| 1 | | Round-1 finding | Disposition | Why | |
| 2 | |---|---|---| |
| 3 | | 1. Shared types introduced too late | Fixed | `HostAssets`/`LocalAssets` move into Plan 1 Task 8; `FS` moves into Plan 2 Task 1. | |
| 4 | | 2. `Declared` called on the wrong interface | Fixed | Plan 3 Task 5 now calls `e.assets.local.Declared` with the request hostname. | |
| 5 | | 3. Invalid census dispositions | Fixed | The revised rows use valid classes, legacy formats and kept-family ownership. | |
| 6 | | 4. Impossible AWS dependency assertion | Fixed | The check now targets `assetcache` and the new asset implementation files. | |
| 7 | | 5. Unusable registry failure fixtures | Fixed | Selective SQLite triggers replace the wrapper/closed-handle proposals. | |
| 8 | | 6. Missing cookie-trailer veto | Fixed | Both fill paths now require a trailer check before committing. | |
| 9 | | 7. Confirming unapplied records | Partly fixed | The skipped-generation case is covered, but [the equality shortcut](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:228) checks only asset fields and can overlook failed gate convergence. | |
| 10 | | 8. Unbounded metadata writes | Fixed | Plan 2 specifies a 64 KiB encoded-metadata limit, accounting and oversized-input tests. | |
| 11 | | 9. Unsafe replacement sequence | Fixed | Versioned bodies and an atomic metadata replacement preserve the previous entry until publication. | |
| 12 | | 10. Cold conditional/range handling | Fixed | Admitted cold fills now answer these requests through `serveAssetEntry`. | |
| 13 | | 11. Acknowledgement key rotation | Fixed | Verification returns the matched key, which signs the acknowledgement. | |
| 14 | | 12. Far cache catches upgrades | Fixed | The far predicate explicitly excludes upgrade requests. | |
| 15 | | 13. Serving-generation publication trigger | Fixed | A serving-build digest now triggers publication independently of the registry fingerprint. | |
| 16 | | 14. Missing fallback ETag | Fixed | Both fill paths specify the same SHA-256 fallback validator. | |
| 17 | | 15. Missing production-wired attacks | Partly fixed | [Task 9](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:248) adds coverage but still leaves required cases, including oversized responses and generation/owner mismatches, outside its explicit acceptance matrix. | |
| 18 | | 16. Incomplete copy inventory | Partly fixed | The missing refusals are added, but [Task 0](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:106) requires EAC-1–24 while the inventory never defines EAC-20 or EAC-21. | |
| 19 | |
| 20 | 1. **P2 — Late fill failure can replay a response after delivery has started.** Plan 3 Task 5 tees ordinary initiating requests directly to the client, then instructs the implementation to forward the request again after a deadline, short body or trailer veto ([plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160)). Task 6 inherits this rule. For a streamed response, headers and body bytes have already been sent: replaying can append a second body and cannot replace the status or headers. The spec instead requires abandonment of caching while the original delivery continues ([spec:409](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/specs/2026-10-24-edge-asset-cache-design.md:409)). **Smallest fix:** distinguish buffered initiators from responses already started; never replay onto a started response. Test a streaming GET that receives a cookie trailer and another that passes the cache deadline. |
| 21 | |
| 22 | 2. **P2 — Disk accounting has no reader-lifetime contract.** Plan 2 Tasks 4–5 explicitly allow readers to retain unlinked old bodies, expose them as raw `*os.File` handles, and evict entries to make budget room ([plan 2:128](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:128), [plan 2:147](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:147)). Unlinking an open file does not release its disk space. Slow readers can therefore retain evicted bodies while new fills consume the supposedly reclaimed budget; the filesystem floor does not enforce the separate cache budget. **Smallest fix:** specify reader leases and a release notification; retain accounting for retired bodies until their last reader closes, or prevent eviction while pinned. Test eviction and replacement while an old reader remains open. |
| 23 | |
| 24 | 3. **P2 — The authority acceptance task needs an explicit package boundary.** Plan 3 Task 8 places the test in `internal/edge` and imports an exported constructor from `internal/host` ([plan 3:234](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:234)). The existing edge fixtures use `package edge`, while host already imports edge ([fixture:1](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/backhaul_e2e_test.go:1), [agent.go:184](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/host/agent.go:184)). Following that fixture structure creates an import cycle. Choosing `edge_test` avoids the cycle but loses access to the private home-map and fixture helpers; the constructor alone does not resolve that. **Smallest fix:** specify an external integration-test package and its exported harness, including publication, clock advancement and home-map refresh. |
| 25 | |
| 26 | 4. **P2 — The proposed generation fixture never selects generation routing.** Plan 3 Task 9 adds `Account`, `App` and `AssetGen` to scene routes and passes an activator to `newBackhaulEdge` ([plan 3:246](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:246)). That helper creates TCP `service` routes ([backhaul_e2e_test.go:267](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/backhaul_e2e_test.go:267)). Generation routing requires a socket-backed `instance` with `Hibernate` enabled ([edge.go:740](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:740)). Merely supplying `genActivator` cannot exercise the answering-build or sleep cases. **Smallest fix:** prescribe generation-managed instance routes and sockets for those cases, and assert that the fixture actually selects `genManaged` before testing cache behaviour. |
| 27 | |
| 28 | 5. **P2 — The “old far edge” test removes the forged marker before the home sees it.** Plan 3 Task 9 models the old edge by disabling its asset cache ([plan 3:252](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:252)). However, Task 6 strips client-supplied fill headers from **every** non-hop request, independently of arming ([plan 3:188](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:188)). The test can pass without exercising rejection of a forged assertion inside a legitimate hop. **Smallest fix:** simulate legacy forwarding explicitly, preserving the forged marker while adding valid hop authentication; assert that the home receives both before checking billing and acknowledgement refusal. |
| 29 | |
| 30 | 6. **P3 — Several corrective tests are excluded by their task’s test command.** Plan 2 Task 4 omits `TestOversizedMetaIsRefused` and `TestReplacementCrashKeepsTheOldEntry` from its selector ([plan 2:133](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:133)). Plan 3 Task 1 omits `TestAckUsesTheKeyTheAssertionMatched` ([plan 3:87](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:87)); Task 5 omits the new cold-request, fallback-ETag and trailer-veto tests ([plan 3:171](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:171), [plan 3:180](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:180)). **Smallest fix:** update the selectors so each task’s prescribed fail/pass cycle actually runs every test it introduces. |
| 31 | |
| 32 | reject |
amadan