Technical risk register

Current state (2026-10-27): synchronized main 7ac01d44 contains the exact-SHA workflow_run release gate for issue #117. The verifier requires a successful aggregate Verify for the same completed main push and rechecks the current main SHA before Changesets. The workflow and authorizer code are present, but hosted transition evidence is not recorded; issue #117 remains open. The 0.10.0 Server Components observer reports only Strata's per-host transaction; it is not Angular health monitoring. Evidence levels and local / packed / hosted / deployed limits are in the candidate report.

Browser reference integrity follow-up (2026-10-29, test-only): the real runtime preflight for an unregistered boundary selector is exercised in Chromium on Node and local workerd, including atomic host refusal, exact ErrorHandler/observer delivery, SSR node identity and sibling isolation. This does not exercise malformed generated descriptors in-browser or installed-package selector conflicts. The old optimizer-cache observation from the 0.12.0 report was not reproduced here; a cold/warm cache and package-upgrade comparison remains open. No registry timing or bundle-size measurements were collected. See the report.

The 0.10.0 form API also passed Node/dev/local-workerd fixture and packed-consumer checks, while hosted CI and deployed checks are pending. See Analog validated forms.

Evidence note (2026-10-23, 0.8.0 branch): deployment version skew for Server Components is detected and classified, not eliminated. With the opt-in buildId a document and a script of two real builds are refused as build-mismatch before any island exists (Node and local workerd, packed consumer); scripts built before the feature, apps that do not opt in, and rollbacks to pre-identity builds remain undetected. The identity is client-readable markup: a tampered well-formed value can cause at most one bounded reload per tab and window. Recovery is local evidence only; no deployed Pages run and no CDN-cache behaviour was exercised. See the evidence.

Evidence note (2026-10-22, 0.7.0 branch): the intermittent Server Component SSR failure (HTTP 200, empty island, JIT compiler unavailable) has a reproduced mechanism. Analog builds client and ssr concurrently with one shared Angular plugin that releases its compilation output at the first environment's buildEnd; files the other environment transforms afterwards are silently skipped and ship uncompiled. A fault-injected schedule reproduces the exact signature (ProductPage.get → getCompilerFacade); the plugin now serializes the environments' buildEnd and a post-transform gate fails any build that still contains an uncompiled source-owned Angular class or an unlinked partial declaration. Residual risk: the failure was never observed naturally outside CI and the CI failures were not captured with build output, so attribution is by matching signature, and the gate covers modules that pass through Vite, not packages Nitro traces by itself. The general limitation remains: an unexpected Angular render error still returns HTTP 200 and Strata has no supported way to change that. A dev-only bypass of the server-only assertion through Vite 8's dependency optimizer was reproduced and closed in 0.9 (marked package modules, barrels and dynamic imports are refused; unmarked packages are still not detected; a warm optimizer cache survives an in-place edit that adds the assertion; a failed first optimizer run ends vite dev, see the evidence). Separately, issue #117 identified publishing before aggregate CI verification. Main now has the exact-SHA workflow_run gate; hosted transition evidence remains open as recorded above. See the evidence.

Evidence note (2026-10-23, Analog 0.7.0 candidate): streamResponse() closes the gap between the controller invocation and the response body for an explicitly owned stream, but it inherits what the pinned transport does. Nitro 2.13.4 / H3 1.15.11 never tells the response body that the client left, so a streamed body that does not end holds its request-scoped resources (and, on Node, keeps producing into a closed socket): only finite bodies are safe. A body that fails after the first chunk leaves a Node connection open with no end, and on the Cloudflare Pages preset the whole body is buffered and a mid-body failure becomes an empty 200, so neither runtime lets a client tell a failed stream from a finished one. Analog 2.7.2 server-function dispatch with POST needs the H3 v1 readBody, but @analogjs/router imports an undeclared h3: with H3 v2 hoisted it answers 400 Malformed request body (declared as a workspace packageExtensions entry, as for the Nitro plugin), and on workerd every server function answers 500 because Angular's JIT is unavailable. Fixture evidence, not production adoption. See the evidence.

Evidence note (2026-10-24, 0.9.0 branch): validateHeaders gives schemas the native Headers view, so repeated fields arrive combined with ", " and per-line fidelity is only available from request.headers; a schema that reads authorization, cookie or x-forwarded-* validates shape, not identity. Release risk remains: #117 (publish not gated on Verify) let Release succeed on 769899c while CI failed. See the evidence.

