A large window since Audit #11, covering the DNS-only role’s remaining buildout, the first-run setup wizard, two-key server linking, and the full Mail Only work. It was reviewed by area: the privileged provisioning script, the cross-server linking and dispatch subsystem, cross-account authorization, a secret scan of the repositories, and a dedicated pass on the setup wizard as an entirely new pre-authentication surface.
The real finding
Most areas came back clean. The setup wizard and the server-linking flow converged on one class of problem: later wizard steps did not independently verify that the earlier steps’ preconditions held, relying on step ordering instead. A real invariant check (does the required state actually exist, rather than a session flag that suggests it) was added to every later step, plus a final check at the step that makes setup irreversible.
What else turned up
- A race in first-admin creation: the check-then-create step now runs under a lock.
- Key separation: a value used for one purpose was also reused for another; a domain-separation step now keeps them apart. Real-world impact was already narrow, but the fix was cheap.
- Setup token lifetime: setup tokens now expire. Testing this change caught a bug in our own first version, caused by a date library behaving differently after an upgrade; the test suite caught it, not a re-read of the code.
- Defense in depth: two app-installer update actions were missing a containment guard that their siblings have. Not exploitable as the code stood, but added for consistency.
Verified
Full local suite (1,683 tests) and the code-style check green after every fix. No live server changes during this pass; everything was fixed locally before reaching the dev server.