Thermo-nuclear review: round-2 follow-up (index of #74–#122)

[rawkode]

Thermo-nuclear review — round-2 follow-up (index)

Round-2 convergence review of PR #70 surfaced 85 findings. The 2 P0s (pkt-line underflow, OCI digest-pin) are fixed on the PR branch. The rest are tracked as individual issues below.

P1 — high impact (7)

• [P1][server/security] Operator-code token exchange has no rate limiting (brute-force exposure) #74 [server] Operator-code token exchange has no rate limiting (brute-force exposure)
• [P1][server/correctness] Rate limiter is global, not per-principal as its config/name implies #75 [server] Rate limiter is global, not per-principal as its config/name implies
• [P1][server/correctness] storage.query/list-all ignore pagination — next_page always None drops records beyond limit, breaking extension scan loops #76 [server] storage.query/list-all ignore pagination — next_page always None drops records beyond limit, breaking extension scan loops
• [P1][server/concurrency] Temp worktree dir name collides across concurrent/sequential evaluations; remove_dir_all wipes a peer's tree #77 [server] Temp worktree dir name collides across concurrent/sequential evaluations; remove_dir_all wipes a peer's tree
• [P1][core/correctness] OIDC issuer ids are not checked for uniqueness; duplicate ids silently collapse and drop an issuer #78 [core] OIDC issuer ids are not checked for uniqueness; duplicate ids silently collapse and drop an issuer
• [P1][core/correctness] parity_fingerprint reports jobs count as a hardcoded 0, silently understating job state #79 [core] parity_fingerprint reports jobs count as a hardcoded 0, silently understating job state
• [P1][docs/wit-contract] Manifest schema forbids same-extension reactor mutations that the WIT contract explicitly allows #80 [docs] Manifest schema forbids same-extension reactor mutations that the WIT contract explicitly allows

P2 — should fix (41)