Evidence note (2026-10-24): the Analog 0.8.0 candidate adds onRequestSettled. A stream the transport never reads or cancels, and a client that disconnects while a finite producer keeps running, are not reported until (and unless) the body ends: Strata adds no timeout and does not claim a disconnect event. A broken observer is silent by design (its errors are discarded so it cannot change the response), and Cloudflare Workers durations can read 0 between I/O. Observation overhead is not measured. Fixture evidence, not production adoption. See the evidence.

Evidence note (2026-10-22): the Analog 0.6.0 routing candidate adds an opt-in API boundary on top of Nitro's H3 v1 router. It depends on pinned router behaviour (method-less registration serves every method, method fall-through to less specific routes, no backtracking), so a router upgrade must be re-qualified; the H3 v2 transition is not qualified for it. Undeclared native routes are unknown to the boundary and answer 404 for a wrong method. Separately, an intermittent Server Component SSR failure (HTTP 200 with an empty island and JIT compiler unavailable in the log) was seen on PR #112 and reproduced once on main; its root cause was unestablished when this note was written (superseded by the 2026-10-22 0.7.0 note above). See the evidence.

Evidence note (2026-10-20): the Analog 0.5.0 HTTP contract candidate adds safe application errors and portable Response helpers. Local Node and workerd fixtures exercise them. Cancellation is NO-GO for the pinned adapter path: Node H3 creates a synthetic Web Request without the socket abort signal, while the Cloudflare Pages Nitro path does not forward the native incoming Request.signal into event.web.request. StrataAnalogRequest therefore exposes no signal. Cleanup still covers the awaited handler/interceptor invocation, not the streamed response lifetime. See the contract evidence.

Evidence note (2026-10-20): request-scoped Analog interceptors are added on feat/analog-http-interceptors. This provides an opt-in execution seam; it does not qualify cancellation, streamed-response lifetime, production tracing or application adoption. See the interceptor evidence.

Evidence note (2026-10-19): the Server Component dev recovery CI failure was traced to an asynchronous harness log-window race; the test now gates the post-recovery assertion on observable browser recovery and bounded log quiet, and scenario K proves a fresh invalid edit fails closed after recovery. Hosted PR CI is pending; this does not change R05's production-security disposition (evidence).

Evidence note (2026-10-17): the feature branch feat/analog-standard-schema-validation adds opt-in Standard Schema v1 input validation for Analog, bounded JSON and safe 400/413/415 responses after cleanup. Local Node production/dev, workerd and packed-consumer checks pass. This does not close authentication, authorization, tenant isolation, general error redaction or real-application adoption risks; see the evidence report.

Evidence note (2026-10-19): feat/analog-request-guards introduces the registration-level Analog guard seam with explicit decisions and request-local cleanup. Consumer identity verification is required; there is no framework auth, session, RBAC/ABAC or CSRF policy. Local runtime and packed-consumer evidence passes; hosted checks and production adoption remain unqualified. See the guard report.

Open as of 2026-09-17; R03, R04 and R13 updated 2026-09-24 with SPEC-003 evidence; R13 updated 2026-10-16 with the full-stack performance baseline and the one-versus-three-island scaling evidence. Astra owns architectural disposition; the agent executing the relevant spec produces evidence. A risk closes only with a linked test/report on a pinned tuple. “Deadline” means the gate that cannot pass unresolved, not a calendar estimate. No risk below is closed by this audit.

Evidence note (2026-09-28), no disposition changed: R05, R07, R08, R09 and R12 now have experimental Server Component evidence on one code shape (Node and local workerd, document navigation only; Angular Router navigation NO-GO) in the private @strata-sc/server-components package and the graph, navigation and Cloudflare reports.

Evidence note (2026-10-15, later), no disposition changed: the concurrency anomaly of run 2 was not reproduced (local Node/workerd 829 requests each, existing deployment 478, new deployment run 38741663534 green); the cause is unconfirmed and stays a residual risk, with classified anomaly capture now in the gate (report).

Evidence note (2026-10-15, after two real dispatches), no disposition changed: the full-stack workflow ran twice against strata-fullstack-qualification and both runs are NO-GO (run 1 unreachable URL from the runner; run 2 passed all functional and confidentiality checks on the public URL but had 1 anomalous response in 25 concurrent controller requests, cause unknown). The "no deployed environment" part of R16/R17 stays open (report).

