amadan
Instance key provision: Astra round 6, unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+35
−0
docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-R6.md+35 −0
diff --git a/docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-R6.md b/docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-R6.md| new file mode 100644 |
| index 000000000..041ca1d1e |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-INSTANCE-KEY-R6.md |
| @@ -0,0 +1,35 @@ |
| +Reviewed `2c39819c` (HEAD at review start). The plan remained unchanged during concurrent implementation work. |
| + |
| +1. **P2 — A concurrent config removal bypasses the fresh check.** [Plan:2907](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:2907) |
| + The launch captures configured key A, but the gate rereads the files to determine its source. If `SyncExec` removes the key between those reads, `Effective` returns `LayerNone`. The `layer != LayerConfig` branch then admits the launch without consulting the bucket, while the child still receives A. Config sync shares no lock with these reads; its bounce during a wake is deferred until afterward. Capture the source alongside the launch environment, or refuse when the reread disagrees. Add a deterministic interleaving test. |
| + |
| +2. **P2 — The coordinated procedure never applies digest-list changes to the running agent.** [Plan:4655](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:4655) |
| + `replicaHomeKeys` parses the environment once and captures the map. Editing the agent’s environment drop-in neither invalidates its existing entries nor loads replacements. Following the procedure literally leaves the old map active; a replica updated to B remains refused against A. Specify an agent restart—or implement an explicit reload—after invalidation and replacement, keeping replicas stopped throughout. Verify that invalidation has taken effect before changing the key. |
| + |
| +R5-2 and R5-3 are closed: O8 explicitly defers configured-only homes, and parser errors omit input. R5-1’s approach is sound, but these gaps prevent full closure. |
| + |
| +When reached, the fresh read fails closed on missing configuration, bucket errors and decryption errors. Network reads use a ten-second timeout; bucket outages therefore cost replica availability as documented. The home-only residual is acceptable within the stated no-rotation scope once the coordinated procedure actually updates the agent. |
| + |
| +Static review; proposed tests were not executed. No files changed by me. |
| + |
| +**Verdict: not ready to build.** |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review the instance-key provision plan at HEAD using brief 6. |
| + |
| +**WHAT:** |
| +Check prior findings, fresh-read safety and the documented residual. |
| + |
| +**STATUS:** |
| +Review complete: two P2 findings. |
| + |
| +**NEEDED:** |
| +Nothing for this review. |
| + |
| +**RECOMMENDED:** |
| +Fix launch-snapshot provenance and make digest-list updates effective. |
| + |
| +**SESSION:** |
| +Safe to close this review. No processes left running; handoff not saved because the workspace is read-only. |
| \ No newline at end of file |