amadan
Add the round ten review brief; the handoff names 94ca7482 as the code tip
Documents only. 94ca7482 changed code (round nine's fixes) and is the commit the gate ran on.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+33
−3
.claude/HANDOFF.md+3 −3docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round10.md+30 −0
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 24fa60669..7039b6379 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -11,9 +11,9 @@ Three things, kept apart. (1) Draft copy to review, not approved: pricing http:/ |
| Billing is OFF, the quantity worker is OFF (two switches, both unset), nothing attests, nothing was deployed, and no live Stripe or AWS write was made. |
| -Code tip `3d4104cb`, on the forge. Full gate on it: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-3d4104cb.txt` in the run directory); cross builds for darwin, linux arm64 and windows pass (`logs/cross-3d4104cb.txt`). Any commit after `3d4104cb` on this branch is documents only unless this file says otherwise. Amadan CI was queued on the pushed tip at 06:12 and had not finished when last read; the hub's `carlos/platform` repository answered 500 on and off all night. |
| +Code tip `94ca7482` (it changes code: round nine's fixes). Full gate on that exact commit: go build, go vet, gofmt, `make test` with 61 packages ok (`logs/gate-94ca7482.txt` in the run directory); cross builds for darwin, linux arm64 and windows (`logs/cross-94ca7482.txt`). Commits after `94ca7482` on this branch are documents only unless this file says otherwise; the earlier gated tips were `3d4104cb`, `c3e87a94` and `43383b93`. Amadan CI has been queued on each pushed tip and had not finished when last read; the hub's `carlos/platform` repository answered 500 on and off all night. |
| -Independent review: GPT-6 Astra rejected rounds 1 to 8 (the last three found fourteen, nine and five); the AGENTS-required Opus production review accepted with fixes in rounds 2 to 8. Round eight is fixed with reproductions and mutation checks, except two findings recorded as accepted and open. Round nine of both runs against `f5538467` (the same code plus its brief): run directory `logs/astra-review9.md`, `logs/opus-review9.md`. Nothing lands until a round passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| +Independent review: no round has passed. GPT-6 Astra rejected rounds 1 to 9; the AGENTS-required Opus production review accepted with fixes in rounds 2 to 9. Round nine (Astra two P1 and four P2; Opus five P3) is fixed in `94ca7482` with reproductions and mutation checks, except what `OUTSTANDING.md` names as open. Those fixes have had no independent confirmation: round ten of both runs against the commit that carries its brief (same code as `94ca7482`), run directory `logs/astra-review10.md` and `logs/opus-review10.md`. Nothing lands until a round passes. Dispositions: `docs/superpowers/specs/CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`. |
| Two open defects, both with their paths disabled, neither offered as a risk to accept: a quantity request that runs after Stripe has forgotten its key, and a late invoice-line request that can leave a finalized invoice with a wrong total a customer could pay. The design that removes both is `docs/superpowers/plans/2026-10-01-late-request-fencing.md`, built so far on `feat/carloku-late-request-fencing-20261001` (`833a403c`, pushed, not gated, not reviewed). That branch also voids a wrong-total invoice; that is remediation, and its limits are pinned by tests there. |
| @@ -24,7 +24,7 @@ Scoped replication attestation (path A) cannot prove an exclusive writer and is |
| - Scoped approvals, prepared as plans only: the `rk_live` restricted key and Stripe catalog; the Cost and Usage Report export; Stripe test mode, to run `TestSandboxQuantityFence` and confirm the provider's treatment of a proration date. |
| **RECOMMENDED:** |
| -- Read round nine, fix what it finds, re-review the exact tip. Read CI on that tip. |
| +- Read round ten, fix what it finds, re-review the exact tip. Read CI on that tip. |
| - Finish the late-request design on its branch (the invoice engine's void on a failed verification, the idle measurement in the sandbox test), then review it. |
| - Then, each on its own branch: path B of the attestation plan, quantity reduction at renewal, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting (none started). |
| - Find what moved 1,395 GB out of Ireland to three other regions in September (collector plan). |
diff --git a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round10.md b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round10.md| new file mode 100644 |
| index 000000000..ba3d274b1 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round10.md |
| @@ -0,0 +1,30 @@ |
| +# Review brief, round 10: Carloku paid launch, overnight changes of 2026-10-01 |
| + |
| +Read the round 1 brief (`CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight.md`) for the fixed rulings and the output rules, the round 3 to 9 briefs for rulings 6 to 12, then `CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md` (its last section covers round 9), `docs/superpowers/specs/2026-10-01-stripe-idempotency-evidence.md` and `implementation/carloku-paid-launch/OUTSTANDING.md`. |
| + |
| +Review the commit named in the prompt. Read source only with `git show <commit>:<path>`. The changes since round 9 are `git diff 3d4104cb <commit>`. |
| + |
| +Still the fixed snapshot: round 9's findings, nothing else. Nothing may attest. The quantity worker has two switches, both unset. Billing is off. |
| + |
| +Do not report again, as findings, what `OUTSTANDING.md` lists as open: items 6 and 6a (what the sandbox run must settle), 7 and 9 (the two late-request defects), 19a to 19e. Do report anything that makes one of them worse than the document says, and any claim about them the code contradicts. |
| + |
| +## First: a disposition table |
| + |
| +For every round 9 finding (Astra F1 to F6; Opus N1 to N5 and the claims): closed, partly closed, not closed, or accepted and left open as the dispositions say. File and line of the fix and of the test, and whether the test would pass without the fix. |
| + |
| +## Then: new findings only |
| + |
| +- **The estate** (`internal/objstore/walk.go` `estateOf`, `Grant`, `Teardown`, `leaseForRotation`; `objstore.go` `TeardownBlock.TakeBacks`). The claim: a walk that waited for its lease recognises the store it was asked about, and a grant that takes a store back changes the record before it creates anything. Find a schedule where something usable is created or destroyed and the record still compares equal to what a waiting walk first read. Find a legitimate re-run that the comparison now refuses for good. |
| +- **Unsupported names** (`Teardown`'s branch for a name `ValidBucketName` refuses). The holder check reads store records. Find a holder it cannot see, and a teardown that can now never finish. |
| +- **`markBucketDestroyed`** no longer requires the destroying marker. Find a way it records a destruction that did not happen, and what a wrong `DestroyedAt` then lets through (`walk.go`, the retained teardown's final check). |
| +- **The purge's last read** (`internal/release/trash.go`). It reports and does not prevent. Check that every caller treats the error as "not purged" (the console's purge door, the box-side auto-purge), and that none removes the app's row or relay record after it. |
| +- **A review stops a send** (`internal/console/billingquantity.go` `resolveQuantityOperation`). Find an operation that is now never sent and never settled with nobody told, and a resolved review that is consumed by the wrong path. |
| +- **The lease clock** is now read after the lease object. Check that nothing relied on the earlier order. |
| +- **Claims** in `AGENT_HANDOFF.md`, `OUTSTANDING.md` and the comments at the top of `walklock.go`, `fence.go` and "The fence" in `billingquantity.go`. |
| + |
| +## What to return |
| + |
| +1. The disposition table. |
| +2. New findings, most severe first, in the round 1 format. |
| +3. Claims the code contradicts. |
| +4. A one-line verdict: accept, accept with fixes, or reject. |