`consensus/the-ai-factory.md`

31 lines

# Consensus — the-ai-factory
Generated 2026-04-30T23:48:02-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `server.js:67`, `server.js:95`, `server.js:31`: no auth plus `Access-Control-Allow-Origin: *`; any webpage Steve visits can POST to localhost and trigger builds/activation. Fix: require `ADMIN_TOKEN` Bearer auth on all mutating routes and restrict CORS to the viewer origin.
- `server.js:95`, `server.js:104`, `server.js:143`: activation copies LLM-generated files into `~/.claude` with only status gating, and `?force=true` bypasses approval. Fix: remove force from HTTP or require token + explicit local CLI confirmation; show/record a deterministic diff before copy.
- `src/stages/scaffold.js:16`, `src/stages/smoke_test.js:20`: generated subagents may receive `Bash`, `Write`, or `Edit`; smoke tests only check that tools exist, not whether they are safe. Fix: parse frontmatter and deny dangerous tools unless explicitly allowlisted by artifact type/request.
- Secrets leaked in code: none observed; checked-in `.env` is blank (`.env:4`, `.env:10`, `.env:14`).
- SQL injection: none observed; queries use placeholders.
- Obvious dependency CVEs from package files: none observed.

## Round-1 applied
## Applied
- `src/llm.js:10` — replaced the user-specific absolute Claude CLI fallback path with `claude` — removes a hardcoded `/Users/...` path while preserving env override via `CLAUDE_CLI`.
- `.env.example:15` — added `CLAUDE_CLI=claude` placeholder — documents the configurable CLI path without introducing a real secret or machine-local path.

## Still deferred for Steve
- P0 — `server.js:31`, `server.js:67`, `server.js:95` — no auth plus wildcard CORS allows browser-origin localhost POSTs — deferred because adding token auth/CORS policy is outside the safe-fix list and changes operator workflow.
- P0 — `server.js:95`, `server.js:104`, `server.js:143` — activation can copy generated files into `~/.claude` and `?force=true` bypasses approval — deferred because removing force or adding local confirmation/diff changes activation semantics.
- P0 — `src/stages/scaffold.js:16`, `src/stages/smoke_test.js:20` — generated subagents may include dangerous tools and smoke tests only verify presence — deferred because safe remediation requires a frontmatter parser and artifact-specific allowlist design.
- P1 — `server.js:78` — fire-and-forget pipeline can leave runs stuck after a process crash — deferred because a resumable worker/stale-job recovery is a behavioral change beyond the safe list.
- P1 — `src/stages/memory_write.js:32` — read-modify-write append to `MEMORY.md` can race under concurrent activations — deferred because lock/atomic append behavior needs concurrency testing.
- P1 — `src/pipeline.js:52`, `src/llm.js:51` — no concurrency limit around Ollama/Claude CLI — deferred because queue sizing and backpressure policy need Steve’s decision.
- P1 — `README.md:17`, `package.json:8` — docs say `npm run start` boots orchestrator and viewer, but it only starts the orchestrator — deferred because docs/public-facing command behavior changes were not in the safe-fix list.
- P1 — `PLAN.md:106` — completed items are duplicated as open TODOs — deferred because plan/status cleanup is not in the safe-fix list.
- P1 — `package.json:15`, `.env.example:4`, `src/llm.js:5` — Anthropic SDK/API key remain despite “No Anthropic API” — deferred because dependency/env removal is not a safe autonomous fix and may require package-lock decisions.