[CompleteDotTech]

Refs CompleteTech-LLC/complete.tech#17 (gap 1, exact-target control). Targets main (#10 and #11 merged; main merged in). Scanning stays disabled by default. When enabled, the gate is on by default: every terms version is strict under config terms_policy (required, explicit per served version), and only an r2-or-earlier version listed as legacy is exempt.

What changes

Mailbox confirmation shows control of an email address, not of the website, and a referral code shows neither. For every job whose terms version is strict under terms_policy (the default for any version; frozen into the job at creation as control_required; any profile broader than r2 always requires it), confirmation no longer queues it: it waits as awaiting_control and cannot be claimed, started, admitted or given a detailed report until control of the exact hostname is shown:

• DNS TXT at _ct-scan-challenge.<host> = ct-scan-verify=<value>, or HTTPS file https://<host>/.well-known/ct-scan-challenge.txt containing the value. The customer asks for a check on a private page (GET only displays; nonce-protected POST acts). At most 3 checks, >= 1 minute apart; each is one TXT lookup or one HTTPS request, fixed path, no redirects, 4 KiB, 10 s; no probes. The worker takes a scheduled check (control/claim), is admitted exactly once per lease through the same guard as scans (admit kind control: cancellation, expiry, lease, budget, pacing, attempt consumed in the admission compare-and-set; the admission is recorded on the lease (control_admitted), so a second admit under the same lease is refused 409 already_admitted for the whole two-minute lease, and the worker ends the check without retrying), runs it in the unprivileged child, and relays what it saw (control/result, length-bounded, untrusted); WordPress compares with a stored hash. A result counts only if an admission happened under that lease. Three failures (or all checks spent) => blocked (target_control_failed): never scanned, no detailed report, no fallback.
• The published challenge and the page capability are two independent secrets (found in review: a single value let anyone who read the DNS record burn the customer's attempts).
• Recorded manual authority review (admin): evidence (20-1000 chars), reviewer account, target, time and expiry (the authorization expiry) are stored; an expired review ends the authorization. Refused while a check is in flight (control_state = checking).
• The HTTPS file match ignores surrounding whitespace and a leading UTF-8 BOM. The DNS check does not follow a CNAME at the challenge name, and a check made before a new record propagates can see a cached negative answer and still uses an attempt (documented and stated on the customer page).
• Jobs created before the schema 5 upgrade have control_required = 0; a row with a missing value is treated as requiring control.
• Verification traffic is serialized with scans worker-wide (enforced in WordPress).
• Lead intake stays distinct from signature: nothing here creates a job without a signed, read-back acceptance, and a caller/referrer cannot supply or satisfy a challenge.

Fail-closed behavior

Any anomaly (unknown method/profile, unconfirmed recipient, lapsed lease, no admission, wrong lease/scope/method, oversized or malformed result, DB fault, lost compare-and-set, cancelled/expired/revoked) refuses and changes nothing; a result is never accepted without an admission; a job that required control (or whose control_required value is missing) and has no verified control is cancelled by every liveness check; a lease is admitted at most once; control state is cleared by Stop, revoke and expiry.

Tests (local only; no third-party host or resolver)

• control.php (WordPress/MariaDB, re-runs itself with the strict terms_policy): confirmation behavior, limits (3 attempts, 1/min, pacing, budget, one admission per lease even after the interval passes), authority review refused mid-check, BOM handling, missing control_required fails closed, forged/malformed/near-miss values, spent tasks, lapsed leases, Stop/expiry mid-check, DB faults, serialization, blocked => no scan/report, manual review (authorization, evidence, expiry), and cases that defend each central invariant directly. Mutation-checked.
• test_control.py (34): DNS wire parsing (compression loops, truncation, id/question/source spoofing, caps), a loopback UDP DNS server, a local HTTP server (redirects not followed, 4096-byte edge, non-UTF8, slow server, refused admission reaches nothing), the real scanner entry point, a real child process under the supervisor (kind enforcement, output validation), and the service loop.
• deployment/test-http-control.py: the customer pages and the signed worker API over real HTTP (the CI step takes ~61 s for the one-minute interval).
• CI on the previous head: green (ubuntu/windows, py3.10/3.14, WordPress/Docker, root-only isolation).
• Independent adversarial review found 1 high, 3 medium and several low/nit items; all addressed in the last commit (see its message).

Reviewer: please attack

Any path from a control_required job to scan traffic without verified control; the challenge/capability separation; the requested -> checking -> pending/blocked state machine and attempt accounting; match logic; the DNS client; admin authority review.

Not done / needs the owner

• Product/legal: whether any r2-or-earlier version should stay legacy (exempt) in terms_policy; every other version requires control; whether a customer may get a fresh challenge after blocked; per-contact/domain/IP quotas for fresh challenges (spec section 4.5) are not implemented because there is no reissue.
• The customer pages' wording is functional only (TODO(owner)); form/CTA/email/caller-script copy is out of scope here.
• DNS answers come from the container's first configured resolver; confirm the deployment's resolver and egress policy.

Fail-closed review round 2 (coordinator findings)

Fixed in this stack, each with tests that fail without the fix (mutation-checked):

• Per-request admission guard for the scan worker #10: activation requires egress_enforced: true (loader refuses otherwise); docs/README/example config state it; unverified nftables egress sketch added (not a claim of enforcement). In-flight bound is exactly 10 s from the grant (no grace). Authorization read from the DB, not the object cache. A completed result needs >= 1 admitted request. Failed schema upgrade: one error_log, 5-minute back-off, plugin 0.2.0. Special-purpose IP ranges listed explicitly (CGNAT, documentation, benchmarking, 3fff::/20, 6to4, NAT64, ...), tested independent of the interpreter's ipaddress.
• Verify bound acceptance evidence; accepted copy for the verified customer #11: bound evidence is required for every version (terms_policy, strict by default; legacy only for r2-or-earlier); the loader refuses to enable without an explicit entry for the served version. ct_scan_target_summary() is the one canonical summary and now includes limits and period.
• Exact-target control gate (DNS TXT / HTTPS file / recorded authority review) #12: control is required by the same policy (replaces the opt-in list).
• Retention mechanics: closure, per-version deadlines, holds, deletion tombstones #13: non-legacy retention floored at 6 years (words/null/0/1 mean 6); tombstone scope is a keyed MAC; deletion needs closed_at >= created_at and a sane clock; retention runs outside the queue lock (own lock, throttled, one short queue lock per deletion) so Stop never queues behind a batch.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T19:56:14.421253Z	9e69c38	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-23T19:57:08.274848Z	9e69c38	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.