Reliability round: probe the routes added 2026-10-05/06 on a real server #1202

Open

opened 2026-10-06 12:09:05 +00:00 by kayg · 43 comments

kayg commented 2026-10-06 12:09:05 +00:00

Owner

Copy link

Defensive reliability round (owner rule: after every merge that touches an API, probe it on a real local server). Build a release server from origin/dev in this worktree and run it locally with two Users and an Admin. Extend tests/adversarial with probes for the routes added in the last two days and run the whole suite: tag rewrite/merge/undo (#1110), Note date backfill writer (#1148), link-preview fetcher (#1151; SSRF to private/link-local/metadata ranges, DNS rebinding, redirects to localhost, huge/slow/gzip-bomb/non-HTML bodies, IDN hosts), Mail allowed networks (#1160), licence keys (#1145; malformed, wrongly signed, expired, clock skew, concurrent invites at the cap), healthz startup progress (#1161), toasts → Notifications persistence (#1142), Inspector history (#1129), drawings (#1103), feature flags (#1181), the import wizard routes (#1140, branch job/wizard-1140). Categories per CLAUDE.md: cursed paths, Unicode tricks, malformed and oversized payloads, protocol misuse, concurrency storms, cross-plugin and cross-User interactions. Fix every 5xx, crash, accepted hostile input and inconsistency with a regression test, in separate commits; file anything outside a quick fix as an issue with evidence. Report a table: route, probes, result. Gates per crate + bun run check + bun run test quoted. Do not push.

Defensive reliability round (owner rule: after every merge that touches an API, probe it on a real local server). Build a release server from origin/dev in this worktree and run it locally with two Users and an Admin. Extend tests/adversarial with probes for the routes added in the last two days and run the whole suite: tag rewrite/merge/undo (#1110), Note date backfill writer (#1148), link-preview fetcher (#1151; SSRF to private/link-local/metadata ranges, DNS rebinding, redirects to localhost, huge/slow/gzip-bomb/non-HTML bodies, IDN hosts), Mail allowed networks (#1160), licence keys (#1145; malformed, wrongly signed, expired, clock skew, concurrent invites at the cap), healthz startup progress (#1161), toasts → Notifications persistence (#1142), Inspector history (#1129), drawings (#1103), feature flags (#1181), the import wizard routes (#1140, branch job/wizard-1140). Categories per CLAUDE.md: cursed paths, Unicode tricks, malformed and oversized payloads, protocol misuse, concurrency storms, cross-plugin and cross-User interactions. Fix every 5xx, crash, accepted hostile input and inconsistency with a regression test, in separate commits; file anything outside a quick fix as an issue with evidence. Report a table: route, probes, result. Gates per crate + bun run check + bun run test quoted. Do not push.

adv31-sweep.zip

39 MiB

advfix-a-evidence.zip

410 KiB

kayg commented 2026-10-06 12:09:43 +00:00

Author

Owner

Copy link

Starting #1202 on branch job/adv-1202 from base SHA 5301e02085. I am reading the route contracts and setting up the real-server adversarial run.

Starting #1202 on branch job/adv-1202 from base SHA 5301e020859c1d61b4a7f812a5049a64241203e8. I am reading the route contracts and setting up the real-server adversarial run.

kayg referenced this issue from a commit 2026-10-06 12:36:31 +00:00

test: probe recent API routes for #1202

kayg commented 2026-10-06 17:06:01 +00:00

Author

Owner

Copy link

#1160 Mail network-policy probe: built the release server from job/mailnet-1160, then ran bun tests/adversarial/mail_network_policy.mjs. The local server stayed in jbd2_log_wait_commit on /mnt/hdd and did not become ready within the harness's 300-second bound (server did not become ready within 300000 ms; No server output.). The invalid-CIDR assertion therefore failed before any Mail endpoint probe. This is a host filesystem-I/O stall; Mail route behavior remains unverified in this run.

#1160 Mail network-policy probe: built the release server from `job/mailnet-1160`, then ran `bun tests/adversarial/mail_network_policy.mjs`. The local server stayed in `jbd2_log_wait_commit` on `/mnt/hdd` and did not become ready within the harness's 300-second bound (`server did not become ready within 300000 ms; No server output.`). The invalid-CIDR assertion therefore failed before any Mail endpoint probe. This is a host filesystem-I/O stall; Mail route behavior remains unverified in this run.

kayg commented 2026-10-06 17:30:15 +00:00

Author

Owner

Copy link

The full adversarial run completed its matrix but exited nonzero after the shared root filesystem crossed calternal-fs’s free-space reserve. The log records repeated expected 507 responses with server free-space reserve reached (for example, target/tmp/adv1202-full.log lines 1511, 1521, and 1533–1557); later fixture creation also returned 507. This contaminated dependent probes, so those results are inconclusive rather than route failures. The runner completed 415 cross-User operations, generated 1,158 entry points, and 48 Admin operations before teardown. I added ADVERSARIAL_WORK_ROOT support so future runs can put test data on a dedicated volume.

The full adversarial run completed its matrix but exited nonzero after the shared root filesystem crossed calternal-fs’s free-space reserve. The log records repeated expected 507 responses with `server free-space reserve reached` (for example, `target/tmp/adv1202-full.log` lines 1511, 1521, and 1533–1557); later fixture creation also returned 507. This contaminated dependent probes, so those results are inconclusive rather than route failures. The runner completed 415 cross-User operations, generated 1,158 entry points, and 48 Admin operations before teardown. I added `ADVERSARIAL_WORK_ROOT` support so future runs can put test data on a dedicated volume.

kayg commented 2026-10-06 17:51:14 +00:00

Author

Owner

Copy link

Built

Added real-server reliability probes for the merged health, Tag rewrite/Undo, and Inspector history routes, plus selectable probes for feature flags, licence validation, and the import wizard. Added the Mail allowed-network probe and support for placing adversarial fixtures on a dedicated local volume.

Files: tests/adversarial/reliability_1202.mjs, tests/adversarial/mail_network_policy.mjs, tests/adversarial/run.sh.

Route results

Route / issue	Probes	Result
Health startup #1161	Public /healthz state/progress bounds and /readyz	PASS
Tag rewrite #1110	Cursed, Unicode, malformed and oversized input; durable rewrite and separate Undo receipt; 16 concurrent receipt reads; member isolation	PASS
Inspector history #1129	Limit bounds, malformed identity, authentication, member/Admin User isolation	PASS
Toasts #1142	Validation, idempotency, concurrent writes and User isolation	PASS in full run before storage-reserve failures
Feature flags #1181	Unknown/oversized writes, member denial, Admin toggle/restore and shared state	PASS on its real server
Licence #1145	Malformed/oversized keys, wrong signature, expired/future-issued keys and role guards	PASS on its real server; concurrent invite-cap Rust test also passed
Link previews #1151	The full runner stopped during fixture setup with HTTP 507 before its preview matrix	INCONCLUSIVE
Mail networks #1160	Invalid-CIDR startup and network-policy probe	INCONCLUSIVE: server did not become ready within 300 seconds; the process was blocked in filesystem journal I/O, so the CIDR assertion never reached the API
Note date backfill #1148	No route-specific adversarial result was reached in this round	NOT VERIFIED
Drawings #1103	No route-specific adversarial result was reached in this round	NOT VERIFIED
Import wizard #1140	Focused probe returned HTTP 502 before fixture authentication; later manual health readiness did not run the wizard route	INCONCLUSIVE

The full tests/adversarial/run.sh round used the owner, a second User and an Admin. It exited 1 after repeated HTTP 507 responses stating server free-space reserve reached; a later fixture upload also returned 507. The matrix completed 415 cross-User operations, 1,158 generated entry points and 48 Admin operations. The reserve failures contaminated dependent probes. One unrelated API read also returned 500 during that degraded phase and did not get a clean reproduction. I left existing status/body expectations unchanged. The full run and Mail startup limit were reported earlier on this issue.

Gates

$ cargo fmt --check
(exit 0; no output)

$ bun run check
perf-lint: PASS; 0 violations; 22359 scoped exceptions
svelte-check found 0 errors and 2 warnings in 2 files

$ bun run test
Test Files  274 passed (274)
      Tests  1907 passed (1907)
   Duration  731.23s (transform 43%, import 23%, environment 18%, tests 13%, setup 3%)

$ cargo clean
     Removed 13271 files, 7.1GiB total

No Rust source changed in this branch, so per-crate Clippy/test gates did not apply. The focused calternal-auth test concurrent_invite_acceptance_cannot_exceed_six_active_users passed: 1 passed; 0 failed; 0 ignored; 0 measured; 136 filtered out. Web check reports two existing empty-ruleset CSS warnings in AttachmentDeck.svelte and AgendaList.svelte.

Known gaps

The clean-storage Link Preview, Note date backfill, Drawing, Mail network and import-wizard probes still need a reliable route-level verdict. The full adversarial matrix must be repeated in a merge round with enough filesystem headroom. No UI changed, so screenshots and visual review do not apply. UX gaps closed/left: not applicable.

Decisions

DESIGN does not specify how this reliability runner should choose fixture storage. I added ADVERSARIAL_WORK_ROOT, with target/tmp as the default, so a run can use another local volume. The history probe treats a 200 empty page as isolation because the real route resolves History inside the authenticated User's Home; it also permits explicit authorization/not-found responses. Licence fixtures use the server-reported build epoch and throwaway signing material outside the repository.

Head: 63de36ac7f5e793e8f74cdcceb4f0d779851735c (clean worktree). No push, merge or deploy.

## Built Added real-server reliability probes for the merged health, Tag rewrite/Undo, and Inspector history routes, plus selectable probes for feature flags, licence validation, and the import wizard. Added the Mail allowed-network probe and support for placing adversarial fixtures on a dedicated local volume. Files: `tests/adversarial/reliability_1202.mjs`, `tests/adversarial/mail_network_policy.mjs`, `tests/adversarial/run.sh`. ## Route results | Route / issue | Probes | Result | | --- | --- | --- | | Health startup #1161 | Public `/healthz` state/progress bounds and `/readyz` | PASS | | Tag rewrite #1110 | Cursed, Unicode, malformed and oversized input; durable rewrite and separate Undo receipt; 16 concurrent receipt reads; member isolation | PASS | | Inspector history #1129 | Limit bounds, malformed identity, authentication, member/Admin User isolation | PASS | | Toasts #1142 | Validation, idempotency, concurrent writes and User isolation | PASS in full run before storage-reserve failures | | Feature flags #1181 | Unknown/oversized writes, member denial, Admin toggle/restore and shared state | PASS on its real server | | Licence #1145 | Malformed/oversized keys, wrong signature, expired/future-issued keys and role guards | PASS on its real server; concurrent invite-cap Rust test also passed | | Link previews #1151 | The full runner stopped during fixture setup with HTTP 507 before its preview matrix | INCONCLUSIVE | | Mail networks #1160 | Invalid-CIDR startup and network-policy probe | INCONCLUSIVE: server did not become ready within 300 seconds; the process was blocked in filesystem journal I/O, so the CIDR assertion never reached the API | | Note date backfill #1148 | No route-specific adversarial result was reached in this round | NOT VERIFIED | | Drawings #1103 | No route-specific adversarial result was reached in this round | NOT VERIFIED | | Import wizard #1140 | Focused probe returned HTTP 502 before fixture authentication; later manual health readiness did not run the wizard route | INCONCLUSIVE | The full `tests/adversarial/run.sh` round used the owner, a second User and an Admin. It exited 1 after repeated HTTP 507 responses stating `server free-space reserve reached`; a later fixture upload also returned 507. The matrix completed 415 cross-User operations, 1,158 generated entry points and 48 Admin operations. The reserve failures contaminated dependent probes. One unrelated API read also returned 500 during that degraded phase and did not get a clean reproduction. I left existing status/body expectations unchanged. The full run and Mail startup limit were reported earlier on this issue. ## Gates ```text $ cargo fmt --check (exit 0; no output) $ bun run check perf-lint: PASS; 0 violations; 22359 scoped exceptions svelte-check found 0 errors and 2 warnings in 2 files $ bun run test Test Files 274 passed (274) Tests 1907 passed (1907) Duration 731.23s (transform 43%, import 23%, environment 18%, tests 13%, setup 3%) $ cargo clean Removed 13271 files, 7.1GiB total ``` No Rust source changed in this branch, so per-crate Clippy/test gates did not apply. The focused `calternal-auth` test `concurrent_invite_acceptance_cannot_exceed_six_active_users` passed: `1 passed; 0 failed; 0 ignored; 0 measured; 136 filtered out`. Web check reports two existing empty-ruleset CSS warnings in `AttachmentDeck.svelte` and `AgendaList.svelte`. ## Known gaps The clean-storage Link Preview, Note date backfill, Drawing, Mail network and import-wizard probes still need a reliable route-level verdict. The full adversarial matrix must be repeated in a merge round with enough filesystem headroom. No UI changed, so screenshots and visual review do not apply. UX gaps closed/left: not applicable. ## Decisions DESIGN does not specify how this reliability runner should choose fixture storage. I added `ADVERSARIAL_WORK_ROOT`, with `target/tmp` as the default, so a run can use another local volume. The history probe treats a 200 empty page as isolation because the real route resolves History inside the authenticated User's Home; it also permits explicit authorization/not-found responses. Licence fixtures use the server-reported build epoch and throwaway signing material outside the repository. Head: `63de36ac7f5e793e8f74cdcceb4f0d779851735c` (clean worktree). No push, merge or deploy.

