This PR gets the hard parts of the read cutover right, and the panel said so repeatedly: the GetDefaultChatModelConfigCandidates split prevents a silent no-default commit that an authorized-filter candidate list would have shipped (five reviewers traced it, and the write-window test pins the rollback semantics against real Postgres), the converter mirrors the established WorkspaceConverter shape, the migration follows the enum-add precedent, and every interim write gate carries a ticketed TODO. Takumi ran the concurrency trace and found nothing: "The timing is fine."

Severity count: 1 P1, 5 P2, 14 P3, 5 Nit, 2 Note.

The P1 is the headline: six reviewers converged independently, three with empirical probes against Postgres, on org admins and org auditors of non-default organizations regressing from the full enabled model list to an empty list for the whole fallback window, while plain members of the same org keep the full list. The PR description discloses the custom-site-role regression but not this one, and this one hits built-in roles on every multi-org deployment through the UI model picker.

Two P2s are description/comment honesty: the PR body attributes member read to the seeded org ACL when the code preserves it via the chatd subject grant, and the create-gate comment justifies itself with a dbauthz create-in-org check that does not exist in this PR. One P2 is a test fixture that silently inverts (Enabled: false is dbgen's zero value), turning the centerpiece disabled-visibility assertions into no-ops.

Process observations: CI shows "Pixel / Review" failing on this head. The only frontend changes are generated files, so the diff is an unlikely cause, but a failing check is not "pre-existing"; resolve it or state why it is out of scope before merge. Separately, Gon audited all 33 new comments and found a pattern: several were written for the PR's development narrative (plan milestones, revert history) rather than for the next reader of the file; the individual findings are inline.

Fun quote, from Hisoka: "I pulled the isAdmin thread and something on the other end moved. Shall I show you?"

coderd/exp_chats.go:6551

P2 [CRF-4] The PR description justifies the accepted regression with a mechanism the code does not implement: "members read through the org ACL seeded in the schema PR." (Mafu-san P2, Pariston Note)

Mafu-san traced every member-subject read path: "The list handler routes non-admins to GetEnabledChatModelConfigs(dbauthz.AsChatd(ctx)), so members read because the chatd service subject gained site-level chat_model_config:read (dbauthz.go:795), not through any ACL." ChatModelConfig.RBACObject() has zero non-test callers, and an ACL-only grantee can never reach the SQL filter because the AnyOrganization gate evaluates a bare object with empty ACL lists.

Consequence: the human accepting the tradeoff is told member read is preserved by the seeded ACL. If M3 removes or narrows the chatd grant on that assumption, member read breaks silently. Pariston adds the regression itself is overstated: custom deployment_config:read roles fall to the else branch and still see every enabled config; what they lose is the management view (disabled rows), not "the model list."

Fix: correct the PR description to name the chatd-subject path as the member read mechanism and to scope the stated loss to the management view.

🤖

coderd/exp_chats.go:6551

P3 [CRF-14] The non-admin branch is the only interim authorization site in this PR without a cutover TODO. (Kurapika P3; Hisoka, Mafuuu, Meruem Notes)

Kurapika: "Every authenticated user of any org therefore enumerates every org's enabled configs (model names, provider IDs, context limits, reasoning options), and the org ACLs the schema PR seeded decide nothing on this path. ... After the M3 cutover, when configs are per-org, this branch becomes a standing cross-org disclosure unless someone remembers to scope it. Every other interim decision in this PR carries TODO(mafredri): ... after CODAGT-709 M3; this branch carries only a nolint:gocritic comment."

Three other reviewers flagged the same asymmetry: org-scoped readers are SQL-filtered to their orgs while every plain member sees all orgs' enabled configs. Fine during the window; untagged interim behavior is the kind that survives its window. Add the M3 TODO stating the branch must switch to an org-scoped query at cutover.

🤖

🤖 This review was automatically generated with Coder Agents.

Round 2 is what a fix round should look like. All 25 addressed findings were verified against the code by the panel, most by running the tests against Postgres: the P1 access regression is gone (site-scoped gate, non-default-org roles pinned by new test cases), the fixture actually disables what it claims, the custom-role fixtures use a shape production can hold, and the comment surgery from round 1 landed. Mafu-san's process read: corrections were generalized, not spot-patched (the bare require.Error became a shared helper across all three rollback subtests; the fixture fix came with enabled-flag pins on all three fixtures).

