praxis/.ciagent/REVIEW.md

Praxis — v0.4 Milestone Review (Final Phase P3)

Reviewer: ci-code-reviewer (multi-persona: correctness, testing, security, performance, maintainability, adversarial) Scope: full v0.4 milestone diff — git diff main..HEAD (74 files, +12,361/-819 LOC) — covers P1 (operator foundation) + P2 (cohort dashboard) Branch: phase/03-final-review-ship (from milestone/v0.4-operator-tier) Date: 2026-08-04 Method: code inspection (all v0.4 source + tests), test execution, security grep, grill MUST verification, adversarial analysis

Summary

• Verdict: APPROVE_WITH_NOTES
• Personas: correctness PASS, testing PASS, security PASS, performance PASS, maintainability PASS, adversarial PASS
• P0 fixes applied: 0 (none needed — no P0 issues found across all 6 personas)
• P1+ flagged: 8 (4 from P1 VERIFY + 4 from P2 VERIFY — all non-blocking, all carry-forward)
• Total v0.4 REQ coverage: 8/8 (REQ-MT-01, REQ-AUTH-01, REQ-NFR-AUTH-01, REQ-NFR-MT-01, REQ-MT-02, REQ-DASH-01, REQ-NFR-DASH-01, REQ-NFR-DASH-02)
• Grill MUSTs honored: 6/6 (G-008 backup drill, G-011 two-store fallback, G-027 first-boot path, G-031 R-AUTH-01 reframe, G-038 differencing-attack test, G-041 SPA fallback subclass)

Test Results

Suite	Result	Notes
python3 -m pytest tests/	317 passed, 36 skipped, 0 failed (90.28s)	Postgres-requiring tests skip gracefully (PRAXIS_PG_DSN unset); voice-service-key skips pre-existing
cd client && npx vitest run	17/17 passed	Dashboard auth gate, login (200/401/429), sparkline (4 cases), suppressedLabel, formatFreshness, no-PII-in-DOM
cd client && npm run build	PASS	168 modules, 414ms, 662KB / 186KB gzip
cd client && npm run typecheck	PASS	tsc -b --noEmit clean
python3 -c "import server.__main__"	PASS	All v0.4 modules load, logs "SPA fallback enabled"
docker compose config	PASS	Validates; postgres has no ports: (D-040 honored)
Security grep (f-string SQL, hardcoded secrets, missing auth deps)	PASS	No injection vectors; no secrets in code; all /api/operator/* auth-gated

---

Persona 1 — Correctness

Findings (all PASS — no P0)

1. k-anon threshold (exactly 10): K_ANON_THRESHOLD = 10 is a module constant in server/cohort/aggregator.py:32. Suppression logic suppressed = active_count < K_ANON_THRESHOLD (line 87). Boundary tests pass: 9 → suppressed (test_9_learners_suppressed), 10 → not suppressed (test_10_learners_not_suppressed), 11 → not suppressed (test_11_learners_not_suppressed). The threshold is NOT env-configurable (correct for a privacy control — adversarial persona confirms). ✅

2. VC key migration (archive-before-active, G-027 first-boot): server/vc/migrate_keys.py implements the R-VC-MIG-01 ordering correctly:

   • Step 2 (_archive_v03_public_key, line 86) runs BEFORE step 3 (_generate_fresh_v04_key, line 90).
   • G-027 first-boot path (line 80-87): if v03_row is None → archived_key_id=None, skips archive, generates fresh key only. Test: test_migration_g027_first_boot_no_v03_key.
   • Idempotent (line 74-76): if get_active_signing_key_row() returns non-None → returns {None, None} (no-op). Test: test_migration_idempotent_when_active_key_exists.
   • init_issuer_key uses ON CONFLICT (id) DO NOTHING → cannot replay to overwrite. ✅

3. Auth flow (login/logout/me, cookie lifecycle, rate limit):

   • Login (routes.py:58): rate-limited, verify_password, sets request.session["operator_id"], updates last_login_at, rehashes if needs_rehash.
   • Logout (routes.py:104): Depends(current_operator), clears session.
   • Me (routes.py:112): Depends(current_operator), returns operator info.
   • Inactive operator (dependencies.py:40): 401 + session.clear() (invalidates cookie). ✅