kayg commented 2026-10-06 17:51:30 +00:00

Author

Owner

Copy link

Additional degraded-run finding: the existing unauthenticated Mail assertion received HTTP 401, but its body differed from the assertion: the response used the shared nested error.code = "unauthorized" envelope and lower-case message, while the test expects a top-level unauthenticated code and capitalized message. I did not edit that existing expectation. The full run also saw one unrelated API read return HTTP 500 during the same reserve-exhausted phase; it had no clean reproduction, so its route-level cause remains unverified. Both observations are included as follow-up evidence for this reliability issue.

Additional degraded-run finding: the existing unauthenticated Mail assertion received HTTP 401, but its body differed from the assertion: the response used the shared nested `error.code = "unauthorized"` envelope and lower-case message, while the test expects a top-level `unauthenticated` code and capitalized message. I did not edit that existing expectation. The full run also saw one unrelated API read return HTTP 500 during the same reserve-exhausted phase; it had no clean reproduction, so its route-level cause remains unverified. Both observations are included as follow-up evidence for this reliability issue.

kayg commented 2026-10-06 18:00:06 +00:00

Author

Owner

Copy link

Orchestrator: the 507 "server free-space reserve reached" came from the build host root disk at 94% (old staging images). Cleanup in progress. The inconclusive routes (Link previews, Note date backfill, Drawings, Mail networks, import wizard) get a clean-storage rerun before the next deploy.

Orchestrator: the 507 "server free-space reserve reached" came from the build host root disk at 94% (old staging images). Cleanup in progress. The inconclusive routes (Link previews, Note date backfill, Drawings, Mail networks, import wizard) get a clean-storage rerun before the next deploy.

kayg commented 2026-10-06 22:36:04 +00:00

Author

Owner

Copy link

Starting adv31 for #1202 on branch job/adv31, base 139d4378e. Root filesystem has 89 GB free; /mnt/hdd has 203 GB free. Production web and release server builds are running. I will run the full real-server adversarial runner, close the five inconclusive route results, cover Hide, feature flags and Notifications, and capture every Tab and Settings in light/dark at 390, 820 and 1440 CSS pixels with macOS emulation. This checkout lacks the earlier #1202 reliability probe and ADVERSARIAL_WORK_ROOT changes; I will reuse those reviewed probes and preserve newer runner phases. No push or deploy.

Starting adv31 for #1202 on branch `job/adv31`, base `139d4378e`. Root filesystem has 89 GB free; /mnt/hdd has 203 GB free. Production web and release server builds are running. I will run the full real-server adversarial runner, close the five inconclusive route results, cover Hide, feature flags and Notifications, and capture every Tab and Settings in light/dark at 390, 820 and 1440 CSS pixels with macOS emulation. This checkout lacks the earlier #1202 reliability probe and ADVERSARIAL_WORK_ROOT changes; I will reuse those reviewed probes and preserve newer runner phases. No push or deploy.

kayg commented 2026-10-06 22:39:49 +00:00

Author

Owner

Copy link

Runner finding: the merge31 contract adds PUT /api/v1/admin/features/{id} and DELETE /api/v1/notifications/inbox/{id}/read, but the cross-User inventory did not classify either identity. XUSER_CLASSIFY_ONLY=1 python3 tests/adversarial/xuser_matrix.py stopped with OpenAPI path ID has no resource classification before server startup. Fixed in 1bebd6e81: feature IDs are Instance catalog selectors; mark-unread uses the existing User-owned notification identity. Regression output:

Cross-User classification gate: 429 operations classified
Generated entry point classification: 1206 tools classified
Ran 34 tests in 1.892s
OK

No product-route blocker identified yet. Release compilation is continuing; production web build has completed. git fetch origin && git merge origin/dev returned Already up to date.

Runner finding: the merge31 contract adds `PUT /api/v1/admin/features/{id}` and `DELETE /api/v1/notifications/inbox/{id}/read`, but the cross-User inventory did not classify either identity. `XUSER_CLASSIFY_ONLY=1 python3 tests/adversarial/xuser_matrix.py` stopped with `OpenAPI path ID has no resource classification` before server startup. Fixed in `1bebd6e81`: feature IDs are Instance catalog selectors; mark-unread uses the existing User-owned notification identity. Regression output: ```text Cross-User classification gate: 429 operations classified Generated entry point classification: 1206 tools classified Ran 34 tests in 1.892s OK ``` No product-route blocker identified yet. Release compilation is continuing; production web build has completed. `git fetch origin && git merge origin/dev` returned `Already up to date.`

kayg commented 2026-10-06 23:05:37 +00:00

Author

Owner

Copy link

Release binaries and the production web app are built. Product source remains merge31 139d4378e; probe head is b47b0a5dd. Gates so far:

    Finished `release` profile [optimized] target(s) in 24m 53s
svelte-check found 0 errors and 1 warning in 1 file
 Test Files  287 passed (287)
      Tests  2035 passed (2035)
   Duration  502.37s (transform 29%, environment 26%, import 23%, tests 16%, setup 5%)

cargo fmt --check exited 0. The warning is the empty .attachment-row:focus rule in packages/ui/src/components/calendar/AttachmentDeck.svelte:1055. The production sweep has 42 routes and is running at 390, 820 and 1440 px in light and dark, scale 1, macOS rendering. No live product-route blocker has been established yet. The full adversarial runner starts after this browser closes.

Release binaries and the production web app are built. Product source remains merge31 `139d4378e`; probe head is `b47b0a5dd`. Gates so far: ```text Finished `release` profile [optimized] target(s) in 24m 53s svelte-check found 0 errors and 1 warning in 1 file Test Files 287 passed (287) Tests 2035 passed (2035) Duration 502.37s (transform 29%, environment 26%, import 23%, tests 16%, setup 5%) ``` `cargo fmt --check` exited 0. The warning is the empty `.attachment-row:focus` rule in `packages/ui/src/components/calendar/AttachmentDeck.svelte:1055`. The production sweep has 42 routes and is running at 390, 820 and 1440 px in light and dark, scale 1, macOS rendering. No live product-route blocker has been established yet. The full adversarial runner starts after this browser closes.

kayg commented 2026-10-06 23:15:09 +00:00

Author

Owner

Copy link

Production screenshot sweep passed. Download screenshots and page list.

PASS 252 actual-size macOS captures; page list: artifacts/adv31/sweep/pages.json

42 routes × 390/820/1440 px × light/dark; device scale 1, PNG width equals viewport width. No failed capture, recorded page error or HTTP 5xx. The archive contains pages.md, pages.json and all 252 PNGs. Product source is 139d4378e. This is evidence for the orchestrator; no visual judgement was made.

The full adversarial runner has started with the release server, CLI and sync daemon and its own data root at target/tmp/adv31-data.

Production screenshot sweep passed. [Download screenshots and page list](https://git.kayg.org/attachments/74ed2639-4f7c-4cae-8fdb-b49c4608d0c0). ```text PASS 252 actual-size macOS captures; page list: artifacts/adv31/sweep/pages.json ``` 42 routes × 390/820/1440 px × light/dark; device scale 1, PNG width equals viewport width. No failed capture, recorded page error or HTTP 5xx. The archive contains `pages.md`, `pages.json` and all 252 PNGs. Product source is `139d4378e`. This is evidence for the orchestrator; no visual judgement was made. The full adversarial runner has started with the release server, CLI and sync daemon and its own data root at `target/tmp/adv31-data`.

kayg referenced this issue 2026-10-06 23:18:02 +00:00

Adversarial health probe expects fields removed from the startup contract #1245

kayg commented 2026-10-06 23:18:07 +00:00

Author

Owner

Copy link

Round 31: preserve and review restored health probe assertions (#1202)

On product head 139d4378e, the release server returns HTTP 200 from /healthz with {"state": "ok", "progress": null}. The restored #1202 probe expects flat phase, completed_steps, total_steps and progress_percent; it fails at typeof health.json.phase. Current StartupHealth in crates/calternal-server/src/main.rs:238 is { state, progress }, and the ready state is ok.

FAIL health: /healthz reports the current startup phase
+ actual - expected
+ 'undefined'
- 'string'

This is a probe/contract mismatch. It does not establish a product crash, data loss or access hole. The job rule forbids changing an existing test expectation to make it pass, so the assertions remain intact. The runner now finishes the independent Tag and history probes before returning the aggregate failure. The orchestrator must decide the intended health contract and then update the probe or the route.

Tracked as #1245: kayg/calternal#1245

Round 31: preserve and review restored health probe assertions (#1202) On product head `139d4378e`, the release server returns HTTP 200 from `/healthz` with `{"state": "ok", "progress": null}`. The restored #1202 probe expects flat `phase`, `completed_steps`, `total_steps` and `progress_percent`; it fails at `typeof health.json.phase`. Current `StartupHealth` in `crates/calternal-server/src/main.rs:238` is `{ state, progress }`, and the ready state is `ok`. ```text FAIL health: /healthz reports the current startup phase + actual - expected + 'undefined' - 'string' ``` This is a probe/contract mismatch. It does not establish a product crash, data loss or access hole. The job rule forbids changing an existing test expectation to make it pass, so the assertions remain intact. The runner now finishes the independent Tag and history probes before returning the aggregate failure. The orchestrator must decide the intended health contract and then update the probe or the route. Tracked as #1245: https://git.kayg.org/kayg/calternal/issues/1245

kayg commented 2026-10-06 23:23:05 +00:00

Author

Owner

Copy link

Live route evidence so far: Tag rewrite/Undo (#1110), history isolation (#1129), feature flags (#1181) and Drawing validation/isolation (#1103) passed. No crash, data loss or cross-User leak has been established.

Three new fixture corrections are pending focused verification:

• Wizard admission returned 200 because the probe omitted background=true. ImportProgressQuery documents synchronous compatibility and durable 202 admission. The request now selects the durable contract; the 202 assertion is unchanged.
• Task owner reads omit revision. The probe sent an undefined If-Match and got 412. It now reads the same strong source hash from the Task's stable Note identity. The 200 mutation assertion is unchanged. Foreign Task and missing Task selectors both returned 400 with bad_request / unknown Task; their response profiles agree. The source Note write has the exact 404 check.
• The Note upgrade fixture restarted with inherited parent IMAP listener options but had no parent TLS files, so startup returned Error: NotFound. The fixture now clears only that inherited listener prefix on both starts. This was fixture startup, not a product failure.

