amadan
Record the independent review findings, unedited
GPT-6 Astra via codex, high reasoning effort, read-only, against aed42815..70bb5114 from the committed brief. Verdict: reject, nine P1 and one P2. Dispositions follow in later commits.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 file changed,
+67
−0
docs/superpowers/specs/CODEX-FINDINGS-carloku-paid-launch-overnight.md+67 −0
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-carloku-paid-launch-overnight.md b/docs/superpowers/specs/CODEX-FINDINGS-carloku-paid-launch-overnight.md| new file mode 100644 |
| index 000000000..1ed0f36e2 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-carloku-paid-launch-overnight.md |
| @@ -0,0 +1,67 @@ |
| +## Findings |
| + |
| +1. **P1 — Partially overwritten reports can be accepted as a final delivery.** |
| + [delivery.go:294](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/delivery.go:294), [delivery.go:331](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/delivery.go:331). |
| + An overwrite delivery references two files. A restatement replaces the first file before replacing the second and updating the manifest. The reader accepts the new first file, old second file, and unchanged manifest. Distinct line identities evade duplicate detection; invoice IDs make the mixed delivery final. Evidence verification also passes while this partial state remains unchanged. |
| + **Smallest fix:** Require immutable, generation-specific files or manifest-bound file versions/digests. Hold overwrite deliveries without that proof; rereading unchanged mutable objects cannot establish a common generation. |
| + |
| +2. **P1 — Partial ownership backfill can charge one tenant for another tenant’s transfer.** |
| + [walk.go:182](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/objstore/walk.go:182), [ownership.go:302](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/objstore/ownership.go:302). |
| + Two previously provisioned apps share an adopted bucket. Neither initially has ownership history. Re-granting only app A backfills A’s interval, while B retains working credentials. `OwnerAt` now resolves the bucket exclusively to A, and [storeegressfold.go:164](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/storeegressfold.go:164) attributes both apps’ transfer to A without holding. |
| + **Smallest fix:** Require complete ownership backfill for the bucket before accepting its historical attribution. Reconcile all existing grants referencing it and hold periods whose ownership history remains unproven. |
| + |
| +3. **P1 — Adoption can assign pre-adoption transfer to the new tenant.** |
| + [ownership.go:289](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/objstore/ownership.go:289). |
| + An existing bucket transfers data at 10:05 and is adopted by tenant A at 10:20. Its first ownership interval starts at 10:20. `OwnerAt(10:00)` nevertheless assigns the entire charged hour to A. The assumption that no bytes could leave before the interval began does not hold for adopted buckets. |
| + **Smallest fix:** Hold partially covered hours unless the ledger also proves that the uncovered portion had no possible transfer. Without that evidence, require ownership coverage across the whole hour. |
| + |
| +4. **P1 — Failed S3 operations with HTTP 200 responses count as successful writes.** |
| + [durability.go:244](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/usage/durability.go:244). |
| + `CompleteMultipartUpload` or `CopyObject` returns HTTP 200 with an embedded `<Error>`. The request meter records the raw 200 before the SDK processes that error: [requestmeter.go:87](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/lease/requestmeter.go:87), [requestmeter.go:160](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/lease/requestmeter.go:160). The pinned SDK explicitly handles this response shape. A failed attempt followed by a successful retry therefore produces two billable writes. |
| + **Smallest fix:** Exclude these operations until persisted outcomes distinguish decoded success from embedded errors. Existing raw-200 evidence cannot establish success. |
| + |
| +5. **P1 — Platform-forced move checkpoints enter the tenant’s billable meter.** |
| + [durability.go:238](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/usage/durability.go:238). |
| + Every checkpoint-purpose write is billable. The move worker assigns that purpose to its final checkpoint at [movespass.go:105](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/host/movespass.go:105), then uploads through the replicator. Thus platform-initiated moves generate tenant charges, although [the attestation plan:37](/home/paulca/amadan.net/carlos/platform-paid-launch/docs/superpowers/plans/2026-10-01-durability-attestation-path.md:37) explicitly leaves their charging policy unresolved. |
| + **Smallest fix:** Exclude checkpoint-purpose writes until attribution distinguishes customer work from platform-forced work. |
| + |
| +6. **P1 — A box that never registered durability is omitted from completeness.** |
| + [economicspass.go:588](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/economicspass.go:588). |
