randomayzer/agents/codex/done/2026-10-19-auditor1-rereview-cce70c0.md

# Independent rereview — cce70c0

Base SHA: `17faecd962c2cf40e0a3f6ec4434811cfffdd312`
Reviewed SHA: `cce70c0b8feb263cc9209332c8c50a44bc97428a`
Result SHA: `cce70c0b8feb263cc9209332c8c50a44bc97428a` (review only; no source changes)

## Prior findings and status

### auditor1 MEDIUM — live smoke could accept mock-provider data: CLOSED at this SHA

The previous reproduction set `USE_VK_MOCK=true` in the production environment while a real service token existed, then omitted the optional restricted-post case. This no longer yields live-smoke evidence:

- [`ProviderFactory`](/srv/projects/Agent%20projects/randomayzer/src/providers/factory.ts:10) now throws in `NODE_ENV=production` when the mock flag is true, before returning the mock provider. The production Compose service also sets `USE_VK_MOCK: "false"` explicitly at [compose.production.yml](/srv/projects/Agent%20projects/randomayzer/compose.production.yml:33), overriding the env-file value.
- The preview and import responses report `providerMode` from the actual `VkProvider` instance at [preview route](/srv/projects/Agent%20projects/randomayzer/src/app/api/posts/preview/route.ts:32) and [participants route](/srv/projects/Agent%20projects/randomayzer/src/app/api/giveaways/%5Bid%5D/participants/route.ts:99). The token is not included in that field or response.
- The smoke script requires `success` and `providerMode === LIVE` for preview; G/H additionally require a safe integer `totalCount > 0` at [vk-smoke.sh](/srv/projects/Agent%20projects/randomayzer/tools/vk-smoke.sh:94). Thus MOCK and empty imports are failures.
- The regression suite passed: production mock refusal even with a service token; mock instance reports MOCK despite SERVICE auth metadata; real provider reports LIVE without exposing a marker token; and actual shell smoke subprocess fixtures reject MOCK and zero-count imports while accepting LIVE nonempty imports. The tests also assert the cookie marker is absent from output.

Closure is limited to the false-positive code path and regression evidence. No live VK run was performed.

### auditor2 HIGH — malformed likes/comments could be silently omitted or collapsed: CLOSED at this SHA

The `VkProvider` validates both payload envelopes and each returned participant record before returning any list. Likes require complete count/items, object items, positive safe-integer IDs, valid optional profile field types, and unique user IDs across pages. Comments require complete count/items, valid profile lists and IDs, and nonzero safe-integer author IDs; negative community author IDs are explicitly excluded as nonparticipants. Malformed responses throw `VkIncompleteDataError`.

The import route does not call `GiveawayStore.updateParticipants` until provider fetch, enrichment, and filtering all complete. The focused route regression loops through 25 malformed likes/comments payloads and checks HTTP 502, `VK_INCOMPLETE_DATA`, and preservation of the prior participant list for each. A separate test confirms valid negative community comment authors are ignored. Focused suites passed 13 R3 tests including these cases.

Closure is limited to malformed-item validation and no-partial-save evidence. External VK response schemas were not verified against current official documentation or a live response.

## Remaining LOW finding

### LOW — COMMUNITY metadata still advertises admin detection without a manager-list implementation: OPEN / unchanged

[`resolveEffectiveCapabilities`](/srv/projects/Agent%20projects/randomayzer/src/providers/vk/vk-capabilities.ts:34) still sets `adminDetection: true` for COMMUNITY auth and removes the explanatory note. This commit does not change that code. The prior auditor noted that the participant import route validates against the static capability object, which keeps the current server-side exclusion guard false; the inaccurate dynamic metadata remains a preview/API contract issue and should stay tracked separately.

## New findings

CRITICAL: none.

HIGH: none in the rereviewed fixes.

MEDIUM: none in the rereviewed fixes.

LOW: the unchanged COMMUNITY capability-metadata finding above.

## Commands actually run

- Initial `npx vitest run tests/vk-smoke-provider-mode.test.ts tests/vk-r3-safety.test.ts` overlapped the coordinator's `npm ci`; Vitest failed to load PostCSS because `dlv` was temporarily unavailable. A second attempt during the same install window reported `vitest: not found`. Per coordinator instruction, these transient install-state errors were not treated as source findings.
- After the coordinator confirmed `npm ci`/Prisma generation had completed: `npx vitest run tests/vk-smoke-provider-mode.test.ts tests/vk-r3-safety.test.ts` — exit 0; 2 files, 19 tests passed (13 R3 safety, 6 provider-mode/smoke tests).
- `bash -n tools/vk-smoke.sh` — exit 0.
- `node --check tools/production-transport.cjs` — exit 0.
- `node --check tools/serve-production.cjs` — exit 0.
- `git diff --check 17faecd962c2cf40e0a3f6ec4434811cfffdd312..cce70c0b8feb263cc9209332c8c50a44bc97428a` — exit 0.

The coordinator separately reported `npm ci`, Prisma generation, and full `npm test` exit 0 with 380/380 tests at this SHA; I did not run those commands. Lint/build/audit, real PostgreSQL, and Docker remain coordinator-owned.

## UNVERIFIED and blockers

- Actual live VK behavior, consent, token scopes, and current official payload contracts remain UNVERIFIED.
- R4 production Docker startup and backup/restore drill remain unverified by this rereview.
- R5 DNS, TLS/basic-auth, live domain login, Docker-preserved peer address, firewall persistence, and internet/LAN/WireGuard isolation remain operator acceptance blockers.
- No phase closure or release readiness is claimed.

Files changed by this rereview: `agents/codex/inbox/2026-10-19-auditor1-rereview-cce70c0.md`, `agents/codex/done/2026-10-19-auditor1-rereview-cce70c0.md`, and individual memory worklog `/srv/projects/AI-Memory/01_PROJECTS/randomayzer/worklog/2026-10-19_auditor1_cce70c0-rereview.md`. No production code or tests changed; no commit/push was made. Pre-existing `AGENTS.md` modification was preserved.