The full runner is continuing Search mutation and rebuild recovery. Focused reruns will complete the corrected fixtures; no existing product-test expectation is changed.

Live route evidence so far: Tag rewrite/Undo (#1110), history isolation (#1129), feature flags (#1181) and Drawing validation/isolation (#1103) passed. No crash, data loss or cross-User leak has been established. Three new fixture corrections are pending focused verification: - Wizard admission returned 200 because the probe omitted `background=true`. `ImportProgressQuery` documents synchronous compatibility and durable 202 admission. The request now selects the durable contract; the 202 assertion is unchanged. - Task owner reads omit `revision`. The probe sent an undefined `If-Match` and got 412. It now reads the same strong source hash from the Task's stable Note identity. The 200 mutation assertion is unchanged. Foreign Task and missing Task selectors both returned 400 with `bad_request` / `unknown Task`; their response profiles agree. The source Note write has the exact 404 check. - The Note upgrade fixture restarted with inherited parent IMAP listener options but had no parent TLS files, so startup returned `Error: NotFound`. The fixture now clears only that inherited listener prefix on both starts. This was fixture startup, not a product failure. The full runner is continuing Search mutation and rebuild recovery. Focused reruns will complete the corrected fixtures; no existing product-test expectation is changed.

kayg referenced this issue 2026-10-06 23:26:12 +00:00

Search filename results briefly differ for canonically equivalent Unicode queries #1247

kayg commented 2026-10-06 23:26:21 +00:00

Author

Owner

Copy link

Round 31 Search probe saw transient filename results (#1202)

Product head: 139d4378e, release build. tests/adversarial/search_chaos.py::unicode_and_mutation_probes uploaded café-nfc.txt and café-nfd.txt, waited for their body sentinels, then checked NFC and NFD filename queries. The NFD check returned only the earlier Tag receipt fixture, not either expected File.

FAIL search chaos: NFD canonical Unicode query missed expected filenames: ['Tag receipt 2e91172b9a9b41868896ffe37861ec46']

A later read on the same server returned HTTP 200 and both café-nfc.txt and café-nfd.txt for both NFC and NFD queries. No source mutation, data loss or authorization failure was observed. The result is consistent with a publication/cache timing difference; that cause is not proved. No expectation was changed and no extra wait was added to hide the finding. Investigate filename query snapshot/cache invalidation after uploads and whether sentinel readiness proves filename query readiness. The complete one-round runner is continuing.

Tracked as #1247: kayg/calternal#1247

Round 31 Search probe saw transient filename results (#1202) Product head: `139d4378e`, release build. `tests/adversarial/search_chaos.py::unicode_and_mutation_probes` uploaded `café-nfc.txt` and `café-nfd.txt`, waited for their body sentinels, then checked NFC and NFD filename queries. The NFD check returned only the earlier Tag receipt fixture, not either expected File. ```text FAIL search chaos: NFD canonical Unicode query missed expected filenames: ['Tag receipt 2e91172b9a9b41868896ffe37861ec46'] ``` A later read on the same server returned HTTP 200 and both `café-nfc.txt` and `café-nfd.txt` for both NFC and NFD queries. No source mutation, data loss or authorization failure was observed. The result is consistent with a publication/cache timing difference; that cause is not proved. No expectation was changed and no extra wait was added to hide the finding. Investigate filename query snapshot/cache invalidation after uploads and whether sentinel readiness proves filename query readiness. The complete one-round runner is continuing. Tracked as #1247: https://git.kayg.org/kayg/calternal/issues/1247

kayg referenced this issue 2026-10-06 23:27:25 +00:00

Mail adversarial probe expects a different anonymous AuthError shape #1248

kayg commented 2026-10-06 23:27:30 +00:00

Author

Owner

Copy link

Round 31 Mail event probe stops at an old AuthError shape (#1202)

On product 139d4378e, an anonymous /api/v1/mail/events request returns HTTP 401 with { "error": { "code": "unauthorized", "message": "authentication is required" } }. tests/adversarial/mail_api.mjs:100 expects { "code": "unauthenticated", "message": "Authentication required" }. The 401 assertion passes; the shape assertion fails and stops the independent hostile-ID, account-input and attachment probes.

The original assertion remains intact, per the job rule against changing existing expectations. A small runner correction now defers this anonymous-contract error until the independent Mail probes finish, then returns failure. A focused rerun will report both the contract result and the later probes. The owner/orchestrator must decide the intended AuthError contract. No anonymous stream opened, provider details leaked or access hole was observed.

Tracked as #1248: kayg/calternal#1248

Round 31 Mail event probe stops at an old AuthError shape (#1202) On product `139d4378e`, an anonymous `/api/v1/mail/events` request returns HTTP 401 with `{ "error": { "code": "unauthorized", "message": "authentication is required" } }`. `tests/adversarial/mail_api.mjs:100` expects `{ "code": "unauthenticated", "message": "Authentication required" }`. The 401 assertion passes; the shape assertion fails and stops the independent hostile-ID, account-input and attachment probes. The original assertion remains intact, per the job rule against changing existing expectations. A small runner correction now defers this anonymous-contract error until the independent Mail probes finish, then returns failure. A focused rerun will report both the contract result and the later probes. The owner/orchestrator must decide the intended AuthError contract. No anonymous stream opened, provider details leaked or access hole was observed. Tracked as #1248: https://git.kayg.org/kayg/calternal/issues/1248

kayg referenced this issue 2026-10-06 23:33:18 +00:00

Notifications probe expects 400 for a missing required category; API returns 422 #1251

kayg commented 2026-10-06 23:33:24 +00:00

Author

Owner

Copy link

Notifications missing-category probe expects 400; merge31 returns 422 (#1202)

Product 139d4378e, release server. POST /api/v1/notifications/inbox/toasts with a fresh event UUID and title/action/link but no category_id returned 422. The existing tests/adversarial/toast_notifications.mjs:78 requires 400.

AssertionError: missing toast category: expected HTTP 400, received 422
422 !== 400

The input was rejected; no accepted hostile input or access hole was observed. The original 400 assertion remains intact. The probe now defers only that assertion failure, then runs the independent unread, clear/Undo and cross-User checks and returns an aggregate failure. The focused rerun will provide their outcome. The orchestrator must decide the intended missing-field status; this job does not change the assertion or route to make it pass.

Tracked as #1251: kayg/calternal#1251

Notifications missing-category probe expects 400; merge31 returns 422 (#1202) Product `139d4378e`, release server. `POST /api/v1/notifications/inbox/toasts` with a fresh event UUID and title/action/link but no `category_id` returned 422. The existing `tests/adversarial/toast_notifications.mjs:78` requires 400. ```text AssertionError: missing toast category: expected HTTP 400, received 422 422 !== 400 ``` The input was rejected; no accepted hostile input or access hole was observed. The original 400 assertion remains intact. The probe now defers only that assertion failure, then runs the independent unread, clear/Undo and cross-User checks and returns an aggregate failure. The focused rerun will provide their outcome. The orchestrator must decide the intended missing-field status; this job does not change the assertion or route to make it pass. Tracked as #1251: https://git.kayg.org/kayg/calternal/issues/1251

kayg referenced this issue 2026-10-06 23:39:25 +00:00

Mail selected attachment row intercepts its Save to Files button #1254

kayg commented 2026-10-06 23:39:31 +00:00

Author

Owner

Copy link

Mail selected attachment row intercepts Save to Files (#1202)

On release product 139d4378e, tests/adversarial/mail_api.mjs reached the attachment action after its account/input and cross-User guards. At a 1440 × 960 viewport, it opens /mail/t/<fixture-thread>?attachment=<fixture-message>%3A3 and clicks the Save to Files button for the test-only ../../../../etc/passwd attachment. Playwright resolves a visible enabled button but the selected parent row intercepts pointer events.

TimeoutError: click: Timeout 30000ms exceeded.
locator resolved to <button ... aria-label="Save ../../../../etc/passwd to Files">…</button>
<li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events

The final Save to Files/name-safety assertion was not reached. The job did not force-click or replace pointer input with a scripted click. This is a primary-action gap, not a server crash or demonstrated access leak. The main Mail network-policy probe passed, and the cross-User matrix reported zero denial failures. Investigate selected-row hit testing and button stacking, then rerun the actual pointer action. The screenshots for Mail's empty state at all three widths and both themes are attached to #1202; they do not prove this attachment action.

Tracked as #1254: kayg/calternal#1254

Mail selected attachment row intercepts Save to Files (#1202) On release product `139d4378e`, `tests/adversarial/mail_api.mjs` reached the attachment action after its account/input and cross-User guards. At a 1440 × 960 viewport, it opens `/mail/t/<fixture-thread>?attachment=<fixture-message>%3A3` and clicks the Save to Files button for the test-only `../../../../etc/passwd` attachment. Playwright resolves a visible enabled button but the selected parent row intercepts pointer events. ```text TimeoutError: click: Timeout 30000ms exceeded. locator resolved to <button ... aria-label="Save ../../../../etc/passwd to Files">…</button> <li aria-current="page" class="svelte-dbzj7x selected">…</li> intercepts pointer events ``` The final Save to Files/name-safety assertion was not reached. The job did not force-click or replace pointer input with a scripted click. This is a primary-action gap, not a server crash or demonstrated access leak. The main Mail network-policy probe passed, and the cross-User matrix reported zero denial failures. Investigate selected-row hit testing and button stacking, then rerun the actual pointer action. The screenshots for Mail's empty state at all three widths and both themes are attached to #1202; they do not prove this attachment action. Tracked as #1254: https://git.kayg.org/kayg/calternal/issues/1254

kayg referenced this issue 2026-10-06 23:42:15 +00:00

Adversarial proxy returned a transient 502 for a rejected 3 MiB Appearance body #1256

kayg commented 2026-10-06 23:50:26 +00:00

Author

Owner

Copy link

Correction and stronger evidence for #1256: the first focused 413 used a different unknown-field body. The exact Appearance background.light.color body reproduces the problem: direct server 413, Node fixture proxy 502. Bun preserves that 3 MiB rejection, but an expanded test also reproduces 502 for larger streamed bodies after the peer reads a chunk. The underlying server remains live.

The fixture fix is in progress: retain the real upstream response with native streaming forwarding, with regression coverage before/after Continue, after the first body chunk, a bounded burst and binary collaboration forwarding. No existing expected 413 is changed. Both exact live shapes and the complete proxy regression must pass before committing this fix. This is a fixture transport defect; the job is not claiming a clean adversarial exit while its old proxy is running.

Correction and stronger evidence for #1256: the first focused 413 used a different unknown-field body. The exact Appearance `background.light.color` body reproduces the problem: direct server 413, Node fixture proxy 502. Bun preserves that 3 MiB rejection, but an expanded test also reproduces 502 for larger streamed bodies after the peer reads a chunk. The underlying server remains live. The fixture fix is in progress: retain the real upstream response with native streaming forwarding, with regression coverage before/after Continue, after the first body chunk, a bounded burst and binary collaboration forwarding. No existing expected 413 is changed. Both exact live shapes and the complete proxy regression must pass before committing this fix. This is a fixture transport defect; the job is not claiming a clean adversarial exit while its old proxy is running.

kayg commented 2026-10-06 23:56:05 +00:00

Author

Owner

Copy link

Fixed fixture transport in b81414b0c (#1256). The runner now uses Bun. Large ordinary bodies use native fetch with a bounded backpressure bridge; upstream cancellation drains the frontend rather than destroying it before the 413 is read. Raw encoded dot paths and Fetch-forbidden methods keep the compatibility client. Redirects are not followed, compressed bytes and separate cookies are preserved, and binary collaboration still forwards. The Bun fetch options were checked against the official reference.

