amadan
Instance key provision: Astra final build review, unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+32
−0
docs/superpowers/plans/CODEX-REVIEW-INSTANCE-KEY-BUILD.md+32 −0
diff --git a/docs/superpowers/plans/CODEX-REVIEW-INSTANCE-KEY-BUILD.md b/docs/superpowers/plans/CODEX-REVIEW-INSTANCE-KEY-BUILD.md| new file mode 100644 |
| index 000000000..6a3ad6436 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-REVIEW-INSTANCE-KEY-BUILD.md |
| @@ -0,0 +1,32 @@ |
| +1. **P2 — Minting can permanently override a key whose configuration has not arrived yet.** [instancekey.go:299](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/internal/activator/instancekey.go:299) |
| + A missing local `<host>.config.env` is treated as no configured key. However, reconciliation publishes a ready route before the later `SyncExec` pass; the admission guard checks whether configuration can render, without delivering it. A first wake in that interval mints B even when the bucket already specifies A. Once configuration arrives, B continues winning from `<host>.env`. Require configuration delivery before deciding to mint, and test first launch with configuration delivery delayed. |
| + |
| +2. **P2 — A flat env FIFO can block the entire startup backfill.** [ownenv_unix.go:18](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/internal/activator/ownenv_unix.go:18) |
| + `O_NOFOLLOW` rejects symlinks but still opens FIFOs in blocking mode. A ready flat row whose `<host>.env` is a FIFO without a writer hangs here while holding `adminTokenMu`. Because the new backfill runs synchronously before `svc.Start`, one malformed file prevents startup from completing. The flat configuration-file read has the same problem. Use nonblocking opens followed by regular-file checks; extend the existing nested FIFO test to flat backfill. |
| + |
| +3. **P3 — The adoption endpoint accepts malformed trailing JSON.** [keyadoption.go:96](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/internal/activator/keyadoption.go:96) |
| + `Decoder.More()` does not establish EOF: it returns false for a trailing `}` or `]`, and suppresses reader errors. A valid adoption body followed by either delimiter therefore writes and publishes a record instead of returning 400. Require a second decode to return `io.EOF`, with tests asserting no write or publication on malformed input. |
| + |
| +**Verdict: not ready to merge.** |
| + |
| +Reviewed `0901e835..3e32533e`. Go formatting and Go-file whitespace checks passed. Focused tests could not start because the read-only sandbox prevented Go from creating its work directory. No files changed. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +“Follow the review brief docs/superpowers/plans/CODEX-REVIEW-INSTANCE-KEY-BUILD-BRIEF.md. Review the code diff 0901e835..HEAD on branch instance-key-build.” |
| + |
| +**WHAT:** |
| +Review the instance-key build against the brief and binding rulings. |
| + |
| +**STATUS:** |
| +Review complete: two P2 findings and one P3. |
| + |
| +**NEEDED:** |
| +Nothing. |
| + |
| +**RECOMMENDED:** |
| +Fix the findings, add regression coverage, and rerun the gate before merge. |
| + |
| +**SESSION:** |
| +Safe to close. Working tree unchanged; no background processes started. Handoff file could not be saved in the read-only sandbox. |
| \ No newline at end of file |