• [P2][server/security] Git smart-HTTP endpoint has no rate limiting despite dedicated config #81 [server] Git smart-HTTP endpoint has no rate limiting despite dedicated config
• [P2][server/security] Operator-code comparison is not constant-time #82 [server] Operator-code comparison is not constant-time
• [P2][server/performance] SSE /events and /graphql/stream buffer the entire event log into one response #83 [server] SSE /events and /graphql/stream buffer the entire event log into one response
• [P2][server/type-boundary] HTTP status is derived by substring-matching String error messages #84 [server] HTTP status is derived by substring-matching String error messages
• [P2][server/error-handling] Storage errors on credential lookup are reported as 401 Invalid, masking outages #85 [server] Storage errors on credential lookup are reported as 401 Invalid, masking outages
• [P2][server/maintainability] main.rs is a 10,776-line god-file mixing routing, handlers, auth, git, CUE, storage and tests #86 [server] main.rs is a 10,776-line god-file mixing routing, handlers, auth, git, CUE, storage and tests
• [P2][server/correctness] GraphQL operation dispatch relies on a hand-rolled, lossy query parser #87 [server] GraphQL operation dispatch relies on a hand-rolled, lossy query parser
• [P2][server/wit-contract] storage.query silently ignores filters and order — broken WIT contract #88 [server] storage.query silently ignores filters and order — broken WIT contract
• [P2][server/tests-docs] Stale module/section docs claim relations, comments, events, ops are unimplemented stubs #89 [server] Stale module/section docs claim relations, comments, events, ops are unimplemented stubs
• [P2][server/dead-code] check_run_to_json emits duplicate commitOID/commitOid keys; the legacy alias has no consumer #90 [server] check_run_to_json emits duplicate commitOID/commitOid keys; the legacy alias has no consumer
• [P2][server/correctness] Two distinct extension schemas can canonicalize to the same filename and silently overwrite each other #91 [server] Two distinct extension schemas can canonicalize to the same filename and silently overwrite each other
• [P2][core/dead-code] Entire extension manifest/capability/runtime model in extensions.rs is dead code (parallel to the authoritative server model) #92 [core] Entire extension manifest/capability/runtime model in extensions.rs is dead code (parallel to the authoritative server model)
• [P2][core/type-boundary] InstanceConfig.ceilings and rate_limits are unconfigurable: wire layer always hardcodes ::default() #93 [core] InstanceConfig.ceilings and rate_limits are unconfigurable: wire layer always hardcodes ::default()
• [P2][core/correctness] OIDC allowed-domain match is case-sensitive, denying logins for mixed-case email domains #94 [core] OIDC allowed-domain match is case-sensitive, denying logins for mixed-case email domains
• [P2][core/dead-code] Entire authz module (InMemoryAuthorizer, CorePermission, can_read_visibility) is dead code; server uses a separate, divergent authorization path #95 [core] Entire authz module (InMemoryAuthorizer, CorePermission, can_read_visibility) is dead code; server uses a separate, divergent authorization path
• [P2][core/dead-code] TokenAction::as_scope is unused dead code #96 [core] TokenAction::as_scope is unused dead code
• [P2][core/security] login does not audit failed attempts against an unknown issuer id #97 [core] login does not audit failed attempts against an unknown issuer id
• [P2][core/dead-code] Entire JobQueue lifecycle is an unwired parallel implementation (dead code per project hard rule) #98 [core] Entire JobQueue lifecycle is an unwired parallel implementation (dead code per project hard rule)
• [P2][core/concurrency] extend_lock treats wall_time_quota_ms as a per-call cap, not a cumulative budget, allowing unbounded lease extension #99 [core] extend_lock treats wall_time_quota_ms as a per-call cap, not a cumulative budget, allowing unbounded lease extension
• [P2][git-http/dead-code] Dead module: errors::GitHttpError is never used #100 [git-http] Dead module: errors::GitHttpError is never used
• [P2][git-http/dead-code] Unused public API on FetchRequest: filter_requested() and push_want() #101 [git-http] Unused public API on FetchRequest: filter_requested() and push_want()
• [P2][extension-oci/security] No size limit on pulled WASM layer enables memory-exhaustion DoS from an untrusted registry #102 [extension-oci] No size limit on pulled WASM layer enables memory-exhaustion DoS from an untrusted registry
• [P2][wit-codegen/type-boundary] Generated TS client is fully untyped (input?: unknown / OpResult<unknown>) despite doc promising typed inputs #103 [wit-codegen] Generated TS client is fully untyped (input?: unknown / OpResult) despite doc promising typed inputs
• [P2][cli/maintainability] validate-config validates a hardcoded built-in config, not the user's real config #104 [cli] validate-config validates a hardcoded built-in config, not the user's real config
• [P2][extensions/dead-code] ext_issues declares unused host imports relations.read, relations.write, events.read (over-grant) #105 [extensions] ext_issues declares unused host imports relations.read, relations.write, events.read (over-grant)
• [P2][extensions/dead-code] ext_issues grants allowedEventReads to ext_pull_requests but never reads events #106 [extensions] ext_issues grants allowedEventReads to ext_pull_requests but never reads events
• [P2][extensions/dead-code] ext_pull_requests declares unused host imports events.read and relations.write #107 [extensions] ext_pull_requests declares unused host imports events.read and relations.write
• [P2][extensions/dead-code] ext_epics declares allowedCrossCalls to ext_issues/issues.by-ref-issue that it never invokes #108 [extensions] ext_epics declares allowedCrossCalls to ext_issues/issues.by-ref-issue that it never invokes
• [P2][extensions/error-handling] Inconsistent corrupt-record handling: list scans in ext_issues and ext_epics abort on a single undecodable doc #109 [extensions] Inconsistent corrupt-record handling: list scans in ext_issues and ext_epics abort on a single undecodable doc
• [P2][extensions/wit-contract] ops.wit cites a non-existent op name issues.close as its canonical example #110 [extensions] ops.wit cites a non-existent op name issues.close as its canonical example
• [P2][docs/tests-docs] docs/extensions.md documents uiManifest field and a WIT world shape that don't match the real schema/extensions #111 [docs] docs/extensions.md documents uiManifest field and a WIT world shape that don't match the real schema/extensions
• [P2][frontend/correctness] ActivityStream renders internal nav as raw <a href>, forcing full-page reloads outside a repo workbench #112 [frontend] ActivityStream renders internal nav as raw , forcing full-page reloads outside a repo workbench
• [P2][frontend/performance] formatItem() is recomputed 6x per row on every render in ActivityStream template #113 [frontend] formatItem() is recomputed 6x per row on every render in ActivityStream template
• [P2][frontend/dead-code] sdk-preact bindings are never configured; workspace-deps only void-references the symbol to keep the dep linked #114 [frontend] sdk-preact bindings are never configured; workspace-deps only void-references the symbol to keep the dep linked
• [P2][frontend/maintainability] Extension host registerWidget/registerRoute/registerCard return no-op dispose() stubs that don't unregister #115 [frontend] Extension host registerWidget/registerRoute/registerCard return no-op dispose() stubs that don't unregister
• [P2][frontend/correctness] Issue-board route discards its /board subpath, mounting the issues root instead of the board #116 [frontend] Issue-board route discards its /board subpath, mounting the issues root instead of the board
• [P2][frontend/maintainability] RepoTabs applies role=tablist/tab/aria-selected to plain RouterLinks with no tab keyboard semantics #117 [frontend] RepoTabs applies role=tablist/tab/aria-selected to plain RouterLinks with no tab keyboard semantics
• [P2][frontend/type-boundary] Structured admin telemetry is cast from an unvalidated GraphQL JSON scalar #118 [frontend] Structured admin telemetry is cast from an unvalidated GraphQL JSON scalar
• [P2][frontend/wit-contract] use-project-counts hardcodes specific extensions, op names, event topics, and re-implements backend state-bucketing in the generic SDK #119 [frontend] use-project-counts hardcodes specific extensions, op names, event topics, and re-implements backend state-bucketing in the generic SDK
• [P2][frontend/tests-docs] sdk-vue shared modules (markdown, parse-query, classify-principal, project-counts) have no unit tests despite being the single cross-extension source of truth #120 [frontend] sdk-vue shared modules (markdown, parse-query, classify-principal, project-counts) have no unit tests despite being the single cross-extension source of truth
• [P2][core/dead-code] Unused dependency getrandom in comtrya-core #121 [core] Unused dependency getrandom in comtrya-core

P3 — polish (batched)

• [P3 batch] Thermo-nuclear round-2 polish items (35) #122 — 35 polish items