| 1 | # Findings on the Meet spec, revision 3 |
| 2 | |
| 3 | GPT-6 via `codex exec`, read-only, round 3, reviewing commit 1bd7161 against `CODEX-FINDINGS-MEET.md` and `CODEX-FINDINGS-MEET-R2.md`. Verbatim. |
| 4 | |
| 5 | Reviewed revision 3 at `1bd71614ac654e4fe5103d33516b6191fca42e27`. No files modified. “Closed” below means the design answers the reported failure, not that implementation has passed its tests. |
| 6 | |
| 7 | | Round-2 finding | Status | Assessment | |
| 8 | |---|---|---| |
| 9 | | R2-1 callback | Closed | §3.2 explicitly changes `Authorize` and supplies database-backed authorization for an outsider opening the email in another browser. | |
| 10 | | R2-2 mail budget | Half-closed | Guest-address traffic is bounded, but unauthenticated traffic claiming a member address bypasses both budgets. R3-5. | |
| 11 | | R2-3 expiry authority | Half-closed | Participation supplies the missing authority, but endpoint contracts still require standing. R3-4. | |
| 12 | | R2-4 resume/restart | Worse | Reconciliation answers missed `gone`, and restart closes old connections. Unconditional resume rosters introduce a waiting-room disclosure. R3-1. | |
| 13 | | R2-5 delivery | Half-closed | Ordered POSTs and duplicate suppression help upstream delivery. A successful POST followed by downstream loss still loses negotiation permanently. R3-7. | |
| 14 | | R2-6 queue/promotion | Closed | Members receive the waiting snapshot; promotion attempts admission under the cap, with an explicit retry when full. | |
| 15 | | R2-7 ordinary continuation | Closed | Direct member sign-in reaches `/`; outsiders reach the specified `/welcome`. Meeting-link continuation for members has a separate regression. R3-6. | |
| 16 | | R2-8 unjoined streams | Closed | The sixteen-participation limit applies before allocation and includes retained state; unjoined registrations expire. | |
| 17 | | R2-9 renewal completion | Half-closed | Completion is now tracked, but the chosen ICE state can indicate the start of a restart, before replacement connectivity succeeds. R3-8. | |
| 18 | | R2-10 sharing/tests | Closed | Stopping and negotiating rejection of the screen transceiver supports the remote-track ending assertion. Accepted-chat tests now belong to slice 4. | |
| 19 | | R2-11 removal confirmation | Closed | §3.5 supplies the required confirmation URL, component and guarded POST. | |
| 20 | | R2-12 network floor | Closed | Host-only gathering and possible peer-reflexive discovery replace the false bilateral-reachability condition. | |
| 21 | |
| 22 | | Half-closed round-1 finding | Status now | Assessment | |
| 23 | |---|---|---| |
| 24 | | R1-4 memory bounds | Closed | All room registrations are bounded, including pre-join and resume state. | |
| 25 | | R1-5 live authorization | Half-closed | Entry and continued participation are separated, but admission at expiry and endpoint authorization remain inconsistent. R3-3, R3-4. | |
| 26 | | R1-7 continuation | Half-closed | Outsider sessions work; originating-link revocation and member meeting continuation do not. R3-2, R3-6. | |
| 27 | | R1-8 mail abuse | Half-closed | The added budgets do not establish the claimed member reserve. R3-5. | |
| 28 | | R1-9 reconnect | Half-closed | Missed departures and restart are answered; waiting resume and replacement-stream ownership remain defective. R3-1, R3-9. | |
| 29 | | R1-10 negotiation | Half-closed | Collision handling is sound in principle; delivery loss and renewal completion remain. R3-7, R3-8. | |
| 30 | | R1-14 network floor | Closed | The revised floor survives the earlier counterexamples. | |
| 31 | | R1-19 browser gates | Closed | The previous driver, identity-isolation, stop-sharing and slice-assignment defects are answered. Additional gates are needed for the failures below. | |
| 32 | |
| 33 | **R3-1 — P1 — §§4.3, 4.5: A waiting guest receives the call roster by resuming.** |
| 34 | |
| 35 | A waiting guest opens a stream, posts `join`, disconnects, and resumes within thirty seconds. §4.5 unconditionally sends a fresh roster after `hello`. §4.3 defines that roster as every admitted peer’s ID, name and kind. This contradicts the waiting guest’s permitted recipients and reopens R1-1’s isolation failure. It requires neither admission nor a forged peer. [Roster definition](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:470), [resume procedure](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:518). |
| 36 | |
| 37 | **Correction:** Branch resume output by admission. An admitted participant receives the authoritative roster; an unjoined or waiting participant receives only its own state. Test a waiting guest’s deliberate disconnect/resume and five-minute renewal. |
| 38 | |
| 39 | **R3-2 — P1 — §§2.1, 3.2: Continuation cannot identify the revoked link that authorized sign-in.** |
| 40 | |
