agents/codex/done/2026-10-19-auditor1-r5-rereview-c5ede46.md

@@ -0,0 +1,48 @@
+# Auditor1 R5 re-review
+
+## Scope and revision
+
+- Base SHA: `ca28be6ae629d3d67936475ea5896b6f70f6e1e4`
+- Reviewed SHA: `c5ede46bd1c31b1e23434538fdb8a1cd925751a6`
+- Scope: re-review of prior auditor1 findings in the HAProxy no-restart reload procedure and active/source backup integrity, plus staged HTTP-01 → Caddy auth → TLS route ordering.
+- Resulting code SHA: no code changes by reviewer.
+- Files changed by this review: unique assignment and report only; existing `AGENTS.md` modification preserved.
+
+## Prior findings
+
+### CLOSED — MEDIUM: HAProxy no-restart reload path was unspecified
+
+The runbook now has a concrete, gated master-worker path in `docs/STAGE1_DEPLOYMENT_RUNBOOK.md:414-477`. It first requires PID 1 to be `haproxy`, an actual `-W`/`-Ws` argument, and manual confirmation that every live `-f` path matches the validated config set (`:416-425`). The function checks PID 1 and the master-worker argument again immediately before signaling (`:435-440`), sends USR2 specifically to the confirmed PID 1 (`:441-442`), waits for a new HAProxy child worker PID (`:443-451`), and requires unchanged container ID, start time, restart count, and running state (`:452-455`). Unknown process models stop without sending a signal (`:416-420`). Staged activation and failure/rollback instructions are now explicit (`:459-477`, `:518-525`).
+
+Evidence: source inspection at those lines. The coordinator reports having tested the exact function against an official HAProxy 3.0 fixture: worker handoff occurred with ID/StartedAt/RestartCount unchanged, and non-master PID 1 was rejected before signal. That fixture result was not independently rerun in this review. The live VPS process model remains UNVERIFIED, so this closes the runbook gap only; operation on the VPS remains conditional on its documented preflight.
+
+### CLOSED — LOW: directory-tree backups lacked completion/integrity checks
+
+The directory-mount branch now checks that all four active/source backup trees are nonempty, compares each source tree to its saved copy, and compares each active tree copy against its source copy before edits (`docs/STAGE1_DEPLOYMENT_RUNBOOK.md:303-326`). The single-file path also compares each host-source backup to its source (`:289-300`). The root shell is instructed to use `set -euo pipefail` (`:148-155`), so a failed copy command aborts before the later steps; explicit mismatch checks stop with a non-content error.
+
+Evidence: source inspection at those lines. The coordinator reports directory backups and diff checks reviewed; no VPS backup commands were executed in this review.
+
+## Remaining finding
+
+### LOW — When adding a new HTTP-01-only route, the final config never routes ordinary HTTP requests for the hostname to Caddy
+
+The new conditional route in `deploy/randomayzer.haproxy.cfg:18-27` matches both the requested host and only `/.well-known/acme-challenge/`. The runbook says to add this challenge-only route when the hostname is not already sent to Caddy, then to add Caddy auth and later the TLS SNI route (`docs/STAGE1_DEPLOYMENT_RUNBOOK.md:375-391`, `:459-477`). It never adds or enables a general HTTP host route after the Caddy site and TLS route are ready. In that topology, ordinary `http://random.ochenstarik.ru/` traffic continues to HAProxy's previous catch-all and cannot receive Caddy's automatic HTTP-to-HTTPS redirect. This is conditional on the HTTP host not already being routed to Caddy; the runbook's local/domain route baselines should include an explicit HTTP check for Randomayzer after activation.
+
+Evidence: the official Caddy Automatic HTTPS documentation says it creates HTTP-to-HTTPS redirects on port 80, while the HAProxy example routes only the challenge path to Caddy: [Caddy Automatic HTTPS](https://caddyserver.com/docs/automatic-https) and the cited source lines. This was not tested against the live topology. A post-TLS stage can route the full host to Caddy after the authenticated site is loaded, preserving the challenge path and other hosts; if broad HTTP forwarding is not intended, document the deliberate behavior instead.
