arah2/.planning/phases/02-bot-skeleton-initdata-security/02-REVIEW-FIX.md

status, phase, source, fixed

status	phase	source	fixed
all_fixed	02-bot-skeleton-initdata-security	02-REVIEW.md	2026-10-22

Fix Summary

Finding	Fix	Commit	Verification
WR-01 unbounded body read on /api/session	bot/src/webhook.ts: 4 KB pre-read Content-Length rejection + post-read backstop → 413, category-only logs	8995498	WK1 valid mint 200; WK2 over-cap signed body → 413, zero KV writes, log "[initdata] rejected: malformed"; WK2b lying Content-Length → 413; WK3 broken stream resolves 413
WR-02 fail-open webhook when secret missing	webhook.ts: missing/empty WEBHOOK_SECRET binding → constant 500 + [webhook] rejected: misconfigured before grammY accept-all path; config.ts REQUIRED comment	3ea1fdd	WK5 unarmed → two consecutive constant 500s, no bot wiring, no KV touch; RED evidence recorded pre-fix; armed+unsigned covered by live 02-03 smokes (401)
WR-03 rotate-on-new atomicity over-claim	sessions.ts: honest invariant documented (intended single live token; reconciliation at mint/next use; orphans TTL-bounded; Phase 4 must not assume more) + best-effort post-mint sweep	af691ae	SR2 re-worded sequential; SR3 stale-replica emulation asserts honest outcome; PG1/PG2 unchanged

Adjacent INFO fixed in same commits: IN-01(b) dead branch removed, IN-01(c) Phase-4 don't-delete notes added.

Out of scope (Phase 7 audit): IN-01(a), IN-02, IN-03, IN-04, IN-05.

Verification

• npm test -w bot → 34 passed, 0 failed (was 27)
• npm run bot:typecheck → exit 0
• All 4 console.* in bot/src are category-only (no payload/uid/timestamp/coords)
• Redeployed after fixes: version b6ba6e58; live /api/session garbage → 401; webhook pending 0; only stale (pre-fix) last_error

Review status

02-REVIEW.md status issues_found → all Critical+Warning findings fixed; 3 INFO deferred deliberately.