Both contested findings are closed on the author's defense, 11/11. CRF-6 (write actions published but inert): fail-closed, ticketed window, and the panel found the defense stronger than stated: the scope constants are generated from the policy action set and the enum must match, so trimming to read-only would force a second irreversible enum migration at cutover. CRF-27 inherits that decision through the same generation chain; Pariston, its raiser, withdrew it. Related observation from Ryosuke, recorded for the M3 checklist rather than re-raised: the org auditor's new read grant also has no consuming path until cutover, same forward-declaration class.

New this round: 1 P2, 6 P3, 1 Nit, 1 Note, plus one re-raise. The P2 and one P3 are the same disease CRF-10 had, in new locations: authorization comments justifying checks with a "default-org fallback" serving mechanism that this PR's own base commit (483b499) deleted. The largest convergence (five reviewers) is the 500-for-authz-denial contract that the new test helper now pins. The re-raise: the converter compile tests cover four of five matchers; the owner matcher (AlwaysFalse) has no case.

Small residue, not findings: the CRF-16 fix makes the Prometheus label fire, but the emitted SQL still carries "-- name: GetChatModelConfigs", so slow-query-log correlation attributes candidates traffic to the wrong name; the whole method is TODO-tagged for M3 removal. Leorio also notes the fix commit body is empty for a 289/235-line change treating 25 findings; the PR description carries the durable record, so Note weight only.

Fun quote, from Hisoka: "I came back for a rematch and the author rebuilt the arena."

coderd/x/chatd/chatd.go:1538

Nit [CRF-35] The chatdModelConfigLookupContext comment still says the elevation exists for "daemon-scoped deployment-config reads," but this PR changed GetEnabledChatModelConfigByID to authorize chat_model_config:read. (Mafuuu)

"Outside the diff, but the diff falsified it: dbauthz.go:3740 now checks rbac.ResourceChatModelConfig, and the chatd subject's matching grant is the new chat_model_config:read at dbauthz.go:795, not its deployment-config read. Stale permission comments are exactly the drift class CRF-12/CRF-26 cleaned up elsewhere in this PR."

🤖

🤖 This review was automatically generated with Coder Agents.

Round 4 is blocked on a single finding, and it is the last open item on this PR.

Everything else from rounds 1 through 3 is now verified fixed at head 6c72e7d (commit 91eeb0b): the CRF-2 re-raise (the ChatModelConfigNoOwner compile case landed, exactly the one table row asked for), CRF-28 (ChatModelConfig.RBACObject() deleted), CRF-30 (the GetDefaultChatModelConfig comment now cites the real safety argument, the org-scoped chat authorization), CRF-31 (the stale fallback sentence is gone from the dbauthz anchor), and CRF-32 (all five comment sites trimmed). CI is green and the migration renumbering concern is resolved (the scopes migration now takes a fresh number, 000575).

The one open finding, silent for two consecutive rounds:

[CRF-35] (Nit) chatdModelConfigLookupContext at coderd/x/chatd/chatd.go:1596-1599: the nolint comment still says "Chat message admission needs daemon-scoped deployment-config reads for model config validation." The check it feeds (GetEnabledChatModelConfigByID, dbauthz.go:3750) has authorized chat_model_config:read since round 2, and the chatd subject's matching grant is chat_model_config:read, not its deployment-config read. Concrete fix, a one-line comment edit: "Chat message admission needs daemon-scoped chat_model_config reads for model config validation."

To be fair about why this keeps slipping: the line sits outside every diff in this PR, so the finding has been folded into review bodies since round 2 and has never appeared as a reviewable thread. It still needs one of: the one-line fix above, a filed ticket, or a stated reason it should not change. A bare pass-over cannot close it.

Per the review process, no panel runs on a blocked round. Respond to or fix CRF-35 and the next round proceeds to a normal panel review.

🤖 This review was automatically generated with Coder Agents.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c72e7d184

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe8c02b8f8