| 41 | `pending_guests` records `meeting_id`, but no link ID or token hash. `/continue` ignores the cookie and promises to reject a link revoked during sign-in. After link A is replaced by B, the meeting remains live and has a live link. The pending row cannot distinguish an attempt authorized by revoked A from one authorized by B. Checking the meeting or its current links cannot enforce the promised revocation. [Pending schema](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:160), [continuation](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:313). |
| 42 | |
| 43 | **Correction:** Bind each pending continuation to its originating `meeting_links` row. Revalidate that specific link, the meeting and their deadlines when consuming the pending row, atomically with grant creation. Test A → pending sign-in → replace with B → click A’s emailed sign-in link. |
| 44 | |
| 45 | **R3-3 — P1 — §§2.4, 4.3: Admission can convert an expired waiting grant into indefinite participation.** |
| 46 | |
| 47 | Waiting-grant expiry is processed only on the fifteen-second tick. The `admit` operation checks that its target is waiting and that capacity remains; it does not check the target’s current grant. An admission arriving after expiry but before the tick therefore marks the guest admitted. At the next tick, the admitted-guest expiry rule does nothing, preserving the participation. This defeats the distinction between an already-admitted guest continuing and an expired waiting guest entering. [Expiry transitions](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:240), [`admit` checks](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:460). |
| 48 | |
| 49 | **Correction:** At every admission transition, check the target’s current entry authority as well as capacity. Apply the transition under the same synchronization as expiry. Test admission immediately after grant expiry without first running the tick. |
| 50 | |
| 51 | **R3-4 — P2 — §§2.4, 4.1, 4.3, 5.2: The participation authority still conflicts with the endpoint contracts.** |
| 52 | |
| 53 | §2.4 authorizes signalling, resume and `/ice` through participation after grant expiry. §4.1 still puts the stream under a standing check; §4.3 still validates the sender’s standing; §5.2 expressly puts `/ice` under standing. An implementation following those endpoint sections reproduces R2-3: the admitted guest cannot renew its stream or relay credentials after two hours. [Participation authority](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:214), [stream](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:409), [signalling](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:491), [ICE](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:592). |
| 54 | |
| 55 | **Correction:** Give each endpoint one authorization contract. Distinguish fresh entry, admitted continuation and member-only operations. Require current membership for privileged operations and apply member-loss transitions on requests as well as ticks. Keep the admitted guest’s continuation authority independent of grant expiry. |
| 56 | |
| 57 | **R3-5 — P2 — §3.2: The outsider budgets do not reserve ten attempts for members.** |
| 58 | |
| 59 | The gate classifies the submitted address, not the unauthenticated requester. An attacker submits one known allowlisted address twenty times without a meeting link. Every request bypasses both outsider budgets and reaches `Begin`. Its IP limiter runs before its address limiter, so even attempts refused after the first five consume the shared IP allowance. The next real member cannot sign in. The same mechanism permits targeted address-budget exhaustion; enumeration therefore is not confined to the stated globally exhausted window. [Budget claim](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:331), [limiter ordering](/home/paulca/go/pkg/mod/github.com/keymaildev/signin@v0.1.1/flow.go:117). |
| 60 | |
| 61 | **Correction:** Do not claim authenticated member capacity based on an unverified address. Either explicitly accept this larger residual failure or provide a trusted client-address/separate admission mechanism that survives it. Add a test exhausting the shared budget using repeated submissions of one member address. |
| 62 | |
| 63 | **R3-6 — P2 — §3.2: A signed-out member loses the meeting continuation.** |
| 64 | |
| 65 | A member follows `/j/A` while signed out and receives the pending cookie. `POST /signin` writes `pending_guests` only for an outsider address. After authentication, `/continue` deliberately ignores the cookie, finds no row and redirects the member to `/`. The original member meeting-link journey no longer reaches its holding screen. [Row creation](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:291), [continuation branches](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:309). |
| 66 | |
| 67 | **Correction:** Record meeting continuations for members as well as outsiders, while keeping outsider session authorization a separate purpose. Specify selection when an address has multiple pending meetings. Test signed-out member → meeting link → emailed sign-in → intended holding screen, including another-browser completion. |
