2026-09-28 15:51:13 +02:00
|
|
|
# BUGS.md — open findings
|
|
|
|
|
|
2026-10-18 00:54:23 +02:00
|
|
|
Only the 2026-09-28 specification review (B-73 … B-100) still has open entries
|
Readiness, Electrum status, audit browsing and logs (B-92, API-37, API-46, API-47, AUD-34, AUD-41, ARC-02, ARC-09, ARC-61, ELC-29, SEC-48)
2026-10-18 01:15:22 +02:00
|
|
|
(B-93). A finding is removed from this file once it is fixed, and
|
2026-10-18 00:54:23 +02:00
|
|
|
`git log --all --grep 'B-nn'` is the record of how it was closed. Per CLAUDE.md's
|
|
|
|
|
convention each entry gets its own commit with its own regression test, and the `B-nn`
|
|
|
|
|
marker goes in a comment next to the fix.
|
2026-09-28 15:51:13 +02:00
|
|
|
|
2026-09-29 09:17:52 +02:00
|
|
|
# Audit of 2026-09-28 — specification review (B-73 … B-98)
|
2026-09-28 15:51:13 +02:00
|
|
|
|
|
|
|
|
Fourth audit, run against the new specification in `docs/` rather than the code
|
|
|
|
|
alone: four independent reviews (coin/chain mechanics, money state machine,
|
|
|
|
|
DevOps, spec cross-validation), with the critical claims re-verified in code.
|
|
|
|
|
The target behaviour of every entry below is now written into `docs/` as
|
|
|
|
|
requirements marked `*Stato:* da implementare (B-nn)`; the Italian overview, the
|
|
|
|
|
design decisions and the implementation order are in
|
|
|
|
|
[docs/piano-correzioni.md](docs/piano-correzioni.md). The code has **not** been
|
|
|
|
|
changed yet. Same convention as above: one commit per entry, with its own
|
|
|
|
|
regression test, spec + code + test together.
|
|
|
|
|
|
|
|
|
|
Design decisions taken with the owner on 2026-09-28 (they change existing
|
2026-10-14 12:05:57 +02:00
|
|
|
decisions, see `docs/limiti-noti.md`):
|
2026-09-28 15:51:13 +02:00
|
|
|
|
|
|
|
|
- **Draw by commit-reveal.** The winner must not be computable by anyone who
|
|
|
|
|
controls block production, since PLM's hashrate (~22 TH/s) is rentable.
|
|
|
|
|
- **Never release funds on doubt.** A money-moving row is rolled back only on proof
|
|
|
|
|
(an explicit rejection, or its inputs confirmed-spent elsewhere), never on a
|
|
|
|
|
timeout or on one server's silence.
|
|
|
|
|
- **One pool address per round**, so a round's money, history and payout are
|
|
|
|
|
isolated from every other round's.
|
|
|
|
|
- **Deposits need 6 confirmations** (configurable), everything else keeps 1: the
|
|
|
|
|
deposit is the only input a user can double-spend.
|
|
|
|
|
- **Contain reorgs instead of pretending they don't happen:** detect them, pause
|
|
|
|
|
on deep ones, and pay out only what is verifiably on chain.
|
|
|
|
|
|
|
|
|
|
## Medium
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### B-93 — Deploys and rollbacks
|
|
|
|
|
|
|
|
|
|
A deploy with an open SSE stream never shuts down gracefully (uvicorn waits, Docker
|
|
|
|
|
kills after 10s); an older image cannot start on a newer DB; images are untagged;
|
|
|
|
|
`SITE_ADDRESS` passed per command reverts to `localhost` on the next plain
|
|
|
|
|
`docker compose up`.
|
|
|
|
|
|
|
|
|
|
Fix: close SSE streams on shutdown, `stop_grace_period: 30s`, await task
|
|
|
|
|
cancellation; tag images per release; `SITE_ADDRESS` in `.env` with `${SITE_ADDRESS:?}`;
|
|
|
|
|
documented pre-deploy backup and downgrade procedure.
|
