| 1 | | Previous finding | Round 7 assessment | |
| 2 | |---|---| |
| 3 | | R1-1: flat tenant borrows a nested socket | Fixed by the peer-cgroup check (§5.4). | |
| 4 | | R1-2: aliases and path routes remain public | Fixed by checking the final upstream (§5.1). | |
| 5 | | R1-3: new box starts public | Fixed by classification before serving and refusal of `NULL` (§5.1). | |
| 6 | | R1-4: revoked grants return after restart | Fixed for retained local state; fresh-box replay remains explicitly accepted (§5.3). | |
| 7 | | R1-5: door exceptions fail across routing | Resolved by removing the owner exception and defining the identity transition (§5.4). | |
| 8 | | R1-6: socket lifecycle conflicts | Fixed by instance-level listener ownership (§5.4). | |
| 9 | | R1-7: transport and body limits | Resolved at spec level (§5.5). | |
| 10 | | R2-1: stamp follows serving | Set-before barrier fixed (§5.1). A separate clear-after failure follows below. | |
| 11 | | R2-2: upgrade serves unclassified engines | Fixed by classification before listeners and refusal of `NULL` (§5.1). | |
| 12 | | R2-3: flat callers borrow door credentials | Fixed by the door’s UID restriction (§§5.4, 6.2). | |
| 13 | | R2-4: deployment verification fails | Fixed by watch tickets (§5.8). | |
| 14 | | R2-5: port-80 refusal cannot work remotely | Resolved by the narrowed contract (§5.1). | |
| 15 | | R3-1: previously admitted requests cross the mark | Fixed: acknowledgement waits for cancellation and completion (§5.1). | |
| 16 | | R3-2: flat tenant injects into a nested caller | Fixed by excluding unisolated execution while armed; historical compromise remains explicitly excluded (§6.2). | |
| 17 | | R3-3: grant-only routes lack watch tickets | Fixed: every deploy target receives a ticket (§5.8). | |
| 18 | | R4-1: foreign instances and workers remain unisolated | Fixed by the arming prerequisite and launch refusals (§6.2). | |
| 19 | | R4-2: path routing widens an engine grant | Fixed by exact-host engine dispatch (§5.4). | |
| 20 | | R4-3: watch tickets expire mid-watch | Fixed by renewal every four minutes (§5.8). | |
| 21 | | R5-1: platform-minted hostnames cannot classify | Socket-backed case fixed (§5.1); the TCP backend case remains uncovered, detailed below. | |
| 22 | | R5-2: arming rejects isolated unit-backed routes | Fixed by distinguishing backing from exec layout (§6.2). | |
| 23 | | R5-3: home edge lacks the probe path | Fixed by signing the watcher’s probe path (§5.8). | |
| 24 | | R6-1: minted row’s own grant is ignored | Fixed by aggregating grants across the execution-owner group (§5.1). | |
| 25 | | R6-2: static platform domains are refused | Fixed by restricting inheritance to minted instance rows (§5.1). | |
| 26 | |
| 27 | Reviewed spec `d59eec0c` against locally available amadan `origin/main` at `aaa6a949`. The implementation files cited below match that revision. No files changed. |
| 28 | |
| 29 | 1. **P1 — The clear-after sequence can reopen a still-serving engine during a generation rollout (§§5.1, 6.3).** |
| 30 | |
| 31 | Run an awake nested instance with generation rollouts enabled. Its serving release declares `doc_engine`, so its mark is `1`, but it holds no `doc-engine` grant. Deploy a non-declaring release. |
| 32 | |
| 33 | Section 5.1 clears the mark after adoption repoints, restarts and records the version. On this execution path, however, the restart callback only schedules the replacement. Adoption can finish while the declaring generation still serves. Clearing the mark then exposes that engine publicly; if the successor fails, the exposure can persist. |
| 34 | |
| 35 | The adoption callback selects `Manager.Adopted` when rollout is armed ([agent.go:4309](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/host/agent.go:4309)). That method nudges the scheduler and returns success without waiting for a replacement ([manager.go:483](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/rollout/manager.go:483)). The restart wrapper returns `nil` ([agent.go:4057](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/host/agent.go:4057)), allowing adoption to record the new version ([adopt.go:2051](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/release/adopt.go:2051)). Requests still select the actual serving generation ([genproxy.go:255](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/edge/genproxy.go:255)), which changes separately during the successful swap ([swap.go:638](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/activator/swap.go:638)). |
| 36 | |
| 37 | **Suggested fix:** Assign clearing to confirmed activation of the non-declaring serving generation, with no remaining group grant. Neither the live symlink, recorded version nor successful scheduling callback proves that activation. Keep `1` through queued, failed and abandoned replacements. |
| 38 | |
| 39 | 2. **P2 — Execution-owner matching omits supported TCP-backed instance rows (§5.1).** |
| 40 | |
| 41 | Start with a public, classified instance using `Addr: 127.0.0.1:9000`, an empty `Socket`, and its automatically minted platform hostname. Upgrade the edge. |
| 42 | |
| 43 | The new ownership rule identifies the source through `Socket` or fleet `Region`; neither identifies this TCP backend. Applying missing-owner refusal disables the platform hostname. Treating two empty socket values as a match instead makes ownership ambiguous when the app has multiple TCP instances. |
| 44 | |
| 45 | This is an established route shape. `carlos add` explicitly supports TCP-only unit-backed instances without assigning a socket ([cli.go:172](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/cli.go:172)). Domain reconciliation selects sources carrying `Addr` ([reconcile.go:835](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/domains/reconcile.go:835)) and copies that address into the minted row ([reconcile.go:881](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/domains/reconcile.go:881)). An existing reconciliation test covers exactly this instance-and-platform-domain shape ([reconcile_test.go:113](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/domains/reconcile_test.go:113)). |
| 46 | |
| 47 | **Suggested fix:** Include TCP backend identity in execution-owner resolution, or record the source route explicitly. Empty socket values must not establish ownership; unresolved or ambiguous ownership should remain fail-closed. |
| 48 | |
| 49 | **Overall verdict: reject.** The generation rollout path can reopen a still-running engine. TCP-backed platform domains also need an ownership rule. |
amadan