Findings on the Meet spec, revision 4

GPT-6 via codex exec, read-only, round 4, reviewing commit 79787b8 against the three earlier findings files. Verbatim.

Reviewed revision 4 at 79787b82e2ee675fabd2e144af0e03b06ff0cc97. No files modified. “Closed” means the design survives the reported failure; it does not mean implementation has passed its gates.

Eight R3 findings are closed. Two remain half-closed. The remaining blocking defects concern recovery in slice 2.

| R3 finding | Status | Assessment | |---|---|---| | R3-1 waiting-room disclosure | Closed | §4.5 branches resume by admission. Waiting and unjoined peers receive their own state, without the roster or signalling replay. | | R3-2 originating-link revocation | Closed | pending_joins.link_id identifies the original link, and §3.2 revalidates it atomically with grant creation. Replacing A with B cannot authorize continuation through A. The claimed HTTP outcome remains inconsistent: R4-4. | | R3-3 admission after expiry | Closed | §2.5 checks the target’s current entry authority under the admission lock, including tick-driven promotion. The interval before the next tick no longer permits admission on an expired grant. | | R3-4 endpoint authorization | Closed | Admitted continuation now authorizes signalling, resume and /ice; member-loss checks also run on requests. The original two-hour interruption is answered. Other table inconsistencies remain advisory: R4-3. | | R3-5 member reserve | Closed as a disclosure correction | §3.2 withdraws the reserve and explicitly concedes targeted address exhaustion, shared-budget denial of service and attacker-triggered enumeration. It does not claim those failures are fixed. | | R3-6 member continuation | Closed | Members also get pending rows. The most-recent-row rule supplies destination selection and supports another-browser completion. | | R3-7 downstream signalling loss | Half-closed | Replay answers loss within the retained history. Recovery beyond that history depends on an incomplete reset protocol: R4-1. | | R3-8 premature renewal completion | Closed | §5.3 requires the completed exchange and a succeeded selected pair carrying the new local ICE generation. Merely entering connected cannot satisfy that predicate. usernameFragment exists in the W3C candidate statistics contract and is populated from the candidate in libwebrtc’s collector. | | R3-9 replacement loop | Half-closed | Receiving replaced is now terminal. Losing that notice still allows automatic takeover: R4-2. | | R3-10 stale explanatory claims | Closed | §7.1 refers to the complete sign-in contract; §4.4 admits legitimate 429 responses and retains retries. |

The unresolved residues from R3’s two tables, checked individually:

| Earlier residue | Status now | Assessment | |---|---|---| | R2-2 mail budget | Closed as a disclosure correction | Shared exhaustion and enumeration are expressly conceded. | | R2-3 expiry authority | Closed | Admitted participation reaches all three continuation endpoints. | | R2-4 resume/restart, previously worse | Half-closed | Waiting-room disclosure and missed departures are answered; replacement recovery remains defective. R4-2. | | R2-5 delivery | Half-closed | Retained messages replay; a gap still lacks reliable coordinated recovery. R4-1. | | R2-9 renewal completion | Closed | Completion is tied to replacement connectivity and the intended ICE generation. | | R1-5 live authorization | Closed | Admission checks current entry authority; privileged requests recheck membership; the tick covers quiet connections. Instance-owned grants remain authority under doctrine §5.2. | | R1-7 continuation | Closed | Outsider authentication, originating-link binding and member destinations are supplied. R4-4 concerns the response claim, not unauthorized grant creation. | | R1-8 mail abuse | Closed as a disclosure correction | Link-gated outsider mail is bounded; the inherited member-address attack is explicitly retained. | | R1-9 reconnect | Half-closed | Admission preservation, reconciliation and restart handling survive; lost replacement notices do not. R4-2. | | R1-10 negotiation | Half-closed | Perfect negotiation and renewal completion survive; coordinated recovery after signalling loss remains incomplete. R4-1. |

R4-1 — P2 — §§4.3–4.6: Gap recovery depends on a reset message the protocol cannot reliably deliver.

reset appears only in the recovery prose. It has no row in the type-validated message table, and the sequencing and replay contracts expressly cover only offer, answer and candidate. Thus slice 2 cannot implement the specified gap recovery solely from the declared protocol. Message table, replay contract, reset procedure.

