kayg/calternal-v0
Archived
Watch
1
0
Fork
You've already forked calternal-v0
 0
Code Issues 1.1k Pull requests Projects Releases Packages Wiki Activity Actions

Isolation: no user directory on a shared instance (contacts-only visibility, no account enumeration) #1199

Closed
opened 2026-10-06 10:08:25 +00:00 by kayg · 44 comments
kayg commented 2026-10-06 10:08:25 +00:00
Owner
Copy link

Cross-user isolation (owner, 2026-10-06): no user discovery on a shared instance

calternal.cloud is ONE instance shared by unrelated customers (Individual / Duo / Family plans). Owner: "make sure since it's all one instance, they can't discover other people."

Current behaviour: GET /api/v1/files/people ("List other Users") returns EVERY enabled User other than the caller to any signed-in User with the data scope — a full directory of all customers on a shared instance. Any other path that reveals other accounts (share dialog autocomplete, mentions, Group member pickers, invite flows saying "this person already has an account", avatars/names in shared-item metadata, error messages, timing) is in scope.

Do:

  1. Instance setting directory_visibility (admin, config + Admin UI, documented in contracts/config.json):
    • instance — current behaviour; default for self-hosted Instances (a family/team server).
    • contacts — default for the official shared instance (calternal.cloud). A User can see only: members of Groups they belong to (a Duo/Family plan auto-creates its member Group), people they already share with or who share with them, and Admins acting in Admin UI.
  2. Exact lookup without enumeration in contacts mode: the Share dialog accepts a full email address (or exact handle); the server answers identically whether or not an account exists ("We'll share it with this address"), shares directly when the account exists, otherwise sends/queues an invite; never reveals existence, name or avatar before the recipient accepts; rate-limited per User; constant-time-ish responses.
  3. Audit every route returning other Users' identities (names, emails, avatars, presence) and apply the policy; error messages never confirm an account.
  4. Tests: the cross-user isolation matrix (#331 probe) extended — two unrelated Users on a contacts Instance cannot list, autocomplete, mention or infer each other through any route; Group members can; sharing by exact email works both when the account exists and not, with indistinguishable responses. Add the probe to tests/adversarial.
    This is a merge/launch blocker for calternal.cloud. Gates per crate + bun run check + bun run test quoted; an independent security-style review follows (word it as a defensive audit).
## Cross-user isolation (owner, 2026-10-06): no user discovery on a shared instance calternal.cloud is ONE instance shared by unrelated customers (Individual / Duo / Family plans). Owner: "make sure since it's all one instance, they can't discover other people." Current behaviour: `GET /api/v1/files/people` ("List other Users") returns EVERY enabled User other than the caller to any signed-in User with the data scope — a full directory of all customers on a shared instance. Any other path that reveals other accounts (share dialog autocomplete, mentions, Group member pickers, invite flows saying "this person already has an account", avatars/names in shared-item metadata, error messages, timing) is in scope. Do: 1. **Instance setting `directory_visibility`** (admin, config + Admin UI, documented in contracts/config.json): - `instance` — current behaviour; default for self-hosted Instances (a family/team server). - `contacts` — default for the official shared instance (calternal.cloud). A User can see only: members of Groups they belong to (a Duo/Family plan auto-creates its member Group), people they already share with or who share with them, and Admins acting in Admin UI. 2. **Exact lookup without enumeration** in `contacts` mode: the Share dialog accepts a full email address (or exact handle); the server answers identically whether or not an account exists ("We'll share it with this address"), shares directly when the account exists, otherwise sends/queues an invite; never reveals existence, name or avatar before the recipient accepts; rate-limited per User; constant-time-ish responses. 3. Audit every route returning other Users' identities (names, emails, avatars, presence) and apply the policy; error messages never confirm an account. 4. Tests: the cross-user isolation matrix (#331 probe) extended — two unrelated Users on a `contacts` Instance cannot list, autocomplete, mention or infer each other through any route; Group members can; sharing by exact email works both when the account exists and not, with indistinguishable responses. Add the probe to tests/adversarial. This is a merge/launch blocker for calternal.cloud. Gates per crate + `bun run check` + `bun run test` quoted; an independent security-style review follows (word it as a defensive audit).
admin-paper-1440-macos.png
210 KiB
admin-paper-390-macos.png
66 KiB
admin-paper-820-macos.png
126 KiB
admin-tokyo-night-1440-macos.png
194 KiB
admin-tokyo-night-390-macos.png
73 KiB
admin-tokyo-night-820-macos.png
124 KiB
share-paper-1440-macos.png
572 KiB
share-paper-390-macos.png
82 KiB
share-paper-820-macos.png
124 KiB
share-tokyo-night-1440-macos.png
130 KiB
share-tokyo-night-390-macos.png
77 KiB
share-tokyo-night-820-macos.png
116 KiB
notifications-1440-dark-macos.png
147 KiB
notifications-1440-light-macos.png
167 KiB
notifications-390-dark-macos.png
68 KiB
notifications-390-light-macos.png
62 KiB
notifications-820-dark-macos.png
121 KiB
notifications-820-light-macos.png
133 KiB
shared-requests-1440-dark-macos.png
802 KiB
shared-requests-1440-light-macos.png
849 KiB
shared-requests-390-dark-macos.png
271 KiB
shared-requests-390-light-macos.png
269 KiB
shared-requests-820-light-macos.png
296 KiB
notifications-1440-dark-macos.png
123 KiB
notifications-1440-light-macos.png
140 KiB
notifications-390-dark-macos.png
59 KiB
notifications-390-light-macos.png
54 KiB
notifications-820-dark-macos.png
113 KiB
notifications-820-light-macos.png
124 KiB
shared-request-row-keyboard-menu-macos.png
528 KiB
shared-request-row-mouse-menu-macos.png
528 KiB
shared-request-row-zoom-macos.png
50 KiB
shared-requests-1440-dark-macos.png
410 KiB
shared-requests-1440-light-macos.png
528 KiB
shared-requests-390-dark-macos.png
262 KiB
shared-requests-390-light-macos.png
260 KiB
shared-requests-820-dark-macos.png
380 KiB
shared-requests-820-light-macos.png
278 KiB
shared-requests-820-dark-macos.png
397 KiB
admin-paper-1440-macos.png admin-paper-390-macos.png admin-paper-820-macos.png admin-tokyo-night-1440-macos.png admin-tokyo-night-390-macos.png admin-tokyo-night-820-macos.png share-paper-1440-macos.png share-paper-390-macos.png share-paper-820-macos.png share-tokyo-night-1440-macos.png share-tokyo-night-390-macos.png share-tokyo-night-820-macos.png notifications-1440-dark-macos.png notifications-1440-light-macos.png notifications-390-dark-macos.png notifications-390-light-macos.png notifications-820-dark-macos.png notifications-820-light-macos.png shared-requests-1440-dark-macos.png shared-requests-1440-light-macos.png shared-requests-390-dark-macos.png shared-requests-390-light-macos.png shared-requests-820-light-macos.png notifications-1440-dark-macos.png notifications-1440-light-macos.png notifications-390-dark-macos.png notifications-390-light-macos.png notifications-820-dark-macos.png notifications-820-light-macos.png shared-request-row-keyboard-menu-macos.png shared-request-row-mouse-menu-macos.png shared-request-row-zoom-macos.png shared-requests-1440-dark-macos.png shared-requests-1440-light-macos.png shared-requests-390-dark-macos.png shared-requests-390-light-macos.png shared-requests-820-dark-macos.png shared-requests-820-light-macos.png shared-requests-820-dark-macos.png
kayg commented 2026-10-06 12:08:34 +00:00
Author
Owner
Copy link

Starting #1199 on branch job/directory-1199, based on origin/dev at 5301e020859c1d61b4a7f812a5049a64241203e8. I am tracing identity-returning routes and the shared instance config/admin flows before implementing contacts-only visibility and indistinguishable exact-address sharing.

Starting #1199 on branch `job/directory-1199`, based on `origin/dev` at `5301e020859c1d61b4a7f812a5049a64241203e8`. I am tracing identity-returning routes and the shared instance config/admin flows before implementing contacts-only visibility and indistinguishable exact-address sharing.
kayg commented 2026-10-06 12:22:20 +00:00
Author
Owner
Copy link

Finding: crates/plugins/files/src/lookup.rs::people selects every enabled User other than the caller. crates/calternal-server/src/wire/groups.rs::list_groups returns every active Group to a data-scoped User, and the Share dialog consumes both lists. In contacts mode the People result must be limited to contacts, and Group names/picker results must not enumerate unrelated Groups. The admin Users and Group-membership routes are guarded by the admin scope.

Finding: `crates/plugins/files/src/lookup.rs::people` selects every enabled User other than the caller. `crates/calternal-server/src/wire/groups.rs::list_groups` returns every active Group to a data-scoped User, and the Share dialog consumes both lists. In contacts mode the People result must be limited to contacts, and Group names/picker results must not enumerate unrelated Groups. The admin Users and Group-membership routes are guarded by the admin scope.
kayg commented 2026-10-06 19:49:43 +00:00
Author
Owner
Copy link

Starting resumed work on job/directory-1199 at branch tip 5301e02085; origin/dev is ff53d7b8b4. The prior run left implementation uncommitted. I am preserving it and will reconcile with origin/dev before final gates.

Starting resumed work on job/directory-1199 at branch tip 5301e020859c1d61b4a7f812a5049a64241203e8; origin/dev is ff53d7b8b4da5a21f862d57dcc3496f8c019f647. The prior run left implementation uncommitted. I am preserving it and will reconcile with origin/dev before final gates.
kayg commented 2026-10-06 19:51:43 +00:00
Author
Owner
Copy link

Finding during origin/dev reconciliation: auth migrations 0014 and 0015 were already used by origin/dev, and Files migration numbers through 0028 were occupied. I moved the new files to auth 0017/0018 and Files 0029/0030 before final gates; no deployed migration number is reused.

Finding during origin/dev reconciliation: auth migrations 0014 and 0015 were already used by origin/dev, and Files migration numbers through 0028 were occupied. I moved the new files to auth 0017/0018 and Files 0029/0030 before final gates; no deployed migration number is reused.
kayg commented 2026-10-06 20:09:14 +00:00
Author
Owner
Copy link

Compile finding and fix: calternal-server could not compile because FilesState derives Clone while the new address limiter held a bare Mutex. Changed the limiter to clone a shared Arc<Mutex<_>>; the request limiter stays shared across state clones and does not hold its lock across awaits.

Compile finding and fix: calternal-server could not compile because FilesState derives Clone while the new address limiter held a bare Mutex. Changed the limiter to clone a shared Arc<Mutex<_>>; the request limiter stays shared across state clones and does not hold its lock across awaits.
kayg commented 2026-10-06 20:11:44 +00:00
Author
Owner
Copy link

Decision for unspecified address ownership: direct email resolution uses only verified OIDC email claims in Security state; a missing address gets a private pending Share request. Email delivery is not wired because DESIGN §56 is OPEN. The cloud service sets contacts mode with CALTERNAL_SERVER__DIRECTORY_VISIBILITY; self-hosted defaults remain instance.

Decision for unspecified address ownership: direct email resolution uses only verified OIDC email claims in Security state; a missing address gets a private pending Share request. Email delivery is not wired because DESIGN §56 is OPEN. The cloud service sets contacts mode with CALTERNAL_SERVER__DIRECTORY_VISIBILITY; self-hosted defaults remain instance.
kayg commented 2026-10-07 00:17:24 +00:00
Author
Owner
Copy link

Adversarial probe findings and fixes: the OpenAPI identity gate initially rejected files_update_share because the cross-user operation inventory lacked its share_id classification; added the classification. The live contacts probe then showed its fixture was joining the literal owner account instead of the A identity used by the request, so it reported a fixture mismatch (charlie absent; dora present). Updated the fixture to join A's actual ID, choose an unrelated existing user, and print the bounded usernames on failure. Rerunning the focused adversarial round now.

Adversarial probe findings and fixes: the OpenAPI identity gate initially rejected files_update_share because the cross-user operation inventory lacked its share_id classification; added the classification. The live contacts probe then showed its fixture was joining the literal owner account instead of the A identity used by the request, so it reported a fixture mismatch (charlie absent; dora present). Updated the fixture to join A's actual ID, choose an unrelated existing user, and print the bounded usernames on failure. Rerunning the focused adversarial round now.
kayg commented 2026-10-07 00:26:55 +00:00
Author
Owner
Copy link

Focused adversarial result: after binding the probe Group to the live A User and selecting an unrelated existing User without a contact edge, the directory visibility check and exact-address comparison both passed; the run advanced past verify_directory_visibility. The broader xuser setup then stopped later while creating an unrelated Money transaction (transport status -1), so the rest of that matrix is unverified in this run. No product-side directory leak was reproduced.

Focused adversarial result: after binding the probe Group to the live A User and selecting an unrelated existing User without a contact edge, the directory visibility check and exact-address comparison both passed; the run advanced past verify_directory_visibility. The broader xuser setup then stopped later while creating an unrelated Money transaction (transport status -1), so the rest of that matrix is unverified in this run. No product-side directory leak was reproduced.
kayg commented 2026-10-07 00:57:53 +00:00
Author
Owner
Copy link

Finished #1199 on branch job/directory-1199.

Built

  • Added the directory_visibility setting (instance / contacts) and persisted it through auth migrations and server config. Self-hosted defaults stay instance; deployments can default the shared service to contacts.
  • Limited People and Group discovery in contacts mode to existing contact edges and Group membership.
  • Added exact email/handle sharing with a per-User limiter, private pending invites, and indistinguishable acknowledgements for known and unknown addresses.
  • Kept the picker on the shared Pill primitive and improved its exact-address label. Updated its accessible name in the live Share e2e.
  • Extended the cross-user probe and captured the full macOS screenshot matrix (390, 820, 1440; light and dark) in artifacts/share-1034/screenshots/ (66 files; not committed).

Head and commits

HEAD: 202da836b33954646b351f6d9e57f0d292c5d559.
Atomic commits cover auth/config, Files routes, contracts, migration numbering/registration, policy documentation, adversarial coverage, the recipient label, and the e2e selector.

Gates and verification

  • cargo fmt --check — passed.
  • cargo clippy -p calternal-auth --all-targets -- -D warnings — passed.
  • cargo test -p calternal-auth -- --test-threads=4 — 136 passed; 0 failed; 3 ignored.
  • cargo clippy -p calternal-plugin-files --all-targets -- -D warnings — passed.
  • cargo test -p calternal-plugin-files -- --test-threads=4 — 260 passed; 0 failed; 4 ignored; the focused exact-address route test also passed.
  • cargo clippy -p calternal-server --all-targets -- -D warnings — passed. Full server tests reported 264 passed; 2 failed; 12 ignored; the two failures are the existing nested namespace/process probes that cannot open .system/index.sqlite in their isolated child process. Feature-specific authorization and schema-upgrade tests passed.
  • bun run check — passed: perf-lint: PASS; 0 violations; 22681 scoped exceptions; svelte-check found 0 errors and 2 warnings in 2 files (existing empty rulesets in AttachmentDeck and AgendaList).
  • bun run test --maxWorkers=2 — Test Files 282 passed (282); Tests 1979 passed (1979). Static sub-gates: Python 136 tests ... OK; Bun 8 pass, 0 fail.
  • CALTERNAL_SERVER_BIN=... bun e2e/share-1034.mjs — PASS #1034: two-User Share → Collaborate → revoke, recursive folder, public Note and 66 macOS screenshots.
  • ADVERSARIAL_DIRECTORY_VISIBILITY_ONLY=1 tests/adversarial/run.sh — Directory visibility #1199: unrelated Users hidden, Group member visible, known and unknown exact-address responses match. Revoked-Share timing control also passed with identical 404 profiles (median delta 0.4 ms across 12 alternating pairs).
  • cargo clean removed 23,831 files / 21.8 GiB; web build output was deleted.

