carlos / platform Public

| R4 finding | Status | Assessment at 80647eeb | |---|---|---| | 1. Target-selection integration | Partly | Adapter and signatures are now specified; the HTTP fixtures cannot satisfy it, and source selection is incomplete. | | 2. Early moves.Check / strict-spawn fake | Partly | Earlier producer and mock seam added; Task 11 still redeclares Check. | | 3. Signing timestamp | Resolved | The guard’s captured timestamp reaches the signer; pause-across-expiry coverage is specified. | | 4. Generation-source prefix | Resolved | Separator normalization and a validated-claim fixture address it. | | 5. Recovery entry points | Partly | Units check a marker, but its asynchronous publication leaves an unsafe recovery window. | | 6. Privileged materialization / floor persistence | Partly | Floor moved to /data; staging relay added, but its error classification and authority checks are incomplete. | | 7. Default-off behavior | Partly | Ordinary S3 mirroring and console publication are corrected; system-apply dormancy remains contradictory. | | 8. Archive verification | Resolved | Decoded-tar hashing, sealed digest and terminal authentication are addressed. A separate error-path leak remains. | | 9. Invalid fixtures | Partly | Earlier bucket, PUT and claim-location defects are corrected; other fixtures still fail. | | 10. Flat spawn environment | Resolved | Actual spawn composition and optional purge availability are represented. | | 11. Source readiness probe | Resolved | Explicit cache bypass and a cached-success/failed-wake test are specified. | | 12. Readiness input producers | Partly | Version-aware loader and archive references added; T3 still contains conflicting loader instructions. | | 13. Private-storage refusal | Resolved | Checks the instance’s actual binding, fails closed and repeats the check in the worker. | | 14. Copy inventory | Resolved | Includes M-C1–M-C22 and explicitly imports the copy record into the implementation branch. | | 15. Legacy/guarded-transition instructions | Resolved | The cited replacement instructions are corrected. A new guarded-call signature error remains. |

Reviewed the pinned plans, moves spec rev 7.21, claim rev 6.30 at 73b1b9dc, and prior reviews. Fetching was attempted but failed: the sandbox forbids writing FETCH_HEAD; the subsequent remote lookup failed DNS resolution. Source comparisons therefore use cached origin/main 1c43c2ce82f621c6ac84a623db54f0ef63075603, whose freshness I cannot establish. No files changed, hosts contacted or tests run.

Findings

1. P1 — The task sequence contains definite build failures. Task 3 calls undefined testHolderKey at Plan 1:803; it exists neither on the inspected main nor in an earlier task. Task 1 creates moves.Check, then Task 11 declares it again at Plan 1:3217. Task 14 calls MoveGuardedCut(g, now) at Plan 1:3543, but Task 2 defines MoveGuardedCut(g MoveGuard).

Define the fixture helper, retain one Check declaration and correct the cut call. Task 14 also needs its own or a shared instanceStoreEnv: Task 4’s console-local helper is not accessible from package host.

1. P1 — The new root staging relay lacks an operation-authority check. Plan 1:2551 directs root to read {acct, app, host, version, op} and call MaterializeHeld, which calls PointLive. It specifies no verification that the request still names the current operation, incarnation, assigned box and pinned release. The pub parameter has no stated verification role.

A request queued for operation A can run after A is aborted or replaced, repointing the host to A’s build. Request-controlled path components also reach main’s filesystem joins without a specified validation contract. Require validation immediately before the filesystem effect, safe request/path handling, and tests for stale-operation and traversal requests. Keep authority validation in an appropriate host-side layer or callback to avoid introducing a release/hostclaim import cycle.

1. P1 — The recovery marker still permits execution below the protocol floor. Plan 1:3441 has the agent publish participation and hold-prev asynchronously. Nothing establishes that publication before the console commits a move. A crash after that commit but before the next agent pass leaves recovery free to execute old carlos.prev before the agent starts.

The marker is also removed for nonparticipants even when an armed floor remains and .prev is below it. That does not implement §11’s activation floor. The proposed unit test starts with the marker already present and misses both cases. Enforce the floor at executable selection and test the admission-to-marker crash boundary.

1. P2 — Default-off system-apply behavior contradicts the stated dormant boundary. Plan 1:3445 says absence of agent-written files makes floorAllows dormant. But the preceding contract also reads registry holds and the remote floor; the applier hooks are unconditional at Plan 1:3517.

