ochenstarik/randomayzer
1
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
randomayzer/agents/codex/done/2026-10-19-auditor1-rereview-cce70c0.md

6 KiB
Raw Blame History

Independent rereview — cce70c0

Base SHA: 17faecd962c2cf40e0a3f6ec4434811cfffdd312 Reviewed SHA: cce70c0b8feb263cc9209332c8c50a44bc97428a Result SHA: cce70c0b8feb263cc9209332c8c50a44bc97428a (review only; no source changes)

Prior findings and status

auditor1 MEDIUM — live smoke could accept mock-provider data: CLOSED at this SHA

The previous reproduction set USE_VK_MOCK=true in the production environment while a real service token existed, then omitted the optional restricted-post case. This no longer yields live-smoke evidence:

  • ProviderFactory now throws in NODE_ENV=production when the mock flag is true, before returning the mock provider. The production Compose service also sets USE_VK_MOCK: "false" explicitly at compose.production.yml, overriding the env-file value.
  • The preview and import responses report providerMode from the actual VkProvider instance at preview route and participants route. The token is not included in that field or response.
  • The smoke script requires success and providerMode === LIVE for preview; G/H additionally require a safe integer totalCount > 0 at vk-smoke.sh. Thus MOCK and empty imports are failures.
  • The regression suite passed: production mock refusal even with a service token; mock instance reports MOCK despite SERVICE auth metadata; real provider reports LIVE without exposing a marker token; and actual shell smoke subprocess fixtures reject MOCK and zero-count imports while accepting LIVE nonempty imports. The tests also assert the cookie marker is absent from output.

Closure is limited to the false-positive code path and regression evidence. No live VK run was performed.

auditor2 HIGH — malformed likes/comments could be silently omitted or collapsed: CLOSED at this SHA

The VkProvider validates both payload envelopes and each returned participant record before returning any list. Likes require complete count/items, object items, positive safe-integer IDs, valid optional profile field types, and unique user IDs across pages. Comments require complete count/items, valid profile lists and IDs, and nonzero safe-integer author IDs; negative community author IDs are explicitly excluded as nonparticipants. Malformed responses throw VkIncompleteDataError.

The import route does not call GiveawayStore.updateParticipants until provider fetch, enrichment, and filtering all complete. The focused route regression loops through 25 malformed likes/comments payloads and checks HTTP 502, VK_INCOMPLETE_DATA, and preservation of the prior participant list for each. A separate test confirms valid negative community comment authors are ignored. Focused suites passed 13 R3 tests including these cases.

Closure is limited to malformed-item validation and no-partial-save evidence. External VK response schemas were not verified against current official documentation or a live response.

Remaining LOW finding

LOW — COMMUNITY metadata still advertises admin detection without a manager-list implementation: OPEN / unchanged

resolveEffectiveCapabilities still sets adminDetection: true for COMMUNITY auth and removes the explanatory note. This commit does not change that code. The prior auditor noted that the participant import route validates against the static capability object, which keeps the current server-side exclusion guard false; the inaccurate dynamic metadata remains a preview/API contract issue and should stay tracked separately.

New findings

CRITICAL: none.

HIGH: none in the rereviewed fixes.

MEDIUM: none in the rereviewed fixes.

LOW: the unchanged COMMUNITY capability-metadata finding above.

Commands actually run

  • Initial npx vitest run tests/vk-smoke-provider-mode.test.ts tests/vk-r3-safety.test.ts overlapped the coordinator's npm ci; Vitest failed to load PostCSS because dlv was temporarily unavailable. A second attempt during the same install window reported vitest: not found. Per coordinator instruction, these transient install-state errors were not treated as source findings.
  • After the coordinator confirmed npm ci/Prisma generation had completed: npx vitest run tests/vk-smoke-provider-mode.test.ts tests/vk-r3-safety.test.ts — exit 0; 2 files, 19 tests passed (13 R3 safety, 6 provider-mode/smoke tests).
  • bash -n tools/vk-smoke.sh — exit 0.
  • node --check tools/production-transport.cjs — exit 0.
  • node --check tools/serve-production.cjs — exit 0.
  • git diff --check 17faecd962c2cf40e0a3f6ec4434811cfffdd312..cce70c0b8feb263cc9209332c8c50a44bc97428a — exit 0.

The coordinator separately reported npm ci, Prisma generation, and full npm test exit 0 with 380/380 tests at this SHA; I did not run those commands. Lint/build/audit, real PostgreSQL, and Docker remain coordinator-owned.

UNVERIFIED and blockers

  • Actual live VK behavior, consent, token scopes, and current official payload contracts remain UNVERIFIED.
  • R4 production Docker startup and backup/restore drill remain unverified by this rereview.
  • R5 DNS, TLS/basic-auth, live domain login, Docker-preserved peer address, firewall persistence, and internet/LAN/WireGuard isolation remain operator acceptance blockers.
  • No phase closure or release readiness is claimed.

Files changed by this rereview: agents/codex/inbox/2026-10-19-auditor1-rereview-cce70c0.md, agents/codex/done/2026-10-19-auditor1-rereview-cce70c0.md, and individual memory worklog /srv/projects/AI-Memory/01_PROJECTS/randomayzer/worklog/2026-10-19_auditor1_cce70c0-rereview.md. No production code or tests changed; no commit/push was made. Pre-existing AGENTS.md modification was preserved.