+
+## Staged ordering assessment
+
+The runbook now orders a needed HTTP-01 challenge-only route first, Caddy's Basic Auth site second, and the new TLS SNI route third (`docs/STAGE1_DEPLOYMENT_RUNBOOK.md:375-391`). The HTTP-01 route is limited to the challenge prefix and preserves port 80, while the TLS SNI route remains absent until after Caddy has loaded the protected site. The ordering is sound for avoiding a new public TLS route before the auth config is active. The remaining LOW finding above concerns ordinary HTTP requests after activation, not the ordering of challenge/auth/TLS stages.
+
+## Commands and evidence
+
+- `git rev-parse HEAD` — `c5ede46bd1c31b1e23434538fdb8a1cd925751a6`.
+- `git diff --check ca28be6ae629d3d67936475ea5896b6f70f6e1e4 c5ede46bd1c31b1e23434538fdb8a1cd925751a6` — exit 0.
+- Source diff inspected with `git diff --unified=5 ca28be6ae629d3d67936475ea5896b6f70f6e1e4 c5ede46bd1c31b1e23434538fdb8a1cd925751a6 -- deploy/randomayzer.haproxy.cfg docs/STAGE1_DEPLOYMENT_RUNBOOK.md`.
+- No Docker, container, VPS, application test, or full-gate commands were run. Coordinator-reported checks: official HAProxy 3.0 fixture behavior and config validation passed; 25 Bash blocks passed syntax checks. These are not claimed as independently run.
+
+## UNVERIFIED and blockers
+
+- VPS PID 1, actual HAProxy arguments and complete `-f` config set, mounts, routing rules, Caddy admin endpoint, and HTTP path to Caddy remain UNVERIFIED. The new reload command must not run unless the live preflight proves its preconditions.
+- DNS, public certificate issuance, external HTTP/HTTPS behavior, login, WireGuard peer identity, firewall isolation, and preservation of sites on the actual VPS remain UNVERIFIED.
+- No R5 phase closure or deployment readiness is claimed.

agents/codex/done/2026-10-19-auditor2-r5-rereview-c5ede46.md

@@ -0,0 +1,44 @@
+# Result: independent R5 follow-up review
+
+Base SHA: `ca28be6ae629d3d67936475ea5896b6f70f6e1e4`
+Reviewed SHA: `c5ede46bd1c31b1e23434538fdb8a1cd925751a6`
+Result SHA: `c5ede46bd1c31b1e23434538fdb8a1cd925751a6` (review only; no source changes)
+Files changed by this reviewer: this report and its inbox task record only.
+
+## Review result
+
+The prior **MEDIUM is CLOSED for the runbook/documentation deliverable**. The prior **LOW is CLOSED**. I found no new CRITICAL, HIGH, or MEDIUM finding in the reviewed delta.
+
+The prior MEDIUM was that the runbook had no executable HAProxy no-restart reload procedure. At `docs/STAGE1_DEPLOYMENT_RUNBOOK.md:414-457`, the revised procedure first requires PID 1 to be `haproxy`, an exact `-W`/`-Ws` argument, and manual confirmation that its `-f` paths match the complete validated config set (`:416-425`). It stops without signalling if those checks fail. The reload function repeats the PID/mode check, snapshots Docker ID/start time/restart count, requires existing worker PIDs, sends USR2 specifically to the confirmed container master, waits for a new worker PID, and verifies the container remains running with unchanged identity/start/restart count (`:435-455`). The operator invokes it only after config/source gates (`:459-464`). This is a concrete, conditionally safe procedure, not an instruction to guess at or alter the deployed process model.
