| 1 | Reviewed HEAD `37c48a403f229d78e743f61192ac4bffdf658cba`. |
| 2 | |
| 3 | 1. **P2 — A stale digest still admits the wrong key after an ordinary configuration change.** [Plan:275](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:275) |
| 4 | Shared configuration does not change both boxes simultaneously: `SyncExec` reconciles each box separately. Starting with key A everywhere, the home can adopt B while the replica retains A. Its next launch still passes against the recorded digest of A, despite the home now using B. A delayed or failed configuration fetch extends this window. Require fresh home-key evidence, or a coordinated procedure that stops replicas and invalidates their entries **before any key change**, including app-level changes. Add a test with the home updated and replica configuration delayed. |
| 5 | |
| 6 | 2. **P2 — O8 has no source for a configured key’s value.** [Plan:310](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:310) |
| 7 | O1′ publishes `<host>.env` byte-for-byte. When configuration supplies the key, ruling 5 deliberately leaves it out of that file; the value lives in `<host>.config.env`. The adoption record contains only its digest. Reading these published items therefore cannot deliver the configured key promised at line 313. Specify an authorized source for those bytes, verify them against the writer-bound digest, and test a home whose key exists only in configuration. Otherwise explicitly defer that case and retain refusal. |
| 8 | |
| 9 | 3. **P3 — Malformed digest-list entries can reach logs unredacted.** [Plan:1054](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:1054) |
| 10 | If an entry contains only a digest, without `replica-host=`, `strings.Cut` places the entire digest in `host`. The error interpolates it, and `replicaHomeKeys` logs that error. This contradicts the no-digest-logging requirement. Report an entry index and validation reason without echoing malformed input; test this logging path. |
| 11 | |
| 12 | The original round 4 failures are addressed at the plan level: matching configured keys are preserved, and keyless launches without a socket are gated across seeds, flat starts, nested preparation and claim snapshots. The agent’s digest list is stripped from inherited tenant environments by `childEnv`. The keyless fallback is sound for the documented helper, but the stale-list case prevents the broader home-key guarantee. |
| 13 | |
| 14 | Static review; proposed tests were not executed. No files changed. |
| 15 | |
| 16 | **Verdict: not ready to build.** |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | **FIRST PROMPT:** |
| 21 | Review the instance-key provision plan at HEAD using brief 5. |
| 22 | |
| 23 | **WHAT:** |
| 24 | Check replica launch safety, rollout verification and O8. |
| 25 | |
| 26 | **STATUS:** |
| 27 | Review complete: two P2 findings and one P3. |
| 28 | |
| 29 | **NEEDED:** |
| 30 | Nothing for this review. |
| 31 | |
| 32 | **RECOMMENDED:** |
| 33 | Resolve digest freshness, define configured-key delivery, and redact parser errors. |
| 34 | |
| 35 | **SESSION:** |
| 36 | Safe to close. No processes or scratch files created; handoff not saved because the workspace is read-only. |
amadan