4. SPA fallback (SpaStaticFiles subclass, G-041): server/__main__.py:279-289 defines class SpaStaticFiles(StaticFiles) with get_response override that returns FileResponse("index.html") ONLY on 404 (non-file paths). This is the custom subclass mandated by G-041, NOT a @app.get("/{path:path}") catch-all (which would shadow asset serving). Test: test_assets_served_by_staticfiles_not_spa_fallback confirms /assets/index.js returns javascript content, not index.html. ✅

5. Nightly scheduler timing (03:00 CT): seconds_until_next_03_ct (nightly.py:32) computes seconds until 03:00 CT correctly. Tests: test_seconds_until_next_03_ct_future_today + test_seconds_until_next_03_ct_past_today_wraps_tomorrow. Fixed UTC-5 offset is a documented DST approximation (P1+-02 from VERIFY-P2). ✅

6. Race conditions (aggregation hook fire-and-forget, pool access):

   • Hook: session_recorder.py:161 uses asyncio.create_task(self._run_cohort_aggregation(session_outcome)) — fire-and-forget, off the voice path.
   • Hook failure: hook.py:37 except Exception: log.exception(...) — no propagation; nightly reconciles.
   • Pool access: all PgStore methods use async with self.pool.acquire() as conn — no leaked connections. ✅

Correctness verdict: PASS — no logic errors, off-by-ones, or missing edge cases found.

---

Persona 2 — Testing

Findings (all PASS — no P0)

1. Postgres-requiring tests skip gracefully: 36 skips total — all test_pg_store.py (12), test_p1_auth_integration.py, test_p1_vc_migration_e2e.py, test_backup_restore.py, test_p2_aggregation_integration.py (3) skip with clear messages when PRAXIS_PG_DSN is unset. No hard CI dependency on Postgres. ✅

2. G-038 differencing-attack test: tests/test_cohort_aggregation.py:175 test_g038_differencing_attack_cannot_isolate_dropped_learner — seeds 10 learners in window A, 9 in window B (learner-9 dropped), asserts:

   • Window A has non-suppressed cells (10 ≥ threshold).
   • Window B has ALL cells suppressed (9 < threshold), NO non-suppressed cells.
   • Suppressed cells have value=None (differencing-attack defense — subtraction impossible).
   • No learner-9 ref leaks in any aggregate cell arg. API e2e layer: test_p2_aggregation_integration.py::test_g038_differencing_attack_api_layer (skips without Postgres, logic verified at unit layer). ✅

3. R-VC-MIG-01 e2e test: tests/test_p1_vc_migration_e2e.py (skips without Postgres) — seeds v0.3 VC, runs migration, verifies v0.3 VC against archived superseded key, issues v0.4 VC, verifies, tampers, confirms idempotency. Mock-based equivalent: test_vc_migration.py::test_migration_archives_before_activating_r_vc_mig_01 (instrumented ordering test). ✅

4. Graceful degradation (server starts without Postgres): lifespan in __main__.py:78-90 — if PRAXIS_PG_DSN unset, logs WARNING, sets pg_pool=None, pg_store=None, yields. /health returns 200, auth routes return 503, learner voice loop (SQLite) unaffected. ✅

5. Voice UI at / unchanged (R-DASH-03, R-DASH-05): test_p2_spa_fallback.py::test_root_serves_voice_ui (200, text/html, <div id="root">). client/src/App.tsx route / → <VoiceSession />, * → <VoiceSession />. All v0.1-v0.3 tests still pass (317 passed, 0 failed). ✅

6. Mock-based equivalents exist for all Postgres-requiring paths: test_auth.py (mocked PgStore, 310 LOC), test_vc_migration.py (mocked stores, 354 LOC), test_create_operator.py (mocked PgStore, 217 LOC), test_cohort_aggregation.py (mocked PgStore, 246 LOC). ✅

7. Rate limit 429 path: Tested at decorator level in mock suite (test_rate_limit_login_decorator); full 6th-attempt→429 path is in PG-requiring test_p1_auth_integration.py. P1+ carry-forward (P1 VERIFY P1+-02): add a mock-based 429 test for CI coverage without Postgres. Non-blocking.

Testing verdict: PASS — comprehensive coverage, graceful skips, G-038 + R-VC-MIG-01 explicitly tested.