UX gaps closed / left

Closed: exact-address action text now includes the address with readable spacing; the exact-address input and list item have accessible names; keyboard and pointer selection remain covered; responsive/light-dark macOS screenshots cover the Share flows.
Left: screenshots are in the ignored local artifacts directory. scripts/fj issue has no attachment command, so they could not be uploaded from this job.

Decisions not stated in DESIGN

  • Verified OIDC email is the address identity; handles are exact-match only.
  • Surrounding ASCII spaces are trimmed; control and Unicode whitespace are rejected.
  • The exact-share acknowledgement is padded and stable for known and unknown addresses; unknown addresses create a private pending invite.
  • The performance gate required exact live-site adoption after the merged baseline changed. --adopt-7c updated exact scopes under #1058; no rules were weakened. This produced a large generated ledger diff.

Known gaps

  • No dedicated bench/ profile or realistic-data performance measurement was added for this feature; the hot paths need a follow-up measurement.
  • A final fetch observed origin/dev at 3601719b80a39f712daf07b37879b22929dfffa0, after this branch's required merge at a365d1442. A second merge attempt conflicted in generated OpenAPI/performance files and the upgrade fixture, so it was aborted; this branch does not include that later upstream merge. No push was made.
Finished #1199 on branch `job/directory-1199`. ## Built - Added the `directory_visibility` setting (`instance` / `contacts`) and persisted it through auth migrations and server config. Self-hosted defaults stay `instance`; deployments can default the shared service to `contacts`. - Limited People and Group discovery in contacts mode to existing contact edges and Group membership. - Added exact email/handle sharing with a per-User limiter, private pending invites, and indistinguishable acknowledgements for known and unknown addresses. - Kept the picker on the shared `Pill` primitive and improved its exact-address label. Updated its accessible name in the live Share e2e. - Extended the cross-user probe and captured the full macOS screenshot matrix (390, 820, 1440; light and dark) in `artifacts/share-1034/screenshots/` (66 files; not committed). ## Head and commits HEAD: `202da836b33954646b351f6d9e57f0d292c5d559`. Atomic commits cover auth/config, Files routes, contracts, migration numbering/registration, policy documentation, adversarial coverage, the recipient label, and the e2e selector. ## Gates and verification - `cargo fmt --check` — passed. - `cargo clippy -p calternal-auth --all-targets -- -D warnings` — passed. - `cargo test -p calternal-auth -- --test-threads=4` — `136 passed; 0 failed; 3 ignored`. - `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings` — passed. - `cargo test -p calternal-plugin-files -- --test-threads=4` — `260 passed; 0 failed; 4 ignored`; the focused exact-address route test also passed. - `cargo clippy -p calternal-server --all-targets -- -D warnings` — passed. Full server tests reported `264 passed; 2 failed; 12 ignored`; the two failures are the existing nested namespace/process probes that cannot open `.system/index.sqlite` in their isolated child process. Feature-specific authorization and schema-upgrade tests passed. - `bun run check` — passed: `perf-lint: PASS; 0 violations; 22681 scoped exceptions`; `svelte-check found 0 errors and 2 warnings in 2 files` (existing empty rulesets in AttachmentDeck and AgendaList). - `bun run test --maxWorkers=2` — `Test Files 282 passed (282)`; `Tests 1979 passed (1979)`. Static sub-gates: Python `136 tests ... OK`; Bun `8 pass, 0 fail`. - `CALTERNAL_SERVER_BIN=... bun e2e/share-1034.mjs` — `PASS #1034: two-User Share → Collaborate → revoke, recursive folder, public Note and 66 macOS screenshots`. - `ADVERSARIAL_DIRECTORY_VISIBILITY_ONLY=1 tests/adversarial/run.sh` — `Directory visibility #1199: unrelated Users hidden, Group member visible, known and unknown exact-address responses match.` Revoked-Share timing control also passed with identical 404 profiles (median delta 0.4 ms across 12 alternating pairs). - `cargo clean` removed 23,831 files / 21.8 GiB; web build output was deleted. ## UX gaps closed / left Closed: exact-address action text now includes the address with readable spacing; the exact-address input and list item have accessible names; keyboard and pointer selection remain covered; responsive/light-dark macOS screenshots cover the Share flows. Left: screenshots are in the ignored local artifacts directory. `scripts/fj issue` has no attachment command, so they could not be uploaded from this job. ## Decisions not stated in DESIGN - Verified OIDC email is the address identity; handles are exact-match only. - Surrounding ASCII spaces are trimmed; control and Unicode whitespace are rejected. - The exact-share acknowledgement is padded and stable for known and unknown addresses; unknown addresses create a private pending invite. - The performance gate required exact live-site adoption after the merged baseline changed. `--adopt-7c` updated exact scopes under #1058; no rules were weakened. This produced a large generated ledger diff. ## Known gaps - No dedicated `bench/` profile or realistic-data performance measurement was added for this feature; the hot paths need a follow-up measurement. - A final fetch observed `origin/dev` at `3601719b80a39f712daf07b37879b22929dfffa0`, after this branch's required merge at `a365d1442`. A second merge attempt conflicted in generated OpenAPI/performance files and the upgrade fixture, so it was aborted; this branch does not include that later upstream merge. No push was made.
kayg commented 2026-10-07 10:26:58 +00:00
Author
Owner
Copy link

Independent defensive review started at detached HEAD 202da836b33954646b351f6d9e57f0d292c5d559, requested base a365d1442. Reviewing contacts visibility, exact-address response equivalence, protocol/agent surfaces, and the four migration numbers against fetched origin/dev. Product code will remain unchanged; findings and failing defensive tests are retained in this worktree.

Independent defensive review started at detached HEAD `202da836b33954646b351f6d9e57f0d292c5d559`, requested base `a365d1442`. Reviewing contacts visibility, exact-address response equivalence, protocol/agent surfaces, and the four migration numbers against fetched origin/dev. Product code will remain unchanged; findings and failing defensive tests are retained in this worktree.
kayg commented 2026-10-07 10:51:48 +00:00
Author
Owner
Copy link

Defensive live checks on the pinned backend reproduced two account-discovery boundaries in contacts mode:

  • crates/calternal-auth/src/store.rs:2526 (PATCH /api/v1/auth/me/profile): an unrelated existing handle returns HTTP 409, 55 bytes, Resource already exists; an unused handle returns HTTP 200, 142 bytes.
  • crates/plugins/files/src/shares.rs:275 (POST /api/v1/files/shares): with the same missing item path, an unrelated existing User ID returns HTTP 404, 57 bytes, file not found; a missing UUID returns HTTP 400, 68 bytes, invalid path or request. This check creates no Share. It requires a candidate User ID, but neither a contact edge nor a real item.

People and Group filtering, Admin-only lists, and invitation-start status/size comparisons passed their positive and negative controls. Remaining protocol, MCP, pending-state and 200-request timing checks are running. No product code has changed.

Defensive live checks on the pinned backend reproduced two account-discovery boundaries in contacts mode: - `crates/calternal-auth/src/store.rs:2526` (`PATCH /api/v1/auth/me/profile`): an unrelated existing handle returns HTTP 409, 55 bytes, `Resource already exists`; an unused handle returns HTTP 200, 142 bytes. - `crates/plugins/files/src/shares.rs:275` (`POST /api/v1/files/shares`): with the same missing item path, an unrelated existing User ID returns HTTP 404, 57 bytes, `file not found`; a missing UUID returns HTTP 400, 68 bytes, `invalid path or request`. This check creates no Share. It requires a candidate User ID, but neither a contact edge nor a real item. People and Group filtering, Admin-only lists, and invitation-start status/size comparisons passed their positive and negative controls. Remaining protocol, MCP, pending-state and 200-request timing checks are running. No product code has changed.
kayg commented 2026-10-07 11:05:13 +00:00
Author
Owner
Copy link

NOT SAFE — independent defensive privacy review of #1199.

Reviewed product source: 202da836b33954646b351f6d9e57f0d292c5d559; requested diff base: a365d1442. Review branch: review/dirrev-1199; review HEAD: a7c6ad850d7db2e9deb30887654fea3b4790fa2d. Only defensive tests and their comments were committed. No product fixes, pushes, deploys or merge commits.

Confirmed defensive findings:

  1. Handle existence through own profile. crates/calternal-auth/src/store.rs:2526 and crates/calternal-auth/src/error.rs:79. A signed-in member changes their own handle to an unrelated existing handle: HTTP 409, 55 bytes, Resource already exists. An unused handle gives HTTP 200, 142 bytes. This needs no Group, Share or candidate User ID. The Profile changes do not disclose unrelated handles test fails.
  2. Unrestricted direct recipient checks and contact creation. crates/plugins/files/src/shares.rs:275, :290, :316; crates/plugins/files/src/lookup.rs:165. The same missing item gives HTTP 404/57 bytes for an unrelated existing User ID and HTTP 400/68 bytes for a missing UUID, without creating a Share. With a real item, an unrelated User gives HTTP 200/298 bytes and a missing UUID gives 400/68. The next People read exposes that User's username and display name before acceptance. An unrelated Group gives HTTP 200/320 bytes including its private name; a missing Group gives 400/68. The corresponding three direct-recipient checks and the contact-creation check fail. The corrected MCP calternal_api_files_create_share check also fails: HTTP 200 and isError: false create the unrelated grant.
  3. Acceptance boundary is incomplete. crates/plugins/files/src/shares.rs:408 and :520; crates/plugins/files/migrations/0030_address_share_invites.sql:15. An exact-handle request returns 202, but the recipient can immediately list a raw incoming grant with the sender's User ID, Home path, and recipient_private: false. No acceptance occurred, and no handler writes accepted_at. Two checks fail under the job's accepted-contact boundary. This is distinct from the owner-side pending mask, which passed. The sender voluntarily initiated sharing; whether this disclosure is an intended exception needs an explicit policy decision. Findings 1 and 2 independently block the merge.

Defensive checks that passed:

  • People hides unrelated Users and retains the Group peer; Group lists hide unrelated Groups.
  • Both Admin User lists and the Admin Group list return 403 for the member and 200 for the Admin.
  • Invite-start known/unknown handles both return 200/663 bytes. Registration finish was not exercised.
  • Authenticated DAV root returns 207 and lists only the caller. Known/missing other principal and calendar Homes return identical empty 404 responses. Other WebDAV Homes return identical empty 403 responses. The CardDAV address-book path returns identical 404 responses; inbound CardDAV is not implemented here.
  • Search returns no hidden profile for the handle, address or User ID. With MCP enabled through the ordinary User setting, MCP People and Search also pass.
  • Notifications contain generic Share notices and item links, without the sender's User ID.
  • Every one of 40 senders receives 429 on the eleventh address request. The retained Index has 40 unknown private pending invites with no recipient or grant, and 40 known grants with acceptance still unset.
  • No separate User mention/autocomplete, avatar or other-User profile read endpoint was found in the OpenAPI/source inventory. The Share autocomplete uses People/Groups; current prompt mentions select Agents.

Timing: local defensive measurements, with all samples retained. Load averages were [33.71044921875, 37.26318359375, 33.84423828125] at start and [36.16015625, 37.12646484375, 34.11376953125] at end. Each class has 200 successful requests; 40 senders each make five known and five unknown requests, alternating order, without disabling limits.

Operation / class p50 ms p95 ms
Address create, known 94.07 1193.63
Address create, unknown 92.63 114.22
Pending invite PATCH, known 43.23 209.71
Pending invite PATCH, unknown 44.96 309.63

Create acknowledgements match exactly in status (202), length (90 bytes), keys and message. Known-minus-unknown create p50 is 1.44 ms; p95 is 1079.41 ms. The 75 ms floor does not bound the known-address tail: recipient publication is awaited at shares.rs:478-493. This observed separation needs investigation. It is not the sole basis for the verdict, and these busy-host timings do not prove a timing-only privacy defect. PATCH has 113/200 known-slower pairs, with no consistent positive median separation. Raw samples remain in timing.json and mutation-timing.json.

Migrations: no number collisions with final fetched origin/dev at 0419170fe456b58614befcb12d9c9d255118f1c0: auth 0017/0018; Files 0029/0030. Notes 0036/0037, notifications 0009-0011 and plugin 0003 have separate namespaces. Applying all four SQL scripts preserves the original Users, Group memberships and direct/Group grants in the independent fixture. Transaction rollback removes the new schema and preserves those rows. Production snapshot restore and older-binary privacy during downgrade remain unverified; SQL transaction rollback is not a binary downgrade claim.

Files built: tests/adversarial/dirrev_1199.py. Evidence: artifacts/dirrev/findings.md, probe.log, results.json, mcp-probe.log, mcp-results.json, timing.json, mutation-timing.json, binary.sha256, and gate/setup logs. Test comments were re-read. No visible controls changed; no UI screenshot review is claimed.

Gate and test output, verbatim:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 43s
Compressed 917 static variants; saved 21369345 bytes.
Defensive review: 63 passed; 10 failed; 73 checks
Defensive review: 2 passed; 1 failed; 3 checks
     Removed 8648 files, 7.3GiB total

cargo fmt --check and python3 -m py_compile tests/adversarial/dirrev_1199.py each returned exit 0 with no output. The first review summary includes three MCP fixture denials, which are not product findings; those checks were rerun alone after correcting Host and enabling the default-disabled MCP surface. Valid combined result: 65 passed; 8 failed; 73 checks. The failed checks intentionally remain failing on this product branch. No Rust crate or web product code was changed, so clippy, crate tests and full web check/test were not rerun by this review.

Reconciliation and remaining gaps: the one requested merge attempt found conflicts in contracts/openapi.json, contracts/perf/adoption-1058.json, contracts/perf/exceptions.json, contracts/perf/ratchet.json, crates/calternal-server/src/upgrade_tests.rs, tests/adversarial/run.sh, and tests/adversarial/xuser_matrix.py. It was aborted to keep the exact pinned independent-review source and avoid product resolutions. No combined-dev verification is claimed. The author must fix the discovery boundaries, complete the acceptance policy, reconcile these files, and rerun focused defensive cases before another safety verdict. Unknown-address delivery remains deferred by DESIGN §56 (OPEN). This review did not run invite registration finish, a production backup restore, or a real older-binary downgrade.

Decisions: no new product design. The defensive interpretation follows the prompt's accepted-contact restriction. Timing uses separate senders to preserve the live limiter and keeps slow samples. The whole API/protocol round ran once; only MCP fixture checks needed a focused correction. Cargo cleanup removed the target, and the exact /mnt/hdd/targets/dirrev, web build and Svelte output directories were removed. The worktree is clean.

