Findings on the Meet spec, revision 2

GPT-6 via codex exec, read-only, round 2, reviewing commit 3a1fa42 against CODEX-FINDINGS-MEET.md. Verbatim.

Reviewed revision 2 at 3a1fa428536b647c719cc46435a2769116ae00cb. No files modified.

Round-1 dispositions below assess the design, not implemented behavior. §14’s “Tested” wording is premature: this checkout still contains the scaffold.

| Finding | Status | Assessment | |---|---|---| | R1-1 | Closed | §4.3 restricts call-content recipients and separates waiting-peer departures. | | R1-2 | Closed | Session-and-room binding, local target lookup and server-built envelopes answer the impersonation and cross-room failures. | | R1-3 | Closed | Every admission transition checks capacity under the hub lock. | | R1-4 | Half-closed | Payloads and joined peers are bounded; peers registered before join escape the room limit. See R2-8. | | R1-5 | Half-closed | Membership transitions and the P2P enforcement limit are explicit. Admitted guests’ expiry now contradicts request authorization. See R2-3. | | R1-6 | Closed | §8.1 requires current operator membership on every API request. The referenced doctrine supplies the stale-roster rule. | | R1-7 | Half-closed | The cookie supplies a concrete continuation, but the inherited callback still rejects outsiders. Ordinary member continuation also misroutes. See R2-1 and R2-7. | | R1-8 | Half-closed | A live link now gates outsider mail. The shared-budget denial of service remains, and the uniform-response reuse claim is false. See R2-2. | | R1-9 | Half-closed | Admission and capacity survive quiet renewal. Lost control events and restart still lack safe recovery. See R2-4. | | R1-10 | Half-closed | Perfect negotiation fixes permanent offerer ordering. Signalling delivery and renewal completion remain unspecified. See R2-5 and R2-9. | | R1-11 | Closed | Console order, secure TURN schemes and supported deployment shapes now match relay §2. | | R1-12 | Closed | Meet, TURN and the future SFU have distinct privacy claims. | | R1-13 | Closed | The design now prohibits sensitive logging and specifies WAL and captured-log checks. Their slice assignment still needs correction under R2-10. | | R1-14 | Half-closed | The LAN guarantee and failure diagnosis are corrected, but bilateral host-candidate reachability remains an incorrect necessity. See R2-12. | | R1-15 | Closed | Person/session creation is explicit, attendance retention is withdrawn, and admission audit is separated from authority. | | R1-16 | Closed | Both URLs have useful scriptless output; the repository amendment lands with the exception. | | R1-17 | Closed | The original replace-link and end-meeting actions now have confirmation pages. The newly introduced removal action creates a separate defect: R2-11. | | R1-18 | Closed | Both minting operations return their new token once; replacement is atomic. | | R1-19 | Half-closed | Isolated contexts and received-media assertions replace the weak gates. Stop-sharing and slice assignments remain defective. See R2-10. | | R1-20 | Closed | Build stamping is explicit slice-1 work, using Meet’s module path. | | R1-21 | Closed | The sealer and authentication consumer counts now match the supplied sources. |

R2-1 — P2 — §§3.2, 7.1: The adopted callback still prevents outsider sign-in.

§7.1 names exactly two changes to Docs: the pending-cookie exception before Begin, and SignedInPath=/continue. Docs also configures Authorize: list.allows. Rastrillo checks that callback before creating a session. An outsider therefore receives the email but gets a 403 when following it; /continue never runs. Moreover, Authorize receives an address, not the request, so checking the browser cookie there is not an available drop-in correction. Meet adoption, Docs configuration, Rastrillo admission.

Correction: Specify the callback authorization change explicitly. Keep the live-link gate at mail issuance, allow the resulting verified outsider identity to obtain a session, and authorize meeting access separately. Test the complete emailed-link round trip, including opening it without the pending cookie.

R2-2 — P2 — §3.2: The added mail budget does not protect members, and Docs does not normalize every refusal.