---

Persona 3 — Security

Findings (all PASS — no P0)

1. Auth: argon2id params (OWASP): server/auth/passwords.py:14 _ph = PasswordHasher() — defaults (time_cost=3, memory_cost=64MiB=65536 KiB, parallelism=4) exceed all OWASP minimums (46MiB/t=1, 19MiB/t=2, 12MiB/t=3, etc.). verify_password catches VerifyMismatchError → False (no exception, uniform 401 path). needs_rehash delegates to check_needs_rehash. ✅

2. Signed cookies (HMAC-SHA256, httpOnly+secure+SameSite): server/auth/cookies.py returns SessionMiddleware kwargs: https_only=secure (Starlette's https_only param, not secure — verified correct via fix 0a95102), same_site="strict", max_age=28800 (8h), session_cookie="praxis_op", path="/". itsdangerous HMAC-SHA256 under the hood. ✅

3. R-AUTH-01 / G-031 reframe: cookies.py docstring (lines 7-12) + WARNING text (lines 51-57) correctly frame the k-anon defense-in-depth as the PRIMARY mitigation ("cohort dashboard reads only k-anonymized aggregates → sniffed cookie leaks no PII") and the config flag as SECONDARY ("operational convenience for when TLS arrives"). G-031 honored. ✅

4. SQL injection (all PgStore queries parameterized): Verified all PgStore methods use asyncpg $1, $2, ... parameterized bindings. Grep for f"(SELECT|INSERT|UPDATE|DELETE|FROM) found:

   • db/pg_store.py:227 f"UPDATE issued_credentials SET status = $1{extra} WHERE id = $2" — extra is a hardcoded constant (, revoked_at = now() or empty) derived from status == "revoked" comparison, NOT user input. status and cred_id are bound parameters. SAFE (P1+-04 code smell, non-blocking).
   • tests/test_backup_restore.py f-strings interpolate hardcoded table names (not user input). SAFE. ✅

5. k-anon (write-time suppression, no per-learner drill-down, no PII): Suppression applied in aggregator.py:87 BEFORE upsert_cohort_aggregate (write-time, auditable). No per-learner drill-down: endpoints return only (path, metric, value, cell_count, cell_suppressed, updated_at). test_no_per_learner_data_in_cohort_response confirms no learner_ref string in cohort/mastery/failure responses. No raw PII in Postgres aggregates (D-031): only opaque learner_ref for distinct counting. ✅

6. VC key migration (v0.3 private key NOT migrated, v0.4 encrypted at rest): migrate_keys.py:45 init_issuer_key(v03_key_id, v03_public_key, b"") — empty bytes for private_key_enc (only public key archived). Fresh v0.4 key encrypted via _encrypt_private_key(signing_key, root_key) (nacl.SecretBox, line 56). issuer_keys.private_key_enc is BYTEA in Postgres. ✅

7. Secret handling (.env.secrets gitignored, no secrets in code): .gitignore has .env.secrets, .env.* ignored, !.ciagent/.env.secrets.example whitelisted. Grep for os.environ["PRAXIS_PG_PASSWORD"] / os.environ["PRAXIS_COOKIE_SECRET"] / os.environ["PRAXIS_BOOTSTRAP found only in test (test_p2_spa_fallback.py:47 sets a test secret). No secrets committed. ✅

8. Cookie PII check: The signed cookie (praxis_op) payload contains ONLY {operator_id: "<uuid>"}. No username, display_name, role, or learner data in the cookie. Verified by inspecting routes.py:85 (sets operator_id) and dependencies.py:33 (reads operator_id). ✅

Security verdict: PASS — no injection vectors, no PII leaks, auth stack solid, secrets handled correctly.

---

Persona 4 — Performance

Findings (all PASS — no P0)

1. asyncpg pool (min 1, max 10): __main__.py:94-99 create_pool(dsn, min_size=1, max_size=10, command_timeout=10). D-050 honored. Appropriate for single-instance pilot with low-frequency operator queries. command_timeout=10 prevents slow queries from blocking. ✅

2. Aggregation hook non-blocking (asyncio.create_task): session_recorder.py:161 asyncio.create_task(self._run_cohort_aggregation(session_outcome)) — fire-and-forget, off the voice path (C-8, D-054). Voice loop latency unaffected. ✅

3. Nightly job doesn't block the event loop: nightly.py:81-95 _run_loop uses asyncio.sleep(secs) (cooperative). Reconciliation (_reconcile) is a sequence of await pg_store.upsert_cohort_aggregate(...) calls (yields between each). Runs at 03:00 CT (low activity). ✅

