amadan
Astra round 7: unedited — round-6 findings closed; one new P2 (a replaced target's new install stamp fails the prepared-authority stamp check)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+29
−0
docs/superpowers/plans/CODEX-REVIEW-L18-MERGE-7.md+29 −0
diff --git a/docs/superpowers/plans/CODEX-REVIEW-L18-MERGE-7.md b/docs/superpowers/plans/CODEX-REVIEW-L18-MERGE-7.md| new file mode 100644 |
| index 000000000..396ea96fa |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-REVIEW-L18-MERGE-7.md |
| @@ -0,0 +1,29 @@ |
| +**Verdict: do not approve the dormant merge at `03212a8b`. One new P2 finding.** |
| + |
| +1. **P2 — Replacing a target invalidates the prepared-authority stamp check.** [movesfiles.go:734](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/host/movesfiles.go:734) requires `prepared_authority.InstallStamp == install_stamp`. But replacing a terminated target at `installed`, or before P’s first admission in `probing`, deliberately retains P and its prepared authority while [issuing a new installation stamp](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostclaim/relocation.go:1234). `ToInstalled` does not run again. The replacement can complete its own local install and admit P, then deterministically fail C8 establishment on this comparison. Preserve the distinction between P’s build stamp and the replacement’s local-install stamp, and cover this replacement path through the real provider. |
| + |
| +The original four round-6 failures are addressed, but the prepared-authority fix introduces this replacement failure. Otherwise, operation-kind selection and the digest/exact-version checks are sound. Treating foreign rows as flat matches the exec backend. |
| + |
| +Plan 15 records P through shared `AdmitWriter`/`Update`; no relocation-specific provenance write is missing. With origins disabled, probing fails closed. Activation still requires origin recording and backfill of unproven existing file origins. The old prefix mismatch caused active-location parks to refuse unclassified keys, rather than delete live files. |
| + |
| +Focused tests could not start: the read-only sandbox blocked Go’s build-directory creation. The full `internal/host` suite was not run. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review round 7 at `03212a8b`, read-only, without the full host suite. |
| + |
| +**WHAT:** |
| +Assess the round-6 fixes and Plan 15 integration. |
| + |
| +**STATUS:** |
| +One new P2; dormant-merge approval withheld. |
| + |
| +**NEEDED:** |
| +Nothing for this review. |
| + |
| +**RECOMMENDED:** |
| +Fix replacement stamp handling and test replacement-before-P with the real provider. |
| + |
| +**SESSION:** |
| +Safe to close; no files changed or background processes started. |
| \ No newline at end of file |