Evidence note (2026-10-15, earlier), no disposition changed: pnpm test:full-stack-deployed-cloudflare builds the same external full-stack consumer from source-packed tarballs for Cloudflare Pages and passes the black-box verifier on local workerd; the manual workflow for the real deployment exists but has not run (REAL DEPLOYMENT: NOT RUN), so the "no deployed environment" part of R16/R17 stays open. A future GO would cover a fixture on one isolated Pages project: no authentication or tenant-aware caching, no shared controller/SSR DI, no bindings, and soft 404s, /api/* fallthrough and 200-on-render-error stay as recorded (report).

Evidence note (2026-10-15), no disposition changed: R16 and R17 gain one more fixture datum. pnpm test:full-stack-package-consumer installs the three packed packages (core 0.2.1, analog 0.2.1, server-components 0.2.0) into one external Analog app and runs a controller API, a server-only Server Component and a hydrated island that calls the API, on Nitro and local workerd (report). Controller and Angular SSR DI remain independent (R03 unchanged); it is still a fixture, not a real application (R17 open), local workerd is not a deployment, and unmatched /api/* paths fall through to Analog's HTML catch-all.

Evidence note (2026-10-05), R05 only: R05 is partially resolved / substantially qualified for module-graph ownership, not closed. The private package's server-only assertion (import "@strata-sc/server-components/server-only") makes the build reject, with a diagnostic naming module, importer and reason, every measured illegal browser import shape: direct, dynamic import(), @defer-lazy, barrel, chained barrel, ?raw and ?url (real Vite production builds, pnpm test:server-component-server-only). Marked modules and a synthetic canary stay in the Node and Worker server graphs and out of every browser file and source map, with plugin-off positive controls. Marked modules are also dogfooded by www and Relay. Dev evidence (2026-10-07, report, pnpm test:server-component-dev): under the real Analog dev server the graph is regenerated after every source edit, a module that starts asserting server-only (or a barrel that starts re-exporting one) is refused to the browser live (import, import(), ?raw, ?url) and an invalid graph fails the client closed until fixed, without restarting Vite; bytes already delivered to a realm cannot be revoked, so the document reloads. Remaining R05 gaps: Analog liveReload: true is not qualified for server-owned edits; the pre-scan follows relative, Vite-aliased and tsconfig-path re-exports under sourceDir (0.6 candidate; a marked module outside it, including a package module, is rejected only when its own assertion import resolves in the browser, with the importer and chain the bundler reports; a package that leaks without asserting is not detected; Analog's compile cache can serve a stale module that left its TypeScript program); unmarked transitive dependencies are protected by ownership, not by assertion; no deployed environment; data disclosure beyond modules is R11.

Evidence note (2026-10-07), R11 only: R11 is partially resolved / substantially qualified for server-owned data crossing implicitly, not closed. pnpm test:server-component-security renders a Server Component that uses a server-only repository holding a synthetic DATA canary and passes a PUBLIC control canary through [strataClient]. On Nitro node-server and local workerd the DATA canary, in any of its encodings, is absent from the raw SSR HTML (comments, inline scripts, ng-state, ngh, data-strata-*), response headers, the parsed protocol v1 payload, the hydrated DOM before and after an interaction, every public network response, the browser output and every browser source map, the browser error surface and the output of a failed illegal-import build; it is present in the server and Worker graphs, and the PUBLIC control is present everywhere it deliberately crosses. Unsupported values (a repository instance, a nested object) are rejected with StrataBoundaryError before serialization and the diagnostic prints no contents. Production errors carrying the canary (plain, Error.cause, AggregateError) leave the public response clean on both runtimes, with the original error only in the server log; no runtime code changed (report). Still open: authorization; tenant and cache isolation; broader request-context lifecycle and tenant semantics are NOT QUALIFIED; origin and CSRF rules for mutations; log and error-reporter redaction; the dev server; a real deployed environment.

Evidence note (2026-10-07), failure and recovery; R08, R09, R10 and R11 are not closed: pnpm test:server-component-failures pins the buffered-SSR failure contract on Node and local workerd. R09: a failing host is inert per host (preflight and commit failures) while sibling hosts hydrate, one ErrorHandler report, same DOM nodes restored, no retry. R10: an invalid value is never serialized, and the preflight error no longer quotes the payload (it could, through some engines' JSON.parse messages). R11: failures add no data to public responses. R08: document navigation into a failing route, Back and re-entry are clean lifecycles; Angular Router navigation stays NO-GO. New finding: a Server Component render error answers HTTP 200 (an empty outlet, or a half-rendered component for a template error) and no supported Strata seam can change that. Streaming is unsupported, not qualified.

