randomayzer/agents/codex/done/2026-10-19-auditor2.md

Independent auditor2 review — stage1 R1–R5

Reviewed SHA: 17faecd962c2cf40e0a3f6ec4434811cfffdd312 Base SHA: 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60 Result SHA: 17faecd962c2cf40e0a3f6ec4434811cfffdd312 (review only; no code changes).

Scope and conclusion

Reviewed the immutable base-to-HEAD patch against R1–R5, with emphasis on malformed/incomplete VK responses and persistence, unsupported repost/manager checks, smoke behavior and credential handling, migration bootstrap, production socket trust, deployment binding and operator runbook.

One HIGH issue remains in R3: likes/comments item records are not validated, allowing malformed VK payload elements to be silently accepted or omitted and the resulting list to be persisted as complete. One LOW issue remains in capability metadata: COMMUNITY auth is reported as enabling admin detection despite no manager-list fetch implementation. No CRITICAL findings. This is not a phase-closure decision.

Findings

HIGH — malformed likes/comments can produce a persisted “complete” participant list

Evidence: vk-provider.ts converts item.id directly with String(item.id) and inserts the participant without checking that the ID is a valid user identifier. The comments path accepts any from_id satisfying JavaScript > 0 and silently ignores other values at vk-provider.ts. The pagination guard at vk-client.ts validates array size and reported totals, but not element shape. The route then saves whatever the provider/pipeline returned at participants/route.ts.

For example, a likes page with a reported matching count and an item missing id becomes participant ID "undefined"; multiple such records collapse in the map. A malformed comment from_id is counted by pagination but omitted from participants. Either path can silently change draw eligibility while completing the import and replacing the previous list. The added R3 tests cover missing/short pages and incomplete groups.isMember results, but do not exercise malformed likes/comments item payloads.

The provider should reject malformed participant records with the explicit incomplete-data error before returning; a regression test should assert the existing participant list survives each malformed payload case.

LOW — COMMUNITY capability metadata claims admin detection without an implementation

Evidence: vk-capabilities.ts sets adminDetection: true whenever the auth type is COMMUNITY and clears the explanation. The provider implementation has no manager-list lookup, and participant-enricher.ts only enriches subscriptions. Actual participant/snapshot validation currently uses the provider’s static capabilities (adminDetection: false), so this metadata discrepancy does not bypass the current server guard; however, the preview API can return a capability consumers could treat as available.

Keep this capability false until a complete manager-detection implementation exists, or derive it from a separately verified capability; add a test for COMMUNITY auth metadata. Current end-user flow selecting manager exclusion is disabled with a clear explanation, and the server validator rejects it.

Areas reviewed without additional findings

• Pagination rejects invalid/changing totals, short/empty pages before total, oversized pages, missing totals for incomplete data, and max-page truncation. Subscription enrichment validates response shape, unexpected/duplicate/missing IDs and member values. The import route writes only after all fetch/enrichment succeeds.
• Reposts and manager exclusion are rejected by provider capability validation with reasons; the creation UI visibly disables both unsupported options and explains why. The code makes ordinary paginated calls and does not use execute.
• Smoke configuration requires a non-symlink regular mode-0600 file, allowlists keys and URL origins, keeps cookie/basic-auth material in curl config under a private temp directory, does not print response bodies, and reports SKIP/MANUAL distinctly. Exit status is zero when executed checks pass even when others are skipped/manual, but the script prints skip counts and its documentation explicitly says skipped checks are not passed; I did not classify that as a false PASS.
• The new initial migration intentionally models the pre-ownership schema; the following ownership migration aborts on null owner rows, then makes the column non-null and changes FK behavior. The runbook explicitly requires backup/schema/history inspection and says not to apply CREATE TABLE over existing tables. The recorded disposable-PostgreSQL migration evidence includes a zero-difference Prisma schema check.
• The production entrypoint replaces proxy metadata before Next receives the request, derives trust from socket.remoteAddress, strips proxy headers from untrusted peers, and allows only the configured 10.77.0.1 peer in the domain profile. Tests cover forged headers from several peers and a real loopback socket. Compose publishes only loopback plus the explicit WireGuard address in the domain overlay; DB has no host port. The runbook gates the actual VPS/WireGuard source identity and firewall persistence on operator checks.
• The deployment runbook includes startup, migration, backup/restore, update/rollback and two-host domain procedures. It requires the correct existing proxy and firewall manager and avoids changing the tunnel or unrelated services.

Commands run by this review

• git status --short --branch — branch codex/stage1-completion; pre-existing M AGENTS.md preserved.
• git rev-parse HEAD — 17faecd962c2cf40e0a3f6ec4434811cfffdd312.
• USE_VK_MOCK=true npx vitest run tests/vk-r3-safety.test.ts tests/production-transport.test.ts tests/deployment-profile.test.ts — exit 0; 3 files, 26 tests passed.
• git diff --check 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60..17faecd962c2cf40e0a3f6ec4434811cfffdd312 — exit 0, no whitespace errors.

Not run by this reviewer: npm ci, Prisma generation, full unit/integration suites, lint, build, dependency audit, Docker stack rebuild, live VK smoke, live VPS/domain/network acceptance. Coordinator owns the full gates and Docker work.

UNVERIFIED and remaining blockers

• Actual live VK response schemas and official behavior for manager listing, private-profile reposts, pagination consistency and method limits remain unverified. This review makes no claim about external VK contracts.
• Whether the deployed Docker/VPS path preserves the trusted socket peer as 10.77.0.1, and whether firewall rules persist correctly, still require operator verification on the target hosts.
• Live VK consent, domain login, TLS/basic-auth behavior, and external/LAN/WireGuard isolation remain unverified.
• R3 malformed participant item validation is the release-blocking code issue identified here; regression coverage and repair remain outstanding.

Files changed by this review session

• agents/codex/inbox/2026-10-19-auditor2.md — assignment record.
• agents/codex/done/2026-10-19-auditor2.md — this report.
• /srv/projects/AI-Memory/01_PROJECTS/randomayzer/worklog/2026-10-19_auditor2_stage1-review.md — individual memory worklog.

No production code or tests were changed; no commit was created. The pre-existing AGENTS.md modification was left untouched.