| 68 | |
| 69 | **R3-7 — P2 — §§4.5, 4.6: POST acknowledgement does not acknowledge signalling delivery.** |
| 70 | |
| 71 | An offer POST receives 2xx, then the recipient’s SSE connection fails before delivering the offer. The sender advances its queue and never retries that offer. Resume returns the same peer roster, so reconciliation leaves the existing connection untouched. Neither roster reconciliation nor dropping duplicate sequence numbers reconstructs the missing offer. A later answer can be lost the same way, leaving negotiation stuck despite successful POSTs. [POST acknowledgement](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:546), [resume reconciliation](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:521). |
| 72 | |
| 73 | **Correction:** Define either bounded receiver acknowledgement/replay or an explicit, coordinated negotiation reset after signalling discontinuity. Specify sequence gaps and pair-generation changes. Test a 2xx offer or answer whose SSE delivery is lost, with both peers still present in the resumed roster. This belongs to slice 2. |
| 74 | |
| 75 | **R3-8 — P2 — §5.3: `connected` after restart can report renewal before the replacement path works.** |
| 76 | |
| 77 | The proposed completion predicate accepts `connected` or `completed` after restart. WebRTC explicitly permits an ICE transport in `completed` to transition to `connected` when restart begins. That transition can occur while the old path still carries traffic and the new negotiation has not succeeded. Meet can therefore discard the old must-succeed-by deadline prematurely and encounter the same hard expiry R2-9 described. [Completion predicate](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:616), [W3C ICE transport states](https://www.w3.org/TR/webrtc/#dom-rtcicetransportstate). |
| 78 | |
| 79 | **Correction:** Tie completion to the intended restart generation, its completed offer/answer exchange and successful replacement connectivity. A state transition caused by starting the restart must not qualify. Keep the old deadline until that proof exists. Test a previously completed connection whose restart begins but whose answer or replacement checks fail. |
| 80 | |
| 81 | **R3-9 — P2 — §§4.2, 4.3, 4.5: A replaced stream is instructed to reclaim ownership indefinitely.** |
| 82 | |
| 83 | Two tabs share one session and open the same room. The second replaces the first; the first receives `lost {reason:"replaced"}` and must resume. There is no stream-generation ownership rule that distinguishes this displaced tab from a legitimate reconnect. If its resume replaces the second stream, that tab receives the same instruction. If replacement instead changes the peer ID, the first tab’s 404 recovery opens another fresh stream and can displace the second again. [Replacement](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:440), [`lost` handling](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:478), [404 recovery](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:534). |
| 84 | |
| 85 | **Correction:** Make replacement terminal for the displaced tab, or define a stream-generation ownership mechanism that prevents it reclaiming the participation automatically. Test two tabs with the same session and verify that one remains connected without repeated replacement. |
| 86 | |
| 87 | **R3-10 — P3 — §§4.4, 7.1: Two explanatory claims remain false.** |
| 88 | |
| 89 | - §7.1 still describes “two changes” to Docs and “the same 303 for every address.” Revision 3 adds the callback, pending rows and budgets, and §3.2 explicitly retains distinguishable redirect destinations. Replace this stale summary with a reference to the complete §3.2 contract. [Adoption summary](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:698). |
| 90 | - §4.4 says one in-flight message per target means 429 occurs only through abuse. Sequential requests can exceed thirty per second; three target queues also run concurrently. Remove the assertion and retain retry handling for legitimate negotiation bursts. [Rate claim](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:500). |
| 91 | |
| 92 | The requested local reuse sources support the revised sealer provenance, session callback shape, Sheets buffer behavior, Calendar feed mounting, Slides principal model and browser-driver correction. The three-hour credential mint and thirty-minute renewal margin match relay §2; the defect is proving renewal completion. The scriptless floor and corrected chat-test slice assignments survive this review. |
| 93 | |
| 94 | Verification limits: the supplied dumps still do not establish `rastrillo/rastrillo` discussion 17 or `oficina/suite` discussion 5. The claimed live relay deployment was not independently verified. The roadmap was read at `8291cb2` because its path is absent from the current platform checkout; relay revision 6 was available at `dcf0cad`. These limits are not findings of false attribution. |
| 95 | |
| 96 | **Verdict: request changes.** |
amadan