NOT SAFE — independent defensive privacy review of #1199. Reviewed product source: `202da836b33954646b351f6d9e57f0d292c5d559`; requested diff base: `a365d1442`. Review branch: `review/dirrev-1199`; review HEAD: `a7c6ad850d7db2e9deb30887654fea3b4790fa2d`. Only defensive tests and their comments were committed. No product fixes, pushes, deploys or merge commits. Confirmed defensive findings: 1. **Handle existence through own profile.** `crates/calternal-auth/src/store.rs:2526` and `crates/calternal-auth/src/error.rs:79`. A signed-in member changes their own handle to an unrelated existing handle: HTTP 409, 55 bytes, `Resource already exists`. An unused handle gives HTTP 200, 142 bytes. This needs no Group, Share or candidate User ID. The `Profile changes do not disclose unrelated handles` test fails. 2. **Unrestricted direct recipient checks and contact creation.** `crates/plugins/files/src/shares.rs:275`, `:290`, `:316`; `crates/plugins/files/src/lookup.rs:165`. The same missing item gives HTTP 404/57 bytes for an unrelated existing User ID and HTTP 400/68 bytes for a missing UUID, without creating a Share. With a real item, an unrelated User gives HTTP 200/298 bytes and a missing UUID gives 400/68. The next People read exposes that User's username and display name before acceptance. An unrelated Group gives HTTP 200/320 bytes including its private name; a missing Group gives 400/68. The corresponding three direct-recipient checks and the contact-creation check fail. The corrected MCP `calternal_api_files_create_share` check also fails: HTTP 200 and `isError: false` create the unrelated grant. 3. **Acceptance boundary is incomplete.** `crates/plugins/files/src/shares.rs:408` and `:520`; `crates/plugins/files/migrations/0030_address_share_invites.sql:15`. An exact-handle request returns 202, but the recipient can immediately list a raw incoming grant with the sender's User ID, Home path, and `recipient_private: false`. No acceptance occurred, and no handler writes `accepted_at`. Two checks fail under the job's accepted-contact boundary. This is distinct from the owner-side pending mask, which passed. The sender voluntarily initiated sharing; whether this disclosure is an intended exception needs an explicit policy decision. Findings 1 and 2 independently block the merge. Defensive checks that passed: - People hides unrelated Users and retains the Group peer; Group lists hide unrelated Groups. - Both Admin User lists and the Admin Group list return 403 for the member and 200 for the Admin. - Invite-start known/unknown handles both return 200/663 bytes. Registration finish was not exercised. - Authenticated DAV root returns 207 and lists only the caller. Known/missing other principal and calendar Homes return identical empty 404 responses. Other WebDAV Homes return identical empty 403 responses. The CardDAV address-book path returns identical 404 responses; inbound CardDAV is not implemented here. - Search returns no hidden profile for the handle, address or User ID. With MCP enabled through the ordinary User setting, MCP People and Search also pass. - Notifications contain generic Share notices and item links, without the sender's User ID. - Every one of 40 senders receives 429 on the eleventh address request. The retained Index has 40 unknown private pending invites with no recipient or grant, and 40 known grants with acceptance still unset. - No separate User mention/autocomplete, avatar or other-User profile read endpoint was found in the OpenAPI/source inventory. The Share autocomplete uses People/Groups; current prompt mentions select Agents. Timing: local defensive measurements, with all samples retained. Load averages were [33.71044921875, 37.26318359375, 33.84423828125] at start and [36.16015625, 37.12646484375, 34.11376953125] at end. Each class has 200 successful requests; 40 senders each make five known and five unknown requests, alternating order, without disabling limits. | Operation / class | p50 ms | p95 ms | | --- | ---: | ---: | | Address create, known | 94.07 | 1193.63 | | Address create, unknown | 92.63 | 114.22 | | Pending invite PATCH, known | 43.23 | 209.71 | | Pending invite PATCH, unknown | 44.96 | 309.63 | Create acknowledgements match exactly in status (202), length (90 bytes), keys and message. Known-minus-unknown create p50 is 1.44 ms; p95 is 1079.41 ms. The 75 ms floor does not bound the known-address tail: recipient publication is awaited at `shares.rs:478-493`. This observed separation needs investigation. It is not the sole basis for the verdict, and these busy-host timings do not prove a timing-only privacy defect. PATCH has 113/200 known-slower pairs, with no consistent positive median separation. Raw samples remain in `timing.json` and `mutation-timing.json`. Migrations: **no number collisions** with final fetched `origin/dev` at `0419170fe456b58614befcb12d9c9d255118f1c0`: auth 0017/0018; Files 0029/0030. Notes 0036/0037, notifications 0009-0011 and plugin 0003 have separate namespaces. Applying all four SQL scripts preserves the original Users, Group memberships and direct/Group grants in the independent fixture. Transaction rollback removes the new schema and preserves those rows. Production snapshot restore and older-binary privacy during downgrade remain unverified; SQL transaction rollback is not a binary downgrade claim. Files built: `tests/adversarial/dirrev_1199.py`. Evidence: `artifacts/dirrev/findings.md`, `probe.log`, `results.json`, `mcp-probe.log`, `mcp-results.json`, `timing.json`, `mutation-timing.json`, `binary.sha256`, and gate/setup logs. Test comments were re-read. No visible controls changed; no UI screenshot review is claimed. Gate and test output, verbatim: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 43s Compressed 917 static variants; saved 21369345 bytes. Defensive review: 63 passed; 10 failed; 73 checks Defensive review: 2 passed; 1 failed; 3 checks Removed 8648 files, 7.3GiB total ``` `cargo fmt --check` and `python3 -m py_compile tests/adversarial/dirrev_1199.py` each returned exit 0 with no output. The first review summary includes three MCP fixture denials, which are not product findings; those checks were rerun alone after correcting Host and enabling the default-disabled MCP surface. Valid combined result: **65 passed; 8 failed; 73 checks**. The failed checks intentionally remain failing on this product branch. No Rust crate or web product code was changed, so clippy, crate tests and full web check/test were not rerun by this review. Reconciliation and remaining gaps: the one requested merge attempt found conflicts in `contracts/openapi.json`, `contracts/perf/adoption-1058.json`, `contracts/perf/exceptions.json`, `contracts/perf/ratchet.json`, `crates/calternal-server/src/upgrade_tests.rs`, `tests/adversarial/run.sh`, and `tests/adversarial/xuser_matrix.py`. It was aborted to keep the exact pinned independent-review source and avoid product resolutions. No combined-dev verification is claimed. The author must fix the discovery boundaries, complete the acceptance policy, reconcile these files, and rerun focused defensive cases before another safety verdict. Unknown-address delivery remains deferred by DESIGN §56 (OPEN). This review did not run invite registration finish, a production backup restore, or a real older-binary downgrade. Decisions: no new product design. The defensive interpretation follows the prompt's accepted-contact restriction. Timing uses separate senders to preserve the live limiter and keeps slow samples. The whole API/protocol round ran once; only MCP fixture checks needed a focused correction. Cargo cleanup removed the target, and the exact `/mnt/hdd/targets/dirrev`, web build and Svelte output directories were removed. The worktree is clean.
kayg commented 2026-10-07 11:05:48 +00:00
Author
Owner
Copy link

Reference correction for the final defensive report: Conflict maps to HTTP 409 at crates/calternal-auth/src/error.rs:73; the direct Group name is read at crates/plugins/files/src/shares.rs:317; the exact-address grant INSERT is at shares.rs:413. The retained final-report.md now uses these exact lines. Verdict remains NOT SAFE; the valid checks remain 65 passed, 8 failed, 73 total. Product code is unchanged and cleanup is complete.

Reference correction for the final defensive report: Conflict maps to HTTP 409 at `crates/calternal-auth/src/error.rs:73`; the direct Group name is read at `crates/plugins/files/src/shares.rs:317`; the exact-address grant INSERT is at `shares.rs:413`. The retained final-report.md now uses these exact lines. Verdict remains **NOT SAFE**; the valid checks remain **65 passed, 8 failed, 73 total**. Product code is unchanged and cleanup is complete.
kayg commented 2026-10-07 11:13:06 +00:00
Author
Owner
Copy link

Resuming privacy fixes on job/directory-1199 from 202da836b3. Fetched origin/dev 0419170fe; reconciling seven conflicts while retaining both isolation coverage and current migrations. Independent review a7c6ad850 findings read. Will fix bounded profile-handle probing, allowed-set direct recipients, pending acceptance, and inline publication, then run all three required isolation probes and ordered gates. No push or deployment.

Resuming privacy fixes on job/directory-1199 from 202da836b33954646b351f6d9e57f0d292c5d559. Fetched origin/dev 0419170fe; reconciling seven conflicts while retaining both isolation coverage and current migrations. Independent review a7c6ad850 findings read. Will fix bounded profile-handle probing, allowed-set direct recipients, pending acceptance, and inline publication, then run all three required isolation probes and ordered gates. No push or deployment.
kayg commented 2026-10-07 11:13:06 +00:00
Author
Owner
Copy link

Resuming privacy fixes on job/directory-1199 from 202da836b3. Fetched origin/dev 0419170fe; reconciling seven conflicts while retaining both isolation coverage and current migrations. Independent review a7c6ad850 findings read. Will fix bounded profile-handle probing, allowed-set direct recipients, pending acceptance, and inline publication, then run all three required isolation probes and ordered gates. No push or deployment.

Resuming privacy fixes on job/directory-1199 from 202da836b33954646b351f6d9e57f0d292c5d559. Fetched origin/dev 0419170fe; reconciling seven conflicts while retaining both isolation coverage and current migrations. Independent review a7c6ad850 findings read. Will fix bounded profile-handle probing, allowed-set direct recipients, pending acceptance, and inline publication, then run all three required isolation probes and ordered gates. No push or deployment.
kayg commented 2026-10-07 11:20:34 +00:00
Author
Owner
Copy link

Privacy fix findings and decisions: the former exact-address handler inserted files_grants before consent; both create and later pending update/revoke publication exposed Shared paths. Requests now retain no grant, and pending mutations do not publish recipient content. Acceptance writes accepted_at and creates a grant together, after stable item verification. Owner revoke reads consent under the same writer lock to prevent acceptance racing revocation. Direct recipient authorization reuses the indexed People contact relation under the writer lock, after item validation; it is independent of the picker display cap. Group resolution follows the Group picker policy.

Decision: five handle-change attempts per User per hour, persisted in Security state. Refusals count, concurrent requests serialize admission, and display-name edits use no budget. Unique handles retain a bounded taken-handle refusal; documented this residual in DESIGN §54 as the brief requires. The imported independent profile assertion is updated only for this explicitly changed acceptance criterion; the known pending storage assertion now requires share_id IS NULL. Acceptance and decline positive/negative regressions are added.

Fetched origin/dev again before gates: 0419170fe, already up to date. New migrations auth 0019 and Files 0031 do not collide; auth 0017/0018 and Files 0029/0030 remain unchanged. Backend/API fixes only; no new visual screen is claimed.

Privacy fix findings and decisions: the former exact-address handler inserted files_grants before consent; both create and later pending update/revoke publication exposed Shared paths. Requests now retain no grant, and pending mutations do not publish recipient content. Acceptance writes accepted_at and creates a grant together, after stable item verification. Owner revoke reads consent under the same writer lock to prevent acceptance racing revocation. Direct recipient authorization reuses the indexed People contact relation under the writer lock, after item validation; it is independent of the picker display cap. Group resolution follows the Group picker policy. Decision: five handle-change attempts per User per hour, persisted in Security state. Refusals count, concurrent requests serialize admission, and display-name edits use no budget. Unique handles retain a bounded taken-handle refusal; documented this residual in DESIGN §54 as the brief requires. The imported independent profile assertion is updated only for this explicitly changed acceptance criterion; the known pending storage assertion now requires share_id IS NULL. Acceptance and decline positive/negative regressions are added. Fetched origin/dev again before gates: 0419170fe, already up to date. New migrations auth 0019 and Files 0031 do not collide; auth 0017/0018 and Files 0029/0030 remain unchanged. Backend/API fixes only; no new visual screen is claimed.
kayg commented 2026-10-07 11:31:52 +00:00
Author
Owner
Copy link

Atomic progress: 901f45349 persists the five-per-hour per-User handle budget and tests concurrent refusals plus store recreation. Focused gate output, verbatim:

test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 129 filtered out; finished in 0.70s

Production web build passed: Compressed 917 static variants; saved 21487399 bytes. Final clippy and full per-crate tests remain pending while the cold Files dependency graph compiles. This is progress evidence, not a READY verdict.

Atomic progress: 901f45349 persists the five-per-hour per-User handle budget and tests concurrent refusals plus store recreation. Focused gate output, verbatim: ``` test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 129 filtered out; finished in 0.70s ``` Production web build passed: `Compressed 917 static variants; saved 21487399 bytes.` Final clippy and full per-crate tests remain pending while the cold Files dependency graph compiles. This is progress evidence, not a READY verdict.
kayg commented 2026-10-07 12:09:24 +00:00
Author
Owner
Copy link

The first focused Files test failed before reaching HTTP assertions: migration 31 deletes old unaccepted grants, which follows the address-invite foreign key to Auth-owned Users. Isolated Files fixtures previously migrated Files before creating Users. Production migrates Auth first. I extracted the existing Users test-schema helper and now call it before Files migrations in all affected fixtures, without disabling foreign keys or changing HTTP expectations. The independent SQLite upgrade regression passes with foreign keys enabled. A focused Files rerun is queued.

The contacts relation now has one SQL view shared by People and direct recipient authorization. The pending request inbox is capped at 100 newest rows with a matching index; accepting or declining exposes the next batch. No pending grant, Search hook or Shared publication runs on the address acknowledgement path.

The first focused Files test failed before reaching HTTP assertions: migration 31 deletes old unaccepted grants, which follows the address-invite foreign key to Auth-owned Users. Isolated Files fixtures previously migrated Files before creating Users. Production migrates Auth first. I extracted the existing Users test-schema helper and now call it before Files migrations in all affected fixtures, without disabling foreign keys or changing HTTP expectations. The independent SQLite upgrade regression passes with foreign keys enabled. A focused Files rerun is queued. The contacts relation now has one SQL view shared by People and direct recipient authorization. The pending request inbox is capped at 100 newest rows with a matching index; accepting or declining exposes the next batch. No pending grant, Search hook or Shared publication runs on the address acknowledgement path.
kayg commented 2026-10-07 12:25:32 +00:00
Author
Owner
Copy link

Committed the isolated fixture correction as 28c0e009f and the recipient/consent implementation as 028ce1255. The focused Files regression output is:

test tests::exact_address_shares_do_not_disclose_account_existence ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 267 filtered out; finished in 1.99s

Auth clippy completed with:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 56m 50s

The full Auth test run is in progress; its migration receipt expectation was extended from 18 to 19 because this issue explicitly adds the durable budget migration. The assertion still pins every receipt in order. Files and server gates and the required live isolation matrices remain pending. No READY FOR MERGE claim yet.