Focused regression output:

# tests 15
# suites 0
# pass 15
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 2395.786292
PASS exact live Appearance payload: direct 413; corrected proxy 413
PASS exact live Photos Undo payload: direct 413; corrected proxy 413

Coverage includes 200 KB, 3 MiB, 5 MiB and >8 MiB bodies before/after Continue and after one body chunk; four concurrent requests per case; raw DAV dot segments; manual redirects; separate Set-Cookie values; exact compressed response bytes; binary collaboration. No expected 413 was changed. The ongoing full round keeps its already-started Node proxy, so its two historical proxy 502 findings remain in the report. No full-suite loop is started. The release server returned 413 directly in both cases and stayed live.

Fixed fixture transport in `b81414b0c` (#1256). The runner now uses Bun. Large ordinary bodies use native fetch with a bounded backpressure bridge; upstream cancellation drains the frontend rather than destroying it before the 413 is read. Raw encoded dot paths and Fetch-forbidden methods keep the compatibility client. Redirects are not followed, compressed bytes and separate cookies are preserved, and binary collaboration still forwards. The Bun fetch options were checked against [the official reference](https://bun.com/reference/globals/BunFetchRequestInit). Focused regression output: ```text # tests 15 # suites 0 # pass 15 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 2395.786292 PASS exact live Appearance payload: direct 413; corrected proxy 413 PASS exact live Photos Undo payload: direct 413; corrected proxy 413 ``` Coverage includes 200 KB, 3 MiB, 5 MiB and >8 MiB bodies before/after Continue and after one body chunk; four concurrent requests per case; raw DAV dot segments; manual redirects; separate Set-Cookie values; exact compressed response bytes; binary collaboration. No expected 413 was changed. The ongoing full round keeps its already-started Node proxy, so its two historical proxy 502 findings remain in the report. No full-suite loop is started. The release server returned 413 directly in both cases and stayed live.

kayg referenced this issue 2026-10-06 23:57:19 +00:00

Editor heading-link probe expects a slug despite the decided stable block anchor format #1262

kayg commented 2026-10-06 23:57:24 +00:00

Author

Owner

Copy link

Editor adversarial heading link assertion expects the retired new-link format (#1202)

Product 139d4378e, Editor seed 25608414. The Note identity path check passed. The heading anchor check in tests/adversarial/editor.mjs:608 expected anchor-heading; Copy link returned ^zxhir0.

FINDING editor browser editor paste, Unicode, and block actions seed=25608414: heading links use the heading slug
+ actual - expected
+ '^zxhir0'
- 'anchor-heading'

DESIGN §33 now states: new Note heading links use their existing block ID and /n/<calternal-id>#^<block-id>; old heading-slug links remain resolvable. The copied shape agrees with that grammar. The job leaves the old assertion intact, per the rule against changing expectations. The orchestrator must update this probe to the decided stable identity behaviour and ensure rename/reopen resolution, rather than simply accepting any anchor. The current browser sub-area stops at the old assertion; later independent Editor areas passed concurrent same-block writes, offline reconciliation, delete/edit races, external source edits and restart recovery.

The separate 10,000-block sync measured 2,494 ms against a 2,000 ms budget on the busy host. That is a SLOW-only result and does not block the merge.

Tracked as #1262: kayg/calternal#1262

Editor adversarial heading link assertion expects the retired new-link format (#1202) Product `139d4378e`, Editor seed `25608414`. The Note identity path check passed. The heading anchor check in `tests/adversarial/editor.mjs:608` expected `anchor-heading`; Copy link returned `^zxhir0`. ```text FINDING editor browser editor paste, Unicode, and block actions seed=25608414: heading links use the heading slug + actual - expected + '^zxhir0' - 'anchor-heading' ``` DESIGN §33 now states: new Note heading links use their existing block ID and `/n/<calternal-id>#^<block-id>`; old heading-slug links remain resolvable. The copied shape agrees with that grammar. The job leaves the old assertion intact, per the rule against changing expectations. The orchestrator must update this probe to the decided stable identity behaviour and ensure rename/reopen resolution, rather than simply accepting any anchor. The current browser sub-area stops at the old assertion; later independent Editor areas passed concurrent same-block writes, offline reconciliation, delete/edit races, external source edits and restart recovery. The separate 10,000-block sync measured 2,494 ms against a 2,000 ms budget on the busy host. That is a SLOW-only result and does not block the merge. Tracked as #1262: https://git.kayg.org/kayg/calternal/issues/1262

kayg commented 2026-10-07 00:00:36 +00:00

Author

Owner

Copy link

Additional proxy regression in the follow-up commit proves the runtime does not impose a smaller upload cap: a valid 64 MiB body reaches the inert peer byte-for-byte (count 67,108,864), in 462.76797 ms locally. Final focused suite:

# tests 16
# suites 0
# pass 16
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 3152.994447

The forwarding cost is linear in body bytes, with streaming backpressure rather than a full-body copy. No product feature or API contract changed.

Additional proxy regression in the follow-up commit proves the runtime does not impose a smaller upload cap: a valid 64 MiB body reaches the inert peer byte-for-byte (count 67,108,864), in 462.76797 ms locally. Final focused suite: ```text # tests 16 # suites 0 # pass 16 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 3152.994447 ``` The forwarding cost is linear in body bytes, with streaming backpressure rather than a full-body copy. No product feature or API contract changed.

kayg referenced this issue 2026-10-07 00:03:09 +00:00

Tag Photo/XMP probe uploads plain text in its JPEG fixture #1264

kayg commented 2026-10-07 00:03:15 +00:00

Author

Owner

Copy link

Tag probe uses plain text as its Photo fixture (#1202)

On product 139d4378e, the global Tag/XMP part of tests/adversarial/attack.py uploads Travel/beach.jpg using b"test image payload" at line 3324. Its later checks require kind: photo and a .jpg.xmp sidecar. The actual Tag projections contain the Note and two Files; the text-backed .jpg is a File and its expected XMP file does not exist.

Findings include global Tag page, rewrite preview/source kinds, renamed page, XMP source read, corrupt XMP source setup and rebuild source kinds. The returned paths still contain the three fixture sources; no source loss was observed. This fixture cannot prove a Tag/XMP failure with a valid Photo. The job leaves the old fixture and expectations intact, per the rule against changing them to make a test pass. The orchestrator should review the intended MIME/content classification and use an existing valid image fixture for the Photo-specific regression.

The new round-31 Hide probe uses a valid decoded 1×1 PNG; its hide/unhide and protocol checks passed. The shared source-byte contracts also passed all 12 cases. This issue records the older global Tag fixture gap; it does not establish an authorization hole or loss of image data.

Tracked as #1264: kayg/calternal#1264

Tag probe uses plain text as its Photo fixture (#1202) On product `139d4378e`, the global Tag/XMP part of `tests/adversarial/attack.py` uploads `Travel/beach.jpg` using `b"test image payload"` at line 3324. Its later checks require `kind: photo` and a `.jpg.xmp` sidecar. The actual Tag projections contain the Note and two Files; the text-backed `.jpg` is a File and its expected XMP file does not exist. Findings include global Tag page, rewrite preview/source kinds, renamed page, XMP source read, corrupt XMP source setup and rebuild source kinds. The returned paths still contain the three fixture sources; no source loss was observed. This fixture cannot prove a Tag/XMP failure with a valid Photo. The job leaves the old fixture and expectations intact, per the rule against changing them to make a test pass. The orchestrator should review the intended MIME/content classification and use an existing valid image fixture for the Photo-specific regression. The new round-31 Hide probe uses a valid decoded 1×1 PNG; its hide/unhide and protocol checks passed. The shared source-byte contracts also passed all 12 cases. This issue records the older global Tag fixture gap; it does not establish an authorization hole or loss of image data. Tracked as #1264: https://git.kayg.org/kayg/calternal/issues/1264

kayg commented 2026-10-07 00:09:45 +00:00

Author

Owner

Copy link

adv31 focused completions and resumed tail

Product head remains 139d4378e. Fixes are in the verification harness and probes.

• #1148: real Tus import, missing versus existing date metadata, malformed and oversized Note source, exact bytes/mtime and two restarts passed.
• #1153: hide/unhide all seven item formats, hostile paths, private isolation, Share overlay/revoke and hidden CalDAV/WebDAV views passed. The valid PNG fixtures also have two rows in photos_media; this is actual Photo coverage.
• #1140: durable admission, parsing to review, foreign read/cancel/confirm denial, owner cancellation, admission after cancel, owner publication, private receipt, foreign Undo denial and idempotent inverse passed. Durable confirmation replays HTTP 201 with the same result, as the existing durable_import_tests.rs contract requires; the existing synchronous-preview HTTP 404 assertion is unchanged.
• #1194: mark unread, clear/Undo, User isolation and concurrent writes passed after preserving and deferring the old missing-category HTTP 400 assertion (actual 422; #1251).
• #1160: Mail network restriction probes completed and passed.
• Cross-User matrix: 203 operations replayed, 938 comparisons, 117 extra Job/Mail/quota checks, zero denial failures; 39 routes lack local fixture factories.
• Screenshot sweep: 252 actual-size macOS captures, 42 routes at 390/820/1440, light/dark. No page errors or HTTP 5xx. Attached previously.

Runner interruption: editing run.sh while its first invocation was waiting in attack.py made Bash read changed byte offsets. It stopped after round 1 with an unexpected EOF. The retained fixture is intact. I resumed only the unexecuted tail (voice/media, hostile bytes, round 2, dedup restarts, Notes protocols, socket restarts, Admin matrix), using the same release binaries and data. The initial result and resumed-tail result are recorded separately. Commit 2079288f7 makes Bash parse the entire round first; a live source-rewrite regression passes. The resumed voice-upload phase passed.

The exact initial proxy 502 findings were fixture errors, fixed in b81414b0c/b8c8d25a7: 16 tests pass and the real backend's exact Appearance/Photo Undo oversized payloads remain HTTP 413 through the corrected proxy. Expected peer TLS failure 502 is intentional provider failure. No confirmed product crash, data loss or cross-User leak so far. Remaining phases are still running; this is not a completion claim.

## adv31 focused completions and resumed tail Product head remains 139d4378e. Fixes are in the verification harness and probes. - #1148: real Tus import, missing versus existing date metadata, malformed and oversized Note source, exact bytes/mtime and two restarts passed. - #1153: hide/unhide all seven item formats, hostile paths, private isolation, Share overlay/revoke and hidden CalDAV/WebDAV views passed. The valid PNG fixtures also have two rows in photos_media; this is actual Photo coverage. - #1140: durable admission, parsing to review, foreign read/cancel/confirm denial, owner cancellation, admission after cancel, owner publication, private receipt, foreign Undo denial and idempotent inverse passed. Durable confirmation replays HTTP 201 with the same result, as the existing durable_import_tests.rs contract requires; the existing synchronous-preview HTTP 404 assertion is unchanged. - #1194: mark unread, clear/Undo, User isolation and concurrent writes passed after preserving and deferring the old missing-category HTTP 400 assertion (actual 422; #1251). - #1160: Mail network restriction probes completed and passed. - Cross-User matrix: 203 operations replayed, 938 comparisons, 117 extra Job/Mail/quota checks, zero denial failures; 39 routes lack local fixture factories. - Screenshot sweep: 252 actual-size macOS captures, 42 routes at 390/820/1440, light/dark. No page errors or HTTP 5xx. Attached previously. Runner interruption: editing run.sh while its first invocation was waiting in attack.py made Bash read changed byte offsets. It stopped after round 1 with an unexpected EOF. The retained fixture is intact. I resumed only the unexecuted tail (voice/media, hostile bytes, round 2, dedup restarts, Notes protocols, socket restarts, Admin matrix), using the same release binaries and data. The initial result and resumed-tail result are recorded separately. Commit 2079288f7 makes Bash parse the entire round first; a live source-rewrite regression passes. The resumed voice-upload phase passed. The exact initial proxy 502 findings were fixture errors, fixed in b81414b0c/b8c8d25a7: 16 tests pass and the real backend's exact Appearance/Photo Undo oversized payloads remain HTTP 413 through the corrected proxy. Expected peer TLS failure 502 is intentional provider failure. No confirmed product crash, data loss or cross-User leak so far. Remaining phases are still running; this is not a completion claim.

kayg referenced this issue 2026-10-07 00:11:05 +00:00

Adversarial video fixture is indexed as text and HLS error triggers byte-CSP assertion #1266

kayg referenced this issue 2026-10-07 00:11:06 +00:00

Adversarial PDF preview deadline and equal-byte renderer fixture need review #1267

kayg referenced this issue 2026-10-07 00:11:07 +00:00

Adversarial semantic recall did not meet its fixed 120-second bound #1268

kayg commented 2026-10-07 00:11:43 +00:00

Author

Owner

Copy link

adv31 media/recall findings

Filed all new non-SLOW findings, with the old expectations kept:

• #1266: text bytes uploaded as adversarial.mp4 are indexed as text/plain. Video source/range checks return 404, and the HLS 404 triggers the blanket byte-response sandbox assertion. No executable content or 5xx was observed in these cases.
• #1267: valid PDF missed the preview deadline. Direct Index inspection confirms its thumbnail job is pending with attempts=0 and last_error=NULL. The two equal-byte PDF/txt fixtures are both application/pdf. Native PDF/SVG sandbox tests passed.
• #1268: semantic recall did not return its created Note within the fixed 120-second bound. Cause is not isolated; no data-loss claim.