| + Box A supplies attested days. Box B has metrics and edge evidence, but its first durability-ledger open fails. The host continues without a recorder; B creates neither a durability directory nor a durability lifecycle registration. The candidate list omits B, allowing A’s evidence to make the durability source complete despite B’s unmetered replication. |
| + **Smallest fix:** Include independently known active boxes in durability expectations, respecting lifecycle bounds, and hold absent durability evidence unless an explicit scope proves the box cannot replicate. This defect is masked today by production attestation remaining false. |
| + |
| +7. **P1 — Positive-cost CloudFront outbound transfer is silently discarded.** |
| + [classify.go:112](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/classify.go:112). |
| + An invoiced `EUW1-CloudFront-Out-Bytes` row with positive cost returns `ReasonCloudFront` before cost is examined. That reason does not hold billing, so the month can be marked complete while an explicit outbound charge contributes zero. The classifier test itself supplies this positive-cost case. |
| + **Smallest fix:** Continue excluding uncharged CloudFront rows, but hold positive-cost outbound rows as an unexpected charge requiring reconciliation. |
| + |
| +8. **P1 — A row can charge a later month’s usage to an earlier month.** |
| + [cur.go:371](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/cur.go:371), [delivery.go:301](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/delivery.go:301). |
| + A September manifest contains an invoiced row with period start September 1, period end November 1, and an October 1 usage hour. `parseWindow` accepts the hour against November’s boundary; `ReadDelivery` checks only the period start. The fold adds October’s transfer to September. |
| + **Smallest fix:** Require any supplied period end to equal the requested month end, and validate usage windows against that requested month. |
| + |
| +9. **P1 — A transfer hold becomes permanent after the following month ends.** |
| + [economicspass.go:1341](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/economicspass.go:1341). |
| + September stays open throughout October because a charged bucket lacks ownership evidence. The evidence is repaired on November 1. The worker now processes only November and October at [economicspass.go:1242](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/economicspass.go:1242), so September never retries or closes. The invoice engine continues refusing its open statement. |
| + **Smallest fix:** Retain and revisit months deferred by `HoldClose` beyond the existing two-month sweep window. |
| + |
| +10. **P2 — The chooser offers plans that checkout rejects for the same membership.** |
| + [billingpage.go:259](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/billingpage.go:259). |
| + With two members and Ireland selected, the page clamps Personal’s quantity to one and offers it for €24. Checkout uses the actual member count at [billingservice.go:148](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/billingservice.go:148), which exceeds Personal’s maximum and fails. |
| + **Smallest fix:** Remove the maximum clamp and omit or disable plans whose actual checkout quantity fails `plans.Quote`. |
| + |
| +## Contradicted handoff claims |
| + |
| +[AGENT_HANDOFF.md:33](/home/paulca/amadan.net/carlos/platform-paid-launch/implementation/carloku-paid-launch/AGENT_HANDOFF.md:33) says, “Every unmetered replication fallback now files an escape.” A failed ledger open leaves the publisher nil; [durability.go:67](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/host/durability.go:67) returns without filing an escape. The local dirty marker is invisible to the console until a later successful open and publication. Finding 6 describes how that omission can affect completeness. |
| + |
| +## Tests that assert less than their names or descriptions |
| + |
| +- [TestDurabilityFoldNeedsEveryBox:356](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/console/meterfolds_test.go:356) gives the silent box an existing durability directory. It does not cover a known box that never registered durability. |
| +- [TestReadDeliveryFinalAndPinned:51](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/delivery_test.go:51) checks digest lengths, not equality with the actual manifest and file digests. |
| +- [TestGrantAndTeardownRecordOwnership:274](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/objstore/ownership_test.go:274) checks final states. Its description promises ordering, but moving closure before bucket deletion would still pass. |
| +- [TestDurabilityHostRecorderAfterStopVoidsCleanStop:183](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/host/durabilityescape_test.go:183) checks the dirty marker, but never reopens with the original handoff token and verifies the promised coverage gap. |
| +- [TestReadLinesBothGenerations:63](/home/paulca/amadan.net/carlos/platform-paid-launch/internal/awsbilling/cur_test.go:63) promises equivalent parsing, but reads different fixtures and never compares equivalent normalized rows. |
| + |
| +The demo and preview skip without explicit environment variables and use local fake service boundaries. No production-check weakening was found. This was a static, local review; no tests or network commands were run. |
| + |
| +**Verdict: reject.** |
| \ No newline at end of file |