carlos / platform Public

Reviewed HEAD cba8ae4ea824eda6ca8a06d00fd398d9f6bf2e66.

1. P2 — Gate the platform rollout before removing existing replicas’ configured keys. Plan:2343 fileEnvFor strips the key unconditionally, including a deliberately shared key that already matches the home’s. Such a replica loses its working key on its next launch after the platform upgrade, without any app change. The “before adopting” advice at line 3861 comes too late for existing consumers. Require a pre-roll check and migration to an independently supplied, matching own key before upgrading affected boxes. Until the follow-up, explicitly prohibit helper adoption with empty own on apps with replicas. Correct “runs everywhere” at line 3857.

1. P2 — Removing the variable does not guarantee refusal on claim launches. Plan:243 Before O6, claim launches have no control socket. After stripping the key, InstanceKey("") returns ErrNotOnCarlos; the cited rastrillo helper’s documented caller then mints a key. A replica can therefore start with a new key over the home’s data instead of refusing. This also changes an existing configured-key consumer from successful resolution to fallback. Gate these launches/adoptions until they can refuse reliably, or require the matching own key. Add a test exercising helper resolution and startup with no control socket; checking variable absence alone misses this failure.

The round 3 findings are closed at their narrow scope: delivery through the specified environment paths is removed, and O7 consistently precedes O6. Refusing startup is a safe data-preservation choice only when refusal is reliable and the availability change is gated.

Static review against the plan, launch code and rastrillo commit e3ea08de; proposed tests were not executed. No files changed.

Verdict: not ready to build.

---

FIRST PROMPT: Review the instance-key provision plan at HEAD using the round 4 brief.

WHAT: Confirm the previous fixes and assess replica startup safety.

STATUS: Review complete: two P2 findings.

NEEDED: Nothing for this review.

RECOMMENDED: Add the rollout gate and close the claim-launch fallback path.

SESSION: Safe to close; no processes or scratch files created. Handoff not saved because the workspace is read-only.