Twenty outsider attempts through one live link can still consume the inherited twenty-attempt budget keyed by the edge’s address. The next member request uses that same key and fails. A separate twenty-mails-per-link limit cannot make members “unaffected”; counting successful mails also does not bound failed attempts that consume the inherited budget. Meet budget, limiter ordering.

The accompanying “same page … as in Docs” claim is also wrong. Allowed requests reach Begin, which redirects rate and syntax failures to ?err=rate and ?err=address; rejected allowlist requests receive ?sent=1. Under an exhausted shared budget, this also exposes membership through different redirect destinations. Docs forwarding, framework responses.

Correction: Define enforceable separation between guest-link traffic and member sign-in capacity, or implement a verified client-address strategy. Explicitly implement the promised response normalization. Test outsider exhaustion followed by member sign-in through the same proxy address.

R2-3 — P2 — §§2.3, 4.1, 5.2: “Expiry gates entry, not presence” has no usable authorization mechanism.

Standing defines guest only while the grant remains unexpired. Yet an admitted guest must stay after expiry. All /m/ requests require standing, including signalling, stream resume and /ice. Consequently, a guest admitted before the two-hour deadline loses chat and renegotiation immediately afterward, cannot renew the five-minute stream, and cannot perform the scheduled relay renewal at two-and-a-half hours. Preserving the hub’s admission boolean does not satisfy those request gates. Standing and expiry, stream gate, ICE gate.

Correction: Separate current membership, permission to enter, and permission to continue an admitted participation. Define the latter’s session-and-peer binding, allowed endpoints, resume lifetime and terminal transitions. Test a guest across grant expiry, stream renewal and credential renewal without granting fresh entry after expiry.

R2-4 — P1 — §4.5: Resume can permanently miss removal, and restart does not restore the waiting-room boundary.

A buffer-overflowed member can miss another peer’s gone. Resume supplies neither replay nor a current roster, so that honest browser never receives the instruction on which §2.3 relies to close the removed peer’s media connection. This is a failure of the prescribed client protocol, beyond the acknowledged inability to control malicious P2P endpoints. Removal enforcement, resume.

Restart has the same problem: guests return to waiting, but the protocol never closes their surviving browser connections before fresh admission. Members renegotiate on new peer events; that does not dispose of old connections to guests who receive no new admission event. Restart.

Correction: Reconcile authoritative participation state on resume, closing connections absent from the current roster. After unknown-peer/restart recovery, close old connections before joining under a new identity. Distinguish resumable transport failures from terminal removal, expiry and meeting end. Test a dropped gone and restart with an admitted guest.

R2-5 — P2 — §§4.1, 4.4, 5.1: Perfect negotiation does not make independent POSTs ordered or reliable.

The browser can send an offer and its candidates through independent POSTs. Nothing specifies ordering, acknowledgement, retry or duplicate handling. A candidate can arrive before its offer; an offer can receive 429 and disappear permanently. Perfect negotiation addresses offer collisions, not these transport failures. Applying a candidate without a remote description rejects with InvalidStateError. POST transport, message dropping, W3C candidate processing.

Correction: Define bounded, ordered signalling delivery and recovery from failed POSTs, with duplicate handling or explicit negotiation reset. Account for candidates belonging to ignored offers and old ICE generations. Test reordered delivery, a refused offer and simultaneous renegotiation.

R2-6 — P2 — §§2.3, 4.3: Members cannot discover an existing waiting queue.

A guest joins before any member and its knock has no recipient. When a member joins later, the table sends that member a roster but never the existing waiting queue. No roster payload is defined to include it, and ordinary admitted-peer rosters cannot expose waiting guests to everyone. The guest can remain invisible indefinitely.

Promotion is also incomplete: a waiting guest becoming a member “continues,” but remains unadmitted; admit requires an admitted member, and join is idempotent for an existing peer. No cap-checked promotion transition is specified. Standing transitions, message table.

Correction: Define a members-only queue snapshot on member admission, promotion and resume. Specify waiting-to-member behavior under the cap and how standing changes reach clients. Test guest-first arrival and promotion when no admitted member exists.

R2-7 — P2 — §3.2: Ordinary member sign-in lands on the not-a-member page.

