From 39b5453287f1b985365efdc605ee46510c670676 Mon Sep 17 00:00:00 2001 From: mptyl Date: Tue, 18 Aug 2026 09:27:11 +0200 Subject: [PATCH] docs(auth): record unresolved Task 15 review --- .../task-15-report.md | 23 +++++++++++++++-- PROJECT_STATE.md | 25 +++++++++++++------ 2 files changed, 38 insertions(+), 10 deletions(-) diff --git a/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md b/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md index 582199d7..1fe13fbf 100644 --- a/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md +++ b/.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md @@ -88,5 +88,24 @@ names and credentials are deliberately omitted. identity/access is available; isolated provider readiness because an unrelated host port is occupied. -The authentication feature is **not release-complete** while required FAIL or PENDING gates remain. -No secret values, real identities, internal endpoints, or registry names are retained. +## Final Task 15 review after fix round 5 + +The fresh Terra review verdict is **CHANGES REQUIRED**. The five-round breaker is exhausted; no +sixth implementation round was started. Two Important findings remain: + +- `StageArchive` does not retain the opaque parent/directory capability through the complete + stream and `Close` lifecycle. Staging-directory creation and final cleanup still use pathname + operations, so an ancestor swap after creation can strand the secret-bearing archive or redirect + cleanup. Deterministic StageArchive swap-and-cleanup coverage is still required on Unix and + native Windows. +- Windows claim removal closes its validated retained parent handles before calling pathname-based + `DeleteFile`. Removal must instead remain handle-relative (or delete through the opened handle), + with a native-Windows ancestor-swap test. + +The focused/full Go, cross-compile, Node 24, browser, Compose, Docker lifecycle, image-traceability, +and cleanup results above remain valid evidence for source `74b062f1a737103524cbe706346cfd65f87cdfd1`. +They do not override the final code-review verdict. Native Windows execution remains PENDING. + +The authentication feature is **not implementation-complete or release-complete** while these code +findings and the required FAIL/PENDING gates remain. No secret values, real identities, internal +endpoints, or registry names are retained. diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md index 301407c7..a0f3e170 100644 --- a/PROJECT_STATE.md +++ b/PROJECT_STATE.md @@ -7,11 +7,12 @@ > ThothII per il repository (app + CLI `thothctl`), (3) come usare l'applicazione ThothII di base > (sessioni, domande, gate). Il documento userà parole semplici ed esempi; i dettagli tecnici > resteranno nei contratti esistenti. Esempio pratico completo: Policlinico San Donato. -> Last updated: 2026-08-18 (Task 15 fix-round-5 evidence recorded; the authentication feature is -> not complete or release-accepted while the required FAIL/PENDING gates listed below remain). +> Last updated: 2026-08-18 (Task 15 fix-round-5 evidence and final review recorded; the final +> review is CHANGES REQUIRED and the authentication feature is not implementation- or +> release-complete). > Point a fresh session here ("read PROJECT_STATE.md") before substantial work. -### Task 15 authentication release — final automated smoke PASS, release incomplete (2026-08-18) +### Task 15 authentication — automated smoke PASS, final review CHANGES REQUIRED (2026-08-18) - Task 13 carry-ins are closed with focused TDD: restore acquires the lifecycle lock before target-dependent preflight; stages the immutable candidate and recovery archives under that lock; @@ -19,8 +20,11 @@ transaction capability. Fix-round-5 makes private archive creation retain its validated parent through the full create/metadata/failure-cleanup sequence: Unix uses `openat` plus descriptor `fchmod`/`fstat` and `unlinkat`; Windows uses NT `RootDirectory`-relative traversal and final - create with the owner-only DACL applied in that same operation. StageArchive capacity, lifecycle, - rollback, streaming, and cleanup behavior remain covered by its existing tests. + create with the owner-only DACL applied in that same operation. Capacity, lifecycle, rollback, + and streaming tests pass, but the final review found that StageArchive drops the retained + capability before pathname-based staging cleanup; an ancestor swap can therefore strand the + secret-bearing archive or redirect cleanup. Deterministic StageArchive swap-and-cleanup tests are + still required on Unix and native Windows. - Final tested source is `74b062f1a737103524cbe706346cfd65f87cdfd1`; fix-round-4 `54698e73400a54ce7c3e6c10099e14eb471ce8b9`, prior final Docker source `e20bf33e2a00102192e5be66b178037aeca3a7b1`, fix-round-2 @@ -45,7 +49,7 @@ `.artifacts/task-15/unified-docker-images.json` (`9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6`), and `.superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md` - (`058d4841ec3aa7296ff9ace8aff2efd12303a8e1b1a58d46d4d41941914343a9`). Authentication smoke + (`67b3ad854457be66ee2525aaf08b8ca2b56b5ee9e6b28e297a7f9b6ede8e526a`). Authentication smoke exercised no Docker images; the final unified run retained all five exercised image identities. - FAIL baseline evidence remains unchanged: Ruff reports 192 errors; MkDocs strict reports 69 warnings; canonical/workspace install checks have existing wording mismatches; Pi user-auth @@ -55,8 +59,13 @@ PSD/manual acceptance because no real identity/access is available; L2 because its configured secret layout is unavailable; isolated provider readiness because an unrelated host port is occupied. These are not PASS claims. -- **Release state: NOT COMPLETE.** Do not mark authentication release-complete until every required - FAIL/PENDING gate is rerun in an eligible environment and is PASS. +- Final Task 15 review after fix round 5 is **CHANGES REQUIRED**. In addition to the StageArchive + cleanup race above, Windows claim removal closes validated retained parent handles before using + pathname-based `DeleteFile`, leaving an ancestor-swap race. The five-round breaker is exhausted; + no sixth implementation round was started. +- **Implementation/release state: NOT COMPLETE.** Resolve both Important code-review findings and + rerun the affected tests/review, then make every required FAIL/PENDING gate PASS in an eligible + environment before marking authentication complete or release-accepted. ### P3 effective configuration and `.tht-dwh` — implementation complete, automated PASS, manual PASS (2026-08-13)