+
+That signal choice agrees with the [official HAProxy 3.0 Management Guide](https://docs.haproxy.org/3.0/management.html), which documents `-W` as master-worker mode and SIGUSR2 to the master as a reload mechanism. The coordinator reports it separately exercised the exact function against an official HAProxy 3.0 image: worker handoff occurred with Docker ID, StartedAt, and RestartCount unchanged, while a non-master PID 1 was rejected before a signal. I did not rerun that container test.
+
+The prior LOW was the ordering that could route TLS requests to Caddy before Caddy loaded its site configuration. It is closed by the explicit activation order at `docs/STAGE1_DEPLOYMENT_RUNBOOK.md:374-392`: when needed, first add and reload only the HTTP-01 challenge route; next validate and reload Caddy with Basic Auth; only after that succeeds add and reload the TLS SNI route. The HTTP route is constrained to the exact Host and `/.well-known/acme-challenge/` prefix in `deploy/randomayzer.haproxy.cfg` (lines 18-26), so this staging does not expose the new TLS route prematurely.
+
+The follow-up also adds explicit source/active config-tree backup comparisons at `docs/STAGE1_DEPLOYMENT_RUNBOOK.md:318-325`, complementing the single-file and inode checks. Rollback now restores and reloads Caddy before using the same gated HAProxy handoff procedure (`:509-525`).
+
+## Commands actually run
+
+- `git rev-parse HEAD` — `c5ede46bd1c31b1e23434538fdb8a1cd925751a6`.
+- `git status --short` — showed pre-existing `AGENTS.md` modification and shared task artifacts; no source changes by this reviewer.
+- `git diff --stat ca28be6ae629d3d67936475ea5896b6f70f6e1e4 c5ede46bd1c31b1e23434538fdb8a1cd925751a6` — scoped follow-up change summary.
+- `git diff --no-ext-diff --unified=15 ca28be6ae629d3d67936475ea5896b6f70f6e1e4 c5ede46bd1c31b1e23434538fdb8a1cd925751a6 -- docs/STAGE1_DEPLOYMENT_RUNBOOK.md deploy/randomayzer.haproxy.cfg` — inspected the review delta.
+- `git show c5ede46bd1c31b1e23434538fdb8a1cd925751a6:docs/STAGE1_DEPLOYMENT_RUNBOOK.md | nl -ba | sed -n '140,550p'` — inspected final line references.
+- `git show c5ede46bd1c31b1e23434538fdb8a1cd925751a6:docs/STAGE1_DEPLOYMENT_RUNBOOK.md | nl -ba | sed -n '275,325p;374,480p;509,528p'` — verified cited reload, ordering, tree-compare and rollback locations.
+- `git diff --check ca28be6ae629d3d67936475ea5896b6f70f6e1e4 c5ede46bd1c31b1e23434538fdb8a1cd925751a6` — exit 0.
+- Read the official HAProxy 3.0 Management Guide at `https://docs.haproxy.org/3.0/management.html` for master-worker/SIGUSR2 semantics.
+
+Coordinator reports Caddy/HAProxy config validation and syntax checks for 25 Bash blocks passed. Those checks were not rerun by this reviewer. No full application gates, Docker test, live VPS command, or container mutation was performed by me.
+
+## UNVERIFIED and remaining blockers
+
+- Actual VPS PID 1, HAProxy argv/config paths, mounts, active/source equality, master-worker mode, and successful live handoff remain UNVERIFIED. The runbook explicitly stops before editing/signalling unless those preconditions are established on the VPS.
+- Actual Caddy admin endpoint, routing topology, HTTP-01 issuance/renewal, DNS/WireGuard/firewall preconditions, and existing-site baselines remain UNVERIFIED. No live acceptance or phase closure is claimed.
+- No remaining code-review blocker in the two prior findings; live operation remains gated on the documented operator preconditions and acceptance checks.
+
+## Severity status
+
+- CRITICAL: none.