4. SPA fallback doesn't add latency to API routes: API routers (auth_router, cohort_router, mastery_router, failure_router, credentials_router) are mounted (__main__.py:259-268) BEFORE the SPA StaticFiles mount (__main__.py:297). FastAPI matches API routes first — no fallback overhead on API paths. ✅

5. argon2id hashing is sync (~100-300ms): verify_password + hash_password (rehash) are sync calls in the async login handler (routes.py:79, 88). Blocks the event loop ~100-300ms per login. Acceptable for single-operator pilot (R-AUTH-02 — low frequency, single operator). P1+ carry-forward (P1 VERIFY P1+-01): offload to asyncio.to_thread if login frequency increases or multi-operator. Non-blocking. ✅

6. Voice loop (WebRTC → Pipecat) does NOT touch Postgres: Uses SQLite (D-007 preserved). No perf impact on the <600ms latency budget (C-8). ✅

Performance verdict: PASS — no blocking calls on the voice path, pool sizing appropriate, async patterns correct.

---

Persona 5 — Maintainability

Findings (all PASS — no P0)

1. IssuerKeyStore protocol clean: server/vc/issuer_keys.py:26-44 — @runtime_checkable class IssuerKeyStore(Protocol) with 4 methods. Both PraxisStore (SQLite, v0.3) and PgStore (Postgres, v0.4) implement it (duck-typed). isinstance(store, IssuerKeyStore) succeeds for both. Clean dependency inversion — verification.py depends on the protocol, not concrete stores. ✅

2. SpaStaticFiles subclass clean: __main__.py:279-289 — 11-line override, get_response catches 404 → FileResponse("index.html"). Well-commented with G-041 rationale. ✅

3. 3 dashboard view components consistent: PracticeVolume.tsx, MasteryProgression.tsx, FailurePatterns.tsx all share _viewCommon.ts (Cell type, suppressedLabel, formatFreshness) and follow the same fetch→render pattern. Server-side: cohort.py, mastery.py, failure_patterns.py all use _common.py (require_pg_store, all_recent_aggregates, group_by_path). ✅

4. Router mounting order (API before SPA fallback before StaticFiles): __main__.py:256-298 — auth_router → cohort_router → mastery_router → failure_router → credentials_router → SpaStaticFiles mount. Documented in comments. ✅

5. Naming, structure, coupling: server/auth/ package (passwords, cookies, rate_limit, dependencies, routes, models) — clear separation. db/pg_store.py — single class with clear method groups (operator CRUD, cohort, issuer keys, credentials, gate events). No god-class. learner_ref is opaque (not FK) per D-031. Consistent get_*_row / set_* / insert_* / upsert_* conventions. ✅

Maintainability verdict: PASS — clean protocols, consistent structure, good separation of concerns.

---

Persona 6 — Adversarial

Findings (all PASS — no P0)

1. What if an attacker calls /api/operator/cohort with a path that doesn't exist? The endpoint takes NO path parameter — it returns all paths' aggregates from the last 30 days. A non-existent path simply returns no rows (no error, no leak). The attacker cannot probe for specific paths. ✅

2. What if k-anon threshold is lowered via config? K_ANON_THRESHOLD = 10 is a module constant in aggregator.py:32, NOT configurable via env. Changing it requires a code change + redeploy. This is correct for a privacy control — it should not be runtime-configurable (an operator with env access should not be able to weaken k-anon). ✅

3. What if the aggregation hook runs before Postgres is healthy? The hook (hook.py:27-32) checks pg_store is None → no-op + WARNING. If Postgres is unhealthy mid-session, upsert_cohort_aggregate raises → caught by hook.py:37 except Exception: log.exception(...) → nightly job reconciles. No crash path. ✅

4. What if PRAXIS_COOKIE_SECRET is weak? cookies.py:41-48 checks if not secret (empty) → generates ephemeral random + WARNING. However, it does NOT validate len(secret) >= 32 — a short non-empty secret (e.g., "x") would be accepted, weakening the HMAC signature. P1+ carry-forward (P1 VERIFY P1+-03): add len(secret) >= 32 check with WARNING. Non-blocking — .env.secrets.example documents openssl rand -base64 48 generation. ✅

5. What if Postgres is exposed despite the internal Docker network? docker-compose.yml:59-82 — postgres service has NO ports: mapping (D-040 honored). An attacker would need to compromise the LXC CT or the praxis-net bridge. Mitigated by network isolation. ✅

