carlos / platform Public

| Previous finding | Round 6 assessment | |---|---| | R1-1: flat tenant borrows a nested socket | Fixed by the peer-cgroup check (§5.4). | | R1-2: aliases and path routes remain public | Fixed by checking the final upstream (§5.1). | | R1-3: new box starts public | Fixed by classification before serving and refusal of NULL (§5.1). | | R1-4: revoked grants return after restart | Fixed for retained local state; fresh-box replay remains explicitly accepted (§5.3). | | R1-5: door exceptions fail across routing | Resolved by removing the owner exception and defining the identity transition (§5.4). | | R1-6: socket lifecycle conflicts | Fixed by instance-level listener ownership (§5.4). | | R1-7: transport and body limits | Resolved at spec level (§§5.4–5.5). | | R2-1: stamp follows serving | Fixed by the admission barrier (§5.1). | | R2-2: upgrade serves unclassified engines | Fixed by classification before listeners and refusal of NULL (§5.1). | | R2-3: flat callers borrow door credentials | Fixed by the door’s UID restriction (§§5.4, 6.2). | | R2-4: deployment verification fails | Fixed by watch tickets (§5.8). | | R2-5: port-80 refusal cannot work remotely | Resolved by the narrowed contract (§5.1). | | R3-1: previously admitted requests cross the mark | Fixed: acknowledgement waits for cancellation and completion (§5.1). | | R3-2: flat tenant injects into a nested caller | Fixed at spec level by excluding unisolated execution while armed (§6.2); historical compromise remains explicitly excluded. | | R3-3: grant-only routes lack watch tickets | Fixed: every deploy target receives a ticket (§5.8). | | R4-1: foreign instances and workers remain unisolated | Fixed by the armed-state prerequisite and launch refusals (§6.2). | | R4-2: path routing widens an engine grant | Fixed by exact-host engine dispatch (§5.4). | | R4-3: watch tickets expire mid-watch | Fixed by renewal every four minutes (§5.8). | | R5-1: platform-minted hostnames cannot classify | Fixed for the reported socket-backed instance case by execution-owner inheritance (§5.1). Two new conflicts in that rule follow below. | | R5-2: arming rejects isolated unit-backed routes | Fixed by separating execution backing from exec layout (§6.2). | | R5-3: home edge lacks the probe path | Fixed by signing the watcher’s probe path, including bucket mode (§5.8). |

Reviewed spec 3829dada against locally available amadan origin/main at aaa6a949. The implementation files cited below match that revision. No files changed.

1. P1 — Execution-owner inheritance ignores a platform row’s own doc-engine grant (§5.1).

Start with a unit-backed instance whose release does not declare doc_engine. Its plain platform-minted hostname copies that instance’s backend. Grant doc-engine to the minted hostname, then upgrade the edge.

The source instance classifies public. The new rule says the minted row has no mark of its own and is internal exactly when its owner is. Consequently, the granted hostname remains public, violating G1 and the preceding requirement that a grant sets 1 regardless of the manifest.

This grant is reachable through the existing CLI: grantRail refuses Platform && Canary, but permits a plain platform row with instance kind and unit backing (cli.go:1432). The grant updates only the named row (registry.go:1640). Minting copies the source’s kind, backing and socket, so that row satisfies the CLI’s checks (reconcile.go:881).

Suggested fix: Define how grants on minted rows affect the execution owner. Aggregate existing grants into the owner’s internal classification and admission barrier, and make subsequent grant/revoke operations use that same ownership rule. An inherited public classification must never override an existing doc-engine grant.

1. P2 — The new execution-owner requirement refuses ordinary static platform domains (§5.1).

Start with a static app and its automatically minted platform hostname. Upgrade using the new platform-row rule. The required non-platform instance owner does not exist: the source is static. The specified missing-owner outcome is NULL and refusal, so the platform hostname stops serving indefinitely. Static canary hostnames have the same problem.

These are supported route shapes. firstReadyUpstream explicitly selects static sources with a channel (reconcile.go:829); mintedRoute preserves their static kind and channel (reconcile.go:881). Canary minting specifically creates static rows on their own selected channel (reconcile.go:368). The edge serves these through its static handler (edge.go:789).

The earlier “static and service are 0 by construction” rule conflicts with this new unconditional treatment of platform rows.

Suggested fix: Scope execution-owner inheritance and missing-owner refusal to platform-minted instance rows. Preserve the explicit classification for static and service rows, including static canaries whose channel differs from their source.

Overall verdict: reject. The new inheritance rule can leave a granted hostname public and can disable supported static platform domains.