+- HIGH: none.
+- MEDIUM: prior no-command finding CLOSED for the runbook; deploy-time process model remains UNVERIFIED.
+- LOW: prior activation-order window CLOSED by the staged HTTP-01, Caddy, then TLS route sequence.

agents/codex/done/2026-10-19-stage1-completion.md

@@ -0,0 +1,157 @@
+# Stage1 — результат локальной реализации и проверки
+
+Исходный base SHA: 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60.
+Обновление задания: 52fb7587d7dda5ae3d1c5e9ecef96b7f48d147a3; включено merge-коммитом 8284eb5d006943d42133eb665c99dcbc3133d6a6.
+Result / проверяемый implementation SHA: c5ede46bd1c31b1e23434538fdb8a1cd925751a6.
+Production source, tests, dependencies, Prisma, Docker/Compose и tools совпадают с independently reviewed cce70c0b8feb263cc9209332c8c50a44bc97428a (git diff --exit-code: 0). После него менялись manifest, R5 proxy templates, документация и review artifacts.
+Ветка: codex/stage1-completion. Финальный artifacts commit определять через git log -1 -- agents/codex/done/2026-10-19-stage1-completion.md. Этот отчёт фиксирует точный SHA результата кода выше, не самоссылочный SHA.
+Main не изменялся. Локальная пользовательская правка AGENTS.md сохранена и не включена в коммиты.
+
+## Реализация по актуальному заданию
+
+- R1: next и eslint-config-next 16.3.2 → 16.3.8 (MIT), sharp 0.35.3 → 0.35.5 (Apache-2.0), source-map-js 1.2.1 → 1.2.2 (BSD-3-Clause). Production audit: 0.
+- R2: PostgreSQL 16 на 127.0.0.1:55439; добавлена историческая initial migration перед двумя существующими миграциями. Первоначальный P3018/42P01 воспроизведён. Повторный draw возвращает ConflictError. Владелец прямо разрешил 32 случайных байта seed / 64 hex и узкое обновление seed assertions; authorization записана в inbox. Deterministic proof format, snapshot hash и HMAC_SHA256_FY_V1 не менялись.
+- R3: неполная пагинация, malformed participant records и неполные subscription data вызывают явную ошибку до сохранения; prior participants сохраняются. Unsupported manager/repost capabilities объяснены. Smoke A–H требует реальный LIVE provider и непустые импорты, MOCK в production запрещён; ручные шаги и I–M сохранены.
+- R4: явный local-single-user профиль только loopback, строгий HTTPS/Secure для остальных origin; CSRF привязан к canonical origin. Production entrypoint очищает forwarded headers по реальному socket peer. App 127.0.0.1:3100, PG без host ports, node/postgres users и CPU/RAM limits; backup/timer/clean restore, update/rollback и SSH tunnel в runbook.
+- R5 по обновлению владельца: additive Caddy 2.8 / HAProxy 3.0 templates для krona-reverse-proxy и krona-proxy-mux; inspect mounts/process topology, fail-stop backups, validations, условный USR2 reload с worker/container evidence, Caddy auth до TLS route, other-site baselines и rollback. Существующие VPS/Forgejo/fleet/authelia/WireGuard конфигурации не менялись. Authelia integration не заявлена.
