alkblobs/tasks/review-wave-10.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-wave-10	Wave 10 review gate — the security gate	completed	s1-s3-ops-authority-model s2-ranged-fetch-bounds s4-wire-error-detail s5-token-field-bounds s6-local-symlink-doctrine s7-fanout-residuals-doc	narrow	low	phase	review	wave-10 review review-001

Description

The wave-10 review gate (docs/plans/implementation.md §Review gates — the security gate), before wave 11 (fuzzing) decomposes. The wave's claim: the ops and local security findings fixed with their tests, the residuals named as decisions, and the authority model landed per the OQ-14 ADR. The gate audits exactly that claim.

Gate checks:

• S-2's bounds verified by test — an over-count request rejected at the schema, an over-bytes request rejected at the ingress, the bounded-request streaming byte-verified end to end; the pre-materialization gone from FetchPlan::Ranges (the plan carries ranges, the pump reads); the slice-digest ack contract unchanged.
• S-4/S-5/S-6 fixed with their tests — the stable domain texts at every synthesis point (no Error::Display detail, no raw payload Values on the wire), the token field bounded before the decode, the registry/custodial retention recorded embedder-facing with the admission-cap judgment recorded, the local symlink doctrine loud on stat/get and verified loud on the publish path.
• S-7's residuals named on the module — both notes present with their bounds, doc-only diff confirmed.
• S-1/S-3 consistent with the landed OQ-14 ADR — ADR-017 read line by line against the landed behavior: the model statement's wording, the pool-framing texts (no remaining partitioning claim anywhere on the surface), the renewal namespace parity (mapping intact on refusal), the remote-putter role requirement stated; any divergence flagged or the ADR amended through the OQ/ADR path (not silently).
• The closed-by-default ACL surface unchanged — the existing ACL matrix e2e green unmodified (the gate's explicit clause); payload schemas and the op family unchanged (ADR-017's Neutral clause).
• review-001 stamped — S-1..S-7 marked fixed on the review's findings (the stamp discipline from the wave-8/9 gates); the review's overall status disposition judged — with the S round landed, review-001 closes (alksocks review-003 style) or names its residue.
• Statuses updated — the plan's wave table row and the task files' statuses/summaries reflect what landed.
• Gates green (the AGENTS verification matrix): cargo test (default), cargo test --all-features server-less (clean skips), cargo test --all-features against the live harness (the pg acceptance), clippy --all-targets -- -D warnings across the feature variants (default, ops, all-features, the pg-pure shapes), cargo fmt --check, cargo doc --no-deps zero warnings on the default and ops builds.

Live harness

export ALKBLOBS_PG_HOST=localhost
export ALKBLOBS_PG_PORT=15432
export ALKBLOBS_PG_USER=postgres
export ALKBLOBS_PG_PASSWORD=poc
export ALKBLOBS_PG_DB=blobs

The local dockerized postgres container (pglo-poc, postgres:16-alpine on :15432) — running for dev/testing; the pg columns' acceptance requires it.

Findings are fixed inline where cheap, or recorded as wave-11 amendments (the fuzzing wave's decomposition reads them — its target inventory is chosen against the remediated surface).

Acceptance Criteria

• Every gate check above passes (each verified against the diff, not the task's claim)
• ADR-017 fidelity verified line by line; any divergence resolved through the OQ/ADR path
• The ACL matrix e2e green unmodified
• review-001 stamped; its overall status dispositioned
• The plan's wave table + task statuses/summaries current
• All gates green across the verification matrix

References

• docs/plans/implementation.md (§Wave 10; §Review gates — the security gate; §The waves — wave 11's dependency)
• docs/reviews/001-storage-surface-general-review.md (S-1..S-7)
• docs/architecture/decisions/017-ops-authority-model-cas-global-pool.md
• tasks/s1-s3-ops-authority-model.md, tasks/s2-ranged-fetch-bounds.md, tasks/s4-wire-error-detail.md, tasks/s5-token-field-bounds.md, tasks/s6-local-symlink-doctrine.md, tasks/s7-fanout-residuals-doc.md
• AGENTS.md (the verification matrix)

Notes

Completed 2026-10-15. Every check verified against the six commits' diffs (4074499, 9faff12, 3e2d0aa, 437ab7f, c67ed61, 72ba114), not the task claims.

S-2 against the diff — verified: fetch_ranges_ingress(input, bounds) sums the requested lens with checked_add (the overflow arm the same over-bytes refusal, never a panic) and rejects over-byte sums at the establisher with stable domain text; the per-context schema carries maxItems from OpsConfig::fetch_max_ranges; an over-count open is the registry's INVALID_INPUT (the 257-item payload rides the malformed-payload sweep at the default config). FetchPlan::Ranges { key, ranges } carries no slices; fetch_establish_ranges reads per range for the ack digests only (bytes transient, one range resident); fetch_pump_ranges reads per range through the captured Arc<Store>. Tests verified in src/ops/tests.rs: the knob-riding wire round (custom 3/16 config — over-count at the schema, single/summed/overflow over-bytes at the ingress, the bound-exact request establishing with its ack digests and byte-verified concatenation), the default-64-MiB stable-text assertion in the establisher-direct sweep; the existing ranged e2e and the pump silent-return round untouched. The bounded-request streaming is byte-verified; the slice-digest ack contract unchanged.

