randomayzer/agents/codex/done/2026-10-19-auditor2-high-rereview.md

Auditor2 independent re-review — malformed VK data and live smoke

Reviewed SHA: cce70c0b8feb263cc9209332c8c50a44bc97428a Comparison SHA: 17faecd962c2cf40e0a3f6ec4434811cfffdd312 Base SHA: 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60 Result SHA: cce70c0b8feb263cc9209332c8c50a44bc97428a (review only; no code changes).

Conclusion

The previous HIGH finding for malformed VK likes/comments participant data is CLOSED at the reviewed SHA. The implementation now rejects malformed records before the import route persists any result, and focused route regressions confirm that prior stored participants survive all included malformed cases.

The follow-up live-smoke false-success issue is also addressed: smoke checks require the actual provider marker LIVE; G/H additionally require a positive safe-integer participant count. Production refuses USE_VK_MOCK=true and the production Compose profile explicitly sets it false. Focused adversarial fixtures cover mock provider, empty live imports, and nonempty live imports.

The COMMUNITY admin capability discrepancy remains a pre-existing, nonblocking debt, not a finding introduced by this stage. I independently confirm that classification for current server routes: preview passes fetchPost only organizerId (no explicit COMMUNITY auth), and the resolver's automatic/service/user selection returns only SERVICE or USER. Giveaway detail derives only SERVICE/USER. Participant/snapshot enforcement reads the provider's static capability, which remains adminDetection: false.

No CRITICAL, HIGH, or MEDIUM findings remain from these reviewed issues. This report does not declare the phase closed.

Re-reviewed issues and evidence

Prior HIGH — CLOSED: malformed likes/comments responses

At vk-provider.ts, profile records now require a plain object with a positive safe-integer user ID and correctly typed returned fields. Response validation requires a response object, an items array, a nonnegative safe-integer count, and object-shaped items. Likes also reject duplicate user IDs at lines 297–303. Comments reject malformed/zero/non-integer/unsafe author IDs at lines 355–359 and validate returned profile arrays and IDs.

The earlier concrete failures are blocked: a missing id cannot become the participant ID "undefined"; a string or unsafe ID is rejected; and malformed comment author IDs are no longer silently omitted while the reported count is accepted. Negative integer comment author IDs remain deliberately excluded as community authors, matching prior behavior and now covered by a focused test.

At participants route, fetch/enrichment must finish before updateParticipants at line 97. The route-level regression at vk-r3-safety.test.ts iterates 25 malformed likes/comments cases, expects 502 VK_INCOMPLETE_DATA, and checks the previous participant list remains unchanged after each case.

Smoke false-success — CLOSED

ProviderFactory throws in production if mock mode is explicitly enabled, even when a service token exists. Production Compose sets USE_VK_MOCK: "false" at compose.production.yml.

Preview and participant-import responses identify the actual provider instance as LIVE or MOCK. vk-smoke.sh requires providerMode === "LIVE"; G/H also require totalCount to be a safe integer greater than zero. Its test fixture proves MOCK with reported participants fails before creating/importing a giveaway, LIVE with zero participants fails G/H, and LIVE with nonempty participants passes D/G/H: vk-smoke-provider-mode.test.ts.

Pre-existing LOW metadata discrepancy — nonblocking, not stage1-introduced

resolveEffectiveCapabilities still sets adminDetection: true for COMMUNITY auth at vk-capabilities.ts, though no manager-list lookup exists. The exact behavior is present in base SHA 6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60. Current routes do not supply or resolve COMMUNITY auth: preview calls fetchPost(url, { organizerId }); its automatic resolver chooses SERVICE or USER; giveaway details likewise derive only SERVICE/USER. Import and snapshot checks use provider.capabilities, whose static adminDetection remains false, as enforced by giveaway-schemas.ts. Thus this metadata branch is unreachable through current routes and cannot enable admin exclusion. I agree it is pre-existing nonblocking debt for this phase, not an open stage1 finding.

Commands run by this review

• git show -s --format='%H%n%P%n%s' cce70c0b8feb263cc9209332c8c50a44bc97428a — confirmed fixed commit parent is 17faecd962c2cf40e0a3f6ec4434811cfffdd312.
• git diff 17faecd962c2cf40e0a3f6ec4434811cfffdd312 cce70c0b8feb263cc9209332c8c50a44bc97428a -- <reviewed files> — reviewed only the immutable commit delta.
• USE_VK_MOCK=true npx vitest run tests/vk-r3-safety.test.ts tests/vk-smoke-provider-mode.test.ts — exit 0; 2 files, 19 tests passed (13 R3 safety, 6 smoke provider-mode).
• bash -n tools/vk-smoke.sh — exit 0.
• git diff --check 17faecd962c2cf40e0a3f6ec4434811cfffdd312 cce70c0b8feb263cc9209332c8c50a44bc97428a — exit 0; no whitespace errors.

Coordinator separately reported raw npm test at this SHA passed 380/380 across 63 files; I did not independently rerun the full suite, install, Prisma generation, lint, build, audit, or Docker gates. Live VK and target-host acceptance remain operator-dependent and unverified.

UNVERIFIED / remaining blockers

• Actual live VK payload contracts and stable offset-pagination behavior remain UNVERIFIED; this review does not assert external VK method contracts. The existing documentation discloses that changing VK data during offset pagination cannot be proven point-in-time consistent.
• Live VK consent, real credentials, and production A–H smoke remain unverified.
• Actual VPS/WireGuard socket peer preservation, firewall persistence, TLS/basic-auth, and LAN/internet isolation require operator checks on target hosts.
• Coordinator's full lint/build/audit/Docker acceptance is outside this rereview; no phase-closure claim is made.

Files changed by this rereview session

• agents/codex/inbox/2026-10-19-auditor2-high-rereview.md — task record.
• agents/codex/done/2026-10-19-auditor2-high-rereview.md — this report.
• /srv/projects/AI-Memory/01_PROJECTS/randomayzer/worklog/2026-10-19_auditor2_high-rereview.md — individual memory worklog.

No production source/tests were changed, and no commit, push, container mutation, or communication with auditor1 was made.