Node PRs — week of 2026-05-21 quality sweep

[linear]

Scope

Review of merged PRs in kynesyslabs/node for the week of 2026-05-14 → 2026-05-21. Filed by Nesy-Claude per KYN-192. All 4 merged PRs reviewed (no docs/typo-only PRs in window; under the 8-PR cap).

Linear-ticket linkage: none of the 4 PRs reference a Linear ticket in commit messages or PR body (no DEM-/KYN- IDs, no Linear attachments). Per-ticket review comments not posted — verdicts and notes are consolidated here instead.

Quality table

PR #	Title	Linear ticket	Verdict	Notes
#837	feat(docker-run): add --rebuild flag for --no-cache image rebuild	none	clean	Single-file (scripts/docker-run, +21/-1), well-scoped. Order-of-ops correct: rebuild after --clean, gated to up subcommand only. Companion to #836 — folds two-step rebuild into one flag.
#836	fix(docker): prune rule deletes runtime modules named like docs	none	clean	Real correctness fix. -iname 'CHANGES*' was deleting @mysten/sui/.../changes.js (a runtime JS module), crashing the node on boot. Replaced prefix globs with explicit X, X.md, X.txt, X.rst enumerations + common LICENSE-MIT/APACHE variants. Verified pre/post with ls of both the runtime file and a doc README. Nit-to-followup: add a CI smoke that boots the pruned image and require()s a tree of dependencies to catch any future overreach.
#825	feat(restore): snapshot bootstrap + genesis-baked validators + consensus shard enforcement	none	regression-risk	3 epics, +23631/-74 across 36 files. Touches genesis path (chainGenesis.ts), consensus (getShard.ts), commits 13880+1382 snapshot rows as JSONL (~20 MB). 103 pass / 9 skip / 0 fail. Security/consensus concerns: DEMOS_REQUIRE_VALIDATORS=true is required for prod but defaults to legacy permissive shard behavior with only a warning — needs an audit that mainnet operators flipped the env var. TOCTOU between verifySnapshot and restoreSnapshot documented but not closed. Byzantine 3-validator consensus rehearsal deferred (Mycelium #156). Block-0 hash divergence intentional (chain wipe) — confirm RUNBOOK is followed before mainnet.
#821	Epic 14+13+12: startup hardening, observability, reverse proxy	none	regression-risk	Mega-PR, +6693/-120 across 11 commits / ~3 weeks of work. Bundles security (XFF spoof fix, MCP lockdown, CORS allowlist), observability (subsystem registry, /health extension, 11 Prom alerts, Grafana dashboard), infra (Caddy reverse proxy, opt-in). Multiple rounds of Greptile/CodeRabbit/Sonar feedback addressed inline. Deferred items left open: T4 (per-env wstcp probe), T8 (full WASM notary session), T13 (host-port removal), real-environment ACME verification, pre-existing TS errors in l2ps-messaging + verify-release-gate. Quality of the change is high but the surface is too large for a single review pass; recommend a staged production rollout with monitoring on NodeDormant, NodeFailing, and SubsystemDown alerts during cutover.

Security-relevant findings (escalated)

Flagged for Smooth Operator routing:

• feat(restore): snapshot bootstrap + genesis-baked validators + consensus shard enforcement #825 — consensus shard fallback. Default behavior when the validator set is empty is permissive (legacy shard, loud warning). Production must opt in via DEMOS_REQUIRE_VALIDATORS=true. Anyone running this without setting the env var has a permissive consensus shard. Recommend a deployment-time check or making strict mode the default.
• Epic 14+13+12: startup hardening, observability, reverse proxy #821 — XFF spoof fix + MCP CSRF. Positive security changes (gated XFF parsing via TRUSTED_PROXIES, mcpEnabled default false, /message sessionId check). Note that legacy XFF mode is still selectable for back-compat with only a startup log.error — confirm no production deployment is still running in legacy mode.
• Epic 14+13+12: startup hardening, observability, reverse proxy #821 — basic_auth sentinel pattern. The ${VAR:-default} shift from Caddyfile to compose is correct, but the sentinel hash rejects all callers silently if operators forget to set real values. Consider failing loudly at boot when a real value isn't provided.

Follow-up child tickets

#825 and #821 each warrant a tracking child to close the deferred / risk items above (filed as children of this issue).

---

Filed by Nesy-Claude per KYN-192.