chore: remove agent review report
- commit
- 80c61e3be9fb906f6eef8eac1f9379478170cdcd
- author
- brice · · 2026-08-10 17:33 UTC
- parent
- 641fc0a
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email - refs
- tag: v0.2.0
1 file · +0 -94
D .agent-reviews/redteam.md +0 -94
| @@ -1,94 +0,0 @@ | |||
| 1 | - | # Stack 2 route ledger/protocol red-team | |
| 2 | - | ||
| 3 | - | ## Builder decision | |
| 4 | - | ||
| 5 | - | Add Stack 2 as daemon-neutral plumbing on top of the completed presentation branch: | |
| 6 | - | ||
| 7 | - | - model route origins, exact lifecycle/name targets, committed identity, bounded complete snapshots, opaque key/generation navigation actions, and closed failure codes in `internal/ports`; | |
| 8 | - | - bump the protocol version and append an optional exact target section to `Hello` while preserving the version peeker's first field; | |
| 9 | - | - wire explicit local, remote, and discovery origins at `internal/app`/client composition boundaries; | |
| 10 | - | - keep the client ledger private, bounded, lock-protected, and separate from display values and transport capabilities; | |
| 11 | - | - validate exact local targets in the daemon and preserve existing remote-target authority; | |
| 12 | - | - leave JRS/BSK command authority and the atomic global cutover for Stack 3. | |
| 13 | - | ||
| 14 | - | ## Critic pass | |
| 15 | - | ||
| 16 | - | The read-only reviewer worker did not return a retrievable result in this harness. | |
| 17 | - | The builder completed a local high-impact critic pass below and recorded each | |
| 18 | - | objection with its resolution and acceptance check. | |
| 19 | - | ||
| 20 | - | ## Evidence so far | |
| 21 | - | ||
| 22 | - | - PR #188 dependency branch already has strict Hello peeking and remote lifecycle/tab target validation. | |
| 23 | - | - `internal/ports/wire.go` requires `Hello.Version` first; the new exact-target section is appended after the existing remote/policy section. | |
| 24 | - | - Existing daemon route authority remains in `routeWithContext`; exact local validation is an additional lifecycle check before ordinary attach routing. | |
| 25 | - | - Focused ports, client, app, and daemon tests pass after the current incremental changes. | |
| 26 | - | ||
| 27 | - | ## Accepted risks | |
| 28 | - | ||
| 29 | - | - Stack 2 introduces codec/model seams and private transition primitives but does not yet publish snapshots or replace command authority; those remain explicit Stack 3 work. | |
| 30 | - | - The first reviewer-worker attempts did not produce a retrievable result in this harness, so the builder performed the required critic pass locally before final validation. | |
| 31 | - | ||
| 32 | - | ## Builder critic pass and resolutions | |
| 33 | - | ||
| 34 | - | - **Welcome identity mismatch:** a malicious or buggy daemon could return a committed lifecycle/name different from the Welcome metadata. `UnmarshalWelcome` now rejects mismatched session name or ephemeral state. | |
| 35 | - | - **Stale exact target side effects:** exact local validation waits for an existing restore barrier before checking lifecycle identity; it does not create or mutate a session and rejects lifecycle replacement before normal attach. | |
| 36 | - | - **Snapshot leakage:** `RecentRouteEntry` contains only opaque key/generation and display fields. Dialers, requests, resume credentials, and exact targets remain in private `routeRecord` values and are copied out only through navigation lookup. | |
| 37 | - | - **Transactional navigation:** connector failure, stale key/generation, or committed-target mismatch returns before ledger commit; origin is restored from the selected private record rather than connector input. | |
| 38 | - | - **Bounds/strictness:** snapshot entry count, labels, refs, closed enums, bool encodings, truncation, trailing bytes, and protocol-version peeking are covered by tests; focused race tests pass. | |
| 39 | - | ||
| 40 | - | ## Follow-up fixes | |
| 41 | - | ||
| 42 | - | The implementation now commits a successful Welcome into the private ledger before | |
| 43 | - | raw-mode entry, publishes a complete snapshot frame, and accepts/validates that | |
| 44 | - | frame on the daemon attachment. The active route is metadata-only, the private | |
| 45 | - | history cap is 20, origin keys distinguish daemon endpoints, route labels reject | |
| 46 | - | invalid UTF-8/control text, navigation actions carry the snapshot generation, | |
| 47 | - | active selection is a no-op, and failed transitions invoke the prior-route | |
| 48 | - | restore hook before returning failure. | |
| 49 | - | ||
| 50 | - | # Client-owned route-position red-team | |
| 51 | - | ||
| 52 | - | ## Builder decision | |
| 53 | - | ||
| 54 | - | Keep live tab/view authority on each daemon attachment, but remember the last | |
| 55 | - | stable tab ID per exact client route in the process-local route ledger. Add an | |
| 56 | - | optional preferred stable tab to Hello and a daemon-to-client route-position | |
| 57 | - | publication bound to an exact lifecycle/name target. A missing preferred tab is | |
| 58 | - | a hint miss and falls back to the daemon's normal attachment tab; it never | |