The resumed hostile-byte browser probe passed the enforced CSP self-test; its only finding was the HLS error-response assertion in #1266. Round 2 is running (app profiles, pins isolation and agent downloads reached; change-feed phase active). Commits 2079288f7 and 5b58679a9 contain the runner guard and expanded durable import/Undo coverage, both with passing focused verification.

## adv31 media/recall findings Filed all new non-SLOW findings, with the old expectations kept: - #1266: text bytes uploaded as adversarial.mp4 are indexed as text/plain. Video source/range checks return 404, and the HLS 404 triggers the blanket byte-response sandbox assertion. No executable content or 5xx was observed in these cases. - #1267: valid PDF missed the preview deadline. Direct Index inspection confirms its thumbnail job is pending with attempts=0 and last_error=NULL. The two equal-byte PDF/txt fixtures are both application/pdf. Native PDF/SVG sandbox tests passed. - #1268: semantic recall did not return its created Note within the fixed 120-second bound. Cause is not isolated; no data-loss claim. The resumed hostile-byte browser probe passed the enforced CSP self-test; its only finding was the HLS error-response assertion in #1266. Round 2 is running (app profiles, pins isolation and agent downloads reached; change-feed phase active). Commits 2079288f7 and 5b58679a9 contain the runner guard and expanded durable import/Undo coverage, both with passing focused verification.

kayg referenced this issue 2026-10-07 00:25:22 +00:00

Adversarial Task-view storm omits mandatory If-Match and expects unconditional success #1272

kayg referenced this issue 2026-10-07 00:25:23 +00:00

Adversarial Notes IMAP bulk FETCH misses appended Note and blocks structural replay #1273

kayg commented 2026-10-07 00:27:37 +00:00

Author

Owner

Copy link

adv31 link previews completed; tail recovery

Head d4f3bb880. The complete #1151 focused real-server phase finished:

server alive at end: True

==== ROUND 2 FINDINGS 0

==== ROUND 2 SLOW 1
 - Notes preview rejects slow-drip :: 8.7s status 200

It covered malformed/private URL admission, DNS pinning, private redirects and loops, compressed/oversized/non-HTML/slow responses, IDN metadata, private per-User preferences, shared public cache, identity-header privacy and bursts. The private trap received no requests. Native controlled DNS failed for the IDN's absolute trailing-dot form; production intentionally asks absolute names. Commit d4f3bb880 adds that fixture spelling with a real compiled-libc regression. Commit 306040fd7 moves this member-dependent phase before deletion and adds an ordering regression. Existing status and content assertions are unchanged.

Recovery disclosure: the HTTP-only link phase originally ran beside the loaded round on its fixture ports. The main Calendar phase reached those ports sooner than expected, failed its bind, and ended round 2 early. Dedup roster setup then returned 409 because deletion had not freed its User slots. I paused the coordinator after Notes submission, waited for its protocol child to finish, and resumed only the missed Calendar-through-deletion phases on the retained server. Calendar, Log rewrites and upload slots concluded; quota and Search isolation are progressing. After that, a fresh controller will run dedup and its three crash barriers, socket restarts and the Admin matrix. No completed matrix is being rerun in full.

New safe contract/availability findings: #1272 documents the Task-view storm's missing If-Match (actual 428); #1273 documents missing bulk IMAP FETCH and blocked structural replay. The appended IMAP source exists in the Index and on disk. A small-Home replay reached structural/serial APPEND but hit its existing 15-second read bound. Separate Notes submission finished with zero findings. No confirmed product crash, data loss or cross-User leak so far. The full campaign remains active.

## adv31 link previews completed; tail recovery Head d4f3bb880. The complete #1151 focused real-server phase finished: ``` server alive at end: True ==== ROUND 2 FINDINGS 0 ==== ROUND 2 SLOW 1 - Notes preview rejects slow-drip :: 8.7s status 200 ``` It covered malformed/private URL admission, DNS pinning, private redirects and loops, compressed/oversized/non-HTML/slow responses, IDN metadata, private per-User preferences, shared public cache, identity-header privacy and bursts. The private trap received no requests. Native controlled DNS failed for the IDN's absolute trailing-dot form; production intentionally asks absolute names. Commit d4f3bb880 adds that fixture spelling with a real compiled-libc regression. Commit 306040fd7 moves this member-dependent phase before deletion and adds an ordering regression. Existing status and content assertions are unchanged. Recovery disclosure: the HTTP-only link phase originally ran beside the loaded round on its fixture ports. The main Calendar phase reached those ports sooner than expected, failed its bind, and ended round 2 early. Dedup roster setup then returned 409 because deletion had not freed its User slots. I paused the coordinator after Notes submission, waited for its protocol child to finish, and resumed only the missed Calendar-through-deletion phases on the retained server. Calendar, Log rewrites and upload slots concluded; quota and Search isolation are progressing. After that, a fresh controller will run dedup and its three crash barriers, socket restarts and the Admin matrix. No completed matrix is being rerun in full. New safe contract/availability findings: #1272 documents the Task-view storm's missing If-Match (actual 428); #1273 documents missing bulk IMAP FETCH and blocked structural replay. The appended IMAP source exists in the Index and on disk. A small-Home replay reached structural/serial APPEND but hit its existing 15-second read bound. Separate Notes submission finished with zero findings. No confirmed product crash, data loss or cross-User leak so far. The full campaign remains active.

kayg commented 2026-10-07 00:31:47 +00:00

Author

Owner

Copy link

MERGE BLOCKER: duplicated Daily note content in sync race

Product head 139d4378e, release server, retained real data. The recovered round-2 journalrace phase concluded with duplicated device paragraphs:

!! journalrace: sync upload: ('patch', 503, b'{"error":{"code":"service_unavailable","message":"Index is busy; retry shortly"}}')
!! journalrace: sync upload: ('patch', 503, b'{"error":{"code":"service_unavailable","message":"Index is busy; retry shortly"}}')
!! journalrace: duplicate line: 2 times: 'sync paragraph 6 from a phone'
!! journalrace: duplicate line: 2 times: 'sync paragraph 0 from a phone'
!! journalrace: sync line: 'sync paragraph 6 from a phone' appears 2 times
!! journalrace: sync line: 'sync paragraph 0 from a phone' appears 2 times
journalrace: 2021-03-14: 6 seeds, 40 creates answered 201, 0 timed out (0 of them landed), 8 uploads, 46 entries

This is not a SLOW-only finding. Duplicate source content in a sync/write race blocks merge under the owner rule. I am inspecting the retained source and retry/merge implementation. No assertion will be weakened. Other missed round-2 phases continue to their conclusions; the coordinator is held before final restart/authz phases so its fixture authority remains valid.

## MERGE BLOCKER: duplicated Daily note content in sync race Product head 139d4378e, release server, retained real data. The recovered round-2 journalrace phase concluded with duplicated device paragraphs: ``` !! journalrace: sync upload: ('patch', 503, b'{"error":{"code":"service_unavailable","message":"Index is busy; retry shortly"}}') !! journalrace: sync upload: ('patch', 503, b'{"error":{"code":"service_unavailable","message":"Index is busy; retry shortly"}}') !! journalrace: duplicate line: 2 times: 'sync paragraph 6 from a phone' !! journalrace: duplicate line: 2 times: 'sync paragraph 0 from a phone' !! journalrace: sync line: 'sync paragraph 6 from a phone' appears 2 times !! journalrace: sync line: 'sync paragraph 0 from a phone' appears 2 times journalrace: 2021-03-14: 6 seeds, 40 creates answered 201, 0 timed out (0 of them landed), 8 uploads, 46 entries ``` This is not a SLOW-only finding. Duplicate source content in a sync/write race blocks merge under the owner rule. I am inspecting the retained source and retry/merge implementation. No assertion will be weakened. Other missed round-2 phases continue to their conclusions; the coordinator is held before final restart/authz phases so its fixture authority remains valid.

kayg commented 2026-10-07 00:34:49 +00:00

Author

Owner

Copy link

MERGE BLOCKER: Public hidden-name preview headers disclose names

The recovered share-options phase reports:

!! hidden names leak in preview headers: Quarterly
!! hidden names leak in preview headers: Audit

The Public link has hide_filenames=true. Listings and downloads are checked separately; the preview headers disclose source names to the anonymous link visitor. This is a privacy-contract leak, not a SLOW-only finding. I am inspecting the exact header and preview response. Keep the assertions. Product head under test remains 139d4378e.

## MERGE BLOCKER: Public hidden-name preview headers disclose names The recovered share-options phase reports: ``` !! hidden names leak in preview headers: Quarterly !! hidden names leak in preview headers: Audit ``` The Public link has hide_filenames=true. Listings and downloads are checked separately; the preview headers disclose source names to the anonymous link visitor. This is a privacy-contract leak, not a SLOW-only finding. I am inspecting the exact header and preview response. Keep the assertions. Product head under test remains 139d4378e.

kayg referenced this issue 2026-10-07 00:35:42 +00:00

BLOCKER: Daily note sync race duplicates successful device paragraphs #1279

kayg referenced this issue 2026-10-07 00:35:43 +00:00

BLOCKER: Public hidden-name Markdown preview exposes real names in headers #1280

kayg referenced this issue 2026-10-07 00:49:24 +00:00

Dedup adversarial repair and GC deadlines leave crash coverage incomplete #1287

kayg commented 2026-10-07 00:52:07 +00:00

Author

Owner

Copy link

Continuing #1202 on branch job/adv31, base d4f3bb880 (product head 139d4378e plus runner commits). Finish the hidden-filename privacy check, retain complete runner fixes, and track remaining findings. The recovered #1279 Journal patch is saved in artifacts/adv31/deferred-journal-1279.patch and removed from this job because another job owns it. No push or deploy.

Continuing #1202 on branch job/adv31, base d4f3bb880 (product head 139d4378e plus runner commits). Finish the hidden-filename privacy check, retain complete runner fixes, and track remaining findings. The recovered #1279 Journal patch is saved in artifacts/adv31/deferred-journal-1279.patch and removed from this job because another job owns it. No push or deploy.

kayg commented 2026-10-07 00:56:30 +00:00

Author

Owner

Copy link

#1202 continuation findings and decisions

The privacy fix reuses download_name for the bounded Markdown preview. A loopback HTTP regression walks all Public route boundaries and checks complete wire responses for source names. It uses real PNG, PDF and video fixtures and rejects filename guesses. Source contents keep the byte-exact download contract; hide_filenames controls source-name presentation, not arbitrary words inside the file.

