carlos / platform Public

Download this file

1	Reviewed `38dfb240`. No files modified; findings are based on source inspection, without running tests.
2
3	1. **R2-1 — P1 — §7.2: The snapshot check still permits an outcome no serial order produces.**
4
5	The proposed hook runs after the pipeline read at [release.go:930](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:930), but `Signer.Promote` subsequently reads the target pointer and its current ETag at [release.go:732](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:732).
6
7	A concrete interleaving:
8
9	- A deploy credential starts promoting fresh release A to `edge`; both pipeline checks see no pipeline.
10	- An owner installs a pipeline containing `edge`.
11	- After installation completes, the owner promotes fresh release B to `edge`.
12	- The deploy request resumes. A still qualifies for the legacy entry rung. `Signer.Promote` reads B’s pointer and ETag, then successfully writes A with B in its history.
13
14	The final pointer is A. No permitted serial order produces that result: placing the deploy before pipeline installation leaves B last; placing it after installation requires refusal under R2. Pointer CAS does not prevent this because the deploy reads B’s ETag **after** B lands. History and audit also incorporate B at [release.go:745](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:745).
15
16	**Correction:** Bind pipeline authorization and the subsequent pointer reads/write through serialization or equivalent atomic conflict detection across console pipeline and pointer writers. A separate pipeline recheck alone leaves another race. Add the three-operation interleaving above to the tests. Direct-bucket writers being outside console control does not justify this counterexample, which uses only console operations.
17
18	2. **R2-2 — P2 — §§7.2, 12: The authoritative hook is bypassed by repeat promotions.**
19
20	`PromoteOnLadder` returns a successful no-op at [release.go:887](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:887), before reaching `GetPipeline` and therefore before the proposed hook.
21
22	If `edge` already points at A, the handler can authorize a repeat promotion while no pipeline exists, an owner can install the pipeline, and the primitive can then return success without performing its authoritative scope check. This writes no pointer, so it is not the escape in R2-1, but it violates the specified refusal contract and leaves the proposed “pipeline installed between reads” test incomplete.
23
24	**Correction:** When an authorization hook is supplied, read the pipeline and invoke the hook before the no-op return. Test the race with the requested version already at the channel head, as well as with a changing head.
25
26	3. **R2-3 — P2 — §7.4: The shipping claim and lifetime-check citation are incorrect.**
27
28	“Ship … uses the console’s own signer” is false. The handler calls `release.Ship` without a signing key; [release.go:584](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:584) accepts no signer and stores the manifest as plain JSON at [release.go:618](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:618).
29
30	The lifetime explanation is correct, but its `release.go:396-441` citation does not contain the check against `promoted_at`. That check is at [release.go:480](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-deploy-credential/internal/release/release.go:480).
31
32	**Correction:** State that shipping remains unchanged, uploads immutable artifacts and an unsigned manifest, and moves no pointer. Correct the lifetime-check citation.
33
34	**Verdict: request changes.**