| 59 | - | changes session identity or shared session tab state. | |
| 60 | - | ||
| 61 | - | ## Critic pass | |
| 62 | - | ||
| 63 | - | - **Multiple clients:** daemon-global or session-global memory would couple | |
| 64 | - | clients. The remembered cursor stays in each Runner's private route ledger; | |
| 65 | - | the daemon applies it only to the requesting attachment. | |
| 66 | - | - **Stale/out-of-order publications:** a tab ID without session identity could | |
| 67 | - | corrupt the route selected by a concurrent transition. RoutePosition carries | |
| 68 | - | the exact lifecycle/name target, and the ledger applies it only to that route. | |
| 69 | - | - **Handshake ordering:** publishing another server frame before Welcome would | |
| 70 | - | recreate the resume-token failure found during manual testing. Initial route | |
| 71 | - | position is emitted only by post-Welcome rendering; Welcome stays first. | |
| 72 | - | - **Deleted tabs:** remembered positions are hints, not exact picker authority. | |
| 73 | - | The daemon validates stable IDs under target-session ownership and falls back | |
| 74 | - | without rejecting the attachment when the tab no longer exists. | |
| 75 | - | - **Discovery metadata:** RemoteTarget includes a point-in-time live tab and must | |
| 76 | - | not become route memory. Committed route records drop that catalog selector; | |
| 77 | - | PreferredTabID is the independent mutable cursor. | |
| 78 | - | - **Resume and identity authority:** a preferred tab cannot select a session. It | |
| 79 | - | is accepted only for attach/resume and only after resume-token or exact-target | |
| 80 | - | session resolution succeeds. | |
| 81 | - | - **Untrusted IDs:** both Hello and RoutePosition reject empty/oversized/control | |
| 82 | - | stable IDs and trailing or truncated payloads. | |
| 83 | - | - **Publication completeness:** tab selection and repair always invalidate a | |
| 84 | - | render. RoutePosition is serialized with the attachment's post-commit output | |
| 85 | - | transaction and cached per transport incarnation; output rebase forces an | |
| 86 | - | initial publication after attach/resume. | |
| 87 | - | ||
| 88 | - | ## Accepted risks | |
| 89 | - | ||
| 90 | - | - The state is intentionally process-memory only. Restarting the client loses | |
| 91 | - | remembered tabs; restarting a daemon does not make the daemon the memory | |
| 92 | - | owner, and missing/replaced stable IDs safely fall back. | |
| 93 | - | - RoutePosition is an additional small control frame only when the exact target | |
| 94 | - | or active stable tab changes, not on every output diff. | |
| @@ -1,94 +0,0 @@ | |||||
| 1 | - | # Stack 2 route ledger/protocol red-team | |||
| 2 | - | ||||
| 3 | - | ## Builder decision | |||
| 4 | - | ||||
| 5 | - | Add Stack 2 as daemon-neutral plumbing on top of the completed presentation branch: | |||
| 6 | - | ||||
| 7 | - | - model route origins, exact lifecycle/name targets, committed identity, bounded complete snapshots, opaque key/generation navigation actions, and closed failure codes in `internal/ports`; | |||
| 8 | - | - bump the protocol version and append an optional exact target section to `Hello` while preserving the version peeker's first field; | |||
| 9 | - | - wire explicit local, remote, and discovery origins at `internal/app`/client composition boundaries; | |||
| 10 | - | - keep the client ledger private, bounded, lock-protected, and separate from display values and transport capabilities; | |||
| 11 | - | - validate exact local targets in the daemon and preserve existing remote-target authority; | |||
| 12 | - | - leave JRS/BSK command authority and the atomic global cutover for Stack 3. | |||
| 13 | - | ||||
| 14 | - | ## Critic pass | |||
| 15 | - | ||||
| 16 | - | The read-only reviewer worker did not return a retrievable result in this harness. | |||
| 17 | - | The builder completed a local high-impact critic pass below and recorded each | |||
| 18 | - | objection with its resolution and acceptance check. | |||
| 19 | - | ||||
| 20 | - | ## Evidence so far | |||
| 21 | - | ||||
| 22 | - | - PR #188 dependency branch already has strict Hello peeking and remote lifecycle/tab target validation. | |||
| 23 | - | - `internal/ports/wire.go` requires `Hello.Version` first; the new exact-target section is appended after the existing remote/policy section. | |||
| 24 | - | - Existing daemon route authority remains in `routeWithContext`; exact local validation is an additional lifecycle check before ordinary attach routing. | |||
| 25 | - | - Focused ports, client, app, and daemon tests pass after the current incremental changes. | |||
| 26 | - | ||||
| 27 | - | ## Accepted risks | |||
| 28 | - | ||||
| 29 | - | - Stack 2 introduces codec/model seams and private transition primitives but does not yet publish snapshots or replace command authority; those remain explicit Stack 3 work. | |||
| 30 | - | - The first reviewer-worker attempts did not produce a retrievable result in this harness, so the builder performed the required critic pass locally before final validation. | |||
| 31 | - | ||||
| 32 | - | ## Builder critic pass and resolutions | |||
| 33 | - | ||||