All requested findings already have issues: Notes IMAP #1273; PDF #1267; Mail Save to Files #1254; semantic recall #1268; NFD Search #1247; Task views #1272; video #1266; Tag Photo fixture #1264; health #1245; Mail envelope #1248; Notifications required field #1251; heading links #1262; dedup deadline #1287. No duplicate issues were created.

The job explicitly authorizes fixes to stale tests. Task views use the complete source ETag (#731, DESIGN §2): missing If-Match must return 428; of 48 different updates with one retained ETag, exactly one can return 200 and the rest must return 412. StartupHealth is {state, progress} with ok and null progress after startup (#1161). Mail authentication uses the shared nested ErrorEnvelope. A missing required category is a JSON extractor 422, while an unknown category remains 400. New heading links use a stable Block ID (DESIGN §33). Content detection (#851) means Photo and Video probes need actual media bytes; equal PDF bytes remain PDF even with a .txt suffix. HLS JSON errors retain baseline CSP; successful byte responses must carry sandbox.

These are corrections to decided contracts, not new product decisions. Search, semantic, IMAP, PDF scheduling and dedup deadline causes remain unresolved in their issues. The #1279 Journal patch was saved as an untracked artifact and removed from this job; a separate job owns it.

# #1202 continuation findings and decisions The privacy fix reuses `download_name` for the bounded Markdown preview. A loopback HTTP regression walks all Public route boundaries and checks complete wire responses for source names. It uses real PNG, PDF and video fixtures and rejects filename guesses. Source contents keep the byte-exact download contract; hide_filenames controls source-name presentation, not arbitrary words inside the file. All requested findings already have issues: Notes IMAP #1273; PDF #1267; Mail Save to Files #1254; semantic recall #1268; NFD Search #1247; Task views #1272; video #1266; Tag Photo fixture #1264; health #1245; Mail envelope #1248; Notifications required field #1251; heading links #1262; dedup deadline #1287. No duplicate issues were created. The job explicitly authorizes fixes to stale tests. Task views use the complete source ETag (#731, DESIGN §2): missing If-Match must return 428; of 48 different updates with one retained ETag, exactly one can return 200 and the rest must return 412. StartupHealth is `{state, progress}` with `ok` and null progress after startup (#1161). Mail authentication uses the shared nested ErrorEnvelope. A missing required category is a JSON extractor 422, while an unknown category remains 400. New heading links use a stable Block ID (DESIGN §33). Content detection (#851) means Photo and Video probes need actual media bytes; equal PDF bytes remain PDF even with a .txt suffix. HLS JSON errors retain baseline CSP; successful byte responses must carry sandbox. These are corrections to decided contracts, not new product decisions. Search, semantic, IMAP, PDF scheduling and dedup deadline causes remain unresolved in their issues. The #1279 Journal patch was saved as an untracked artifact and removed from this job; a separate job owns it.

kayg referenced this issue 2026-10-07 01:03:42 +00:00

Adversarial Task-view storm omits mandatory If-Match and expects unconditional success #1272

kayg commented 2026-10-07 01:23:01 +00:00

Author

Owner

Copy link

The required full Files gate on the #1202 continuation reached the unchanged reconcile-storm cleanup and panicked with JoinHandle polled after completion. The completed timeout cleanup already joins the watcher, then the unconditional cleanup polls it again. This is the existing #1213 runner defect; it is not the separate #1279 Journal fix.

The new Public privacy regression passed. Full gate output:

thread 'tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm' (820486) panicked at /home/kayg/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.53.1/src/runtime/task/core.rs:427:22:
JoinHandle polled after completion

test result: FAILED. 260 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 370.28s

I am using one shared test-only abort/join helper for both cleanup paths, with a deterministic consumed-handle and repeated-cleanup regression. The 1,000 writes, four scans, Index/feed assertions and five-minute completion bound stay unchanged. The source behavior will not be changed to make this check pass. The underlying completion outcome will be reported after the focused rerun.

The required full Files gate on the #1202 continuation reached the unchanged reconcile-storm cleanup and panicked with `JoinHandle polled after completion`. The completed timeout cleanup already joins the watcher, then the unconditional cleanup polls it again. This is the existing #1213 runner defect; it is not the separate #1279 Journal fix. The new Public privacy regression passed. Full gate output: ``` thread 'tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm' (820486) panicked at /home/kayg/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.53.1/src/runtime/task/core.rs:427:22: JoinHandle polled after completion test result: FAILED. 260 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 370.28s ``` I am using one shared test-only abort/join helper for both cleanup paths, with a deterministic consumed-handle and repeated-cleanup regression. The 1,000 writes, four scans, Index/feed assertions and five-minute completion bound stay unchanged. The source behavior will not be changed to make this check pass. The underlying completion outcome will be reported after the focused rerun.

kayg referenced this issue 2026-10-07 01:23:02 +00:00

Files reconcile-storm gate panics when a completed JoinHandle is polled again #1213

kayg referenced this issue 2026-10-07 01:24:18 +00:00

Journal: sync retry after 503 duplicates paragraphs #1295

kayg commented 2026-10-07 01:24:24 +00:00

Author

Owner

Copy link

journaldup started on job/journaldup at base 3601719b80. Filed dedicated repair issue #1295: kayg/calternal#1295. Reading retained collision evidence and tracing publication and retry ordering.

journaldup started on job/journaldup at base 3601719b80a39f712daf07b37879b22929dfffa0. Filed dedicated repair issue #1295: https://git.kayg.org/kayg/calternal/issues/1295. Reading retained collision evidence and tracing publication and retry ordering.

kayg commented 2026-10-07 01:26:15 +00:00

Author

Owner

Copy link

Repair #1295 confirms the same late-412 path exists in production revision ff53d7b8b. This is an existing production bug. Deterministic regressions now target a Notes write and SQLite BUSY after upload rename. Existing durable tus IDs can serve as retry keys without a new transport identity.

Repair #1295 confirms the same late-412 path exists in production revision ff53d7b8b. This is an existing production bug. Deterministic regressions now target a Notes write and SQLite BUSY after upload rename. Existing durable tus IDs can serve as retry keys without a new transport identity.

kayg referenced this issue 2026-10-07 01:31:49 +00:00

Files reconcile-storm gate panics when a completed JoinHandle is polled again #1213

kayg commented 2026-10-07 01:35:01 +00:00

Author

Owner

Copy link

advfix-a — #1202 continuation

Head: c8fe092c3de1b1f388ecb2c71ae307de0447eaaa on job/adv31.

Built: the bounded Markdown preview now uses the existing hidden transport-name helper. A real loopback HTTP test sends 57 Public requests and checks complete response bytes, including headers, bodies, errors and thumbnail 304 ETags. It uses genuine PNG, PDF and video sources. The share-options runner also checks all headers and bodies, including the link page.

Reconciled stale runner contracts: Task-view source ETags (one winner, 47 stale conflicts); nested startup health; the shared Mail authentication envelope; required toast category extraction; stable heading Block IDs; content-based Photo, Video and PDF fixtures; HLS error versus byte CSP. Retained the hidden-preview benchmark profile. The separate #1279 Journal patch is saved at artifacts/adv31/deferred-journal-1279.patch and removed from this job.

Files: crates/plugins/files/src/{public.rs,lib.rs}; bench/public-links-755.mjs; tests/adversarial/{attack.py,attack2.py,editor.mjs,hostile_bytes.mjs,mail_api.mjs,media_uploads.py,reliability_1202.mjs,toast_notifications.mjs}.

Check	Result
Public route privacy, including all preview types and ETags	Passed: 57 loopback HTTP requests
Health, Tag rewrite and Inspector history on retained release fixture	Passed
Task-view conditional storm on small Home	Passed: exactly one 200, 47 responses with 412
Notifications validation, persistence, clear/Undo and User isolation	Passed
PDF/content-classification renderer checks on small Home	Passed
Photo and Video MIME, valid and invalid Video ranges	Passed
Anonymous Mail event envelope	Passed
Heading Copy link, persistent Block ID and reopen	Passed

All requested findings already had issues. No duplicate issues were filed. Issue list: Notes IMAP #1273; PDF #1267; Mail Save to Files #1254; semantic recall #1268; NFD Search #1247; Task views #1272; video #1266; Tag Photo fixture #1264; health #1245; Mail envelope #1248; Notifications required field #1251; heading links #1262; dedup deadline #1287. Privacy fix: #1280. Separate Journal owner: #1279. No issues were closed.

Known gaps: the loaded-Home IMAP, semantic, Search, PDF scheduling and dedup deadline causes remain open. The retained large Home also timed out at Task-view creation before its burst; the fresh small-Home test passed. That failed attempt is recorded in #1272 and the evidence, and is not counted as passing coverage. The Mail Save to Files pointer action remains under #1254. An initial heading fixture stopped at a Clipboard permission error; the corrected fixture retained the same assertions and passed. Both attempts are kept in the evidence. Journal duplication remains with its separate job.

Decisions: no new product design decisions. The corrected expectations follow DESIGN §§2,22,33 and the existing #731, #851, #1161, ErrorEnvelope and required-field extractor contracts. Hidden filenames change the transport display name; original download contents keep their existing byte contract.

Expected cost: one basename/extension parse for each existing Markdown preview, with no additional filesystem or Index access. The existing bounded read remains proportional to the Note, up to 2 MiB. The recovered bench profile adds 16 KiB average and 512 KiB burst cases. It was syntax-checked; it was not measured because the latest verification policy reserves perf measurements for performance issues. No matching hidden-preview baseline exists.

No UI feature was changed. No shared visual controls were added or restyled. No dependencies or migrations changed. No push or deploy was done. origin/dev was fetched and merged once, at 3601719b80.

The full Files run found one more existing runner defect (#1213): timeout cleanup joined its watcher twice and panicked. Commit c8fe092c3 uses one shared test-only cleanup helper and adds a consumed-handle/repeated-cleanup regression. It changes no product behavior or test expectations. All doc comments in touched files were reviewed.

Gate output is quoted verbatim below. Complete stdout/stderr is in the evidence attachment.

cargo fmt --check: no output; exit 0.

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings (after cleanup fix):

    Checking calternal-plugin-files v0.0.1 (/home/kayg/Developer/calternal-wt/adv31/crates/plugins/files)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 38.41s

cargo test -p calternal-plugin-files (single full run before cleanup repair):

test public::tests::hidden_names_stay_private_across_public_routes ... ok
JoinHandle polled after completion
test result: FAILED. 260 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 370.28s
error: test failed, to rerun pass `-p calternal-plugin-files --lib`

cargo test -p calternal-plugin-files storm_ (new cleanup regression):

test tests::storm_cleanup_does_not_poll_consumed_worker_handles_twice ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 265 filtered out; finished in 0.00s

cargo test -p calternal-plugin-files internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm (after repair):

test tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm has been running for over 60 seconds
test tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 265 filtered out; finished in 132.34s

cd apps/web && bun run check:

svelte-check found 0 errors and 1 warning in 1 file

cd apps/web && bun run test --maxWorkers=2:

 Test Files  287 passed (287)
      Tests  2035 passed (2035)

The web warning is the unchanged empty .attachment-row:focus rule in packages/ui/src/components/calendar/AttachmentDeck.svelte. There were no web errors. Four existing Files tests are ignored by the normal gate; no ignore or assertion was added or weakened.

Known gate gap: the full Files gate first failed in existing #1213 cleanup. The test-only cleanup is now fixed, its deterministic regression passed, and the unchanged 1,000-write/four-scan check passed on a focused rerun in 132.34 seconds. The full suite was run once; it has not been repeated after this test-only fix. This failed attempt is retained and is not counted as a pass.

For the merge round: cargo test -p calternal-plugin-files -- --test-threads=4 must provide a clean combined full-suite result while keeping the 1,000-write/four-scan/five-minute checks. This job completed the requested full run and its repaired stress scenario. The old broad #1202 campaign remains in artifacts/adv31; this continuation does not claim new full-campaign coverage.

