amadan
Add the round six review brief
Round six covers the round five fixes and the agent's attestation call, which has had no independent review.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 file changed,
+32
−0
docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round6.md+32 −0
CI passed — run details
diff --git a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round6.md b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round6.md| new file mode 100644 |
| index 000000000..ceb3a0369 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round6.md |
| @@ -0,0 +1,32 @@ |
| +# Review brief, round 6: Carloku paid launch, overnight changes of 2026-10-01 |
| + |
| +Read the round 1 brief (`CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight.md`) for the fixed rulings and the output rules, and the round 3, 4 and 5 briefs for rulings 6 to 10. Then read `CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`, whose last section covers round 5. |
| + |
| +Review the branch between `aed42815` and the commit named in the prompt. The changes since round 5 are `git diff daa32cb6 <commit>`: `b4e272ff` (audit guard migration), `6a0c99d8` (replicator-state reader), `0a4c00ec` (teardown and grant on the ledger), `8936244e` (quantity confirmation), `6d2ef508` (durability fold, statement memory), `0d02dd38` (attestation scope fixes and the agent's call) and one documents commit. |
| + |
| +Two rulings changed or were added: |
| + |
| +10 (amended). Replication attestation is scoped, and the agent's call now exists behind `CARLOS_DURABILITY_ATTEST=scoped`. Unset, nothing may attest. Any path that attests without that exact value, or any way the value could be set by something other than an operator editing the box's environment, is a finding. |
| + |
| +11. Ambiguity holds. Where evidence cannot settle who owns an hour, whether a box's minutes were metered, or when a seat's charge began, the code must hold (refuse, leave incomplete, file a review) and must not charge or waive on a guess. A place that guesses is a finding. A place that holds where the evidence does settle it is a lesser finding, and say so. |
| + |
| +## First: a disposition table |
| + |
| +For every round 5 finding (Astra F1 to F11, Opus N1 to N9): closed, partly closed or not closed, with the file and line of the fix and of the test that reproduces the scenario, and whether that test would pass without the fix. Check the dispositions' claims; do not take them. |
| + |
| +## Then: new findings only |
| + |
| +Where to push: |
| + |
| +- **Teardown and grant on the ledger** (`internal/objstore/ownership.go` `beginBucketTeardown`, `openBucketOwner`, `stillDestroying`, `CloseBucketOwner`; `walk.go` `Teardown`, `Grant`, `otherStoreHolders`; `objstore.go` `TeardownBlock`). Walk every crash point and every interleaving of two teardowns, a teardown and a grant, a teardown and a rotate, and a re-run of each. Find: a bucket destroyed while another app holds it; a bucket or scanner plan left with no record that can ever clean it up; a `Destroying` marker or a `Leaving` interval that can never be cleared; a grant refused forever; a `TeardownBlock` that makes a later teardown skip a bucket that does exist and is this app's; a store record inventory that misses a holder (pagination, a record mid-write, an app directory with no record); an hour the ledger now resolves that it should not, given the new fields. Say whether `ErrBucketRetained` leaves an operator any way out, and whether the scanner debt is carried in every case that owes it. |
| +- **Quantity confirmation** (`internal/console/billingquantity.go`, `billingservice.go` `reconcileBillingSubscription`, `billingstore.go` `applyBillingStateDated`). Find: an operation confirmed that did not execute, or executed and never confirmed in a way that charges or dates wrongly; a reconcile that waits forever on a young operation; a webhook for an unrelated change swallowed by that wait; a sender that passes its re-read and then sends an operation retired a moment later; an operation left outstanding forever by the future-date rule; the addition-time bound producing an instant the provider or the period check refuses on every pass. |
| +- **The durability fold** (`internal/console/durabilityfold.go`). The registration comparison is gone and each box must prove the union of its windows. Find a day that reads complete with minutes unproven or an exclusion dropped, and a day that can never read complete on a healthy box (in particular a box's first day, given when `internal/host` opens the ledger and registers each source). The second is a hold, not a wrong bill; say how often it would happen. |
| +- **The scoped attestation, end to end** (`internal/host/durabilityscope.go` `durabilityScope`, `applyScope`, `enableScopedAttestation`, `scopedAttestationEnabled`; `durabilityreplicator.go`; `internal/ops/litestream.go` `GeneratedLitestreamDBs`; `internal/host/durability.go` `publish`; `agent.go`). With the switch on, find an account vouched for while the external replicator can touch its database, at any instant: route and config changes between ticks, a restart, a crash of the agent, a ledger reopened (what does a new run claim, and from when), `SetAttestation` refusing an instant, the `Escaped` fallback, a config whose modification time lies, a unit that is not systemd's to describe, a second replicator the code does not know about. Say what a week on a dev box could not show. |
| +- **`statementMonthState`** after the expiring memory and the three-pass rule (`internal/console/economicspass.go`). |
| + |
| +## What to return |
| + |
| +1. The disposition table. |
| +2. New findings, most severe first, in the round 1 format. |
| +3. Handoff claims the code contradicts (`implementation/carloku-paid-launch/AGENT_HANDOFF.md`). |
| +4. A one-line verdict: accept, accept with fixes, or reject. |