| 34 | - | - **Welcome identity mismatch:** a malicious or buggy daemon could return a committed lifecycle/name different from the Welcome metadata. `UnmarshalWelcome` now rejects mismatched session name or ephemeral state. | |||
| 35 | - | - **Stale exact target side effects:** exact local validation waits for an existing restore barrier before checking lifecycle identity; it does not create or mutate a session and rejects lifecycle replacement before normal attach. | |||
| 36 | - | - **Snapshot leakage:** `RecentRouteEntry` contains only opaque key/generation and display fields. Dialers, requests, resume credentials, and exact targets remain in private `routeRecord` values and are copied out only through navigation lookup. | |||
| 37 | - | - **Transactional navigation:** connector failure, stale key/generation, or committed-target mismatch returns before ledger commit; origin is restored from the selected private record rather than connector input. | |||
| 38 | - | - **Bounds/strictness:** snapshot entry count, labels, refs, closed enums, bool encodings, truncation, trailing bytes, and protocol-version peeking are covered by tests; focused race tests pass. | |||
| 39 | - | ||||
| 40 | - | ## Follow-up fixes | |||
| 41 | - | ||||
| 42 | - | The implementation now commits a successful Welcome into the private ledger before | |||
| 43 | - | raw-mode entry, publishes a complete snapshot frame, and accepts/validates that | |||
| 44 | - | frame on the daemon attachment. The active route is metadata-only, the private | |||
| 45 | - | history cap is 20, origin keys distinguish daemon endpoints, route labels reject | |||
| 46 | - | invalid UTF-8/control text, navigation actions carry the snapshot generation, | |||
| 47 | - | active selection is a no-op, and failed transitions invoke the prior-route | |||
| 48 | - | restore hook before returning failure. | |||
| 49 | - | ||||
| 50 | - | # Client-owned route-position red-team | |||
| 51 | - | ||||
| 52 | - | ## Builder decision | |||
| 53 | - | ||||
| 54 | - | Keep live tab/view authority on each daemon attachment, but remember the last | |||
| 55 | - | stable tab ID per exact client route in the process-local route ledger. Add an | |||
| 56 | - | optional preferred stable tab to Hello and a daemon-to-client route-position | |||
| 57 | - | publication bound to an exact lifecycle/name target. A missing preferred tab is | |||
| 58 | - | a hint miss and falls back to the daemon's normal attachment tab; it never | |||
| 59 | - | changes session identity or shared session tab state. | |||
| 60 | - | ||||
| 61 | - | ## Critic pass | |||
| 62 | - | ||||
| 63 | - | - **Multiple clients:** daemon-global or session-global memory would couple | |||
| 64 | - | clients. The remembered cursor stays in each Runner's private route ledger; | |||
| 65 | - | the daemon applies it only to the requesting attachment. | |||
| 66 | - | - **Stale/out-of-order publications:** a tab ID without session identity could | |||
| 67 | - | corrupt the route selected by a concurrent transition. RoutePosition carries | |||
| 68 | - | the exact lifecycle/name target, and the ledger applies it only to that route. | |||
| 69 | - | - **Handshake ordering:** publishing another server frame before Welcome would | |||
| 70 | - | recreate the resume-token failure found during manual testing. Initial route | |||
| 71 | - | position is emitted only by post-Welcome rendering; Welcome stays first. | |||
| 72 | - | - **Deleted tabs:** remembered positions are hints, not exact picker authority. | |||
| 73 | - | The daemon validates stable IDs under target-session ownership and falls back | |||
| 74 | - | without rejecting the attachment when the tab no longer exists. | |||
| 75 | - | - **Discovery metadata:** RemoteTarget includes a point-in-time live tab and must | |||
| 76 | - | not become route memory. Committed route records drop that catalog selector; | |||
| 77 | - | PreferredTabID is the independent mutable cursor. | |||
| 78 | - | - **Resume and identity authority:** a preferred tab cannot select a session. It | |||
| 79 | - | is accepted only for attach/resume and only after resume-token or exact-target | |||
| 80 | - | session resolution succeeds. | |||
| 81 | - | - **Untrusted IDs:** both Hello and RoutePosition reject empty/oversized/control | |||
| 82 | - | stable IDs and trailing or truncated payloads. | |||
| 83 | - | - **Publication completeness:** tab selection and repair always invalidate a | |||
| 84 | - | render. RoutePosition is serialized with the attachment's post-commit output | |||
| 85 | - | transaction and cached per transport incarnation; output rebase forces an | |||
| 86 | - | initial publication after attach/resume. | |||
| 87 | - | ||||
| 88 | - | ## Accepted risks | |||
| 89 | - | ||||
| 90 | - | - The state is intentionally process-memory only. Restarting the client loses | |||
| 91 | - | remembered tabs; restarting a daemon does not make the daemon the memory | |||
| 92 | - | owner, and missing/replaced stable IDs safely fall back. | |||
| 93 | - | - RoutePosition is an additional small control frame only when the exact target | |||
| 94 | - | or active stable tab changes, not on every output diff. | |||