randomayzer/agents/codex/done/2026-10-19-auditor2-high-rereview.md

# Auditor2 independent re-review — malformed VK data and live smoke

Reviewed SHA: `cce70c0b8feb263cc9209332c8c50a44bc97428a`
Comparison SHA: `17faecd962c2cf40e0a3f6ec4434811cfffdd312`
Base SHA: `6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60`
Result SHA: `cce70c0b8feb263cc9209332c8c50a44bc97428a` (review only; no code changes).

## Conclusion

The previous **HIGH** finding for malformed VK likes/comments participant data is **CLOSED** at the reviewed SHA. The implementation now rejects malformed records before the import route persists any result, and focused route regressions confirm that prior stored participants survive all included malformed cases.

The follow-up live-smoke false-success issue is also addressed: smoke checks require the actual provider marker `LIVE`; G/H additionally require a positive safe-integer participant count. Production refuses `USE_VK_MOCK=true` and the production Compose profile explicitly sets it false. Focused adversarial fixtures cover mock provider, empty live imports, and nonempty live imports.

The COMMUNITY admin capability discrepancy remains a **pre-existing, nonblocking debt**, not a finding introduced by this stage. I independently confirm that classification for current server routes: preview passes `fetchPost` only `organizerId` (no explicit COMMUNITY auth), and the resolver's automatic/service/user selection returns only SERVICE or USER. Giveaway detail derives only SERVICE/USER. Participant/snapshot enforcement reads the provider's static capability, which remains `adminDetection: false`.

No CRITICAL, HIGH, or MEDIUM findings remain from these reviewed issues. This report does not declare the phase closed.

## Re-reviewed issues and evidence

### Prior HIGH — CLOSED: malformed likes/comments responses

At [vk-provider.ts](/srv/projects/Agent%20projects/randomayzer/src/providers/vk/vk-provider.ts:34), profile records now require a plain object with a positive safe-integer user ID and correctly typed returned fields. [Response validation](/srv/projects/Agent%20projects/randomayzer/src/providers/vk/vk-provider.ts:49) requires a response object, an items array, a nonnegative safe-integer count, and object-shaped items. Likes also reject duplicate user IDs at lines 297–303. Comments reject malformed/zero/non-integer/unsafe author IDs at lines 355–359 and validate returned profile arrays and IDs.

The earlier concrete failures are blocked: a missing `id` cannot become the participant ID `"undefined"`; a string or unsafe ID is rejected; and malformed comment author IDs are no longer silently omitted while the reported count is accepted. Negative integer comment author IDs remain deliberately excluded as community authors, matching prior behavior and now covered by a focused test.

At [participants route](/srv/projects/Agent%20projects/randomayzer/src/app/api/giveaways/%5Bid%5D/participants/route.ts:86), fetch/enrichment must finish before `updateParticipants` at line 97. The route-level regression at [vk-r3-safety.test.ts](/srv/projects/Agent%20projects/randomayzer/tests/vk-r3-safety.test.ts:200) iterates 25 malformed likes/comments cases, expects `502 VK_INCOMPLETE_DATA`, and checks the previous participant list remains unchanged after each case.

### Smoke false-success — CLOSED

[ProviderFactory](/srv/projects/Agent%20projects/randomayzer/src/providers/factory.ts:10) throws in production if mock mode is explicitly enabled, even when a service token exists. Production Compose sets `USE_VK_MOCK: "false"` at [compose.production.yml](/srv/projects/Agent%20projects/randomayzer/compose.production.yml:36).

Preview and participant-import responses identify the actual provider instance as `LIVE` or `MOCK`. [vk-smoke.sh](/srv/projects/Agent%20projects/randomayzer/tools/vk-smoke.sh:94) requires `providerMode === "LIVE"`; G/H also require `totalCount` to be a safe integer greater than zero. Its test fixture proves MOCK with reported participants fails before creating/importing a giveaway, LIVE with zero participants fails G/H, and LIVE with nonempty participants passes D/G/H: [vk-smoke-provider-mode.test.ts](/srv/projects/Agent%20projects/randomayzer/tests/vk-smoke-provider-mode.test.ts:66).

### Pre-existing LOW metadata discrepancy — nonblocking, not stage1-introduced

`resolveEffectiveCapabilities` still sets `adminDetection: true` for COMMUNITY auth at [vk-capabilities.ts](/srv/projects/Agent%20projects/randomayzer/src/providers/vk/vk-capabilities.ts:34), though no manager-list lookup exists. The exact behavior is present in base SHA `6382cb8e0473ba9ea5ba7a3f94f34e8ab0d4ec60`. Current routes do not supply or resolve COMMUNITY auth: preview calls `fetchPost(url, { organizerId })`; its automatic resolver chooses SERVICE or USER; giveaway details likewise derive only SERVICE/USER. Import and snapshot checks use `provider.capabilities`, whose static `adminDetection` remains false, as enforced by [giveaway-schemas.ts](/srv/projects/Agent%20projects/randomayzer/src/core/validation/giveaway-schemas.ts:89). Thus this metadata branch is unreachable through current routes and cannot enable admin exclusion. I agree it is pre-existing nonblocking debt for this phase, not an open stage1 finding.

## Commands run by this review

- `git show -s --format='%H%n%P%n%s' cce70c0b8feb263cc9209332c8c50a44bc97428a` — confirmed fixed commit parent is `17faecd962c2cf40e0a3f6ec4434811cfffdd312`.
- `git diff 17faecd962c2cf40e0a3f6ec4434811cfffdd312 cce70c0b8feb263cc9209332c8c50a44bc97428a -- <reviewed files>` — reviewed only the immutable commit delta.
- `USE_VK_MOCK=true npx vitest run tests/vk-r3-safety.test.ts tests/vk-smoke-provider-mode.test.ts` — exit 0; 2 files, 19 tests passed (13 R3 safety, 6 smoke provider-mode).
- `bash -n tools/vk-smoke.sh` — exit 0.
- `git diff --check 17faecd962c2cf40e0a3f6ec4434811cfffdd312 cce70c0b8feb263cc9209332c8c50a44bc97428a` — exit 0; no whitespace errors.

Coordinator separately reported raw `npm test` at this SHA passed 380/380 across 63 files; I did not independently rerun the full suite, install, Prisma generation, lint, build, audit, or Docker gates. Live VK and target-host acceptance remain operator-dependent and unverified.

## UNVERIFIED / remaining blockers

- Actual live VK payload contracts and stable offset-pagination behavior remain **UNVERIFIED**; this review does not assert external VK method contracts. The existing documentation discloses that changing VK data during offset pagination cannot be proven point-in-time consistent.
- Live VK consent, real credentials, and production A–H smoke remain unverified.
- Actual VPS/WireGuard socket peer preservation, firewall persistence, TLS/basic-auth, and LAN/internet isolation require operator checks on target hosts.
- Coordinator's full lint/build/audit/Docker acceptance is outside this rereview; no phase-closure claim is made.

## Files changed by this rereview session

- `agents/codex/inbox/2026-10-19-auditor2-high-rereview.md` — task record.
- `agents/codex/done/2026-10-19-auditor2-high-rereview.md` — this report.
- `/srv/projects/AI-Memory/01_PROJECTS/randomayzer/worklog/2026-10-19_auditor2_high-rereview.md` — individual memory worklog.

No production source/tests were changed, and no commit, push, container mutation, or communication with auditor1 was made.