Committed the isolated fixture correction as 28c0e009f and the recipient/consent implementation as 028ce1255. The focused Files regression output is: ``` test tests::exact_address_shares_do_not_disclose_account_existence ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 267 filtered out; finished in 1.99s ``` Auth clippy completed with: ``` Finished `dev` profile [unoptimized + debuginfo] target(s) in 56m 50s ``` The full Auth test run is in progress; its migration receipt expectation was extended from 18 to 19 because this issue explicitly adds the durable budget migration. The assertion still pins every receipt in order. Files and server gates and the required live isolation matrices remain pending. No READY FOR MERGE claim yet.
kayg commented 2026-10-07 14:01:07 +00:00
Author
Owner
Copy link

Committed 99aac1b67: exact-address recipient lookup now holds the same writer lock as its foreign key insertion. A controlled uncommitted User deletion regression returns 202 instead of permitting a stale recipient reference. The focused consent regression passes.

The first full Files run found share_creation_rejects_a_nonexistent_recipient_before_indexing: 263 passed, 1 failed, 4 ignored. I kept the expectation. Direct creation now stats the item first, preflights recipient discovery before assigning an item ID, then rechecks discovery under the writer lock before the grant. The unchanged focused regression passes:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 267 filtered out; finished in 2.07s

Canonical OpenAPI regeneration has nine semantic JSON changes: three request paths, their minimal DTO, two previously omitted directory-visibility fields, required-field metadata, and descriptions. The large textual diff is key ordering from canonical generation. The registry contains 432 operations and 407 tools. The latest production web build passes. The required dirrev, xuser and authz probes are now running against the rebuilt binary; remaining crate gates are in progress.

Committed 99aac1b67: exact-address recipient lookup now holds the same writer lock as its foreign key insertion. A controlled uncommitted User deletion regression returns 202 instead of permitting a stale recipient reference. The focused consent regression passes. The first full Files run found `share_creation_rejects_a_nonexistent_recipient_before_indexing`: 263 passed, 1 failed, 4 ignored. I kept the expectation. Direct creation now stats the item first, preflights recipient discovery before assigning an item ID, then rechecks discovery under the writer lock before the grant. The unchanged focused regression passes: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 267 filtered out; finished in 2.07s ``` Canonical OpenAPI regeneration has nine semantic JSON changes: three request paths, their minimal DTO, two previously omitted directory-visibility fields, required-field metadata, and descriptions. The large textual diff is key ordering from canonical generation. The registry contains 432 operations and 407 tools. The latest production web build passes. The required dirrev, xuser and authz probes are now running against the rebuilt binary; remaining crate gates are in progress.
kayg commented 2026-10-07 14:21:54 +00:00
Author
Owner
Copy link

Verification finding (head 6e90d79f4):

The updated privacy probe passes: Defensive review: 90 passed; 0 failed; 90 checks. The cross-User matrix completed 958 A-ID/missing-ID comparisons and 117 Job/Mail/quota comparisons (zero denial failures). The authorization matrix completed 3,056 requests over 434 OpenAPI operations.

The added pre-consent folder-listing check now uses the documented listing denial contract: an existing pending owner and an absent owner return identical 403 status, length and body. The first version of this new check incorrectly used the ordinary Item-read 404 contract. No existing test expectation changed.

Files gate: test result: ok. 264 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 308.62s.

Server tests found 14 isolated appearance fixture failures with no such table: main.users. These fixtures migrated Files without Auth; pending-consent cleanup now follows its existing foreign keys. The fix reuses the server Auth migration registration before Files, with no production behavior change. Its focused tests and the server clippy gate are running.

Local profile: 5,044 Users and 200 requests per address class. Known create p50/p95 = 99.184/187.170 ms; unknown = 100.552/190.553 ms. The reviewed implementation had known/unknown p95 = 1193.632/114.224 ms. These are local measurements under host load, not a comparable release baseline.

The production macOS screenshots cover Share and admin configuration at 390/820/1440 px in paper and tokyo-night, under artifacts/dirfix/screenshots. Full web tests are running.

Verification finding (head 6e90d79f4): The updated privacy probe passes: `Defensive review: 90 passed; 0 failed; 90 checks`. The cross-User matrix completed 958 A-ID/missing-ID comparisons and 117 Job/Mail/quota comparisons (zero denial failures). The authorization matrix completed 3,056 requests over 434 OpenAPI operations. The added pre-consent folder-listing check now uses the documented listing denial contract: an existing pending owner and an absent owner return identical 403 status, length and body. The first version of this new check incorrectly used the ordinary Item-read 404 contract. No existing test expectation changed. Files gate: `test result: ok. 264 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 308.62s`. Server tests found 14 isolated appearance fixture failures with `no such table: main.users`. These fixtures migrated Files without Auth; pending-consent cleanup now follows its existing foreign keys. The fix reuses the server Auth migration registration before Files, with no production behavior change. Its focused tests and the server clippy gate are running. Local profile: 5,044 Users and 200 requests per address class. Known create p50/p95 = 99.184/187.170 ms; unknown = 100.552/190.553 ms. The reviewed implementation had known/unknown p95 = 1193.632/114.224 ms. These are local measurements under host load, not a comparable release baseline. The production macOS screenshots cover Share and admin configuration at 390/820/1440 px in paper and tokyo-night, under artifacts/dirfix/screenshots. Full web tests are running.
kayg commented 2026-10-07 14:29:18 +00:00
Author
Owner
Copy link

Production build screenshot evidence for #1199. macOS platform emulation, real local API data, 390/820/1440 px, light and dark. Invite capability fields are masked. Controls reuse OverlaySurface, Pill, SegmentedControl, Toggle, UIHeading and CopyLink; admin uses SettingsStack and ConfigGroup. Screenshot review belongs to the orchestrator.

admin-paper-1440-macos.png

admin-paper-390-macos.png

admin-paper-820-macos.png

admin-tokyo-night-1440-macos.png

admin-tokyo-night-390-macos.png

admin-tokyo-night-820-macos.png

share-paper-1440-macos.png

share-paper-390-macos.png

share-paper-820-macos.png

share-tokyo-night-1440-macos.png

share-tokyo-night-390-macos.png

share-tokyo-night-820-macos.png

Production build screenshot evidence for #1199. macOS platform emulation, real local API data, 390/820/1440 px, light and dark. Invite capability fields are masked. Controls reuse OverlaySurface, Pill, SegmentedControl, Toggle, UIHeading and CopyLink; admin uses SettingsStack and ConfigGroup. Screenshot review belongs to the orchestrator. [admin-paper-1440-macos.png](https://git.kayg.org/attachments/cc178be1-da66-451e-983c-c22f41065072) [admin-paper-390-macos.png](https://git.kayg.org/attachments/e522f30d-5d90-4a8c-981a-7b5f2c1e89f6) [admin-paper-820-macos.png](https://git.kayg.org/attachments/4f78b6ee-391c-45a4-b66a-14fa70e75504) [admin-tokyo-night-1440-macos.png](https://git.kayg.org/attachments/3cddf817-bec0-47e1-a292-af543b2e6b2a) [admin-tokyo-night-390-macos.png](https://git.kayg.org/attachments/faf1969d-b8be-4933-b977-11ca361489d2) [admin-tokyo-night-820-macos.png](https://git.kayg.org/attachments/98d75483-cfa9-4262-95b6-a4f9d4d75321) [share-paper-1440-macos.png](https://git.kayg.org/attachments/21a3a353-56ea-4c00-87e1-1e38faccbda5) [share-paper-390-macos.png](https://git.kayg.org/attachments/916a4fd4-51e9-49ac-b36e-9c04b76ec5a9) [share-paper-820-macos.png](https://git.kayg.org/attachments/5e56f8bf-d951-4505-848c-93a10c624550) [share-tokyo-night-1440-macos.png](https://git.kayg.org/attachments/a61995e9-a696-4e68-a56a-786ed39720e6) [share-tokyo-night-390-macos.png](https://git.kayg.org/attachments/13d7c9c5-1831-4fc7-a301-436dafba662d) [share-tokyo-night-820-macos.png](https://git.kayg.org/attachments/c6b4f714-398f-4f33-9a1b-841432e8716d)
kayg commented 2026-10-07 15:03:01 +00:00
Author
Owner
Copy link

dirfix-1199 final report — NOT READY FOR MERGE

Head: 14d5950774, branch job/directory-1199, base origin/dev 0419170fe. NOT READY until the full web and server gates pass.

Built

  • A durable five-attempt/hour budget for own-profile handle changes. Conflicts and successful changes count; display-only edits do not. Concurrent attempts and restart persistence have regressions.
  • Item-first Share validation and one contacts view shared by People and direct-recipient checks. Unknown and unrelated User/Group recipients have identical refusals. Rejected recipients do not enter the Index.
  • Grant-free pending exact-address requests. The recipient projection has request ID, sender display name, access and creation time only. Recipient-bound accept commits accepted_at, the grant and events together; decline removes the request. Accept follows the stable item ID across renames. Migration 0031 removes earlier pre-consent grants and recipient events while preserving accepted grants.
  • No recipient publication before consent or on the address response path. Known and unknown addresses use the same request write and acknowledgement. Direct Group create publication uses bounded concurrency.
  • Regression coverage for migration preservation, recipient denial, acceptance/decline, rename, User deletion and accept/revoke races. Generated API/action contracts and exact performance receipts are current.
  • Isolated Files and appearance fixtures now provide Auth prerequisites before consent migrations. Existing behavior assertions remain intact.

Files

Auth: crates/calternal-auth/src/store.rs, migrations/0019_profile_handle_budget.sql, src/lib.rs receipt test.
Files: crates/plugins/files/src/{shares,lookup,lib,dav,thumbnails,agent_undo}.rs and migrations/0031_pending_share_consent.sql.
Server: crates/calternal-server/src/{wire,appearance,upgrade_tests}.rs.
Contracts: contracts/{openapi,actions,action-policy}.json, contracts/perf/*.json, packages/api-client/src/generated.ts.
Docs/probes: docs/DESIGN.md §54, tests/adversarial/dirrev_1199.py, existing xuser/run integration, bench/directory-1199.py.
The earlier #1199 UI files remain on this branch: RecipientPicker, ShareDialog, Files API and AdminSection.

Privacy and isolation

All requested live matrices completed. Their exact summary lines are included below. The privacy probe passes all 90 checks, including HTTP/MCP transport, identical refusal status/body/length, rate limits, grant-free requests, access before/after consent, decline and races. Two original review expectations changed only as the fix brief requires: bounded handle uniqueness refusals, and no pre-consent grant. New folder-access assertions use the existing 403 listing contract and compare absent/known owners; ordinary Item reads use 404.

Performance

Local profile, 5044 Users, 200 requests per address class: known create p50/p95 99.184/187.170 ms; unknown 100.552/190.553 ms. Reviewed implementation p95: known 1193.632 ms, unknown 114.224 ms. Whole probe: 38.437 CPU seconds, peak child RSS 342532 KiB. Pending inbox burst: 40 requests, concurrency 4, p50/p95 45.612/78.375 ms. These are local debug measurements, not a release baseline. docs/perf/baseline.json has no comparable address-request baseline. Handle/accept/decline timings are small diagnostic samples; averaged RSS/idle CPU are not measured.

Expected address cost: one indexed address lookup, one FULL request upsert/accepted-grant update, plus item stat/identity verification; no Home scan or pending recipient work. Accept writes one grant, one consent row and two events in one transaction. The inbox reads at most 100 rows. Artifacts: artifacts/dirrev/bench.json and artifacts/dirfix/*.log.

Decisions

The handle budget is five attempts in a one-hour window anchored at first admission; refusals consume admission durably. The residual 409/200 distinction is documented in DESIGN §54. Contacts mode authorizes active contact Users and Groups the caller belongs to; Instance mode keeps its public directory policy. Pending inbox reads use batches of the newest 100. Earlier pre-consent authority is withdrawn during upgrade. Pending requests do not publish recipient Home paths or Search data; consent starts that work. Unknown-address delivery remains OPEN in §56. Used the preset CARGO_TARGET_DIR=/home/kayg/build/targets/dirfix-1199 without overriding it.

UX gaps closed

Unaccepted requests no longer appear as incoming grants or contacts. Accepting a renamed item grants the current item. Decline and revoke preserve consent boundaries. Sender acknowledgements and private recipient rendering remain identical across address classes. Production macOS screenshot sets cover Share and admin at 390/820/1440 px in paper/tokyo-night; 12 masked images are attached on #1199. Icon/text alignment was checked at 3×. Visible controls reuse OverlaySurface, Pill, SegmentedControl, Toggle, UIHeading, CopyLink, SettingsStack and ConfigGroup.

UX gaps left / known gaps

The HTTP/MCP pending inbox and accept/decline operations work; the web pending-request inbox and its controls are not wired. Repeated address submission can update an accepted grant but does not publish a recipient refresh; the normal grant-edit route remains available. Unknown-address delivery is not built because §56 is OPEN. Full server/web gate status must be completed below; do not promote this branch while either is incomplete or failing.

For the merge round

Run the full production Share e2e after the pending-inbox UI gap is addressed: cd apps/web && bun e2e/share-1034.mjs. It must preserve ordinary direct Share, public-link and cross-plugin behavior. Full deployed-build/Mac interop checks remain merge-round work. Requested privacy/isolation matrices were run in this job, not deferred.

No push, deploy, issue close or merge into dev/main was performed. The explicitly requested origin/dev integration was performed in this worktree. Cargo clean removed 23492 files (20.8 GiB). Web build output was deleted. Review artifacts remain. The working tree is clean.

Gates — exact output

cargo fmt --check exited 0 with no output. No test assertions or performance thresholds were weakened.

bun run build

✓ built in 49.37s
✓ built in 33ms
✓ built in 1m 28s
Compressed 917 static variants; saved 21510082 bytes.

cargo clippy -p calternal-auth --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 23.32s

cargo test -p calternal-auth

test result: ok. 137 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 148.48s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 52s

cargo test -p calternal-plugin-files -- --test-threads=4

test result: ok. 264 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 308.62s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-server --all-targets -- -D warnings

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 14s

Focused server fixture regression: cargo test -p calternal-server appearance::tests -- --test-threads=4

test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 260 filtered out; finished in 38.07s

bun run check

perf-lint: PASS; 0 violations; 22614 scoped exceptions
svelte-check found 0 errors and 1 warning in 1 file

bun run test --maxWorkers=2

 Test Files  10 failed | 277 passed (287)
      Tests  11 failed | 2026 passed (2037)
   Duration  2522.69s (transform 47%, import 22%, environment 16%, tests 11%, setup 3%)

Focused changed UI: RecipientPicker

 Test Files  1 passed (1)
      Tests  3 passed (3)

The first full server run failed only in 14 appearance fixtures at the missing Auth table prerequisite:

test result: FAILED. 259 passed; 14 failed; 12 ignored; 0 measured; 0 filtered out; finished in 335.48s

Those fixtures were fixed and all 25 focused appearance tests pass. The final full cargo test -p calternal-server -- --test-threads=4 rerun was stopped at the four-hour limit during compilation. It did not produce a final result. Its output was:

   Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/directory-1199/crates/calternal-server)

All 11 reported web failures were Error: Test timed out in 5000ms.: InfoPanel, JournalPage, themes, inlineLinks, BklitTooltipMaterial (two), static-assets, magnetic, focusTrap, background-store and date-formatting. The longer-timeout focused diagnostic was stopped at the job limit before results. The timeout evidence does not prove these assertions pass. The full web gate remains failed.

