carlos / platform Public

| Earlier finding | Disposition | Why | |---|---|---| | R3-1: Metadata encoded before final fields | Fixed | Plan 2:128 finalizes fields before encoding and adds a commit/reopen/read test. | | R3-2: Provider-test paths | Fixed | Plan 3:272 uses the correct full import path and package-local filenames. | | R3-3: Failed retirement advances authority | Partly fixed | Failed deletes are covered, but failed retirement revalidation still has a nil-return path with no explicit completeness rule or test. | | R3-4: Buffered fallback double billing | Fixed | Plan 3:160 assigns billing to the delivered response; Task 9 tests the combined meters. | | R3-5: Plain HEAD streamed | Fixed | Plan 3:160 explicitly buffers HEAD and requires bodyless refusal delivery. | | R3-6: Re-ship cannot retry generation backfill | Fixed | Plan 1:202 requires backfill before both successful responses and adds the partial-failure retry test. | | R1-15: Missing production-wired attacks | Partly fixed | The named refusal gaps are closed, but Task 9 still omits explicit two-edge cases for missing Cache-Control, no-store, and the retiring-build-only declaration required by spec §12. |

1. P1 — The record-write census is missing from the implementation and landing tasks. Plan 1 Tasks 5 and 11. Task 5 introduces SetRecordAssetGen through updateRecord and changes existing record creators (plan 1:192). Those changes trigger the separate record-write census, which rejects both unlisted declarations and changed source digests (plan9b8census_test.go:262). Task 11 updates only the root-read census; that cannot satisfy TestPlan9B8RecordWriteCensus. Smallest fix: assign review and updates of the record-write inventory, register SetRecordAssetGen in its typed-writer recognizer, and run the record-write census alongside the root-read gate.

1. P2 — A new owner’s cache key can be filled through the previous owner’s backend. Plan 1 Task 8 and Plan 3 Task 5. assetPolicy reads the registry (plan 1:268), while fillFromApp dispatches through the independently captured up.proxy; the signed-fill check compares the assertion only against LocalAssets.For (plan 3:158, plan 3:162). The edge reloads its route snapshot on a separate two-second poll. After an alias changes owners, policy can therefore name the new app while up still targets the old one. If both apps use the same version string and declare the prefix, the declaration check does not distinguish them. Smallest fix: require the selected upstream’s owner, primary route and asset generation to match the policy used for the key before acknowledging or filling. Add a test that changes the registry’s alias target while deliberately withholding Edge.Reload.

1. P3 — Buffered initiating misses are labelled as hits. Plan 3 Tasks 3, 5 and 6. serveAssetEntry unconditionally sets Carlos-Cache: hit (plan 3:120), but buffered cold HEAD, range and conditional requests must also use that helper after filling (plan 3:160). No interface permits the initiating response to retain miss. Smallest fix: pass the cache result into the serving helper, or assign that header in its callers; test that the cold initiator reports miss and subsequent requests report hit.

reject