carlos / platform Public

| Round-1 finding | Disposition | Why | |---|---|---| | 1. Shared types introduced too late | Fixed | HostAssets/LocalAssets move into Plan 1 Task 8; FS moves into Plan 2 Task 1. | | 2. Declared called on the wrong interface | Fixed | Plan 3 Task 5 now calls e.assets.local.Declared with the request hostname. | | 3. Invalid census dispositions | Fixed | The revised rows use valid classes, legacy formats and kept-family ownership. | | 4. Impossible AWS dependency assertion | Fixed | The check now targets assetcache and the new asset implementation files. | | 5. Unusable registry failure fixtures | Fixed | Selective SQLite triggers replace the wrapper/closed-handle proposals. | | 6. Missing cookie-trailer veto | Fixed | Both fill paths now require a trailer check before committing. | | 7. Confirming unapplied records | Partly fixed | The skipped-generation case is covered, but the equality shortcut checks only asset fields and can overlook failed gate convergence. | | 8. Unbounded metadata writes | Fixed | Plan 2 specifies a 64 KiB encoded-metadata limit, accounting and oversized-input tests. | | 9. Unsafe replacement sequence | Fixed | Versioned bodies and an atomic metadata replacement preserve the previous entry until publication. | | 10. Cold conditional/range handling | Fixed | Admitted cold fills now answer these requests through serveAssetEntry. | | 11. Acknowledgement key rotation | Fixed | Verification returns the matched key, which signs the acknowledgement. | | 12. Far cache catches upgrades | Fixed | The far predicate explicitly excludes upgrade requests. | | 13. Serving-generation publication trigger | Fixed | A serving-build digest now triggers publication independently of the registry fingerprint. | | 14. Missing fallback ETag | Fixed | Both fill paths specify the same SHA-256 fallback validator. | | 15. Missing production-wired attacks | Partly fixed | Task 9 adds coverage but still leaves required cases, including oversized responses and generation/owner mismatches, outside its explicit acceptance matrix. | | 16. Incomplete copy inventory | Partly fixed | The missing refusals are added, but Task 0 requires EAC-1–24 while the inventory never defines EAC-20 or EAC-21. |

1. P2 — Late fill failure can replay a response after delivery has started. Plan 3 Task 5 tees ordinary initiating requests directly to the client, then instructs the implementation to forward the request again after a deadline, short body or trailer veto (plan 3:160). Task 6 inherits this rule. For a streamed response, headers and body bytes have already been sent: replaying can append a second body and cannot replace the status or headers. The spec instead requires abandonment of caching while the original delivery continues (spec:409). Smallest fix: distinguish buffered initiators from responses already started; never replay onto a started response. Test a streaming GET that receives a cookie trailer and another that passes the cache deadline.

1. P2 — Disk accounting has no reader-lifetime contract. Plan 2 Tasks 4–5 explicitly allow readers to retain unlinked old bodies, expose them as raw *os.File handles, and evict entries to make budget room (plan 2:128, plan 2:147). Unlinking an open file does not release its disk space. Slow readers can therefore retain evicted bodies while new fills consume the supposedly reclaimed budget; the filesystem floor does not enforce the separate cache budget. Smallest fix: specify reader leases and a release notification; retain accounting for retired bodies until their last reader closes, or prevent eviction while pinned. Test eviction and replacement while an old reader remains open.

1. P2 — The authority acceptance task needs an explicit package boundary. Plan 3 Task 8 places the test in internal/edge and imports an exported constructor from internal/host (plan 3:234). The existing edge fixtures use package edge, while host already imports edge (fixture:1, agent.go:184). Following that fixture structure creates an import cycle. Choosing edge_test avoids the cycle but loses access to the private home-map and fixture helpers; the constructor alone does not resolve that. Smallest fix: specify an external integration-test package and its exported harness, including publication, clock advancement and home-map refresh.

1. P2 — The proposed generation fixture never selects generation routing. Plan 3 Task 9 adds Account, App and AssetGen to scene routes and passes an activator to newBackhaulEdge (plan 3:246). That helper creates TCP service routes (backhaule2etest.go:267). Generation routing requires a socket-backed instance with Hibernate enabled (edge.go:740). Merely supplying genActivator cannot exercise the answering-build or sleep cases. Smallest fix: prescribe generation-managed instance routes and sockets for those cases, and assert that the fixture actually selects genManaged before testing cache behaviour.

1. P2 — The “old far edge” test removes the forged marker before the home sees it. Plan 3 Task 9 models the old edge by disabling its asset cache (plan 3:252). However, Task 6 strips client-supplied fill headers from every non-hop request, independently of arming (plan 3:188). The test can pass without exercising rejection of a forged assertion inside a legitimate hop. Smallest fix: simulate legacy forwarding explicitly, preserving the forged marker while adding valid hop authentication; assert that the home receives both before checking billing and acknowledgement refusal.

1. P3 — Several corrective tests are excluded by their task’s test command. Plan 2 Task 4 omits TestOversizedMetaIsRefused and TestReplacementCrashKeepsTheOldEntry from its selector (plan 2:133). Plan 3 Task 1 omits TestAckUsesTheKeyTheAssertionMatched (plan 3:87); Task 5 omits the new cold-request, fallback-ETag and trailer-veto tests (plan 3:171, plan 3:180). Smallest fix: update the selectors so each task’s prescribed fail/pass cycle actually runs every test it introduces.

reject