Live privacy/isolation — exact output

Defensive review: 90 passed; 0 failed; 90 checks

Two-User OpenAPI matrix: 434 operations classified; 207 operations replayed; 958 A-ID vs missing-ID comparisons across B, C, D and anonymous; 39 identifier routes classified with no local fixture factory; median absolute timing delta 4.1 ms
Job/Mail/quota ownership checks: 117 comparisons; 0 denial failures
Authorization matrix: 434 OpenAPI operations; 3056 requests across 4 base identities plus invalid/stale session probes and 21 App Password scope classes; valid/malformed session bodies on 20 privileged body routes; App Passwords use valid bodies; policy classes {'public': 21, 'public_link': 12, 'user': 348, 'admin': 53}

Remaining before merge

  • Complete cargo test -p calternal-server -- --test-threads=4 after the fixture fix.
  • Resolve the web timeouts and obtain a passing cd apps/web && bun run test --maxWorkers=2. The attempted 60-second focused diagnostic has no result; rerun it as needed without changing assertions.
  • Wire the recipient web pending-request inbox, accept/decline and standard actions/Undo. Add the recipient refresh for accepted address resubmission.
  • Keep unknown-address delivery unbuilt while DESIGN §56 is OPEN.

No required privacy/isolation probe was deferred. The final full gates and web consent UX are the remaining work. This report stops the job within its four-hour budget; it does not claim READY FOR MERGE.

# dirfix-1199 final report — NOT READY FOR MERGE Head: 14d595077422b37a3a6beccf4499ce366683edf4, branch job/directory-1199, base origin/dev 0419170fe. NOT READY until the full web and server gates pass. ## Built - A durable five-attempt/hour budget for own-profile handle changes. Conflicts and successful changes count; display-only edits do not. Concurrent attempts and restart persistence have regressions. - Item-first Share validation and one contacts view shared by People and direct-recipient checks. Unknown and unrelated User/Group recipients have identical refusals. Rejected recipients do not enter the Index. - Grant-free pending exact-address requests. The recipient projection has request ID, sender display name, access and creation time only. Recipient-bound accept commits accepted_at, the grant and events together; decline removes the request. Accept follows the stable item ID across renames. Migration 0031 removes earlier pre-consent grants and recipient events while preserving accepted grants. - No recipient publication before consent or on the address response path. Known and unknown addresses use the same request write and acknowledgement. Direct Group create publication uses bounded concurrency. - Regression coverage for migration preservation, recipient denial, acceptance/decline, rename, User deletion and accept/revoke races. Generated API/action contracts and exact performance receipts are current. - Isolated Files and appearance fixtures now provide Auth prerequisites before consent migrations. Existing behavior assertions remain intact. ## Files Auth: crates/calternal-auth/src/store.rs, migrations/0019_profile_handle_budget.sql, src/lib.rs receipt test. Files: crates/plugins/files/src/{shares,lookup,lib,dav,thumbnails,agent_undo}.rs and migrations/0031_pending_share_consent.sql. Server: crates/calternal-server/src/{wire,appearance,upgrade_tests}.rs. Contracts: contracts/{openapi,actions,action-policy}.json, contracts/perf/*.json, packages/api-client/src/generated.ts. Docs/probes: docs/DESIGN.md §54, tests/adversarial/dirrev_1199.py, existing xuser/run integration, bench/directory-1199.py. The earlier #1199 UI files remain on this branch: RecipientPicker, ShareDialog, Files API and AdminSection. ## Privacy and isolation All requested live matrices completed. Their exact summary lines are included below. The privacy probe passes all 90 checks, including HTTP/MCP transport, identical refusal status/body/length, rate limits, grant-free requests, access before/after consent, decline and races. Two original review expectations changed only as the fix brief requires: bounded handle uniqueness refusals, and no pre-consent grant. New folder-access assertions use the existing 403 listing contract and compare absent/known owners; ordinary Item reads use 404. ## Performance Local profile, 5044 Users, 200 requests per address class: known create p50/p95 99.184/187.170 ms; unknown 100.552/190.553 ms. Reviewed implementation p95: known 1193.632 ms, unknown 114.224 ms. Whole probe: 38.437 CPU seconds, peak child RSS 342532 KiB. Pending inbox burst: 40 requests, concurrency 4, p50/p95 45.612/78.375 ms. These are local debug measurements, not a release baseline. docs/perf/baseline.json has no comparable address-request baseline. Handle/accept/decline timings are small diagnostic samples; averaged RSS/idle CPU are not measured. Expected address cost: one indexed address lookup, one FULL request upsert/accepted-grant update, plus item stat/identity verification; no Home scan or pending recipient work. Accept writes one grant, one consent row and two events in one transaction. The inbox reads at most 100 rows. Artifacts: artifacts/dirrev/bench.json and artifacts/dirfix/*.log. ## Decisions The handle budget is five attempts in a one-hour window anchored at first admission; refusals consume admission durably. The residual 409/200 distinction is documented in DESIGN §54. Contacts mode authorizes active contact Users and Groups the caller belongs to; Instance mode keeps its public directory policy. Pending inbox reads use batches of the newest 100. Earlier pre-consent authority is withdrawn during upgrade. Pending requests do not publish recipient Home paths or Search data; consent starts that work. Unknown-address delivery remains OPEN in §56. Used the preset CARGO_TARGET_DIR=/home/kayg/build/targets/dirfix-1199 without overriding it. ## UX gaps closed Unaccepted requests no longer appear as incoming grants or contacts. Accepting a renamed item grants the current item. Decline and revoke preserve consent boundaries. Sender acknowledgements and private recipient rendering remain identical across address classes. Production macOS screenshot sets cover Share and admin at 390/820/1440 px in paper/tokyo-night; 12 masked images are attached on #1199. Icon/text alignment was checked at 3×. Visible controls reuse OverlaySurface, Pill, SegmentedControl, Toggle, UIHeading, CopyLink, SettingsStack and ConfigGroup. ## UX gaps left / known gaps The HTTP/MCP pending inbox and accept/decline operations work; the web pending-request inbox and its controls are not wired. Repeated address submission can update an accepted grant but does not publish a recipient refresh; the normal grant-edit route remains available. Unknown-address delivery is not built because §56 is OPEN. Full server/web gate status must be completed below; do not promote this branch while either is incomplete or failing. ## For the merge round Run the full production Share e2e after the pending-inbox UI gap is addressed: `cd apps/web && bun e2e/share-1034.mjs`. It must preserve ordinary direct Share, public-link and cross-plugin behavior. Full deployed-build/Mac interop checks remain merge-round work. Requested privacy/isolation matrices were run in this job, not deferred. No push, deploy, issue close or merge into dev/main was performed. The explicitly requested origin/dev integration was performed in this worktree. Cargo clean removed 23492 files (20.8 GiB). Web build output was deleted. Review artifacts remain. The working tree is clean. ## Gates — exact output `cargo fmt --check` exited 0 with no output. No test assertions or performance thresholds were weakened. bun run build ```text ✓ built in 49.37s ✓ built in 33ms ✓ built in 1m 28s Compressed 917 static variants; saved 21510082 bytes. ``` cargo clippy -p calternal-auth --all-targets -- -D warnings ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 23.32s ``` cargo test -p calternal-auth ```text test result: ok. 137 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 148.48s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo clippy -p calternal-plugin-files --all-targets -- -D warnings ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 52s ``` cargo test -p calternal-plugin-files -- --test-threads=4 ```text test result: ok. 264 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 308.62s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo clippy -p calternal-server --all-targets -- -D warnings ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 14s ``` Focused server fixture regression: cargo test -p calternal-server appearance::tests -- --test-threads=4 ```text test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 260 filtered out; finished in 38.07s ``` bun run check ```text perf-lint: PASS; 0 violations; 22614 scoped exceptions svelte-check found 0 errors and 1 warning in 1 file ``` bun run test --maxWorkers=2 ```text Test Files 10 failed | 277 passed (287) Tests 11 failed | 2026 passed (2037) Duration 2522.69s (transform 47%, import 22%, environment 16%, tests 11%, setup 3%) ``` Focused changed UI: RecipientPicker ```text Test Files 1 passed (1) Tests 3 passed (3) ``` The first full server run failed only in 14 appearance fixtures at the missing Auth table prerequisite: ```text test result: FAILED. 259 passed; 14 failed; 12 ignored; 0 measured; 0 filtered out; finished in 335.48s ``` Those fixtures were fixed and all 25 focused appearance tests pass. The final full `cargo test -p calternal-server -- --test-threads=4` rerun was stopped at the four-hour limit during compilation. It did not produce a final result. Its output was: ```text Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/directory-1199/crates/calternal-server) ``` All 11 reported web failures were `Error: Test timed out in 5000ms.`: InfoPanel, JournalPage, themes, inlineLinks, BklitTooltipMaterial (two), static-assets, magnetic, focusTrap, background-store and date-formatting. The longer-timeout focused diagnostic was stopped at the job limit before results. The timeout evidence does not prove these assertions pass. The full web gate remains failed. ## Live privacy/isolation — exact output ```text Defensive review: 90 passed; 0 failed; 90 checks ``` ```text Two-User OpenAPI matrix: 434 operations classified; 207 operations replayed; 958 A-ID vs missing-ID comparisons across B, C, D and anonymous; 39 identifier routes classified with no local fixture factory; median absolute timing delta 4.1 ms Job/Mail/quota ownership checks: 117 comparisons; 0 denial failures Authorization matrix: 434 OpenAPI operations; 3056 requests across 4 base identities plus invalid/stale session probes and 21 App Password scope classes; valid/malformed session bodies on 20 privileged body routes; App Passwords use valid bodies; policy classes {'public': 21, 'public_link': 12, 'user': 348, 'admin': 53} ``` ## Remaining before merge - Complete `cargo test -p calternal-server -- --test-threads=4` after the fixture fix. - Resolve the web timeouts and obtain a passing `cd apps/web && bun run test --maxWorkers=2`. The attempted 60-second focused diagnostic has no result; rerun it as needed without changing assertions. - Wire the recipient web pending-request inbox, accept/decline and standard actions/Undo. Add the recipient refresh for accepted address resubmission. - Keep unknown-address delivery unbuilt while DESIGN §56 is OPEN. No required privacy/isolation probe was deferred. The final full gates and web consent UX are the remaining work. This report stops the job within its four-hour budget; it does not claim READY FOR MERGE.
kayg commented 2026-10-07 15:08:51 +00:00
Author
Owner
Copy link

Starting the remaining #1199 work on branch job/directory-1199 at 14d595077422b37a3a6beccf4499ce366683edf4; branch base is 0419170fe456b58614befcb12d9c9d255118f1c0 (origin/dev). I am implementing pending Share request actions in Notifications and Files → Shared, fixing accepted-address resubmission refresh, then running the requested gates and screenshot matrix.

Starting the remaining #1199 work on branch `job/directory-1199` at `14d595077422b37a3a6beccf4499ce366683edf4`; branch base is `0419170fe456b58614befcb12d9c9d255118f1c0` (`origin/dev`). I am implementing pending Share request actions in Notifications and Files → Shared, fixing accepted-address resubmission refresh, then running the requested gates and screenshot matrix.
kayg commented 2026-10-07 15:33:04 +00:00
Author
Owner
Copy link

Finding: create_by_address updated files_grants.access when a previously accepted address was submitted again, but emitted no recipient Files event and did not wake the Share projection hook. The recipient could keep stale Shared data until another refresh. The regression test now checks the access change, event and hook.

Placement decision: pending requests appear in the existing Notifications panel and as a Requests group at Files → Shared. Copy link uses /shared?request=<recipient-bound-request-id> and restores focus to that request; the route exposes no item details before acceptance. Accept and Decline update the list optimistically and restore a refused request. §54 and the current API define no recipient-side inverse for successful Accept, so there is no success Undo action.

Finding: `create_by_address` updated `files_grants.access` when a previously accepted address was submitted again, but emitted no recipient Files event and did not wake the Share projection hook. The recipient could keep stale Shared data until another refresh. The regression test now checks the access change, event and hook. Placement decision: pending requests appear in the existing Notifications panel and as a Requests group at Files → Shared. Copy link uses `/shared?request=<recipient-bound-request-id>` and restores focus to that request; the route exposes no item details before acceptance. Accept and Decline update the list optimistically and restore a refused request. §54 and the current API define no recipient-side inverse for successful Accept, so there is no success Undo action.
kayg commented 2026-10-07 16:05:08 +00:00
Author
Owner
Copy link

Finding during the recipient UI regression: the request panel's mount effect subscribed to store reads performed by refreshRequests, then reran when that store wrote loading/results. The focused test observed three GETs instead of one initial read plus one post-action refresh. Wrapping the refresh call in Svelte untrack removed the accidental subscription; focused web tests now pass (52 tests across four files).

Finding during the recipient UI regression: the request panel's mount effect subscribed to store reads performed by `refreshRequests`, then reran when that store wrote loading/results. The focused test observed three GETs instead of one initial read plus one post-action refresh. Wrapping the refresh call in Svelte `untrack` removed the accidental subscription; focused web tests now pass (52 tests across four files).
kayg commented 2026-10-07 16:29:16 +00:00
Author
Owner
Copy link

Finding during keyboard review: Accept moved focus to the next <li>, which is not focusable. When Notifications removes its request group after the last request, this also left no live target. Focus now moves to the next request link or the owning heading, and the focused component test plus the real-browser assertion cover the live-row case. Focused Vitest passes: 1 file, 3 tests.

Finding during keyboard review: Accept moved focus to the next `<li>`, which is not focusable. When Notifications removes its request group after the last request, this also left no live target. Focus now moves to the next request link or the owning heading, and the focused component test plus the real-browser assertion cover the live-row case. Focused Vitest passes: 1 file, 3 tests.
kayg commented 2026-10-07 17:10:08 +00:00
Author
Owner
Copy link

Finding: the first real-server UI run captured all 12 screenshots, then the review script checked the Shared action group immediately after navigation. The requests fetch was still pending, so the check failed before the row rendered. I added a wait for that real request row before asserting its accessible action group; the interaction run is being repeated.

Finding: the first real-server UI run captured all 12 screenshots, then the review script checked the Shared action group immediately after navigation. The requests fetch was still pending, so the check failed before the row rendered. I added a wait for that real request row before asserting its accessible action group; the interaction run is being repeated.
kayg commented 2026-10-07 18:27:57 +00:00
Author
Owner
Copy link

Finding from final web checks: svelte-check rejected refreshRequests() because its finally block referenced the in-flight Promise before assignment. I changed cleanup to use the existing request-generation fence. A stale request now cannot clear a newer request's loading marker. The focused Share request/API tests pass (2 files, 26 tests).

