carlos / platform Public

Verdict: REJECT

1. Important — internal/release/materializeheld.go:108: A digested head admits an undigested history target. r.Admit checks the head’s digest. If that passes but p.DigestOf(version) is empty, HeldAuthorized still returns success with no digest binding.

Failure: A signed pointer has head v2 with a digest and legacy history entry v1 without one. v1 has no promotion record. Replace its unsigned manifest and artifacts, then request a held stage of v1: the replacement bytes pass even with CARLOS_REQUIRE_POINTER_DIGEST=true. This bypasses the protection against undigested historical targets in §4.6.

Fix: Reject a digestless history entry when its channel carries digests; continue looking for valid alternative evidence. Add a mixed-head/history regression test that checks both refusal and absence of downloaded artifacts. The existing ratchet test exercises only wholly digestless pointers.

1. Important — internal/release/materializeheld.go:93: Verified pointers can escape the ratchet’s memory. The version-name check skips Admit after successfully verifying a pointer that names another build. §4.6 requires remembering that the box has verified digests for that channel.

Failure: While authorizing v1 through channel B, the box verifies channel A’s digested pointer for legacy build v2, but records no mark. Later, a saved digestless A pointer is replayed alongside substituted v2 bytes. With the fleet-wide flag off and no promotion record for this legacy build, a held stage of v2 succeeds.

Fix: Separate observing a verified digested pointer from selecting evidence for this request. Remember every such observation, preserving fail-closed behavior after persistence failures. Replace TestHeldAuthorizedAdmitsOnlyNamingPointers’s no-mark assertion with a two-pass replay test; its current assertion protects the wrong behavior.

1. Important — internal/release/promotion.go:124: Fleet boxes cannot read promotion records. The new reader requests releases/<acct>/<app>/promoted/<version>, but internal/edge/storedoor.go:425 grants no reads under releases/. The fleet client converts the resulting 404 into os.ErrNotExist, which becomes ErrNoPromotionRecord.

Failure: A validly authorized build outside pointer history cannot be staged on a box using the fleet HTTPS store. Explicitly authorizing it again cannot repair this. If a legacy pointer still names it, the reader instead falls back to weaker evidence despite the existing digest-bound record.

Fix: Grant fleet read access to the exact promotion-record shape within its own account. Keep writes and other accounts denied. Add a test through the actual store door and fleet client, covering record-only authorization and digest-mismatch refusal.

1. Minor — internal/updatewords/words_authorize.go:43: “Nothing was signed” is substantively false after a write error. Signing occurs before Put, and a failed response does not establish that storage rejected the write.

Failure: Storage commits the authorization but the response times out. The console tells the member nothing was signed, although the build is now authorized.

Fix: Report that authorization could not be confirmed, or verify the stored record before reporting the outcome. This is an accuracy issue, independent of copy style.

Rulings

R13: Disagree with checking whether the pointer names the requested version before updating the ratchet. That contradicts §4.6’s “once verified” rule and produces finding 2. The distinction between transient failures and definitive refusals should remain.

Deferred minors that must be fixed before merge

None of the ledger’s deferred minors independently warrants blocking merge. Findings 1–3 and their regression coverage do.

Read-only source review against merge base 412ca787; no files changed or tests executed. ---

Controller response (fix wave 1, commits 6f79b01d, 0fc74c11, 2c3f0ad8). All four findings accepted; none rejected.

• Finding 1 (Ruling R16): a naming pointer whose entry for the version has no digest, on a channel that carries digests, is not held-stage evidence; HeldAuthorized skips it and keeps looking. Cost if wrong: a legacy history build on a now-digested channel needs carlos releases authorize before a move can stage it.
• Finding 2 (Ruling R15, revising R13's ordering): HeldAuthorized admits every verified pointer it reads through the ratchet, then selects evidence among those naming the version; R13's retry/skip split stands for naming pointers. Cost if wrong: an unrelated channel's mark is written during a held stage, as adoption would write it.
• Finding 3 (Ruling R17): the fleet store door grants GET of exactly releases/<sqid>/<app>/promoted/<version> for the box's own account; no listing, no write, nothing else under releases/. Cost if wrong: a box can read its own account's signed build digests (no secret).
• Finding 4 (Ruling R18): the settings.authorize.write-failed draft no longer claims nothing was signed. Still a draft under copy review.

Scoped re-review: CODEX-FINDINGS-SETTINGS-IMPL-2-R2.md (ACCEPT).