+
+## Фактически выполненные проверки
+
+Production code gate выполнен на cce70c0, после чего runtime-файлы не менялись:
+
+| Команда | Результат |
+|---|---|
+| npm ci | exit 0; полный dev-inclusive tree сообщает 19 advisories |
+| npx prisma generate | exit 0, Prisma Client 5.22.0 |
+| npm test | exit 0, 63 файла / 380 тестов |
+| npx tsc --noEmit | exit 0 |
+| npm run lint | exit 0, 0 errors / 6 существующих img warnings |
+| npm run build | exit 0, Next production build |
+| npm audit --omit=dev | exit 0, found 0 vulnerabilities |
+| docker compose up -d --wait | isolated PG16 healthy, loopback55439 |
+| DATABASE_URL=<disposable PG16 URL> npx prisma migrate deploy | exit 0 на чистой randomayzer_stage1_final, применены 3 миграции |
+| DATABASE_URL=<disposable PG16 URL> npm run test:integration | exit 0, 12/12, включая 10 concurrent locks → ровно 1 успех |
+| npx prisma migrate diff --from-url <disposable PG16 URL> --to-schema-datamodel prisma/schema.prisma --exit-code | exit 0, No difference detected |
+| docker compose --env-file <ignored 0600 fake env> -f compose.production.yml build app | exit 0 |
+| тот же compose up -d --wait postgres / app и run --rm --no-deps app npx prisma migrate deploy | healthy production stack / 3 migrations |
+| RANDOMAYZER_ENV_FILE=<fake env> tools/db-backup-daily.sh <private backup directory> | exit 0, clean temporary restore: 3 migrations + 1 fake giveaway, обе PASS строки |
+| production HTTP smoke | anonymous session и PKCE/canonical localhost callback при поддельных Host/X-Forwarded-* прошли; не живой VK |
+| bash agents/codex/notes/validate-r5-templates.sh | exit 0, Caddy2.8.4 / HAProxy3.0.30 validate; fake fixtures, network none, без опубликованных портов |
+| bash -n для всех 25 bash-блоков runbook | exit 0 |
+| точная reload_haproxy_without_restart из runbook в isolated HAProxy3.0 fixture | exit 0: новый worker, Id/StartedAt/RestartCount неизменны |
+| та же функция с PID1 sleep | отвергнута, контейнер остался running без изменения identity/start/restart count |
+| git diff --check | exit 0 |
+
+Actual production image: sha256:8d6a8b2250cf813d078e24dfc79c743be43ec86533a3d24af87ac9d1ab4ed274.
+Проверены runtime binding 127.0.0.1:3100 / DB ports {}, users node/postgres, app1GiB/1.5CPU, PG512MiB/1CPU.
+Логи локально: agents/codex/notes/fix-final-*.log, final-schema-diff.log, r5-reload-fix-template-validation.log и r5-runbook-reload-function.log; ignored, не включают реальные credentials и не упакованы в PR.
+Все временные app/PG/validator/reload контейнеры остановлены/удалены; удалены только два проверенно созданных в этой сессии throwaway DB volumes. Другие сервисы/volumes не трогали.
+
+Ранее один raw npm test упал по timeout существующего live-network security.test.ts. Неизменённый focused повтор 7/7 и финальный raw полный прогон 380/380 прошли. Тесты/таймауты не ослаблялись. Начальные 10/12 и 11/12 integration failures устранены кодом и разрешённым seed contract. Неудачные попытки fixture setup и review во время npm ci отражены в промежуточных отчётах; окончательные проверки выше выполнены после исправления среды.
+
+## Независимое review
+
+Запрошенный цикл: coder1 → coder2 → auditor1 + auditor2 → исправления → оба re-review → coordinator gates.
+- HIGH malformed likes/comments и MEDIUM ложный live-smoke на MOCK: CLOSED обоими независимыми re-review на cce70c0. Новые regression fixtures: 25 malformed route cases сохраняют prior state; smoke subprocess rejects MOCK / zero count.
+- R5 MEDIUM отсутствующий executable HAProxy reload и LOW activation order / backup integrity: исправлены на c5ede46bd1c31b1e23434538fdb8a1cd925751a6; CLOSED по двум независимым re-review: 2026-10-19-auditor1-r5-rereview-c5ede46.md и 2026-10-19-auditor2-r5-rereview-c5ede46.md. Проверка только runbook; реальные VPS preconditions остаются открыты.
+- CRITICAL: не найдено независимыми аудиторами в рассмотренном scope.