Finding from final web checks: `svelte-check` rejected `refreshRequests()` because its `finally` block referenced the in-flight Promise before assignment. I changed cleanup to use the existing request-generation fence. A stale request now cannot clear a newer request's loading marker. The focused Share request/API tests pass (2 files, 26 tests).
kayg commented 2026-10-07 18:42:01 +00:00
Author
Owner
Copy link

Final perf finding: bun run check identified the new ShareRequests loop as an unregistered surface and the three direct apiFetch calls as unclassified boundaries. The request list now uses cache: 'no-store'; its API test asserts the policy, and the accepted/declined calls have mutation boundary tests. scripts/perf-lint --check now reports perf-lint: PASS; 0 violations; 22615 scoped exceptions. The bounded ShareRequests surface remains one exact #1058 checkpoint because the existing registry has no matching per-surface profile contract; the endpoint profile under bench/directory-1199.py measured up to 100 returned rows and a 40-request burst. No guard rule or limit changed.

Final perf finding: `bun run check` identified the new ShareRequests loop as an unregistered surface and the three direct `apiFetch` calls as unclassified boundaries. The request list now uses `cache: 'no-store'`; its API test asserts the policy, and the accepted/declined calls have mutation boundary tests. `scripts/perf-lint --check` now reports `perf-lint: PASS; 0 violations; 22615 scoped exceptions`. The bounded ShareRequests surface remains one exact #1058 checkpoint because the existing registry has no matching per-surface profile contract; the endpoint profile under `bench/directory-1199.py` measured up to 100 returned rows and a 40-request burst. No guard rule or limit changed.
kayg commented 2026-10-07 18:48:15 +00:00
Author
Owner
Copy link

READY — #1199 is complete for merge. No push, deploy, or merge was made.

Branch: job/directory-1199
Head: d6b6f4ef382e6edefb5e13d35d99f391abd4c697

Built

  • Added directory_visibility with instance and contacts policy, private exact-address Share requests, recipient consent, and non-enumerating acknowledgements. Contacts mode limits People and Group discovery to existing contact edges and Group membership.
  • Added pending Share requests to Notifications and Files → Shared. Rows use the shared Pill, CopyLink, and Menu components. Accept and Decline work through pointer and keyboard input, update optimistically, restore on refusal, announce state, and move focus to a live target. The request list has a 100-row server cap and uses a fresh no-store read.
  • Accepted-address resubmission refreshes the existing grant and sends owner/recipient change events after the FULL transaction commits. The recipient sees updated access without a reload.
  • Added regression and adversarial coverage, a local benchmark profile, and DESIGN §54 documentation.

UX gaps closed

  • Pending rows expose only consent-safe sender, access, time, and stable recipient-bound request identity. They do not expose the Home path or owner ID before acceptance.
  • Request rows have Open, Copy link, Accept, Decline, and More actions. Loading, empty, retry, and refusal states are covered. Focus returns to a neighboring row or the section heading when the active row leaves.
  • Real-server screenshots cover Notifications and Shared at 390, 820, and 1440 px in light and dark with macOS shortcut conventions. The review run exercised keyboard Accept and Decline against the real API and checked 44 px targets.

UX gaps left

  • There is no post-success Undo for Accept: the recipient API has no inverse action. A refused request is restored immediately; successful consent remains owner-revocable as defined by the current API.
  • The new ShareRequests render loop has one exact coverage.surfaces perf checkpoint under #1058. The endpoint has a local benchmark, but there is no matching per-surface baseline/profile contract yet.

Screenshots attached

Notifications: 390 light · 390 dark · 820 light · 820 dark · 1440 light · 1440 dark

Files → Shared: 390 light · 390 dark · 820 light · 820 dark · 1440 light · 1440 dark

Files

  • Web: apps/web/src/lib/files/RecipientPicker.svelte, ShareDialog.svelte, ShareRequests.svelte, api.ts, sharing.svelte.ts; apps/web/src/lib/notifications/InboxPanel.svelte, inbox.svelte.ts; apps/web/src/routes/shared/+page.svelte, +layout.svelte; matching tests and E2E review script.
  • Rust: crates/calternal-auth policy, OIDC, store and migrations; crates/plugins/files Share routes, consent migrations and privacy tests; crates/calternal-server wiring and upgrade tests.
  • Contracts/docs/perf: contracts/openapi.json, contracts/config.json, action contracts, exact perf registry/ledger pins, docs/DESIGN.md, bench/directory-1199.py, and adversarial probes under tests/adversarial/.

Gates and verification

Commands use per-crate Rust gates as required by the shared-host policy. Exact successful output lines:

✓ 5984 modules transformed.
✓ 8955 modules transformed.
✓ built in 26.12s
✓ built in 27ms
✓ built in 55.98s
  Wrote site to "build"
Compressed 921 static variants; saved 21524924 bytes.

Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 25s
Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.60s
Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 40s

perf-lint: PASS; 0 violations; 22615 scoped exceptions
Warn: Do not use empty rulesets (css)
svelte-check found 0 errors and 1 warning in 1 file

Test Files  2 passed (2)
Tests 26 passed (26)
  • cargo fmt --check: exit 0, no output.
  • cargo clippy -p calternal-auth --all-targets -- -D warnings, -p calternal-plugin-files, and -p calternal-server: all passed. The three Finished lines above are auth, Files, and server respectively.
  • bun run build, bun run check, and focused Vitest files src/lib/files/api.test.ts and src/lib/files/ShareRequests.svelte.test.ts: passed. The only check warning is the existing empty ruleset in packages/ui/src/components/calendar/AttachmentDeck.svelte:1055.
  • Full Cargo test outcomes under host load:
    • cargo test -p calternal-auth: 136 passed, 1 failed, 3 ignored. review_cache_bounds_ttl_and_keyed_digest observed 2925 vs 4096 during the suite; rerun alone passed: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 139 filtered out; finished in 10.67s.
    • cargo test -p calternal-plugin-files: 262 passed, 2 failed, 4 ignored. public_password_rejection_does_not_wait_for_data_mutation_lock timed out in the suite and passed alone: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 267 filtered out; finished in 5.72s. internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm hit its 5-minute bound when rerun alone (finished in 304.99s).
    • cargo test -p calternal-server: 272 passed, 1 failed, 12 ignored. The nested large-Home performance assertion reported files=20000 writes=32 p50_ms=12369 p95_ms=12781 p95_budget_ms=10000.
      These are SLOW-only timing/timeout results on the loaded host; no test expectation changed.
  • Full bun run test is deferred to the merge round by the shared verification policy. Run cd apps/web && bun run test there; it must prove the complete web Vitest, design-rule, and perf-source suites pass.
  • cargo clean: Removed 20610 files, 16.6GiB total. Web build, .svelte-kit, and temporary web test output were removed. Working tree is clean.

Performance

bench/directory-1199.py ran locally; no matched baseline exists. Address acknowledgement timing used 200 known and 200 unknown requests: known p50/p95 99.18/187.17 ms, unknown 100.55/190.55 ms. Pending inbox burst: 40 requests at concurrency 4, p50/p95 45.61/78.38 ms. The full probe used 38.44 child CPU seconds and peaked at 342,532 KiB RSS; local load average started at 25.59/22.99/29.01. Expected work is one indexed address lookup and one FULL transaction per request; the list returns at most 100 rows. Accept writes one grant, one consent row, and two events in one transaction. No Home scan runs in these request paths.

Decisions not specified by DESIGN

  • Pending requests appear in the existing Notifications panel and Files → Shared “Requests” group, as the issue instructions directed.
  • Accept is optimistic with refusal rollback. No success Undo is offered until the API has a recipient-side inverse operation.
  • shareRequests() uses no-store so opening the panel reads current consent state. The registry keeps one exact #1058 surface checkpoint rather than claiming an unmeasured 10,000-row UI profile; the real endpoint cap is 100 and the local burst used 40 rows.

No issue was closed.

**READY — #1199 is complete for merge.** No push, deploy, or merge was made. Branch: `job/directory-1199` Head: `d6b6f4ef382e6edefb5e13d35d99f391abd4c697` ## Built - Added `directory_visibility` with `instance` and `contacts` policy, private exact-address Share requests, recipient consent, and non-enumerating acknowledgements. Contacts mode limits People and Group discovery to existing contact edges and Group membership. - Added pending Share requests to Notifications and Files → Shared. Rows use the shared `Pill`, `CopyLink`, and Menu components. Accept and Decline work through pointer and keyboard input, update optimistically, restore on refusal, announce state, and move focus to a live target. The request list has a 100-row server cap and uses a fresh `no-store` read. - Accepted-address resubmission refreshes the existing grant and sends owner/recipient change events after the FULL transaction commits. The recipient sees updated access without a reload. - Added regression and adversarial coverage, a local benchmark profile, and DESIGN §54 documentation. ## UX gaps closed - Pending rows expose only consent-safe sender, access, time, and stable recipient-bound request identity. They do not expose the Home path or owner ID before acceptance. - Request rows have Open, Copy link, Accept, Decline, and More actions. Loading, empty, retry, and refusal states are covered. Focus returns to a neighboring row or the section heading when the active row leaves. - Real-server screenshots cover Notifications and Shared at 390, 820, and 1440 px in light and dark with macOS shortcut conventions. The review run exercised keyboard Accept and Decline against the real API and checked 44 px targets. ## UX gaps left - There is no post-success Undo for Accept: the recipient API has no inverse action. A refused request is restored immediately; successful consent remains owner-revocable as defined by the current API. - The new ShareRequests render loop has one exact `coverage.surfaces` perf checkpoint under #1058. The endpoint has a local benchmark, but there is no matching per-surface baseline/profile contract yet. ## Screenshots attached Notifications: [390 light](https://git.kayg.org/attachments/9c91356b-0de5-4e9b-b598-da4d6a760fa3) · [390 dark](https://git.kayg.org/attachments/2229147e-f721-463e-80f6-43cf61b7d14e) · [820 light](https://git.kayg.org/attachments/6349b38c-f458-49d8-b621-92cd23c86599) · [820 dark](https://git.kayg.org/attachments/11dadd3c-371f-4b5f-a00f-1835f8f8f678) · [1440 light](https://git.kayg.org/attachments/eef4d575-6775-4ad6-bff5-e93bc3dc9502) · [1440 dark](https://git.kayg.org/attachments/8433050b-591f-47ac-9bfb-3b7e1c2846b4) Files → Shared: [390 light](https://git.kayg.org/attachments/f7a69c42-ce6e-497e-961b-78a5a558838e) · [390 dark](https://git.kayg.org/attachments/097dba0f-626f-4bb2-a7c6-7c90df1f6414) · [820 light](https://git.kayg.org/attachments/c50598ce-a60d-406f-b5b9-ea2f8cee2bf2) · [820 dark](https://git.kayg.org/attachments/1132f201-7f95-4dfd-805e-717096e30998) · [1440 light](https://git.kayg.org/attachments/056f7bae-2412-40fb-b5dc-5ee3e4024f5f) · [1440 dark](https://git.kayg.org/attachments/4ca89534-b633-4091-b327-5dde62c6d0df) ## Files - Web: `apps/web/src/lib/files/RecipientPicker.svelte`, `ShareDialog.svelte`, `ShareRequests.svelte`, `api.ts`, `sharing.svelte.ts`; `apps/web/src/lib/notifications/InboxPanel.svelte`, `inbox.svelte.ts`; `apps/web/src/routes/shared/+page.svelte`, `+layout.svelte`; matching tests and E2E review script. - Rust: `crates/calternal-auth` policy, OIDC, store and migrations; `crates/plugins/files` Share routes, consent migrations and privacy tests; `crates/calternal-server` wiring and upgrade tests. - Contracts/docs/perf: `contracts/openapi.json`, `contracts/config.json`, action contracts, exact perf registry/ledger pins, `docs/DESIGN.md`, `bench/directory-1199.py`, and adversarial probes under `tests/adversarial/`. ## Gates and verification Commands use per-crate Rust gates as required by the shared-host policy. Exact successful output lines: ```text ✓ 5984 modules transformed. ✓ 8955 modules transformed. ✓ built in 26.12s ✓ built in 27ms ✓ built in 55.98s Wrote site to "build" Compressed 921 static variants; saved 21524924 bytes. Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 25s Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.60s Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 40s perf-lint: PASS; 0 violations; 22615 scoped exceptions Warn: Do not use empty rulesets (css) svelte-check found 0 errors and 1 warning in 1 file Test Files 2 passed (2) Tests 26 passed (26) ``` - `cargo fmt --check`: exit 0, no output. - `cargo clippy -p calternal-auth --all-targets -- -D warnings`, `-p calternal-plugin-files`, and `-p calternal-server`: all passed. The three `Finished` lines above are auth, Files, and server respectively. - `bun run build`, `bun run check`, and focused Vitest files `src/lib/files/api.test.ts` and `src/lib/files/ShareRequests.svelte.test.ts`: passed. The only check warning is the existing empty ruleset in `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. - Full Cargo test outcomes under host load: - `cargo test -p calternal-auth`: 136 passed, 1 failed, 3 ignored. `review_cache_bounds_ttl_and_keyed_digest` observed 2925 vs 4096 during the suite; rerun alone passed: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 139 filtered out; finished in 10.67s`. - `cargo test -p calternal-plugin-files`: 262 passed, 2 failed, 4 ignored. `public_password_rejection_does_not_wait_for_data_mutation_lock` timed out in the suite and passed alone: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 267 filtered out; finished in 5.72s`. `internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm` hit its 5-minute bound when rerun alone (`finished in 304.99s`). - `cargo test -p calternal-server`: 272 passed, 1 failed, 12 ignored. The nested large-Home performance assertion reported `files=20000 writes=32 p50_ms=12369 p95_ms=12781 p95_budget_ms=10000`. These are SLOW-only timing/timeout results on the loaded host; no test expectation changed. - Full `bun run test` is deferred to the merge round by the shared verification policy. Run `cd apps/web && bun run test` there; it must prove the complete web Vitest, design-rule, and perf-source suites pass. - `cargo clean`: `Removed 20610 files, 16.6GiB total`. Web `build`, `.svelte-kit`, and temporary web test output were removed. Working tree is clean. ## Performance `bench/directory-1199.py` ran locally; no matched baseline exists. Address acknowledgement timing used 200 known and 200 unknown requests: known p50/p95 99.18/187.17 ms, unknown 100.55/190.55 ms. Pending inbox burst: 40 requests at concurrency 4, p50/p95 45.61/78.38 ms. The full probe used 38.44 child CPU seconds and peaked at 342,532 KiB RSS; local load average started at 25.59/22.99/29.01. Expected work is one indexed address lookup and one FULL transaction per request; the list returns at most 100 rows. Accept writes one grant, one consent row, and two events in one transaction. No Home scan runs in these request paths. ## Decisions not specified by DESIGN - Pending requests appear in the existing Notifications panel and Files → Shared “Requests” group, as the issue instructions directed. - Accept is optimistic with refusal rollback. No success Undo is offered until the API has a recipient-side inverse operation. - `shareRequests()` uses `no-store` so opening the panel reads current consent state. The registry keeps one exact #1058 surface checkpoint rather than claiming an unmeasured 10,000-row UI profile; the real endpoint cap is 100 and the local burst used 40 rows. No issue was closed.
kayg commented 2026-10-08 02:14:26 +00:00
Author
Owner
Copy link

Starting dirfix3 in job/directory-1199 at d6b6f4ef382e6edefb5e13d35d99f391abd4c697, based on 0419170fe456b58614befcb12d9c9d255118f1c0. This continuation is limited to the accepted Share request and Notifications UI review findings; the behavior and privacy work is already accepted. I’m reproducing the screenshot issues and will update the web UI and evidence only.

