← the record
Review 3dda8339e6ba
internal/brain at 7c24528488, reviewed by
gemini-3.6-flash, verified by
claude-haiku-4-5.
This entry:
hash matches its bytes
link names its predecessor
signature verified
- repo
- git@github.com:pdbethke/corralai
- commit
- 7c245284889c1a1c61d521b29e1fa4c13fd15deb
- scope
- internal/brain · go
- reviewer
- gemini-3.6-flash
- verifier
- claude-haiku-4-5
different model than the reviewer
different vendor: google → anthropic
- substrate
- workspace (a detached worktree at the commit; not a jail)
- started
- 2026-09-07 11:40 UTC
- files shown
- 51 file(s) truncated
Findings (0)
This review recorded no findings.
Looked at and could not break (10)
Recorded so that "found nothing here" can be told apart from "never looked here".
- ActivityRing and capCache in activity.go for thread-safe activity buffering, rune truncation, and telemetry event cap enforcement.
- Role administration tools in admin.go and artifacts.go for requiring isHumanAdmin checks to prevent subagent delegation tokens from elevating privileges.
- Adversarial pool driver runtime (AdvPoolRuntime) in advpool.go for enforcing max shard ceilings, per-shard mutant budget clamping, shadow model deadline widening, and Sink persistence across bugcatch, criticscore, and matrix stores.
- Headless browser manager (BrowserManager) in browser.go for tab idle sweeping and guardNavigateURL SSRF protection against cloud IMDS, link-local addresses, and self-listen endpoints.
- Build certification (certifyBuild and report_build) in buildcert.go for DSSE envelope generation, ledger step marshaling, and graceful degradation during transparency witness outages.
- Control gate runner and staging tools in controlgate.go and controltools.go for fail-closed PR checking, candidate mutation testing, and bounded certify retries.
- Upstream MCP gateway proxy in gateway.go for user endpoint ownership checks, capability listing, and config-driven host rewrite parsing.
- Worker health tracking (HealthBook) and role stall watchdog (DetectRoleStalls) in health.go for claim backoff throttling and multi-role/generalist coverage resolution.
- AskFleet oracle (askfleet.go) and cross-swarm fleet claims (fleetclaims.go) for per-principal rate limiting and verified signature filtering.
- Mission history and replay stream tools in history.go for duration calculation and event-based history summaries.
Reviewer's opinion
Prose, carried but not vouched for.
The signature covers this entry's reproductions — the scripts, their output and their exit codes.
It does not make the opinion below true.
I reviewed the provided files in internal/brain focusing on security, concurrency, authorization gates, and driver integration. The codebase is well-structured, thoroughly tested, and handles error conditions and authorization checks cleanly. I found no reproducible defects within the evaluated scope.
Verifier's opinion
The reviewer's summary is carefully curated and well-chosen from a large, complex codebase. The list identifies genuine security-critical patterns and thoughtful design choices: the adversarial pool's enforced decorrelation (test-critic ≠ test-writer), the human-admin gate that blocks delegation tokens from self-authorizing privilege escalations, SSRF protection in the browser, and foundational checks like fail-closed PR gating. However, the summary is a DESCRIPTION of the implementation rather than a verification or audit. It catalogs observed controls without asserting whether they actually work as intended, cover all paths, or resist realistic attacks. No refutations are possible because the reviewer made no falsifiable claims—no claim that 'X prevents Y' with specific preconditions, no claim that 'code at L does Z', no claim that a given input produces a specific output. The review reads as a competent walk-through of a sophisticated system, but competence at description is not the same as correctness of a security posture.