amadan
Add the round five review brief
Round five covers the round four fixes, the teardown guard and the scoped-attestation groundwork, none of which has had an independent review.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 file changed,
+34
−0
docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round5.md+34 −0
diff --git a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round5.md b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round5.md| new file mode 100644 |
| index 000000000..5b7f3c777 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round5.md |
| @@ -0,0 +1,34 @@ |
| +# Review brief, round 5: Carloku paid launch, overnight changes of 2026-10-01 |
| + |
| +Read the round 1 brief (`CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight.md`) for the fixed rulings and the output rules, the round 3 brief for rulings 6 and 7, and the round 4 brief for ruling 8. Then read `CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`, whose last section covers round 4 (`CODEX-FINDINGS-...-round4.md` and `OPUS-REVIEW-...-round4.md`). |
| + |
| +Review the branch between `aed42815` and the commit named in the prompt. The changes since round 4 are `git diff 4bbe94b6 <commit>`: `5f2b4faf` (quantity worker), `f60f547f` (objstore), `26db8ab0` (statement walk, partial-month sums, per-account durability days), `14ef574a` (attestation scope, unwired) and one documents commit. |
| + |
| +Two more rulings are fixed: |
| + |
| +9. The whole-paid-day rule for partial months is a proposal awaiting the owner's approval. Do not argue the policy. Do say if the code or the plan document misstates what the rule does at its boundary. |
| +10. Replication attestation will be scoped (path A of `docs/superpowers/plans/2026-10-01-durability-attestation-path.md`). Nothing in the agent may set attestation true on this branch. The scope computation and the per-account fold are in scope for review as code that will later carry authority; a production path that reaches them today is a finding. |
| + |
| +## First: a disposition table |
| + |
| +For every round 4 finding (Astra R1 to R5, Opus N1 to N8, and the teardown guard both reviews asked for): closed, partly closed or not closed, with the file and line of the fix and of the test that reproduces the scenario, and whether that test would pass without the fix. The dispositions say which were confirmed to fail with the fix disabled. Check those claims; do not take them. |
| + |
| +## Then: new findings only |
| + |
| +Where to push: |
| + |
| +- **Dating the quantity assignment at the operation's instant** (`internal/console/billingservice.go` `reconcileBillingSubscription`, `billingstore.go` `applyBillingStateDated`). Find a path where the assignment is dated at an instant the provider did not charge from: an operation that did not land but whose target matches a quantity someone else set; a webhook for a different change arriving while an operation is outstanding; a renewal and a quantity change in one reconcile; an operation abandoned or retired and a later one with the same target; a date ahead of the observing clock within `billingClockTolerance`. Find a history this dating makes unreadable to `plans.AllowanceForMonth` (order, frozen months), and a review that should have been filed and was not, or was filed for nothing. |
| +- **The proration date bounds and the immediate retirement** (`billingquantity.go` `raiseQuantity`, `beginQuantityOperation`, `sendQuantityOperation`; `internal/billingstripe` `Error.RefusedParam`, `safeErrorParam`). Find a refusal that is treated as "did not execute" when the request may have executed, and a retirement that loses an addition or lets two operations run. |
| +- **The teardown guard** (`internal/objstore/walk.go` `Teardown`). It has had no review. Find a teardown that now leaks a bucket or a scanner plan for good, one that still destroys a bucket another app holds (a grant between the ledger read and the delete; a holder with no ledger interval), and a ledger state after either that would resolve the wrong owner. Say whether skipping, as opposed to refusing, is the right behaviour for the retried teardown and for the shared adopted bucket. |
| +- **`OwnerAt` and the observation hour** (`internal/objstore/ownership.go`). Find an hour that still resolves to someone who cannot be shown to own all of it, and say whether the month evidence projection (`internal/usage/evidence_month.go`) still pins everything `OwnerAt` now depends on. |
| +- **`statementMonthState`** (`internal/console/economicspass.go`). The classification was rewritten: absent only when no statement exists, corrupt logged once and counted present, a store error is "unknown", and two process-lifetime memories (closed statements, absent months). Find a month that is never swept and should be, a month swept every pass forever, and a state either memory makes wrong, including with two console processes. |
| +- **Per-account durability days** (`internal/console/durabilityfold.go`, `economicspass.go` `accountSourceDays`, `DurabilityExcluded`). Find an account that reads complete for a day on which some box excluded it or proved nothing, including across boxes, across a day with one box excluding and another not expected, and for an account that has no statement of its own. Check what the live economics view and the month evidence do with a per-account count. |
| +- **`durabilityScope`** (`internal/host/durabilityscope.go`). It is unwired. Review it as the rule that will decide who is vouched for. Find a route or a config for which an account is vouched for while the external replicator can touch its database: path matching (symlinks, relative paths, a unit tree's prefix, case), a route with no account, a config the parser reads only partly, the unit restarted between the reads. Say what the reader and the agent's call must do that the plan's "Not built" list does not already say. |
| +- `billingUsageOnPaidDays` after the split of its errors and the ordered sum; `internal/console/billingquantityaudit.go` after the audit guard was changed to admit a new outcome (the trigger is dropped and recreated on every open). |
| + |
| +## What to return |
| + |
| +1. The disposition table. |
| +2. New findings, most severe first, in the round 1 format. |
| +3. Handoff claims the code contradicts (`implementation/carloku-paid-launch/AGENT_HANDOFF.md`). |
| +4. A one-line verdict: accept, accept with fixes, or reject. |