# advfix-a — #1202 continuation Head: `c8fe092c3de1b1f388ecb2c71ae307de0447eaaa` on `job/adv31`. Built: the bounded Markdown preview now uses the existing hidden transport-name helper. A real loopback HTTP test sends 57 Public requests and checks complete response bytes, including headers, bodies, errors and thumbnail 304 ETags. It uses genuine PNG, PDF and video sources. The share-options runner also checks all headers and bodies, including the link page. Reconciled stale runner contracts: Task-view source ETags (one winner, 47 stale conflicts); nested startup health; the shared Mail authentication envelope; required toast category extraction; stable heading Block IDs; content-based Photo, Video and PDF fixtures; HLS error versus byte CSP. Retained the hidden-preview benchmark profile. The separate #1279 Journal patch is saved at artifacts/adv31/deferred-journal-1279.patch and removed from this job. Files: crates/plugins/files/src/{public.rs,lib.rs}; bench/public-links-755.mjs; tests/adversarial/{attack.py,attack2.py,editor.mjs,hostile_bytes.mjs,mail_api.mjs,media_uploads.py,reliability_1202.mjs,toast_notifications.mjs}. | Check | Result | | --- | --- | | Public route privacy, including all preview types and ETags | Passed: 57 loopback HTTP requests | | Health, Tag rewrite and Inspector history on retained release fixture | Passed | | Task-view conditional storm on small Home | Passed: exactly one 200, 47 responses with 412 | | Notifications validation, persistence, clear/Undo and User isolation | Passed | | PDF/content-classification renderer checks on small Home | Passed | | Photo and Video MIME, valid and invalid Video ranges | Passed | | Anonymous Mail event envelope | Passed | | Heading Copy link, persistent Block ID and reopen | Passed | All requested findings already had issues. No duplicate issues were filed. Issue list: Notes IMAP #1273; PDF #1267; Mail Save to Files #1254; semantic recall #1268; NFD Search #1247; Task views #1272; video #1266; Tag Photo fixture #1264; health #1245; Mail envelope #1248; Notifications required field #1251; heading links #1262; dedup deadline #1287. Privacy fix: #1280. Separate Journal owner: #1279. No issues were closed. Known gaps: the loaded-Home IMAP, semantic, Search, PDF scheduling and dedup deadline causes remain open. The retained large Home also timed out at Task-view creation before its burst; the fresh small-Home test passed. That failed attempt is recorded in #1272 and the evidence, and is not counted as passing coverage. The Mail Save to Files pointer action remains under #1254. An initial heading fixture stopped at a Clipboard permission error; the corrected fixture retained the same assertions and passed. Both attempts are kept in the evidence. Journal duplication remains with its separate job. Decisions: no new product design decisions. The corrected expectations follow DESIGN §§2,22,33 and the existing #731, #851, #1161, ErrorEnvelope and required-field extractor contracts. Hidden filenames change the transport display name; original download contents keep their existing byte contract. Expected cost: one basename/extension parse for each existing Markdown preview, with no additional filesystem or Index access. The existing bounded read remains proportional to the Note, up to 2 MiB. The recovered bench profile adds 16 KiB average and 512 KiB burst cases. It was syntax-checked; it was not measured because the latest verification policy reserves perf measurements for performance issues. No matching hidden-preview baseline exists. No UI feature was changed. No shared visual controls were added or restyled. No dependencies or migrations changed. No push or deploy was done. origin/dev was fetched and merged once, at 3601719b80a39f712daf07b37879b22929dfffa0. The full Files run found one more existing runner defect (#1213): timeout cleanup joined its watcher twice and panicked. Commit c8fe092c3 uses one shared test-only cleanup helper and adds a consumed-handle/repeated-cleanup regression. It changes no product behavior or test expectations. All doc comments in touched files were reviewed. Gate output is quoted verbatim below. Complete stdout/stderr is in the evidence attachment. `cargo fmt --check`: no output; exit 0. `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings (after cleanup fix)`: ``` Checking calternal-plugin-files v0.0.1 (/home/kayg/Developer/calternal-wt/adv31/crates/plugins/files) Finished `dev` profile [unoptimized + debuginfo] target(s) in 38.41s ``` `cargo test -p calternal-plugin-files (single full run before cleanup repair)`: ``` test public::tests::hidden_names_stay_private_across_public_routes ... ok JoinHandle polled after completion test result: FAILED. 260 passed; 1 failed; 4 ignored; 0 measured; 0 filtered out; finished in 370.28s error: test failed, to rerun pass `-p calternal-plugin-files --lib` ``` `cargo test -p calternal-plugin-files storm_ (new cleanup regression)`: ``` test tests::storm_cleanup_does_not_poll_consumed_worker_handles_twice ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 265 filtered out; finished in 0.00s ``` `cargo test -p calternal-plugin-files internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm (after repair)`: ``` test tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm has been running for over 60 seconds test tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 265 filtered out; finished in 132.34s ``` `cd apps/web && bun run check`: ``` svelte-check found 0 errors and 1 warning in 1 file ``` `cd apps/web && bun run test --maxWorkers=2`: ``` Test Files 287 passed (287) Tests 2035 passed (2035) ``` The web warning is the unchanged empty `.attachment-row:focus` rule in packages/ui/src/components/calendar/AttachmentDeck.svelte. There were no web errors. Four existing Files tests are ignored by the normal gate; no ignore or assertion was added or weakened. Known gate gap: the full Files gate first failed in existing #1213 cleanup. The test-only cleanup is now fixed, its deterministic regression passed, and the unchanged 1,000-write/four-scan check passed on a focused rerun in 132.34 seconds. The full suite was run once; it has not been repeated after this test-only fix. This failed attempt is retained and is not counted as a pass. For the merge round: `cargo test -p calternal-plugin-files -- --test-threads=4` must provide a clean combined full-suite result while keeping the 1,000-write/four-scan/five-minute checks. This job completed the requested full run and its repaired stress scenario. The old broad #1202 campaign remains in artifacts/adv31; this continuation does not claim new full-campaign coverage.

kayg referenced this issue 2026-10-07 01:35:21 +00:00

BLOCKER: Public hidden-name Markdown preview exposes real names in headers #1280

kayg commented 2026-10-07 01:35:22 +00:00

Author

Owner

Copy link

Final report above is complete. Privacy fix: 92f3f6c39. Runner cleanup fix and final head: c8fe092c3de1b1f388ecb2c71ae307de0447eaaa. The initial full Files gate failure is retained; the cleanup regression and unchanged 1,000-write/four-scan scenario passed after repair. Formatting, Clippy, web check and all 2,035 web tests passed. The combined full Files gate remains listed for the merge round.

Evidence: complete verification logs and reports.

Cleanup: cargo clean reported Removed 11130 files, 7.0GiB total. The owned /mnt/hdd/targets/advfix-a directory and generated web output were removed. The working tree is clean. Head remains c8fe092c3de1b1f388ecb2c71ae307de0447eaaa.

Final report above is complete. Privacy fix: `92f3f6c39`. Runner cleanup fix and final head: `c8fe092c3de1b1f388ecb2c71ae307de0447eaaa`. The initial full Files gate failure is retained; the cleanup regression and unchanged 1,000-write/four-scan scenario passed after repair. Formatting, Clippy, web check and all 2,035 web tests passed. The combined full Files gate remains listed for the merge round. Evidence: [complete verification logs and reports](https://git.kayg.org/attachments/c3745492-657e-4397-a322-15c673c8e7f2). Cleanup: `cargo clean` reported `Removed 11130 files, 7.0GiB total`. The owned `/mnt/hdd/targets/advfix-a` directory and generated web output were removed. The working tree is clean. Head remains `c8fe092c3de1b1f388ecb2c71ae307de0447eaaa`.

kayg commented 2026-10-07 01:53:27 +00:00

Author

Owner

Copy link

journaldup repair #1295: original-code deterministic regression returns 412 after the uploaded paragraph landed; same missing Notes guard and late validation exist at production ff53d7b8b. Backend repair committed as 30720c462; browser recovery committed as 97d363927. All four focused server regressions pass. Final web gates now pass: svelte-check found 0 errors and 1 warning in 1 file; Test Files 287 passed (287); Tests 2036 passed (2036). Serial per-crate Rust clippy/test and the focused local-server Journal race remain in progress.

journaldup repair #1295: original-code deterministic regression returns 412 after the uploaded paragraph landed; same missing Notes guard and late validation exist at production ff53d7b8b. Backend repair committed as 30720c462; browser recovery committed as 97d363927. All four focused server regressions pass. Final web gates now pass: svelte-check found 0 errors and 1 warning in 1 file; Test Files 287 passed (287); Tests 2036 passed (2036). Serial per-crate Rust clippy/test and the focused local-server Journal race remain in progress.

kayg commented 2026-10-07 06:04:06 +00:00

Author

Owner

Copy link

#1295 — Daily note sync retry publication

Built: browser and daemon upload retries keep the durable tus ID after an ambiguous final PATCH. Files finalization keeps the namespace and Notes writer through publication, even when the HTTP request is dropped. Applied-upload proof survives an Index-busy failure, later Log edits and startup recovery. Retry publishes the current revision and does not reinstall the old snapshot. Staging cleanup follows upload-row retirement.

Files: apps/web/src/lib/files/uploads.svelte.ts and uploads.svelte.test.ts; crates/calternal-sync/src/remote.rs and transfer.rs; crates/plugins/files/src/lib.rs and uploads.rs; crates/plugins/notes/src/lib.rs; contracts/perf/exceptions.json; tests/adversarial/attack2.py, xuser_matrix.py, test_xuser_classification.py and run.sh.

Regression evidence: journal_upload_retry_keeps_later_note_edits forces a real SQLite writer reservation after the source rename, confirms the initial 503 applied bytes, edits the Note, and retries the same tus ID. Exact job/merge31 uploads.rs fails with 500 instead of 204. Production ff53d7b8b4 has the same late-precondition and hash-mismatch recovery paths, so it has the same bug. New tests also cover startup recovery, writer exclusion and dropped-request/concurrent-retry ownership. No existing test expectations, workloads or deadlines were changed. A storm-test cleanup defect was fixed: timeout cleanup previously joined the watcher twice and masked the timeout with a panic.

UX gaps closed: full-offset browser retries finalize the original upload; later Log edits remain intact; dropped requests keep writer ownership until publication ends. Existing UploadQueue is reused; no new visible controls or styles.

Decisions: use a bounded server-only staging witness on publication failure, with no new schema or dependency and no extra healthy-path fsync. Move only finalization into an owned server task; admission stays cancellable and each upload ID owns at most one such task. Retain conservative recovery when a legacy intent has no applied proof. Refresh only the exact existing performance source pin, without widening a rule.

Minimal public addition: Notes reexports its existing note_path validator so Files selects the same supported Note paths for writer coordination. No new parsing rule was added.

Expected cost: existing O(bytes) staging/hash work per upload, O(1) finalization task and metadata per admitted ID; failure-only small witness write. No per-request Home scan. No benchmark was run because the verification policy reserves performance measurements for performance issues.

Known gaps: existing duplicate paragraphs are not rewritten automatically, to avoid removing User content. Legacy unsealed ambiguous intents remain conservative. Notes has four existing ignored optional tests; Files has four existing ignored optional tests. Web check reports one existing empty CSS rule warning in AttachmentDeck.svelte. No new UI surface requires screenshots.

For the merge round: cargo fmt --check, cargo clippy --all-targets -- -D warnings, and cargo test -- --test-threads=4 must verify the combined branch. cd apps/web && bun run test:e2e:notes must check Note and Log flows on that build. tests/adversarial/run.sh must check the combined API, cross-User and authorization matrices. This job runs its own required Journal sync reliability check on its local release server.