+- LOW pre-existing COMMUNITY adminDetection metadata: остаётся OPEN как non-blocking debt; текущие маршруты SERVICE/USER и static server guard не позволяют включить неподдерживаемую проверку. Независимая классификация auditor2 в 2026-10-19-auditor2-high-rereview.md.
+- LOW conditional HTTP redirect: если нужен новый challenge-only маршрут80, обычные HTTP-запросы не попадут в Caddy automatic redirect. Coordinator классифицирует как non-blocking: исходная приёмка требует HTTPS/HTTP-01, обычный HTTP redirect не заявлен. Проверять приложение только по HTTPS; при желании general HTTP route — отдельное операторское изменение после активного Caddy auth, с validate/reload/baselines. Finding не объявляется CLOSED.
+- 6 lint warnings и dev-only advisories остаются non-blocking debt, не скрыты production audit.
+
+## UNVERIFIED / оставшиеся внешние blockers
+
+- Живой VK: credentials/consent, localhost redirect acceptance, актуальные official API contracts/scopes/limits, реальный A–H и ручные I–M. Без реальных ключей эти результаты не заявляются.
+- Offset pagination на меняющихся внешних данных не доказывает point-in-time snapshot.
+- DNS локально отдавал 185.26.122.80 вместо целевого178.212.13.102. Владелец подтверждает identity peer10.77.0.1; локальные interface10.77.0.3/route наблюдались.
+- Actual VPS mount paths, active backends/process flags/Caddy admin API, установленный patch version, TLS certificate, proxy401, VK domain login, forwarded socket peer preservation и firewall persistence/isolation интернет/LAN/tunnel — проверяет оператор по runbook с отчётом agents/claude/done/.
+- Нет live VPS изменений, выпуска сертификата или изменения DNS/firewall/tunnel здесь. Deployment templates не считаются принятым deployment.
+
+Phase CLOSED / release-ready / production-ready не объявляются. Локальная реализация передаётся на PR review; внешние acceptance gates остаются открыты.
+
+## Изменённые файлы относительно обновлённого main
+
+Список ниже отражает implementation/review snapshot c5ede46bd1c31b1e23434538fdb8a1cd925751a6; данный итоговый отчёт и последующие review-only artifacts добавляются artifacts-коммитом.
+
+```text
+.dockerignore
+Dockerfile
+agents/codex/done/2026-10-19-auditor1-r5-review-ca28be6.md
+agents/codex/done/2026-10-19-auditor1-rereview-cce70c0.md
+agents/codex/done/2026-10-19-auditor2-high-rereview.md
+agents/codex/done/2026-10-19-auditor2-high-vk-items.md
+agents/codex/done/2026-10-19-auditor2-r5-review.md
+agents/codex/done/2026-10-19-auditor2.md
+agents/codex/done/2026-10-19-r5-reload-fix.md
+agents/codex/done/2026-10-19-r5-template-coder2-review.md
+agents/codex/done/2026-10-19-r5-vps-container-runbook.md
+agents/codex/done/2026-10-19-smoke-mock-fix.md
+agents/codex/done/TASK-2026-10-19-auditor1-independent-review.md
+agents/codex/done/TASK-2026-10-19-coder2-review.md
+agents/codex/done/TASK-2026-10-19-r1-r3.md
+agents/codex/inbox/2026-10-19-auditor1-independent-review.md
+agents/codex/inbox/2026-10-19-auditor1-r5-rereview-ca28be6.md
+agents/codex/inbox/2026-10-19-auditor1-rereview-cce70c0.md
+agents/codex/inbox/2026-10-19-auditor2-high-rereview.md