Starting dirfix3 in `job/directory-1199` at `d6b6f4ef382e6edefb5e13d35d99f391abd4c697`, based on `0419170fe456b58614befcb12d9c9d255118f1c0`. This continuation is limited to the accepted Share request and Notifications UI review findings; the behavior and privacy work is already accepted. I’m reproducing the screenshot issues and will update the web UI and evidence only.
kayg commented 2026-10-08 02:19:02 +00:00
Author
Owner
Copy link

Finding: the rejected 1440 captures come from the review fixture as well as the row markup. share-requests-review-1199.mjs sets hasTouch: true on both browser contexts at every width; the 1440 notification inbox therefore fails SurfaceViewport’s (min-width: 768px) and (pointer: fine) test and uses the sheet, while coarse-pointer tokens enlarge the chrome. The script also does not call routeCurrentBuild, which matches the visible Update available toast in artifacts/dirfix2. The Shared route mounts ShareRequests after FilesBrowser, whose empty state and summary render first. The focused Vitest red run reproduces the loose Copy link control and missing compact Pill size (2 expected failures, 9 passed). I’m fixing the web presentation and capture fixture only.

Finding: the rejected 1440 captures come from the review fixture as well as the row markup. `share-requests-review-1199.mjs` sets `hasTouch: true` on both browser contexts at every width; the 1440 notification inbox therefore fails `SurfaceViewport`’s `(min-width: 768px) and (pointer: fine)` test and uses the sheet, while coarse-pointer tokens enlarge the chrome. The script also does not call `routeCurrentBuild`, which matches the visible Update available toast in `artifacts/dirfix2`. The Shared route mounts `ShareRequests` after `FilesBrowser`, whose empty state and summary render first. The focused Vitest red run reproduces the loose Copy link control and missing compact Pill size (2 expected failures, 9 passed). I’m fixing the web presentation and capture fixture only.
kayg commented 2026-10-08 02:25:45 +00:00
Author
Owner
Copy link

The shared server from origin/dev cannot serve this issue branch's accepted Share request API: the real e2e fixture POSTs to /api/v1/files/shares/by-address returned 405 twice where the fixture expects 202. I’ll build the unchanged branch server as a local e2e dependency so the required production UI flow can run; this continuation still changes web files only.

The shared server from `origin/dev` cannot serve this issue branch's accepted Share request API: the real e2e fixture POSTs to `/api/v1/files/shares/by-address` returned `405` twice where the fixture expects `202`. I’ll build the unchanged branch server as a local e2e dependency so the required production UI flow can run; this continuation still changes web files only.
kayg commented 2026-10-08 02:41:52 +00:00
Author
Owner
Copy link

The first bun run check found one stale exact performance pin after FilesBrowser's Svelte template changed for the Shared request insertion: render.bound for apps/web/src/lib/files/FilesBrowser.svelte#each:c469e9f9e005d61c:1 is reported as an unused or changed exception. The bound and implementation are unchanged; I will refresh the exact live pin after integrating current origin/dev, preserving the existing rule and ratchet.

The first `bun run check` found one stale exact performance pin after FilesBrowser's Svelte template changed for the Shared request insertion: `render.bound` for `apps/web/src/lib/files/FilesBrowser.svelte#each:c469e9f9e005d61c:1` is reported as an unused or changed exception. The bound and implementation are unchanged; I will refresh the exact live pin after integrating current `origin/dev`, preserving the existing rule and ratchet.
kayg commented 2026-10-08 02:48:48 +00:00
Author
Owner
Copy link

Post-merge bun run check found a second stale exact pin: render.bound for apps/web/src/lib/files/RecipientPicker.svelte#each:f302b2413455ec83:1 is reported as an unused or changed exception. The ongoing #1199 branch has 9 insertions and 3 deletions in that file compared with origin/dev; the request-picker list identity is unchanged. I will refresh its existing exact rows with the parsed live hash, without changing the guard, row limit, or ratchet count.

Post-merge `bun run check` found a second stale exact pin: `render.bound` for `apps/web/src/lib/files/RecipientPicker.svelte#each:f302b2413455ec83:1` is reported as an unused or changed exception. The ongoing #1199 branch has 9 insertions and 3 deletions in that file compared with `origin/dev`; the request-picker list identity is unchanged. I will refresh its existing exact rows with the parsed live hash, without changing the guard, row limit, or ratchet count.
kayg commented 2026-10-08 02:49:58 +00:00
Author
Owner
Copy link

After the exact pin refresh, bun run check passed the licence, perf, storage, token, focus and motion checks, then exited 1 with 0 Svelte errors and 4 unused-selector warnings in two unchanged UI files. Three warnings are for Mail's .row-swipe .mail-swipe-action child-component selectors; one is Money's .ready class on a MetricCard component. Svelte scoping means these parent selectors do not match child-owned markup. I will make only those existing selectors cross the component boundary where needed, then rerun the web check.

After the exact pin refresh, `bun run check` passed the licence, perf, storage, token, focus and motion checks, then exited 1 with 0 Svelte errors and 4 unused-selector warnings in two unchanged UI files. Three warnings are for Mail's `.row-swipe .mail-swipe-action` child-component selectors; one is Money's `.ready` class on a `MetricCard` component. Svelte scoping means these parent selectors do not match child-owned markup. I will make only those existing selectors cross the component boundary where needed, then rerun the web check.
kayg commented 2026-10-08 03:00:13 +00:00
Author
Owner
Copy link

Finding during the required web check: the Share badge wiring in +layout.svelte changed the module fingerprint for the existing ResizeObserver and MutationObserver contracts. bun run check reported layout.observer-purpose ... <module>:94496751a7926593: unused or changed exception while the live module hash was 4d4567c24d355b6c5c37965e05563f640d2af9c02da687fea909913ef032e728. I refreshed only those existing rows in contracts/perf/exceptions.json and contracts/perf/adoption-1058.json; the observer code is unchanged.

Finding during the required web check: the Share badge wiring in `+layout.svelte` changed the module fingerprint for the existing ResizeObserver and MutationObserver contracts. `bun run check` reported `layout.observer-purpose ... <module>:94496751a7926593: unused or changed exception` while the live module hash was `4d4567c24d355b6c5c37965e05563f640d2af9c02da687fea909913ef032e728`. I refreshed only those existing rows in `contracts/perf/exceptions.json` and `contracts/perf/adoption-1058.json`; the observer code is unchanged.
kayg commented 2026-10-08 03:09:02 +00:00
Author
Owner
Copy link

The required perf-lint portion of bun run check still has inherited branch debt after refreshing the UI pins. Evidence: the pre-merge branch ledger had 22,615 rows; current origin/dev has a 22,544-row ratchet. The branch-only findings include five unregistered Files API operations, one unregistered ShareRequests list, 53 new io.unresolved-call sites in the accepted Rust implementation, and two raw mutation calls. The job brief limits this follow-up to web UI, so I have not changed server behavior or increased the ratchet. I am continuing the UI screenshot and e2e work; the web check remains a gate gap for this branch.

The required perf-lint portion of `bun run check` still has inherited branch debt after refreshing the UI pins. Evidence: the pre-merge branch ledger had 22,615 rows; current `origin/dev` has a 22,544-row ratchet. The branch-only findings include five unregistered Files API operations, one unregistered ShareRequests list, 53 new `io.unresolved-call` sites in the accepted Rust implementation, and two raw mutation calls. The job brief limits this follow-up to web UI, so I have not changed server behavior or increased the ratchet. I am continuing the UI screenshot and e2e work; the web check remains a gate gap for this branch.
kayg commented 2026-10-08 03:16:17 +00:00
Author
Owner
Copy link

The shared FloatingSurface focus fix changed its exact module fingerprint. I refreshed the three existing layout.observer-purpose rows in contracts/perf/exceptions.json to the live hash 140fb05f7997af539b4615d4c6a6ac558deb6f6d5125eac43142d158629a2db3; exception counts and the ratchet are unchanged.

The shared FloatingSurface focus fix changed its exact module fingerprint. I refreshed the three existing `layout.observer-purpose` rows in `contracts/perf/exceptions.json` to the live hash `140fb05f7997af539b4615d4c6a6ac558deb6f6d5125eac43142d158629a2db3`; exception counts and the ratchet are unchanged.
kayg commented 2026-10-08 03:23:43 +00:00
Author
Owner
Copy link

dirfix3 complete — HEAD 418748d64cb5802ab808ea49de3259527b69fb1c

Built

  • Files → Shared renders pending requests before the shared-item summary. The centered empty state stays hidden while requests exist or are still loading; the compact 0 items footer remains below the request rows.
  • Request actions use the shared compact Pill sizes and keep the 44 px touch target transparent. Copy link is in the standard ⋯ menu. Phone actions wrap under the title at its text inset.
  • The 1440 px Notifications capture now uses a fine-pointer desktop browser context. The earlier full-width sheet came from capturing a touch-enabled context at desktop width; it was a fixture variant, not a product regression. At 1440 the inbox is the anchored panel; at 820 and 390 it uses the shared sheet presentation.
  • Captures assert default text size and DPR 1, macOS platform glyphs, matching SPA/server build IDs, loaded request data, and no update toast. Added zoom and pointer/Enter menu captures; initial menu focus no longer shows a focus-visible ring.

Files

UI and review: packages/ui/src/components/Pill.svelte, packages/ui/src/components/menu/FloatingSurface.svelte, apps/web/src/lib/files/ShareRequests.svelte, apps/web/src/lib/files/FilesBrowser.svelte, apps/web/src/routes/shared/+page.svelte, apps/web/src/lib/components/Pill.svelte.test.ts, apps/web/src/lib/files/ShareRequests.svelte.test.ts, apps/web/e2e/share-requests-review-1199.mjs.

Exact performance pin refreshes: contracts/perf/adoption-1058.json, contracts/perf/exceptions.json.

UX gaps closed

Ordering and compact empty state; consistent row action sizing; Copy link in the row menu; phone wrapping and text inset; desktop Notifications presentation; default text/scale and clean build-matched captures; quiet initial focus for pointer- and Enter-opened menus. The review e2e also exercises Accept and Decline against the real local API.

UX gaps left

No known UI gap remains. bun run check exits 1 because perf-lint reports an unused/changed exception for the existing auth route handler in crates/calternal-auth/src/api.rs. This UI-only follow-up does not change that server code or alter its performance ratchet. The full web suite is for the merge round per the verification policy.

Decisions and cost

DESIGN does not define the Share row's responsive action wrap or the review fixture's pointer profile. I used the shared compact Pill variant with its transparent hit floor, and separate fine-pointer desktop and touch contexts. The 1440 inbox uses the established desktop panel; 820 and 390 use the shared sheet. Ordering reuses the current pending-request projection and adds no API call or sort; this visual change adds no new hot-path operation.

Gates

bun run check (exit 1; Svelte diagnostics have zero errors):

perf-lint: INVALID: ('coverage.router-handler', 'crates/calternal-auth/src/api.rs', 'crates/calternal-auth/src/api.rs#router:route:/auth/me/profile:PATCH:handler'): unused or changed exception
svelte-check found 0 errors and 4 warnings in 2 files
error: script "check" exited with code 1

Focused Vitest:

 Test Files  2 passed (2)
      Tests  32 passed (32)
   Duration  8.85s (transform 76%, environment 10%, import 7%, tests 5%, setup 3%)

Share request review e2e:

PASS #1199: Notifications and Files → Shared screenshots at 390/820/1440, light/dark, macOS; keyboard Accept and Decline update the real API (/home/kayg/Developer/calternal-wt/directory-1199/artifacts/dirfix3/screenshots)

Screenshots

Notifications:

Files → Shared:

For the merge round

Run cd apps/web && bun run test --maxWorkers=2 for the full web suite. bun run check must also pass after the auth route perf exception is reconciled with the combined branch.

## dirfix3 complete — HEAD `418748d64cb5802ab808ea49de3259527b69fb1c` ### Built - Files → Shared renders pending requests before the shared-item summary. The centered empty state stays hidden while requests exist or are still loading; the compact `0 items` footer remains below the request rows. - Request actions use the shared compact Pill sizes and keep the 44 px touch target transparent. Copy link is in the standard ⋯ menu. Phone actions wrap under the title at its text inset. - The 1440 px Notifications capture now uses a fine-pointer desktop browser context. The earlier full-width sheet came from capturing a touch-enabled context at desktop width; it was a fixture variant, not a product regression. At 1440 the inbox is the anchored panel; at 820 and 390 it uses the shared sheet presentation. - Captures assert default text size and DPR 1, macOS platform glyphs, matching SPA/server build IDs, loaded request data, and no update toast. Added zoom and pointer/Enter menu captures; initial menu focus no longer shows a focus-visible ring. ### Files UI and review: `packages/ui/src/components/Pill.svelte`, `packages/ui/src/components/menu/FloatingSurface.svelte`, `apps/web/src/lib/files/ShareRequests.svelte`, `apps/web/src/lib/files/FilesBrowser.svelte`, `apps/web/src/routes/shared/+page.svelte`, `apps/web/src/lib/components/Pill.svelte.test.ts`, `apps/web/src/lib/files/ShareRequests.svelte.test.ts`, `apps/web/e2e/share-requests-review-1199.mjs`. Exact performance pin refreshes: `contracts/perf/adoption-1058.json`, `contracts/perf/exceptions.json`. ### UX gaps closed Ordering and compact empty state; consistent row action sizing; Copy link in the row menu; phone wrapping and text inset; desktop Notifications presentation; default text/scale and clean build-matched captures; quiet initial focus for pointer- and Enter-opened menus. The review e2e also exercises Accept and Decline against the real local API. ### UX gaps left No known UI gap remains. `bun run check` exits 1 because perf-lint reports an unused/changed exception for the existing auth route handler in `crates/calternal-auth/src/api.rs`. This UI-only follow-up does not change that server code or alter its performance ratchet. The full web suite is for the merge round per the verification policy. ### Decisions and cost DESIGN does not define the Share row's responsive action wrap or the review fixture's pointer profile. I used the shared compact Pill variant with its transparent hit floor, and separate fine-pointer desktop and touch contexts. The 1440 inbox uses the established desktop panel; 820 and 390 use the shared sheet. Ordering reuses the current pending-request projection and adds no API call or sort; this visual change adds no new hot-path operation. ### Gates `bun run check` (exit 1; Svelte diagnostics have zero errors): ```text perf-lint: INVALID: ('coverage.router-handler', 'crates/calternal-auth/src/api.rs', 'crates/calternal-auth/src/api.rs#router:route:/auth/me/profile:PATCH:handler'): unused or changed exception svelte-check found 0 errors and 4 warnings in 2 files error: script "check" exited with code 1 ``` Focused Vitest: ```text Test Files 2 passed (2) Tests 32 passed (32) Duration 8.85s (transform 76%, environment 10%, import 7%, tests 5%, setup 3%) ``` Share request review e2e: ```text PASS #1199: Notifications and Files → Shared screenshots at 390/820/1440, light/dark, macOS; keyboard Accept and Decline update the real API (/home/kayg/Developer/calternal-wt/directory-1199/artifacts/dirfix3/screenshots) ``` ### Screenshots Notifications: - [390 light](https://git.kayg.org/attachments/896342bf-b848-45a5-bded-227aaaf104da) · [390 dark](https://git.kayg.org/attachments/4314572e-e4b3-4c70-85d3-5e456a5553db) - [820 light](https://git.kayg.org/attachments/e1441501-0d9f-4be9-acfc-aeedaaccebfa) · [820 dark](https://git.kayg.org/attachments/e396c719-172c-4b06-9c80-c37a9913452b) - [1440 light](https://git.kayg.org/attachments/fe172c45-d124-4d0a-9b67-98fd9ef7cfd4) · [1440 dark](https://git.kayg.org/attachments/2be6c1f7-0014-40dc-976a-6e8960439606) Files → Shared: - [390 light](https://git.kayg.org/attachments/ae5c622c-58b3-4819-822a-357d8a0741be) · [390 dark](https://git.kayg.org/attachments/f028f645-f5da-432f-b355-05204b5efa4e) - [820 light](https://git.kayg.org/attachments/2add1683-8419-45b1-99d8-0e2808008b4c) · [820 dark](https://git.kayg.org/attachments/13e2fa05-a31c-4eb7-b812-8313f87cdb06) - [1440 light](https://git.kayg.org/attachments/424b5db9-f0f0-414a-92a5-fafe9f1aefda) · [1440 dark](https://git.kayg.org/attachments/1376b120-b7c0-4154-b3c8-199203dc40dd) - [Zoomed request row](https://git.kayg.org/attachments/047a3cd2-98dd-4281-bee5-a08b6c433d33) · [Mouse-opened menu](https://git.kayg.org/attachments/d512e4e3-4ce0-40fa-85b4-a87a5c1b0060) · [Enter-opened menu](https://git.kayg.org/attachments/c075d8c7-37ee-44fd-8152-ee69e3cf5604) ### For the merge round Run `cd apps/web && bun run test --maxWorkers=2` for the full web suite. `bun run check` must also pass after the auth route perf exception is reconciled with the combined branch.
kayg commented 2026-10-08 07:53:33 +00:00
Author
Owner
Copy link

dirfix4 start: branch job/directory-1199, base 418748d64. Fixing notification share-request inset, empty Shared footer, perf-lint.

