verification skills: remaining follow-ups (RepoPurger model, S3 multipart ModTime, osv.sh cleanup edge cases)

Open
  • Is something wrong?
#645 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
38/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
aws, go
Domain
devtools, security, testing-qa

Research direction

Start with .agents/skills/verify-orphan-sweep/ and .agents/skills/verify-openstorage/scripts/osv.sh, then read the referenced follow-ups in #641 and #643. The work spans a TLA+ model, cleanup symlink and redaction handling, and an AWS S3 multipart check that is blocked on an approved account, bucket, and spend cap. Done means those cases are covered and cleanup does not leave readable raw tokens after a redaction error.

Written by the indexing model from the issue text.

Description

testing tracking

These verification-skill follow-ups remain after #628 closed. #641 fixed #628 items 1 and 2, and #643 fixed item 4.

verify-orphan-sweep (.agents/skills/verify-orphan-sweep/)

  1. The model does not cover RepoPurger. It needs a TLA+ model of its own: purge eligibility, the delete guard, and the race with a write that re-registers a pack.
  2. S3 multipart ModTime is untested. On AWS S3, a multipart-created object gets the upload's start time as its date, so a quarantine copy of a pack over 5 GiB ages from the start of the copy. This needs a real AWS bucket, which waits for an approved account, bucket and spend cap.

verify-openstorage (.agents/skills/verify-openstorage/scripts/osv.sh)

  1. cleanup copies serve logs and state.env into fixed evidence names with cp, and writes tokens.txt with a redirect. Both write through a symlink planted at those paths, as before #641. Only the run owner can plant one, because the run directory is private. Fix idea: refuse a symlink at each fixed target.
  2. When the redaction walk hits an unreadable entry, it stops part-way, so later files keep raw tokens until a rerun. Cleanup does exit 1 and keeps work/, so a rerun after fixing the mode redacts them. Fix idea: redact every readable file first, then fail.

Owner: @ThomasK33. Trigger: the next change to either skill, or before agents rely on the skill evidence for a release.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh

Dominant language
Go
Stars
0
Forks
0
Avg merge
6h 16m
Merged PRs (30d)
243

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from coder/openstorage

All issues in coder/openstorage

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.