6. What if an attacker forges a cookie? SessionMiddleware validates the itsdangerous HMAC-SHA256 signature on every request. A forged cookie without the correct PRAXIS_COOKIE_SECRET fails signature validation → request.session is empty → current_operator returns 401. ✅

7. Migration replay attack? init_issuer_key uses ON CONFLICT (id) DO NOTHING → re-running migration cannot overwrite an existing key. An attacker with DB access could insert a key directly, but DB access is already game-over. Not a v0.4 concern. ✅

Adversarial verdict: PASS — no exploitable attack paths found. Privacy controls are non-configurable (correct). Weak cookie secret is a P1+ carry-forward.

---

P0 Fixes Applied

None. No P0 issues (broken tests, missing REQ coverage, security holes, logic errors causing incorrect behavior) were found across any of the 6 personas. The v0.4 implementation is correct, secure, complete, and well-tested. All 6 grill MUSTs are honored. All 8 REQs are covered. No auto-fixes were necessary.

---

P1+ Flagged for Post-Hoc Review

The following 8 non-blocking issues are flagged for the next milestone's backlog. All have mitigations present in the v0.4 code. None block ship.

From P1 VERIFY (4 P1+):

1. Argon2id blocking event loop (server/auth/routes.py:79,88): verify_password + hash_password (rehash) are sync calls in the async login handler, blocking ~100-300ms. Acceptable for single-operator pilot (R-AUTH-02). If login frequency increases, offload to asyncio.to_thread. Non-blocking.

2. Rate limit 429 not tested in mock path (tests/test_auth.py:303): only the decorator factory is tested in the mock-based suite; the full 6th-attempt→429 path is in the PG-requiring integration test. Add a mock-based 429 test for CI coverage without Postgres. Non-blocking.

3. No PRAXIS_COOKIE_SECRET length validation (server/auth/cookies.py:41): only checks non-empty, not >=32 bytes. A short secret weakens the HMAC signature. Add len(secret) >= 32 check with WARNING. Non-blocking.

4. set_credential_status status field not validated (db/pg_store.py:223): accepts any string for status (no enum check). Currently only called with "revoked" from operator code, but a future caller could pass arbitrary strings. Consider a CHECK constraint on the issued_credentials.status column or a Python enum. Non-blocking.

From P2 VERIFY (4 P1+):

5. Credential revocation lacks application-level audit log (server/operator/credentials.py): the revoke_credential endpoint sets status='revoked' + revoked_at=now() but does NOT log the revocation event at the application level, and the revoking operator_id is not recorded. Mitigation: revoked_at timestamp + signed session cookie. Recommended: add log.info("credential revoked: operator=%s cred_id=%s", op.id, cred_id) + consider an audit_log table. Non-blocking.

6. Nightly scheduler uses fixed UTC-5 offset (not true America/Winnipeg DST) (server/cohort/nightly.py:27): CT approximated as fixed UTC-5. America/Winnipeg observes CST (UTC-6) in winter + CDT (UTC-5) in summer. Scheduler drifts ≤1h across DST boundaries — acceptable for a nightly reconciliation job. Documented in comments. Recommended: replace with zoneinfo.ZoneInfo("America/Winnipeg"). Non-blocking.

7. Aggregation in-memory cache is per-PgStore-instance (lost on restart) (server/cohort/aggregator.py:162-170): the _agg_cache on PgStore tracks running counters + distinct learner sets. On restart, the cache is lost — the next hook starts fresh, active_learners_count may reset to 1 (under-counting until nightly reconcile). Risk is low — nightly reconciliation recomputes from mastery_gate_events (source of truth), and under-counting → over-suppression (privacy-safe but value-destroying). Non-blocking.

8. set_credential_status uses f-string interpolation in SQL (code smell) (db/pg_store.py:227): the extra variable (, revoked_at = now() or empty) is interpolated via f-string. While extra is a hardcoded constant (not user input) and status/cred_id are parameterized, f-strings in SQL are a code smell. Recommended: refactor to two explicit queries. (Same as P1+ #4 — listed in both VERIFY reports.) Non-blocking.