The proposed switch-off test deliberately uses a held registry row, but only checks that the agent writes no files. Applying the specified activation rule to that same fixture refuses recovery. Define and test the root activation boundary, including the separate case of a previously armed, persistent floor.

1. P2 — The staging fallback misses the production read-only-mount error. Plan 1:2551 recognizes only errors.Is(err, fs.ErrPermission). ProtectSystem=strict can produce EROFS, which is not fs.ErrPermission. Main already handles this distinction in release.stageBlocked (internal/release/adopt.go:250), covering EROFS, EPERM and EACCES.

Reuse that classification. The proposed chmod(0555) fixture tests discretionary permissions, not read-only mounts; inject EROFS explicitly.

1. P2 — Task 4’s supplied HTTP fixtures cannot reach their expected outcomes. Plan 1:1022 supplies minimal edges files, while selectMoveBoxes now requires a complete live snapshot and verified eligible identities. Matching status snapshots, signed identity/binding fixtures and eligibility inputs are missing.

Consequently, the claimless test returns incomplete-fleet refusal before its expected claim refusal; the admitted case cannot select its target. Adding only protocol and serving-claim data does not fix this. Reuse a complete production-shaped fixture in the HTTP tests, not just in the separate selector unit test.

1. P2 — Selection permits an absent source. At Plan 1:1319, both regions reject more than one candidate, but only the target must produce a candidate. Zero source candidates passes; the source candidate is never bound to the claim’s executor. The source-region floor check can also pass vacuously when no source file exists.

Require the source required by §7.1 to be present and consistent with the claim. Add missing-source and different-executor tests.

1. P2 — Versioned receipts leave the multipart receipt-match branch unspecified. Plan 1:1555 gives concrete changes for equal source/destination ETags. Main has another early return for matching receipts when those ETags differ—the normal multipart-source case.

That branch also needs to require DstVersionID and populate round.Versions. Otherwise the specified edits can skip copying while omitting the object’s version from the round. Add a two-round multipart fixture and an old receipt without a version; the supplied single-part case cannot catch this.

1. P2 — Readiness can combine different input generations, and T3’s provenance wiring remains contradictory. Ready at Plan 1:3276 checks age and passing flags, but does not compare the target’s checked files/environment inputs with the current source report. A passing target report for archive A can remain fresh after the source publishes archive B, allowing promotion or auto-cut before B passes T5.

Separately, Task 7b requires LoadMergedHostVersions, while T3 at Plan 1:3138 still specifies LoadMergedHost, which cannot return both bundle ETags. Require matching report input identities, use the version-aware loader for the actual render, and test two fresh reports with different digests. T3’s specified reporting of host-overlay shadowing also needs an explicit producer and assertion.

1. P2 — Interim abort cannot recover from its claim-release crash boundary. Plan 1:3540 releases the moving claim before clearing the record. A crash between those writes leaves an aborting record and a serving claim. Task 3’s ReleaseMove requires the matching moving operation, so replay cannot complete as specified.

Provide operation-bound completion evidence or an explicitly safe idempotent completion path. TestInterimAbortReleasesTheClaim needs a crash/retry case between these two writes.

1. P2 — The dir-store staging-lease fallback cannot satisfy the signing guard. Plan 1:3538 falls back to ordinary lease.Acquire on the own bucket. Its 15-minute lease cannot provide the required 15-minute signature lifetime plus skew/margin, so the first guarded write is unsafe. Using each participant’s own bucket also fails to identify one shared coordination location.

Specify a shared fallback with the staging TTL, or explicitly refuse that deployment mode. Test its first guarded write.

1. P2 — Archive verification leaks its producer on early errors. Plan 1:2309 launches Open writing to an io.Pipe, but early manifest, tar or decoder errors never close the pipe reader. The producer can remain blocked writing the remaining archive. Repeated T5 failures accumulate blocked goroutines and retained resources.

Close/cancel the producer on every return and verify termination using an early mismatch in a multi-chunk archive.

1. P2 — Several commit commands omit files required by their own task. Examples: Task 1 omits check.go at Plan 1:254; Task 4 omits its moves prerequisite and console entry-point changes; Task 6 omits its internal/lease implementation changes at Plan 1:1808; Task 13 omits units and movesfloor files; Task 14 stages only movespass files at Plan 1:3553.

A passing working-tree test does not make those commits buildable. Correct the file sets and validate the committed tree at each task boundary.