Adding the missing type alone does not fix delivery. A receives gap, closes its connection and posts reset to B. The POST succeeds, but B’s stream drops before delivering it. B resumes with the same roster; its old connection remains, and reset is absent from replay. The recovery mechanism has reproduced R3-7’s failure with a control message.

Nor does reset establish a shared connection generation or retire old queued messages. A delayed or duplicated reset can close a newly negotiated connection; an old offer or answer can arrive after one side has rebuilt.

Correction: Define reset as a complete protocol operation: admitted sender and same-room admitted target, reliable delivery, idempotency, a shared pair generation, and explicit retirement of old queues, replay entries and receive state. Both browsers must converge on the same generation before treating recovery as complete. Add slice-2 tests for lost reset delivery after 2xx, duplicate reset, simultaneous reset and delayed pre-reset signalling. Include reset, gap and state in §4.3’s complete message contract.

R4-2 — P2 — §§4.2, 4.5: Losing the terminal replacement notice still permits automatic takeover.

Tab A’s stream fails. Before A reconnects, tab B opens a fresh stream on the same session and replaces A’s participation. A cannot receive lost {reason:"replaced"} over its failed stream.

Under the fresh-participation interpretation, A’s resume now gets an unknown-peer 404. §4.5 directs that browser to open a fresh stream automatically, which replaces B without a person clicking anything. If replacement instead preserves the peer ID, the design supplies no stream-ownership generation that prevents A’s resume from attaching to B’s participation. Calling the delivered notice terminal does not distinguish these cases. Replacement, terminal handling and automatic 404 recovery.

Correction: Make displacement discoverable on resume even when its SSE notice was lost. For example, distinguish a stale tab from process restart using a server boot identifier and stream-ownership generation; refuse automatic fresh entry when another participation already owns this session’s room. Specify whether replacement creates a new peer, and its departure/admission notifications. Test A disconnected → B replaces A → A reconnects, with the replaced event deliberately undelivered.

R4-3 — P3 — §§2.5, 3.3, 3.5, 4.3: The “one rule per endpoint” table still disagrees with its handlers.

Three discrepancies remain:

• §2.5 requires admission for every signal type other than join and admit; §4.3 permits leave from any peer. A waiting guest’s explicit leave is therefore rejected under the table.
• §2.5’s admit row omits the sender’s admitted requirement, which §4.3 supplies. Its removal row similarly names only current membership, while §3.5 requires an admitted member participation.
• §2.5 permits the holding page through standing or live participation; §3.3 says that page requires standing.

These do not recreate R3-4’s admitted-guest signalling failure, but the promised single authorization contract still requires implementer reconciliation. Endpoint table, holding page, removal, message permissions.

Correction: Give leave its own participation-only row, put admitted-member requirements explicitly on admission and removal, and make §3.3 defer to the chosen page-access rule.

R4-4 — P3 — §§3.2, 13: Revoked continuation cannot produce the uniformly claimed 404.

§3.2 says replacing the originating link during sign-in “still 404s,” then directs a failed continuation recheck to / or /welcome. For an outsider with only that pending row, the earlier Authorize check fails instead; the reused rastrillo admission handler returns 403. §13 nevertheless requires “404, no grant” for A replaced by B between mail and click. Continuation branches, prescribed test, inherited admission handler.

The original security failure is closed: none of these branches mints a grant through revoked A. The response claim and gate are wrong.

Correction: Specify outcomes separately for authentication refusal and continuation recheck failure, then make §13 assert those outcomes and no grant. If 404 is required at both points, explicitly include the necessary auth-handler change.

The checked reuse sources support the remaining claims about Docs’ sign-in and stream timings, Sheets’ hub and link isolation, Calendar’s sealing and feed mounting, Slides’ agent surface, and the scaffold. The relay list, credential shape and three-hour mint match relay §2 at dcf0cad. The scriptless floor survives. Slice ordering has no new later-slice dependency; slice 2 needs the recovery corrections above before its gates are sufficient.

Verification limits remain for rastrillo/rastrillo discussion 17, oficina/suite discussion 5 and the claimed live relay deployment. The supplied discussion dumps do not establish those claims. This is not evidence of false attribution.

Verdict: request changes.