Reviewed `2c39819c` (HEAD at review start). The plan remained unchanged during concurrent implementation work.
2
3
1. **P2 — A concurrent config removal bypasses the fresh check.** [Plan:2907](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:2907)
4
The launch captures configured key A, but the gate rereads the files to determine its source. If `SyncExec` removes the key between those reads, `Effective` returns `LayerNone`. The `layer != LayerConfig` branch then admits the launch without consulting the bucket, while the child still receives A. Config sync shares no lock with these reads; its bounce during a wake is deferred until afterward. Capture the source alongside the launch environment, or refuse when the reread disagrees. Add a deterministic interleaving test.
5
6
2. **P2 — The coordinated procedure never applies digest-list changes to the running agent.** [Plan:4655](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:4655)
7
`replicaHomeKeys` parses the environment once and captures the map. Editing the agent’s environment drop-in neither invalidates its existing entries nor loads replacements. Following the procedure literally leaves the old map active; a replica updated to B remains refused against A. Specify an agent restart—or implement an explicit reload—after invalidation and replacement, keeping replicas stopped throughout. Verify that invalidation has taken effect before changing the key.
8
9
R5-2 and R5-3 are closed: O8 explicitly defers configured-only homes, and parser errors omit input. R5-1’s approach is sound, but these gaps prevent full closure.
10
11
When reached, the fresh read fails closed on missing configuration, bucket errors and decryption errors. Network reads use a ten-second timeout; bucket outages therefore cost replica availability as documented. The home-only residual is acceptable within the stated no-rotation scope once the coordinated procedure actually updates the agent.
12
13
Static review; proposed tests were not executed. No files changed by me.
14
15
**Verdict: not ready to build.**
16
17
---
18
19
**FIRST PROMPT:**
20
Review the instance-key provision plan at HEAD using brief 6.
21
22
**WHAT:**
23
Check prior findings, fresh-read safety and the documented residual.
24
25
**STATUS:**
26
Review complete: two P2 findings.
27
28
**NEEDED:**
29
Nothing for this review.
30
31
**RECOMMENDED:**
32
Fix launch-snapshot provenance and make digest-list updates effective.
33
34
**SESSION:**
35
Safe to close this review. No processes left running; handoff not saved because the workspace is read-only.
amadan