minio/docs/investigations/r8/consensus.md

R8 consensus and dispositions

Recorded UTC: 2026-09-15T15:50:55.911352+00:00

Same-version agreement, before implementation

• Baseline: 9ebe81c1b3611f9cc73e676b5b741c2be62c467a.
• Accepted plan: plan-v1.md, SHA256 7cb609e37e3199ecd93c992f08d123968ba8082682a108f20490e0644d735366. The plan is retained verbatim.
• Codex recommends option 4. Real Claude Code assistant messages identify claude-opus-5; invocation explicitly supplied --effort max.
• Opus verdict: CONSENSUS, explicitly names v1 and this SHA256; zero blocking disagreements. Successful result, no rate limit or substitute reviewer. See review/opus-v1.md and metadata. Opus independently read code, did not run tests or recalculate the supplied hash. Codex independently recalculated the hash here and ran the baseline.
• Codex accepts the conclusion and the following dispositions. This record authorizes the local implementation stage under the user's WORKFLOW.md. No production files have been edited at the time this record is created.
• Raw session: /Users/vonng/tmp/silo-r8-01a0a5b9/opus-v1.jsonl; stderr adjacent. The reviewer tried an unavailable Write tool and then delivered its review in text; no file edit was granted or used as evidence.

Nonblocking opinions, individually resolved

ID	Codex disposition
N1	Accept precise Go source ordering: header deadlines are set in serve at 2038/2177; whole-request deadline at 1103 is unconditional. v1 already describes header reading separately from the latter; no algorithm change needed.
N2	Accept: add pipelined requests. StateActive follows successful parsing even when all bytes were buffered, because readRequest resets the read limit.
N3	Retain explicit negotiated-h2 skip as v1 permits. StateNew still enables strict before the handshake; h2 detection only governs later hooks. No connection-level stream timeout added.
N4	Retain listener initial strictness and Init's phase hook, as specified. Document that the private listener and Server.Init cooperate; direct raw-listener users without the hook get strict behavior for the entire request. There is no such production caller today.
N5	Accept, independently reproduced: the initial H2 smoke fell back to HTTP/1.1 and failed its protocol assertion. Fix the fixture to dial TLS advertising only h2; assert negotiated h2 and response HTTP/2.0. This fixture failure is retained in baseline-additional.log and is not a product defect.
N6	Accept: add >30s continuously progressing downloads through plaintext and TLS H1; retain write logic. Unit tests assert strict reads do not change rolling writes.
N7	Accept: delivery notes will state that trickling headers and read-side TLS handshakes now stop at the configured absolute cap, even when socket idle is not exceeded.
N8	Accept: current globalTCPOptions leaves DriveOPTimeout commented out; the optional Linux dial path remains a shared API caller and will be tested explicitly in Linux, without changing production config.
N9	Accept as a known remaining boundary: TLS handshake writes retain rolling behavior. Fixing this requires separate write/handshake phase design and is outside the R8 read-header defect.

No substantive plan revision is required. Added tests are acceptance refinements consistent with v1, not changes to the agreed production behavior.

Complete v2 consensus — before configuration implementation

Recorded UTC: 2026-09-15T16:07:48.799416+00:00

• Accepted complete plan v2, SHA256 426127ed9fb08aeddf8259ebdc4b1c24ebec8cda751a970ed99338a44b065f4c, independently recalculated here. V1 remains historical agreement only.
• Actual assistant model: claude-opus-5; CLI explicitly --effort max; successful response, CONSENSUS, zero blocking disagreements. Opus explicitly named the complete v2 hash and the new assignment. Codex agrees with the complete v2 plan and the dispositions below. Configuration production code is still unmodified at this record's creation.
• Opus explicitly confirms the implementation-review B1 dependency blocker is resolved by the standard-library-only HTTP/2 fixture. go mod tidy -diff independently returned exit 0.
• Reviewer source inspection is separate from execution; all actual tests and binary hashes are Codex-produced evidence. See review/opus-v2.md and metadata for the original opinion and raw log identity.

V2 note	Codex disposition
N1	Accept: document that a positive ReadHeaderTimeout also participates in the standard-library minimum TLS handshake window, including h2's handshake.
N2	Accept: with only idle=2s customized, v1's fallback cap was 2s; complete v2 honors default header=30s. The independent header knob is intentional. Socket inactivity is still constrained under the retained rules.
N3	Accept: explicitly document negative header values and the inherited first-plaintext vs TLS/keep-alive zero-deadline distinction. This is an explicit opt-out of the header cap; no unagreed policy change.
N4	Accept: add parser cases for disabled idle with independent default header=30s, and include disabled-idle coverage in process probing if practical.
N5	Accept evaluation: inspect the existing buildscripts/test-timeout.sh for safe isolated execution. It complements, but does not replace, the new trickle and renewal cases. Record whether run and its exact scope.
N6	Accept: land configuration assertions as a permanent cmd test; zero case remains a compatibility control, not defect-discriminating evidence.
N7	Accept: fmt-gen's absent duration flag returns zero and does not launch HTTP; no extra flag or production change.
N8	Accept: leave the duplicate existing UserTimeout assignment untouched.
N9	Accept: final quality records include actual commands/exit codes; add repaired compiled-process output with binary SHA256. The old runtime-v1 output remains explicitly pre-binding evidence.

Implementation and verification now continue within v2. Merge, release and deployment remain outside automatic delivery.