1. P3 — Competing instructions remain in the index and task bodies. The index still identifies older spec/claim revisions at Index:9. Task 4 retains older private-policy/selection directions; Task 9’s interface description disagrees with its revised purge treatment; Task 13 prescribes readEdgesSnapshot at Plan 1:3471, while Task 4 now uses liveEdges and full completeness.

Reconcile these rather than marking the dispositions wholly complete. Also identify release.LiveVersion as reuse: it already exists on main at internal/release/versions.go:290.

The task-by-task assessment below is static. “Meaningful tests” means the proposed assertions discriminate the intended behavior; it does not mean a red/green run was observed.

| Task | Main interfaces, ordering and tests | |---|---| | 0 — Switch | New configuration is straightforward. Parser tests do not establish actual console/agent wiring. | | 1 — IDs/shared types | Self-contained; ID tests are meaningful. Retain the early Check producer and include it in the commit. | | 2 — Journal | Existing record/store interfaces match; legacy transitions remain. Guard-conflict tests discriminate. Task 14 must use the actual cut signature. | | 3 — Claim transitions | Merged guards, kinds, fields and update primitives exist. Undefined fixture helper blocks compilation; abort replay needs coverage. | | 4 — Door | Existing selector signatures now match, and the adapter is specified locally. HTTP fixtures and source selection remain defective. Legacy dispatch is explicitly gated. | | 5 — Version receipts | Interfaces are additive and ordinary S3 mirroring stays plain. Multipart receipt/version coverage is missing. | | 6 — Lease/signing | Existing TTL acquisition internals, SafeUntil and signer support the additions. Timestamp test is now discriminating; commit file set is incomplete. | | 7 — Archive | Crypto interfaces match. Round-trip, authentication and mode tests are useful; producer cleanup on rejection is untested. | | 7b — Held helpers/strict spawn | Staging, PointLive, PrepareStrict and configuration primitives exist. Mock seam is viable. Root relay, EROFS handling and existing LiveVersion reuse need correction. | | 8 — Timers | Registry timer shape matches; digest and registration round-trip tests are meaningful. No additional blocker found. | | 9 — Environment | Actual spawn helpers/signatures now align. Composition tests discriminate; stale interface prose and shadow reporting need reconciliation. | | 10 — Budget | Referenced model at 9c417aaa and numerical examples align. Boundary tests are meaningful. | | 11 — Readiness | Duplicate Check blocks compilation. Freshness tests miss mismatched input generations. Host work is deferred to Task 14. | | 12 — Holds | Registry APIs and fixture exist. Conditional release/deletion tests are meaningful; additions are compatible with existing rows. | | 13 — Floor | Applier hooks exist. Tests miss admission-to-marker crash ordering and actual switch-off activation behavior. | | 14 — Integration | Worker and harness exist. Wrong call signature, helper placement, abort replay, fallback lease and readiness integration remain unresolved. | | 15 — Copy gate | Earlier DefaultEnabled producer, complete inventory and record import are specified. Negative fixtures meaningfully test the gate. | | 16 — Final gate | Cannot pass the preceding tasks as written. No gate was run in this review. |

Claim independence: I found no direct Plan 1 dependency on unmerged hostops, hostbox, hostwrite, hostexec, hostfence or hostquarantine. The intended implementation can use merged primitives plus the additions specified here. Claimless-host refusal pending adoption is an explicit operational restriction, not a build dependency on claim Plan 5. The findings above can be repaired without claim Plans 5/6/8.

Imports and shippability: No intended package import cycle was found. Missing/duplicate identifiers, the wrong signature and incomplete commit boundaries prevent buildability after every task. Default-off preservation is substantially improved for the console, worker, mirror and strict spawn, but remains unproven for system activation.

Spec coverage: The remaining gaps include §11’s activation floor, §7.1’s source selection, §7.3’s checked-input consistency and shadow reporting, and operation-bound held materialization. These prevent treating the plan as a complete implementation prescription.

PLAN 1: NOT READY TO BUILD.

---

FIRST PROMPT: Read-only review of Plan 1 and its index before implementation.

WHAT: Checked R4 dispositions, main interfaces, claim independence, tests and spec coverage.

STATUS: Review complete; blockers remain. Remote-main freshness unverified.

NEEDED: Correct the findings before implementation.

RECOMMENDED: Re-review the amended plan against successfully fetched origin/main.

SESSION: Safe to close. Repository unchanged; no processes started.