amadan
carlos / platform Public
Reviewed 38dfb240. No files modified; findings are based on source inspection, without running tests.
- R2-1 — P1 — §7.2: The snapshot check still permits an outcome no serial order produces.
The proposed hook runs after the pipeline read at release.go:930, but Signer.Promote subsequently reads the target pointer and its current ETag at release.go:732.
A concrete interleaving:
- A deploy credential starts promoting fresh release A to edge; both pipeline checks see no pipeline. - An owner installs a pipeline containing edge. - After installation completes, the owner promotes fresh release B to edge. - The deploy request resumes. A still qualifies for the legacy entry rung. Signer.Promote reads B’s pointer and ETag, then successfully writes A with B in its history.
The final pointer is A. No permitted serial order produces that result: placing the deploy before pipeline installation leaves B last; placing it after installation requires refusal under R2. Pointer CAS does not prevent this because the deploy reads B’s ETag after B lands. History and audit also incorporate B at release.go:745.
Correction: Bind pipeline authorization and the subsequent pointer reads/write through serialization or equivalent atomic conflict detection across console pipeline and pointer writers. A separate pipeline recheck alone leaves another race. Add the three-operation interleaving above to the tests. Direct-bucket writers being outside console control does not justify this counterexample, which uses only console operations.
- R2-2 — P2 — §§7.2, 12: The authoritative hook is bypassed by repeat promotions.
PromoteOnLadder returns a successful no-op at release.go:887, before reaching GetPipeline and therefore before the proposed hook.
If edge already points at A, the handler can authorize a repeat promotion while no pipeline exists, an owner can install the pipeline, and the primitive can then return success without performing its authoritative scope check. This writes no pointer, so it is not the escape in R2-1, but it violates the specified refusal contract and leaves the proposed “pipeline installed between reads” test incomplete.
Correction: When an authorization hook is supplied, read the pipeline and invoke the hook before the no-op return. Test the race with the requested version already at the channel head, as well as with a changing head.
- R2-3 — P2 — §7.4: The shipping claim and lifetime-check citation are incorrect.
“Ship … uses the console’s own signer” is false. The handler calls release.Ship without a signing key; release.go:584 accepts no signer and stores the manifest as plain JSON at release.go:618.
The lifetime explanation is correct, but its release.go:396-441 citation does not contain the check against promoted_at. That check is at release.go:480.
Correction: State that shipping remains unchanged, uploads immutable artifacts and an unsigned manifest, and moves no pointer. Correct the lifetime-check citation.
Verdict: request changes.