dirfix4 start: branch job/directory-1199, base 418748d64. Fixing notification share-request inset, empty Shared footer, perf-lint.
kayg commented 2026-10-08 09:55:59 +00:00
Author
Owner
Copy link

dirfix4 finished, head 21ffec6ff. Notifications Share request section now uses the panel's row inset (text at panel title edge, More clear of the edge, 6 px separator inset); Files -> Shared shows no bare '0 items' under pending requests; perf-lint passes (origin/dev passes; branch caused failures: merge 92dd7be03 had dropped the Files lib.rs routes/limiter, restored in 699cc8f0e). bun run check exit 0; bun run test: 298 files, 2125 tests passed; cargo clippy/test -p calternal-plugin-files ok. Screenshots in artifacts/dirfix4.

dirfix4 finished, head 21ffec6ff. Notifications Share request section now uses the panel's row inset (text at panel title edge, More clear of the edge, 6 px separator inset); Files -> Shared shows no bare '0 items' under pending requests; perf-lint passes (origin/dev passes; branch caused failures: merge 92dd7be03 had dropped the Files lib.rs routes/limiter, restored in 699cc8f0e). bun run check exit 0; bun run test: 298 files, 2125 tests passed; cargo clippy/test -p calternal-plugin-files ok. Screenshots in artifacts/dirfix4.
kayg commented 2026-10-09 05:37:00 +00:00
Author
Owner
Copy link

Deployed to calternal.cloud in merge round 35b (build 9dc65437e, live 2026-10-09 ~11:07 IST). Closing.

Deployed to calternal.cloud in merge round 35b (build 9dc65437e, live 2026-10-09 ~11:07 IST). Closing.
kayg closed this issue 2026-10-09 05:37:01 +00:00
Commenting is not possible because the repository is archived.
No Branch/Tag specified
Branches Tags
dev
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/blocks-1125
wip/allday-1107
wip/agenda-1086
wip/trayicons2-1095
wip/trayicons-1095
wip/sidebar3-1094
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/nlpchip-1127
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/delete-1119
job/txentry-1198
job/rev1586
job/rev2-money-ident
job/rev2-webperf
job/morph-1104
job/previewcard-1098
job/importhang-1121
job/kanban-1092
job/merge-round-7b
job/merge-round-7c
job/calcards-1115
job/collabrev3-1197
job/e2e-b-1071
job/agenda-1086
job/agenda-decks
job/allday-1107
job/browserfix
job/calact9
job/adv7c-1105
wip/collabrev3-1197
wip/calcards-1115
wip/calact9
wip/calact10
wip/browserfix
wip/agenda-decks
wip/adv7c-1105
wip/txentry-1198
wip/rev2-webperf
wip/rev2-money-ident
wip/rev1586
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/importhang-1121
wip/fix1586
wip/e2e-b2-1071
wip/e2e-b-1071
job/noncanon-1618
wip/noncanon-1618
job/edrevert-1616
job/partial-1605
wip/partial-1605
job/calact6
job/cold-1586
job/perfvm-1587
wip/cold-1586
job/cal404-1581
wip/calact6
wip/cal404-1581
job/dname-1584
wip/dname-1584
job/merge41
wip/merge41b
wip/merge41
job/rev1573c
job/hscroll-1579
wip/rev1573c
job/rev1573b
job/rev1573
wip/fix1573
wip/hscroll2
wip/hscroll-1579
job/rev1574
wip/fix1574
wip/rev1574
job/startup-1573c
job/merge40
wip/startup-1573d
wip/startup-1573c
job/calact5
wip/remtext2
wip/merge40c
wip/merge40b
wip/merge40
job/calact4
job/startup-1573
job/calprof
wip/calprof
wip/startup-1573
job/fs1575
job/fix1570
job/calact3
job/rec1540c
wip/fix1570
job/rev1570-review
wip/calact3
job/calact2
wip/calact2
job/calcold-1560
wip/calcold-1560
wip/rec1540c
job/fix1569
wip/fix1569
job/calact-1557
wip/calact-1557
job/remtext-1568
wip/remtext-1568
job/fix1566
wip/fix1566
job/rec1540b
job/reconcile-1540
job/money2rev
wip/money2rev
job/merge39
wip/merge39
wip/reconcile-1540
job/tabswitch2
job/merge38
wip/merge38
job/autherr-1553
wip/autherr-1553
job/money-688
wip/money688rev3
wip/money688rev2
wip/money688rev
wip/money688l
wip/money688k
wip/money688j
wip/money688i
wip/money688h
wip/money688g
wip/money688f
wip/money688e
wip/money688d
wip/money688c
wip/money688b
wip/money-688
wip/tabswitch2
wip/merge37
job/merge37
job/jobnames-1538
wip/jobnames-1538
job/tabcomp-perf
job/calscript-1492
wip/tabcomp-perf
wip/calscript-1492
job/mailbody-1533
wip/mailbody-1533
job/intlfmt-1461
job/merge36
wip/intlfmt2
wip/intlfmt-1461
wip/merge36
job/merge35c
job/tagperf-1186
wip/tagrev2
wip/tagrev
wip/tagperf4
wip/tagperf2-1186
wip/tagperf-1186
wip/tagfix5
wip/tagfix3
wip/tagfast2
wip/tagfast
wip/merge35c
job/notesel-1493
wip/notesel2
wip/notesel-1493
job/merge35b
wip/merge35b
wip/m35btriage
wip/m35bratchet
wip/calsel-1491
job/calsel-1491
job/notifread-1387
job/bulkwrite-1393
wip/notifread2
wip/notifread-1387
job/slowsel-1392
wip/bulkwrite-1393
wip/bulkrev4
wip/bulkrev3
wip/bulkrev2
wip/bulkrev
wip/bulkfix4
wip/bulkfix3
wip/bulkfix2
wip/bulkfix
job/mail7-1340
job/bigscroll-1481
job/searchperf-1425
wip/mailrev4
wip/mailrev3
wip/mailrev2
wip/mailrev
wip/mail7f
wip/mail7e
wip/mail7d
wip/searchperf2
wip/searchperf-1425
wip/mail7c
wip/mail7b
wip/mail7-1340
job/photoopen-1367
job/mailsel-1449
wip/bigscroll-1481
wip/slowsel3
wip/slowsel2
wip/slowsel-1392
wip/selroot
job/journaldup
wip/journaldup8
wip/journaldup7
wip/journaldup6
wip/journaldup5
wip/journaldup4
wip/journaldup3
wip/journaldup2
wip/journaldup
wip/jdrev5
wip/jdrev4
wip/jdrev3
wip/jdrev2
wip/jdrev
wip/jdfix9
job/bignote-1349
wip/mailsel-1449
wip/bignote3
wip/bignote2
wip/bignote-1349
job/statusmark-1457
wip/statusmark-1457
wip/photoopen4
wip/photoopen3
wip/photoopen2
wip/photoopen-1367
job/authflash-1473
job/merge35
wip/authflash-1473
job/phototags-1370
wip/phototags-1370
wip/merge35
wip/m35triage
job/tick-1446
wip/tick-1446
job/restartidx-1450
job/exmove-1333
job/coldnote-1451
wip/restartidx-1450
wip/exmove-1333
wip/coldnote-1451
job/undo412-1430
wip/undo412-1430
job/calwrite-1441
job/xcancel-1443
job/calscroll-1362
wip/xcancel-1443
wip/calwrite-1441
job/xsub-1445
wip/calscroll3
wip/calscroll2
wip/calscroll-1362
wip/xsub-1445
job/linkdup-1440
wip/linkdup2
wip/linkdup-1440
wip/tabswitch4
wip/tabswitch3
wip/tabswitch-1233
wip/navrev
job/tabswitch-1233
job/mdpaste-1431
job/taskundo-1433
job/directory-1199
wip/taskundo-1433
job/remind-1432
job/nfd-1411
wip/remind-1432
wip/dirfix4
wip/dirfix3
wip/dirfix2
wip/dirfix-1199
wip/directory-1199-r
wip/directory-1199
job/readerx-1427
wip/readerx-1427
job/scrollfade-1416
job/tipphone-1439
wip/nfd-1411
job/purge-1420
job/notifrow-1414
wip/purge-1420
wip/notifrow-1414
job/slop-1385
wip/slop2
wip/slop-1385
job/tbover-1409
job/qltitle-1408
job/grantlive-1405
job/taskclick-1434
wip/tbover-1409
wip/taskclick-1434
wip/qltitle-1408
job/scrub-1422
job/hotfix35
job/ticks-1361
wip/scrub-1422
job/taskprev-1401
wip/grantlive-1405
job/ghost-1323
wip/ticks3
wip/ticks2
wip/ticks-1361
wip/taskprev-1401
job/bash3-settings
wip/ghost-1323
job/mailmorph-1368
wip/bash3-settings
job/apiaudit-1374
wip/bash3-filesphotos
job/bash3-filesphotos
job/xuser39-1402
job/bash3-money
job/mailhtml-1372
wip/mailhtml2
wip/mailhtml-1372
job/bash3-interop
job/bash3-calendar
wip/bash3-money
wip/bash3-interop
wip/bash3-calendar
wip/mailmorph2
wip/mailmorph-1368
wip/bash3-tasks
job/outro-1391
job/linkpick-1379
job/linkdel-1384
wip/linkpick2
wip/linkpick-1379
wip/linkdel3
wip/linkdel2
wip/linkdel-1384
job/mailrows-1390
wip/mailrows-1390
wip/apiaudit2
wip/apiaudit-1374
job/bash-core
wip/outro-1391
wip/bash-core2
wip/bash-core
job/bash3-notes
job/bash3-tasks
job/merge34
job/notifdel-1363
wip/merge34
wip/notifdel2
wip/notifdel-1363
job/wklink-1371
wip/wklink-1371
job/searchbar-1360
wip/searchbar2
wip/searchbar-1360
job/merge33-1122
wip/merge33c
wip/merge33b
wip/merge33-1122
job/bash-security
job/mailglass-1373
wip/bash-security2
wip/bash-security
wip/mailglass-1373
job/instaudit-1369
wip/instaudit-1369
job/tabstorm-1338
wip/tabstorm2
wip/tabstorm-1338
wip/bash-files2
wip/bash-files
job/bash-files
job/bash-money
job/editfuzz-1335
wip/bash-money
wip/moneyrev
job/tasksperf-1286
wip/tasksperf3
wip/tasksperf2
wip/tasksperf-1286
wip/editfuzz2
wip/editfuzz-1335
review/dirrev-1199
job/merge32
wip/merge32b
wip/merge32
job/bash-chrome
job/tagdnd-1187
job/bash-notes
wip/bash-notes2
wip/bash-notes
wip/bash-chrome
wip/reconcile-c1
wip/adv-c1
wip/tagdnd2-1187
wip/tagdnd-1187
job/bash-calendar
job/deploy-c1
job/editbreak-1334
job/bash-perf
wip/bash-calendar2
wip/bash-calendar
wip/bash-perf
job/hunt-20261006
job/bash-interop
job/collabloss-1197
wip/collabrev-1197
wip/collabloss5-1197
wip/collabloss4-1197
wip/collabloss3-1197
wip/collabloss2-1197
wip/collabloss-1197
wip/bash-interop
job/bash-mail
wip/bash-mail
job/vis-1293
wip/vis-1293
wip/restyle-search-r
wip/restyle-search-fix2
wip/restyle-search-fix
wip/restyle-search
job/restyle-settings
job/restyle-search
wip/restyle-settings-fix
wip/restyle-settings
job/adv31
wip/advfix-a
wip/adv31
job/bash-tasks
wip/bash-tasks
job/restyle-files
wip/restyle-files-fix
wip/restyle-files
job/fmtbar-1210
wip/fmtbar2-1210
wip/fmtbar-1210
job/perf2-1124
wip/perf2-1124
job/proflog-1204
job/merge31
wip/restyle-notes
wip/merge31
wip/proflog-1204
job/restyle-notes
job/fix-1213
wip/fix-1213
job/hide-1153
job/restyle-mailmoney
job/notestatus-1209
wip/hide-1153
wip/hiderev2-1153
wip/hiderev-1153
wip/hide5-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
job/sidebarblur-1208
wip/notestatus-1209
wip/sidebarblur-1208
wip/restyle-mailmoney
job/onboard-1141
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
job/adv-1202
job/segmented-1200
wip/segmented-1200
job/merge30
job/notifloop-1194
job/toastmorph-1201
wip/notifloop-1194
job/perf-1124
job/tocrail-1191
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/perf-1124
wip/merge30j
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
fixbatch-25
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
fixbatch-23
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
hotfix-sidebar2
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
wip/e2e-a2-1071
wip/e2e-a-1071
backup/canvas-visual-before-reconcile
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/staging-imap
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/theme-detail
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
job/merge-round-3-pre-rebuild
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
backup/doc-stack-r3-reset-source
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
job/dedup-375-clean
job/dedup-375-before-rebase
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
backup/doc-stack-round3-before-rebuild
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1199
No description provided.