SignedInPath applies to every successful sign-in. /continue sends anyone without a valid pending cookie to the not-a-member page, including an allowlisted member who opened /signin directly. The cited page “below” is never actually defined; later sections only list it. Continuation, fallback.

Correction: Resolve the authenticated person before choosing the fallback: members without a pending join reach the meeting list; non-members receive the meeting-link instruction. Specify that page’s route and scriptless navigation. Test both identities with absent and expired cookies.

R2-8 — P2 — §§4.2–4.4: Opening a stream bypasses the waiting-room resource limit.

The server allocates a peer and subscriber when the stream opens. The eight-waiting limit applies only to a later join. Any number of distinct signed-in guests with grants can open streams without joining; the one-peer-per-session and four-streams-per-person limits do not cap their aggregate room cost. No pre-join timeout or total room subscriber limit closes this state. Registration, limits.

Correction: Bound all registered peers and subscribers before allocating them, including unjoined peers and retained resume state. Give pre-join registrations an expiry. Test opening streams without posting join.

R2-9 — P2 — §5.3: A successful credential fetch is treated as successful renewal.

The retry policy covers failed /ice fetches only. If fetching succeeds but the subsequent offer is lost, negotiation stalls or the new ICE path fails, the existing relay allocation still expires at its old deadline. The next scheduled renewal is another two-and-a-half hours away. Calling restartIce() requests a new exchange; it does not establish that exchange’s success. Renewal policy, W3C restart semantics.

Correction: Track renewal completion per connection separately from credential issuance. Retain the old deadline until replacement connectivity succeeds, and define timeout, retry and expired-path behavior. Test successful fetch followed by failed negotiation and failed connectivity. The three-hour credential lifetime and thirty-minute renewal margin themselves match relay §2.

R2-10 — P2 — §§5.4, 12–13: The stop-sharing gate expects the wrong browser behavior, and earlier slices depend on chat.

§5.4 removes the sender’s track and renegotiates. §13 expects the receiver’s track to end. Removing a remote sending direction normally mutes the receiver track; it does not necessarily end it. A correct implementation can therefore fail the stated gate. Media operation, browser assertion, W3C remote-track removal.

The §0.1 captured-log test must exercise accepted chat, but §13 assigns it to slices 1 and 2 while chat arrives in slice 4. The slice-2 “no chat while waiting” assertion likewise cannot establish recipient isolation before accepted chat exists. Slice assignments, test assignments.

Correction: Assert that screen media stops and its tile is removed while camera media continues; require an ended track only if the design explicitly stops the transceiver. Split privacy tests by implemented message type and assign accepted-chat logging and isolation checks to slice 4.

R2-11 — P2 — §§3.4, 4.3, 9: The new participant-removal action lacks its required confirmation page.

Revision 2 adds remove, which disconnects another participant, through the signalling endpoint. It specifies no confirmation URL or ui/confirm-form. §9 promises only the two meeting-management confirmation pages. This recreates the repository-contract defect fixed for ending meetings and replacing links. Removal, mandatory convention.

Correction: Add a server-rendered removal confirmation page and guarded mutation, with current actor and target authorization checked at execution.

R2-12 — P2 — §§0.3, 5.5: The revised network floor still states a false necessary condition.

The requirement that each browser directly reach the other’s host candidates excludes a valid ICE case: a NATed browser can initiate checks toward a publicly reachable peer; those checks discover a peer-reflexive address and establish the return path. Both advertised host addresses need not be mutually reachable. This follows from ICE’s peer-reflexive discovery and triggered-check procedures. Meet floor, RFC 8445 §7.3.1.3–4.

Correction: Describe host-only initial gathering, with connectivity depending on ICE finding a working direct path and potentially learning peer-reflexive candidates. Keep the practical LAN guidance; remove the bilateral-host-reachability requirement.

Verification limits: the supplied discussion dumps do not include rastrillo/rastrillo discussion 17 or oficina/suite discussion 5, so those attributions remain unverified. The roadmap was readable at the cited 8291cb2; the local platform main lacked that path. That checkout difference is not evidence of a false merge claim.

Verdict: request changes.