replica, enforced in the
    manifest and justified in-line), with both documented upgrade paths shipped
    as concrete config carrying explicit TTLs. Residual risk is operational, not
    architectural: someone raising replicas without applying the ingress. Note
    that the header-based routing itself is only a commented snippet — that
    weakness is recorded under SCALE-003 rather than double-counted here.
