Reviewed HEAD `cba8ae4ea824eda6ca8a06d00fd398d9f6bf2e66`.
2
3
1. **P2 — Gate the platform rollout before removing existing replicas’ configured keys.** [Plan:2343](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:2343)
4
`fileEnvFor` strips the key unconditionally, including a deliberately shared key that already matches the home’s. Such a replica loses its working key on its next launch after the platform upgrade, without any app change. The “before adopting” advice at line 3861 comes too late for existing consumers. Require a pre-roll check and migration to an independently supplied, matching `own` key before upgrading affected boxes. Until the follow-up, explicitly prohibit helper adoption with empty `own` on apps with replicas. Correct “runs everywhere” at line 3857.
5
6
2. **P2 — Removing the variable does not guarantee refusal on claim launches.** [Plan:243](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:243)
7
Before O6, claim launches have no control socket. After stripping the key, `InstanceKey("")` returns `ErrNotOnCarlos`; the cited rastrillo helper’s documented caller then mints a key. A replica can therefore start with a new key over the home’s data instead of refusing. This also changes an existing configured-key consumer from successful resolution to fallback. Gate these launches/adoptions until they can refuse reliably, or require the matching `own` key. Add a test exercising helper resolution and startup with no control socket; checking variable absence alone misses this failure.
8
9
The round 3 findings are closed **at their narrow scope**: delivery through the specified environment paths is removed, and O7 consistently precedes O6. Refusing startup is a safe data-preservation choice only when refusal is reliable and the availability change is gated.
10
11
Static review against the plan, launch code and rastrillo commit `e3ea08de`; proposed tests were not executed. No files changed.
12
13
**Verdict: not ready to build.**
14
15
---
16
17
**FIRST PROMPT:**
18
Review the instance-key provision plan at HEAD using the round 4 brief.
19
20
**WHAT:**
21
Confirm the previous fixes and assess replica startup safety.
22
23
**STATUS:**
24
Review complete: two P2 findings.
25
26
**NEEDED:**
27
Nothing for this review.
28
29
**RECOMMENDED:**
30
Add the rollout gate and close the claim-launch fallback path.
31
32
**SESSION:**
33
Safe to close; no processes or scratch files created. Handoff not saved because the workspace is read-only.
amadan