---

Carry-forward from P1/P2 VERIFY (P1+ items)

P1 VERIFY P1+ (4):

1. Argon2id blocking event loop (server/auth/routes.py:79,88) — offload to asyncio.to_thread if login frequency increases.
2. Rate limit 429 not tested in mock path (tests/test_auth.py:303) — add mock-based 429 test.
3. No PRAXIS_COOKIE_SECRET length validation (server/auth/cookies.py:41) — add len(secret) >= 32 check.
4. set_credential_status status field not validated (db/pg_store.py:223) — add CHECK constraint or Python enum.

P2 VERIFY P1+ (4):

1. Credential revocation lacks application-level audit log (server/operator/credentials.py) — add log.info + consider audit_log table.
2. Nightly scheduler fixed UTC-5 offset (server/cohort/nightly.py:27) — use zoneinfo.ZoneInfo("America/Winnipeg").
3. Aggregation in-memory cache lost on restart (server/cohort/aggregator.py:162-170) — document or persist distinct-learner set.
4. set_credential_status f-string SQL code smell (db/pg_store.py:227) — refactor to two explicit queries. (Overlaps with P1+ #4.)

---

REQ Coverage (8/8)

REQ-ID	Phase	Covered by	Status
REQ-MT-01	P1	docker-compose postgres + asyncpg pool + PgStore + IssuerKeyStore protocol + verification swap	✅ COVERED
REQ-AUTH-01	P1	argon2id + signed cookies + rate limit + current_operator dep + bootstrap CLI	✅ COVERED
REQ-NFR-AUTH-01	P1	argon2id (PasswordHasher defaults), httpOnly+secure+SameSite=Strict, 5/min rate limit, 8h expiry	✅ COVERED
REQ-NFR-MT-01	P1	postgres internal network only (no ports), 6GB CT, graceful degradation, voice loop unaffected	✅ COVERED
REQ-MT-02	P1+P2	schema (P1 SLICE-01) + pipeline (P2 SLICE-07 aggregator + hook + nightly)	✅ COVERED
REQ-DASH-01	P2	4 endpoints + React UI + SPA fallback	✅ COVERED
REQ-NFR-DASH-01	P2	write-time suppression + query value=null + display "— (<10 learners)" + G-038	✅ COVERED
REQ-NFR-DASH-02	P2	nightly job + on-session-end hook + last_updated freshness	✅ COVERED

Grill MUSTs Honored (6/6)

MUST	Honored	Evidence
G-008 (backup drill)	YES	tests/test_backup_restore.py seeds 5 tables, pg_dump, drop, pg_restore --clean --if-exists, verify counts. scripts/backup-pg.sh has restore drill comments.
G-011 (two-store fallback)	YES	server/vc/verification.py _lookup_credential + _lookup_public_key implement (a)/(b)/(c). Tests: G-011b + G-011c.
G-027 (first-boot no v0.3 key)	YES	migrate_keys.py:80-87 if v03_row is None → archived_key_id=None, skip archive. Tests: test_migration_g027_first_boot_no_v03_key + e2e.
G-031 (R-AUTH-01 reframe)	YES	cookies.py docstring + WARNING: "primary R-AUTH-01 mitigation is k-anon defense-in-depth... this flag is the secondary mitigation."
G-038 (differencing-attack test)	YES	test_g038_differencing_attack_cannot_isolate_dropped_learner — 10 in A, 9 in B → B fully suppressed, dropped learner not isolatable.
G-041 (SPA fallback subclass)	YES	__main__.py:279-289 class SpaStaticFiles(StaticFiles) with get_response 404→index.html. NOT a catch-all route. test_assets_served_by_staticfiles_not_spa_fallback.

---

Bottom Line

The v0.4 milestone (Operator Tier — Cohort Dashboard + Auth + Postgres) is APPROVE_WITH_NOTES. All 6 personas pass. All 8 REQs are covered. All 6 grill MUSTs are honored. Zero P0 issues. Eight P1+ items flagged for post-hoc review (all non-blocking, all with mitigations present, all carry-forward to the next milestone's backlog).

The implementation is correct (k-anon threshold exactly 10, archive-before-active, G-027 first-boot), secure (argon2id exceeding OWASP, parameterized SQL, k-anon defense-in-depth, no PII in Postgres), performant (async fire-and-forget hook, pool sizing appropriate, voice loop untouched), maintainable (clean protocols, consistent structure, good separation), and adversarially sound (non-configurable privacy controls, no exploitable attack paths).

The milestone is ready for ship (v0.1.9 = v0.4). The orchestrator delegates to ship after this review.