S-4/S-5/S-6 against the diffs — S-4 verified: every src/ops synthesis point emits stable domain text (store_internal_error/ fetch_establish_failure name only the stage; the refusal family's other arm and the mint/join/data-plane arms stop interpolating; declared codes and details schemas byte-identical; the independent grep sweep found no remaining raw-error/raw-Value interpolation on the wire), the disposition judged (detail dropped, recorded on store_internal_error's doc), tests assert verbatim texts plus absence-of-detail (the wire-driven PUT_REFUSED commit-verification round). S-5 verified: token_wire_schema (maxLength: 64, ^[0-9a-fA-F]{64}$ — the gate/ingress agreement argued from from_hex's case-insensitive contract and asserted by an uppercased wire renewal), from_hex length-first (the 1 MiB rejection + the 63/65/0 near-misses unit-tested), the registry-retention and custodial-never-confirm records embedder-facing with the admission cap named-as-future-hardening (the decomposer's deferred judgment held — the refused-mint-answers-a-committed-put reasoning read and agreed). S-6 verified: open_committed (portable symlink_metadata pre-check + unix O_NOFOLLOW/ELOOP mapping + handle re-check) behind get/size/has; fsync_publish's AlreadyExists arm re-stats the destination (regular = the dedup form with the SyncEvent sequence unchanged; non-regular = loud rejection on both publish forms, zero stage residue); the walk's loud rejection pinned unmodified; the staging-discard judgment coherent (remove_file unlinks the link).

S-7 against the diff — verified doc-only (prose in ops/mod.rs, ops/fetch.rs, plus the one pre-existing local.rs doc-link fix); both residuals named with their bounds at the three homes (the fetch fanout section, the FanoutRegistry doc + the Stall variant, the serving-paths pointer). No behavior change.

S-1/S-3 vs ADR-017, line by line — verified: §1/§2's model statement sits at the ops module doc's ACL section verbatim (placed ahead of the namespace-as-resource naming); §2's texts — the four ACL/miss sites pool-framed (specs.rs stat's declared error and handler miss, fetch.rs's BLOB_MISSING description and fetch_miss); an independent grep for the partitioning framing found no remaining claim; §3's parity in renew (the namespace parameter, RenewalTarget carrying the mint record, the check between the token lookup and the digest check, UnknownToken on mismatch with the mapping intact by construction — peek, never remove — asserted in all three regression shapes from the s1-s3 task); §4's role requirement on the pin hand-over section with the role-duty/grant-implication boundary and the write ⊄ read algebra untouched. No divergence found; no ADR amendment needed.

The Neutral clause — payload schemas and the op family unchanged except S-2's own maxItems addition (S-2's scope, not ADR-017's); the ACL matrix e2e is unmodified (the wave-10 diff contains no change to any ACL test; green in this gate's runs).

Inline findings fixed at the gate (2, doc-only):

1. The s1-s3 commit's module-doc insertion into the renewal probe's composition left two (d) steps (the parity step inserted without renumbering (d)); the second is now (e).
2. The s5 commit's from_hex doc linked the crate-private token_wire_schema in intra-doc syntax — a rustdoc::private_ intra_doc_links warning on the ops build; the link de-linked to plain code font (same text, the S-7 posture). cargo doc --no-deps zero warnings on both builds re-verified.

review-001 stamped and closed — S-1..S-7 carry fixed-stamps (4074499, 3e2d0aa, c67ed61, 437ab7f, 9faff12, 72ba114); the missing wave-8 per-finding stamps for D-1 (126269c/fcc28e7/c67bdd4), D-3 (c67bdd4), D-4 (7aac940), and D-5's landed items (8c186f8) were added at close (they landed without inline marks). The review's status flips to closed with a Closure section naming the residue: D-5's crate-root docs (wave 12's), N-8..N-14 as recorded observations (wave 11's decomposition reads the remediated surface; the rest candidate release-readiness/hygiene work), and the wave-9 gate's two recorded coverage arms.

Summary

Completed 2026-10-15 — the security gate is green; review-001 is closed; wave 11 (fuzzing) decomposes next.

The wave-10 claim audited and confirmed against the diffs: S-2's bounds enforced at their gates (schema maxItems + the ingress total-bytes sum) with the pre-materialization gone (per-range pump streaming, the ack contract unchanged); S-4's synthesis points stale- text-clean with every raw interpolation replaced by stable domain texts and the disposition recorded; S-5's token field bounded before any decode with the retention/custodial records embedder-facing and the admission cap judged-and-recorded; S-6's committed-tree doctrine loud on stat/get/has and verified on the publish path with the walk's rejection unmodified; S-7's two residuals named as decisions across their three doc homes; S-1/S-3 landed per ADR-017 with the fidelity read line by line — no divergence, no amendment. The ACL matrix e2e green unmodified. review-001 stamped (S-1..S-7 + the missing wave-8 D-stamps) and closed with its residue named. Two doc-only inline fixes at the gate: the renewal-composition numbering (d)/(e), and the from_hex private intra-doc link. Six wave-10 task files already completed with Notes/Summaries; the plan's wave-10 row reads completed.

Gates re-run green at the gate (final numbers) — cargo test (default) 149 + 54 + 4; cargo test --all-features server-less 327 + 125 + 4 (pg skips clean); cargo test --all-features + live harness (pglo-poc, postgres:16-alpine :15432, default parallelism) 327 + 125 + 4, 0 failed, 0 skipped; cargo clippy --all-targets -- -D warnings across the feature variants (default, ops, all-features, postgres, postgres,pg-lo, mem,pg-lo); cargo fmt --check; cargo doc --no-deps zero warnings on the default and ops builds. Wave 10 → completed.