amadan
GeoIP code review round 14: R2-1 resolved, merge-ready
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+37
−0
docs/superpowers/plans/CODEX-FINDINGS-GEOIP-CODE1-R14.md+37 −0
CI passed — run details
diff --git a/docs/superpowers/plans/CODEX-FINDINGS-GEOIP-CODE1-R14.md b/docs/superpowers/plans/CODEX-FINDINGS-GEOIP-CODE1-R14.md| new file mode 100644 |
| index 000000000..9914729f0 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-FINDINGS-GEOIP-CODE1-R14.md |
| @@ -0,0 +1,37 @@ |
| +| Previous finding | Disposition at `4287f396` | |
| +|---|---| |
| +| R1-1 — Readiness without established database state | Remains resolved. | |
| +| R1-2 — `off` waits behind publication | Remains resolved. | |
| +| R1-3 — Unbounded console pointer reads | Remains resolved for reads. | |
| +| R1-4 — Recovery generation deleted after failed synchronization | Remains resolved for the reported paths. | |
| +| R1-5 — Rejected-upload test does not establish zero reads | Remains resolved. | |
| +| R1-6 — Countries overflow ordering | Remains resolved. | |
| +| R2-1 — Feed status writes bypass the read cap | **Resolved.** `DirStore.Put` now uses `os.Stat` for create-only writes and `hashFile` for replacement checks, preserving conditional-write semantics with bounded memory. The added regression test checks allocations against a 256 MiB existing object and verifies successful replacement. | |
| +| R2-2 — Timed-out checks never persist failures | Remains resolved for download timeouts. | |
| +| R2-3 — Unreadable feed status clears an alert | Remains resolved. | |
| +| R2-4 — Unusable directory prevents “not loaded” alert | Remains resolved. | |
| +| R2-5 — Published alert reasons never change while unhealthy | Remains resolved. | |
| +| R3-1 — Console follower keeps serving an expired database | Remains resolved. | |
| +| R3-2 — Transient status-read failure erases feed history | Remains resolved. | |
| +| R4-1 — Unbounded bucket operations block startup or publication | Remains resolved for the reported operations. | |
| +| R4-2 — Restart falsely clears a persisted GeoIP alert | Remains resolved. | |
| +| R4-3 — Email delivery suppresses active reason changes | Remains resolved. | |
| +| R4-4 — Region guesses carry another generation’s attribution | Remains resolved. | |
| +| R5-1 — Unknown feed state suppresses confirmed expiry | Remains resolved. | |
| +| R6-1 — Failed startup deletion leaves a disabled feed alert firing indefinitely | Remains resolved. | |
| +| R7-1 — Unbounded feed edition metadata makes control records unreadable | Remains resolved. | |
| +| R7-2 — Unchanged-edition checks leave the feed reported as “not run yet” | Remains resolved. | |
| +| R8-1 — MMDB verification indefinitely holds the publish slot | Remains resolved for the reported traversal attacks. | |
| +| R9-1 — Malformed MMDB metadata can crash the entire console | Remains resolved for the reported arithmetic panic. | |
| +| R10-1 — Verifier child has no memory bound | Remains resolved on Linux for the reported allocation attack. | |
| +| R10-2 — Retained recovery generations survive GeoLite2 expiry | Remains resolved for the reported synchronization failure. | |
| +| R11-1 — Verified database crashes serving processes during lookup | Remains resolved for the reported stack-exhaustion path. | |
| +| R12-1 — Underscore header spellings bypass stripping | Remains resolved. | |
| + |
| +Unchanged dispositions carry forward round 13’s conclusions; this review covers `6bdaba34..4287f396`. |
| + |
| +New findings: none confirmed. |
| + |
| +Validation: static review of both changed Go files and relevant callers. Scoped whitespace and formatting checks passed. Targeted Go tests could not start because the read-only sandbox refused build-directory creation; runtime tests and cross-compilation remain unverified. |
| + |
| +Verdict: merge-ready. |
| \ No newline at end of file |