+agents/codex/inbox/2026-10-19-auditor2-high-vk-items.md
+agents/codex/inbox/2026-10-19-auditor2-r5-review.md
+agents/codex/inbox/2026-10-19-auditor2.md
+agents/codex/inbox/2026-10-19-r5-reload-fix.md
+agents/codex/inbox/2026-10-19-r5-vps-container-runbook.md
+agents/codex/inbox/2026-10-19-seed-owner-authorization.md
+agents/codex/inbox/2026-10-19-smoke-mock-fix.md
+agents/codex/inbox/2026-10-19-stage1-r2-assignment.md
+agents/codex/inbox/2026-10-19-stage1-r4-r5-assignment.md
+agents/codex/inbox/TASK-2026-10-19-coder2-r5-review.md
+agents/codex/inbox/TASK-2026-10-19-coder2-review.md
+agents/codex/inbox/TASK-2026-10-19-r1-dependencies.md
+agents/codex/inbox/TASK-2026-10-19-r3-vk-safety.md
+agents/codex/notes/.gitignore
+agents/codex/notes/2026-10-19-auditor2-high-vk-items.md
+agents/codex/notes/2026-10-19-r5-vps-container-runbook.md
+agents/codex/notes/2026-10-19-stage1-baseline.md
+agents/codex/notes/TASK-2026-10-19-r1-r3-notes.md
+agents/codex/notes/stage1-pr-body.md
+agents/codex/notes/validate-r5-templates.sh
+compose.domain.yml
+compose.production.yml
+deploy/randomayzer-backup.service
+deploy/randomayzer-backup.timer
+deploy/randomayzer.Caddyfile
+deploy/randomayzer.haproxy.cfg
+docker-compose.yml
+docs/PRODUCTION_GUARDS.md
+docs/STAGE1_DEPLOYMENT_RUNBOOK.md
+docs/VK_REAL_SMOKE_TEST.md
+package-lock.json
+package.json
+prisma/migrations/20260818000000_initial/migration.sql
+prisma/migrations/migration_lock.toml
+src/app/api/giveaways/[id]/participants/route.ts
+src/app/api/posts/preview/route.ts
+src/app/giveaways/new/page.tsx
+src/core/errors/http-errors.ts
+src/core/randomizer/hasher.ts
+src/core/validation/giveaway-schemas.ts
+src/integrations/vk/vk-client.ts
+src/integrations/vk/vk-errors.ts
+src/lib/auth/app-config.ts
+src/lib/auth/csrf-guard.ts
+src/lib/auth/session.ts
+src/lib/repository/prisma-repository.ts
+src/providers/factory.ts
+src/providers/vk/vk-capabilities.ts
+src/providers/vk/vk-provider.ts
+tests/deployment-profile.test.ts
+tests/production-transport.test.ts
+tests/randomizer.test.ts
+tests/seed-precommit-gate.test.ts
+tests/vk-r3-safety.test.ts
+tests/vk-smoke-provider-mode.test.ts
+tools/db-backup-daily.sh
+tools/db-backup.sh
+tools/db-restore-check.sh
+tools/production-transport.cjs
+tools/serve-production.cjs
+tools/vk-smoke.sh
+```

agents/codex/inbox/2026-10-19-auditor1-r5-rereview-c5ede46.md

@@ -0,0 +1,7 @@
+# Auditor1 assignment: R5 reload and backup re-review
+
+- Base SHA: `ca28be6ae629d3d67936475ea5896b6f70f6e1e4`
+- Reviewed SHA: `c5ede46bd1c31b1e23434538fdb8a1cd925751a6`
+- Scope: re-review the two findings in `agents/codex/done/2026-10-19-auditor1-r5-review-ca28be6.md`, including the HAProxy reload procedure, backup integrity checks, staged HTTP-01/Caddy-auth/TLS ordering, and any concrete remaining blocker in that diff.
+- Read-only: do not edit production source/tests, run Docker/VPS/container commands, commit, or push.
+- Report: write a unique auditor1 report under `agents/codex/done` with exact SHA, findings marked CLOSED/OPEN, evidence and commands, UNVERIFIED items, and blockers.