Evidence note (2026-10-14), request context: the public Angular REQUEST_CONTEXT token plus Analog's public per-render platformProviders seam now has a narrow GO for Server Component buffered SSR. The service-isolation fixture adds an allow-listed alpha/beta resolver, distinct synthetic private values, same-render parent/child service identity, sequential/failure recovery, and deterministic 24-request overlap on Nitro node-server and local workerd. Missing or invalid context renders an empty safe state and never selects another actor. R11 remains open for authorization, tenant/cache isolation, logs, deployment and broader lifecycle contracts.

Evidence note (2026-10-14), SSR response and expected recovery: R08, R09, R10 and R11 remain open for the general failure contract. The public Analog RESPONSE token supports a narrow, consumer-owned expected-service path: the fixture catches one typed repository failure and returns generic HTML with HTTP 503/no-store, with 400/no-store for invalid context. The new response report passes this path on Nitro and local workerd, including overlap and document navigation. Unexpected Angular/Analog render failures still answer HTTP 200; no general status bridge, fallback API or streaming contract was found.

Evidence note (2026-10-14), request-bound authorization: R04 and R11 remain open for production identity, authorization, deployment, logging and tenant/cache semantics. The fixture-only pnpm test:server-component-authorization gate resolves a synthetic principal from one opaque HttpOnly cookie, ignores route/query/header identity overrides, authorizes the requested resource before a request-local repository trace records a read, and passes 24-request mixed overlap on Node and local workerd. It proves only a narrow synthetic trust model; it does not close authorization, tenant-aware caching, origin/CSRF, sessions or Strata 1.0.

Evidence: SPEC-001 run, Astra review and upstream research. The observed declaration failures do not negate the positive decorator/runtime evidence. Neither runtime success nor a completed no-go experiment closes M1. No new ADR is warranted by errors alone.

R10's 0.3.0 candidate adds a recursive allow-list validator for boundary protocol v2. Unit and browser tests pin structural limits, UTF-8 size, dangerous keys, accessors, cycles, custom serializers, proxy failures and v1/v2 mismatch handling. Relay Node production dogfood, Node/workerd packed-consumer verification, and Node/workerd security scans pass, alongside the requested local CI matrix. Hosted checks remain pending until push. R10 remains open because deployment and production adoption are not qualified and protocol stability is not established. See boundary v2 evidence.

The external-package-island candidate adds an explicit registry and exact named-import matching, but its isolated package install did not complete in the restricted run. Do not treat analyzer tests or the independently compiled tarball as Angular app-AOT, hydration, workerd or security qualification. The remaining qualification gate is tracked in the package-island report; the existing release and production-adoption risks remain open.

Review discipline

Each implementing PR identifies relevant IDs and attaches its evidence. Mark a risk “partially resolved” if only a development, local, Node or synthetic path passed. A changed compiler, runtime tuple or protocol reopens affected proofs. Move closed details into the responsible spec/report and keep this register concise; do not turn uncertainty into an accepted ADR.

Evidence note (2026-10-27, Analog 0.11.0 candidate): Nitro 2.13.4 / H3 1.15.11 shares named-parameter metadata between structurally identical routes, including across HTTP methods. The candidate rejects these collisions among Strata-owned supported static/named-parameter paths during registration preflight. Wildcards and other unsupported path syntax outside apiBoundary remain outside shape detection; native route collisions are unknowable unless declared to the boundary. Configuration rejection is atomic, but rollback from an arbitrary router.add() failure is not guaranteed. Local runtime and packed-consumer suites passed; PR #145's hosted Verify passed, but deploy was skipped and no deployed qualification occurred. See registration integrity evidence.

Evidence note (2026-10-28, Server Components 0.12.0 candidate): the browser runtime used to key client references by reflected selector in a Map, so two distinct components with one selector silently kept the last, and the actual Angular selector of a registered package component was never compared with the one the build authorized. The candidate validates both inside the host preflight as a reference refusal. This narrows, but does not close, the M4 integrity risk for installed Angular packages: no hosted or deployed qualification exists. See reference integrity evidence.