agents/codex/inbox/2026-10-19-auditor2-r5-rereview-c5ede46.md

@@ -0,0 +1,6 @@
+# Task
+Base SHA: `ca28be6ae629d3d67936475ea5896b6f70f6e1e4`
+Scope: Independently rereview the R5 follow-up at immutable `c5ede46bd1c31b1e23434538fdb8a1cd925751a6`, focusing on whether the HAProxy reload is executable and safely gated to a verified process model, and whether activation ordering closes the prior LOW window.
+Do not change: production source/configs, tests, containers, remote VPS, commits, or pushes. Read only; write only this task record and a unique done report.
+Definition of Done: Report exact reviewed SHA, findings and CLOSED/OPEN assessment for prior MEDIUM and LOW with file/line evidence, actual commands run, UNVERIFIED blockers, and remaining debt. Do not claim phase closure.
+Required verification: Inspect immutable diff and current report scope. Do not rerun full gates or perform live operations.

agents/codex/notes/stage1-pr-body.md

@@ -1,7 +1,12 @@
-Stage1 R1–R5 implementation from the owner-supplied inbox manifest. Updates vulnerable production dependencies, adds a clean PostgreSQL bootstrap path and fixes repository duplicate-draw conflict handling, rejects incomplete VK participant/subscription data, and provides a private live-smoke script plus explicit loopback/domain deployment profiles.
+Неполные и malformed ответы VK теперь останавливают импорт до сохранения участников; live-smoke отвергает MOCK и пустые результаты. Обновлены уязвимые production dependencies, исправлены clean PostgreSQL bootstrap и duplicate-draw conflict. Добавлены loopback production-профиль, socket-based proxy header sanitization, backup/restore scripts и runbook для существующих Caddy/HAProxy контейнеров VPS с условным reload без restart.
 
-The owner explicitly authorized 32-byte random seeds and the narrow seed assertion changes. Deterministic proof/hash/HMAC algorithms remain unchanged.
+Учтено обновление задания из main52fb758. Владелец прямо разрешил 32-byte seed и узкие seed assertions; proof/hash/HMAC алгоритмы сохранены. Main автором PR не вливается.
 
-Local production stack and clean backup restore have been exercised with fake marker credentials. Real VK consent/scopes and VPS DNS/TLS/basic-auth/WireGuard/firewall acceptance require the operator; they are not claimed as complete. Main is not merged by this PR author.
+Проверки production code cce70c0 (runtime-файлы далее не менялись): npm ci, prisma generate, npm test380/380, tsc, lint0errors/6warnings, build; npm audit --omit=dev0. PostgreSQL16: clean3migrations, integration12/12, schema diff0. Production Docker healthy; clean restore с3migrations/1fakegiveaway прошёл. Caddy2.8.4/HAProxy3.0.30 configs valid;25 shell blocks syntax pass; exact reload function показала worker handoff без изменения container identity/start/restart count и отказ при неподдерживаемом PID1.
 
-Final validation and independent review evidence will be recorded in agents/codex/done/2026-10-19-stage1-completion.md.
+Два независимых reviewer закрыли найденные HIGH/MEDIUM после исправлений: malformed VK items, ложный live-smoke и отсутствующий executable reload. Открытые non-blocking LOW: pre-existing COMMUNITY capability metadata и отсутствие ordinary HTTP redirect при challenge-only маршруте. Dev-inclusive audit19 advisories; production audit0.
+
+Живой VK, DNS/TLS, proxy401, domain login и firewall/WireGuard isolation не проверены на VPS: это выполняет Claude/владелец по runbook. Phase CLOSED/release-ready не объявляются.
+
+Полный evidence, SHA, список файлов и ограничения: agents/codex/done/2026-10-19-stage1-completion.md.
+Операторский runbook: docs/STAGE1_DEPLOYMENT_RUNBOOK.md.