Head SHA: 777730599b

Gates (verbatim summary output; all commands exited 0):

cargo fmt --check: no output.

cargo clippy -p calternal-sync --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 24s

cargo test -p calternal-sync -- --test-threads=4:

test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.09s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-files --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 44.56s

cargo test -p calternal-plugin-files -- --test-threads=4:

test result: ok. 266 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 212.32s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 35s

cargo test -p calternal-plugin-notes -- --test-threads=4:

test result: ok. 314 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 415.01s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.04s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cd apps/web && bun run check:

perf-lint: PASS; 0 violations; 22548 scoped exceptions
svelte-check found 0 errors and 1 warning in 1 file

cd apps/web && bun run test --maxWorkers=2:

 Test Files  287 passed (287)
      Tests  2036 passed (2036)
   Duration  311.07s (environment 28%, transform 26%, import 23%, tests 17%, setup 5%)

Runner prerequisite: the first invocation stopped before starting a server because the fail-closed inventory lacked existing feature flag and Notifications mark-unread IDs. Added their resource classes and two regression cases. The Admin and fresh sign-in rules are unchanged. No existing test expectation changed.

The release binary was built from 5adc81b4ea; the following commits only add Python classifications/tests and shell runner diagnostics. Rust and web product code are unchanged.

Additional offline gates (verbatim):

Ran 19 tests in 0.410s
OK
Cross-User classification gate: 429 operations classified
Generated entry point classification: 1206 tools classified
Admin coverage: 53 reviewed operations; contract and Rust guards agree

Release build (verbatim):

    Finished `release` profile [optimized] target(s) in 82m 23s

The SSD fixture had 14 GiB available on a 591 GiB filesystem. Log creates correctly returned the storage-reserve 507, so no Daily note existed for inspection. Moved this job's lexical target/tmp to its HDD scratch directory, with 177 GiB available; the production reserve stayed enabled. HDD startup then exceeded the runner's default 60 s budget. Added an optional 1..600 half-second polling budget (default stays 120) and content-free startup diagnostics. This run selected 360 polls. Readiness still requires HTTP 200; API request deadlines and expectations are unchanged. bash -n tests/adversarial/run.sh exited 0 with no output.

Journal sync reliability check (local release server; summary lines only):

journalrace: 2021-03-14: 6 seeds, 40 creates answered 201, 0 timed out (0 of them landed), 3 uploads, 46 entries
server alive at end: True
==== ROUND 2 FINDINGS 7
==== ROUND 2 SLOW 1

The runner exited 1. All seven FINDINGS are labelled SLOW: sync clients had no response within 30 s. The separate SLOW footer counts one latency sample. There were no non-SLOW findings, duplicate paragraphs, duplicate entry IDs, lost acknowledged creates or damaged lines. All 46 Log entries were present; three sync uploads completed. Seven uploads exceeded the client deadline, so their eventual completion is not proven by this check. Per the busy-host policy, no repeat round was run after that SLOW-only result.

UX gaps left: prior duplicates need a separate repair action. Legacy unsealed install intents are still rejected when their current hash differs from the recorded upload hash; they need review and can prevent startup recovery. No older build can supply the new failure witness retroactively. This job prevents new retry duplicates and preserves later edits.

Legacy follow-up filed: #1325, Legacy Note upload intents with later edits cannot recover after restart.

Cleanup complete: cargo clean output (verbatim):

     Removed 25604 files, 14.7GiB total

Removed /mnt/hdd/targets/journaldup, apps/web/build and apps/web/.svelte-kit; restored an empty normal target/tmp directory. No server remains running. Working tree is clean. No push or deploy was done.

# #1295 — Daily note sync retry publication Built: browser and daemon upload retries keep the durable tus ID after an ambiguous final PATCH. Files finalization keeps the namespace and Notes writer through publication, even when the HTTP request is dropped. Applied-upload proof survives an Index-busy failure, later Log edits and startup recovery. Retry publishes the current revision and does not reinstall the old snapshot. Staging cleanup follows upload-row retirement. Files: apps/web/src/lib/files/uploads.svelte.ts and uploads.svelte.test.ts; crates/calternal-sync/src/remote.rs and transfer.rs; crates/plugins/files/src/lib.rs and uploads.rs; crates/plugins/notes/src/lib.rs; contracts/perf/exceptions.json; tests/adversarial/attack2.py, xuser_matrix.py, test_xuser_classification.py and run.sh. Regression evidence: journal_upload_retry_keeps_later_note_edits forces a real SQLite writer reservation after the source rename, confirms the initial 503 applied bytes, edits the Note, and retries the same tus ID. Exact job/merge31 uploads.rs fails with 500 instead of 204. Production ff53d7b8b4da5a21f862d57dcc3496f8c019f647 has the same late-precondition and hash-mismatch recovery paths, so it has the same bug. New tests also cover startup recovery, writer exclusion and dropped-request/concurrent-retry ownership. No existing test expectations, workloads or deadlines were changed. A storm-test cleanup defect was fixed: timeout cleanup previously joined the watcher twice and masked the timeout with a panic. UX gaps closed: full-offset browser retries finalize the original upload; later Log edits remain intact; dropped requests keep writer ownership until publication ends. Existing UploadQueue is reused; no new visible controls or styles. Decisions: use a bounded server-only staging witness on publication failure, with no new schema or dependency and no extra healthy-path fsync. Move only finalization into an owned server task; admission stays cancellable and each upload ID owns at most one such task. Retain conservative recovery when a legacy intent has no applied proof. Refresh only the exact existing performance source pin, without widening a rule. Minimal public addition: Notes reexports its existing `note_path` validator so Files selects the same supported Note paths for writer coordination. No new parsing rule was added. Expected cost: existing O(bytes) staging/hash work per upload, O(1) finalization task and metadata per admitted ID; failure-only small witness write. No per-request Home scan. No benchmark was run because the verification policy reserves performance measurements for performance issues. Known gaps: existing duplicate paragraphs are not rewritten automatically, to avoid removing User content. Legacy unsealed ambiguous intents remain conservative. Notes has four existing ignored optional tests; Files has four existing ignored optional tests. Web check reports one existing empty CSS rule warning in AttachmentDeck.svelte. No new UI surface requires screenshots. For the merge round: `cargo fmt --check`, `cargo clippy --all-targets -- -D warnings`, and `cargo test -- --test-threads=4` must verify the combined branch. `cd apps/web && bun run test:e2e:notes` must check Note and Log flows on that build. `tests/adversarial/run.sh` must check the combined API, cross-User and authorization matrices. This job runs its own required Journal sync reliability check on its local release server. Head SHA: 777730599b7752c1195530c35d962e1df077fa36 Gates (verbatim summary output; all commands exited 0): `cargo fmt --check`: no output. `cargo clippy -p calternal-sync --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 24s ``` `cargo test -p calternal-sync -- --test-threads=4`: ```text test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.09s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-plugin-files --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 44.56s ``` `cargo test -p calternal-plugin-files -- --test-threads=4`: ```text test result: ok. 266 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 212.32s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings`: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 35s ``` `cargo test -p calternal-plugin-notes -- --test-threads=4`: ```text test result: ok. 314 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 415.01s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.04s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cd apps/web && bun run check`: ```text perf-lint: PASS; 0 violations; 22548 scoped exceptions svelte-check found 0 errors and 1 warning in 1 file ``` `cd apps/web && bun run test --maxWorkers=2`: ```text Test Files 287 passed (287) Tests 2036 passed (2036) Duration 311.07s (environment 28%, transform 26%, import 23%, tests 17%, setup 5%) ``` Runner prerequisite: the first invocation stopped before starting a server because the fail-closed inventory lacked existing feature flag and Notifications mark-unread IDs. Added their resource classes and two regression cases. The Admin and fresh sign-in rules are unchanged. No existing test expectation changed. The release binary was built from 5adc81b4ead11c29738a602415a8456484d4b830; the following commits only add Python classifications/tests and shell runner diagnostics. Rust and web product code are unchanged. Additional offline gates (verbatim): ```text Ran 19 tests in 0.410s OK Cross-User classification gate: 429 operations classified Generated entry point classification: 1206 tools classified Admin coverage: 53 reviewed operations; contract and Rust guards agree ``` Release build (verbatim): ```text Finished `release` profile [optimized] target(s) in 82m 23s ``` The SSD fixture had 14 GiB available on a 591 GiB filesystem. Log creates correctly returned the storage-reserve 507, so no Daily note existed for inspection. Moved this job's lexical `target/tmp` to its HDD scratch directory, with 177 GiB available; the production reserve stayed enabled. HDD startup then exceeded the runner's default 60 s budget. Added an optional 1..600 half-second polling budget (default stays 120) and content-free startup diagnostics. This run selected 360 polls. Readiness still requires HTTP 200; API request deadlines and expectations are unchanged. `bash -n tests/adversarial/run.sh` exited 0 with no output. Journal sync reliability check (local release server; summary lines only): ```text journalrace: 2021-03-14: 6 seeds, 40 creates answered 201, 0 timed out (0 of them landed), 3 uploads, 46 entries server alive at end: True ==== ROUND 2 FINDINGS 7 ==== ROUND 2 SLOW 1 ``` The runner exited 1. All seven FINDINGS are labelled SLOW: sync clients had no response within 30 s. The separate SLOW footer counts one latency sample. There were no non-SLOW findings, duplicate paragraphs, duplicate entry IDs, lost acknowledged creates or damaged lines. All 46 Log entries were present; three sync uploads completed. Seven uploads exceeded the client deadline, so their eventual completion is not proven by this check. Per the busy-host policy, no repeat round was run after that SLOW-only result. UX gaps left: prior duplicates need a separate repair action. Legacy unsealed install intents are still rejected when their current hash differs from the recorded upload hash; they need review and can prevent startup recovery. No older build can supply the new failure witness retroactively. This job prevents new retry duplicates and preserves later edits. Legacy follow-up filed: [#1325](https://git.kayg.org/kayg/calternal/issues/1325), Legacy Note upload intents with later edits cannot recover after restart. Cleanup complete: `cargo clean` output (verbatim): ```text Removed 25604 files, 14.7GiB total ``` Removed `/mnt/hdd/targets/journaldup`, `apps/web/build` and `apps/web/.svelte-kit`; restored an empty normal `target/tmp` directory. No server remains running. Working tree is clean. No push or deploy was done.

kayg referenced this issue 2026-10-07 06:43:17 +00:00

Journal: sync retry after 503 duplicates paragraphs #1295

kayg commented 2026-10-07 07:44:25 +00:00

Author

Owner

Copy link

Starting #1202 on job/deploy-c1. Candidate head: 0419170fe456b58614befcb12d9c9d255118f1c0; base SHA (merge-base with origin/dev): 3601719b80a39f712daf07b37879b22929dfffa0. I will run the round 31 checks from the job brief against this pinned candidate and record results in artifacts/adv-c1/results.md.

Starting #1202 on `job/deploy-c1`. Candidate head: `0419170fe456b58614befcb12d9c9d255118f1c0`; base SHA (merge-base with `origin/dev`): `3601719b80a39f712daf07b37879b22929dfffa0`. I will run the round 31 checks from the job brief against this pinned candidate and record results in `artifacts/adv-c1/results.md`.

kayg commented 2026-10-07 07:47:38 +00:00

Author

Owner

Copy link

Finding: the existing #1153 probeHideProtocols asserts that owner WebDAV PROPFIND contains keep.txt and keep.png after Hide, and that the hidden Note remains reachable by its path (tests/adversarial/reliability_1202.mjs, around lines 413–437). This is the opposite of the requested no-name-in-PROPFIND check. The runtime assertion is missing; I am adding only that check to the existing probe. No product code has changed.

Finding: the existing #1153 `probeHideProtocols` asserts that owner WebDAV PROPFIND contains `keep.txt` and `keep.png` after Hide, and that the hidden Note remains reachable by its path (`tests/adversarial/reliability_1202.mjs`, around lines 413–437). This is the opposite of the requested no-name-in-PROPFIND check. The runtime assertion is missing; I am adding only that check to the existing probe. No product code has changed.

kayg commented 2026-10-07 08:25:41 +00:00

Author

Owner

Copy link

adv-c1 final report — DEPLOY-BLOCK

Candidate branch job/deploy-c1; HEAD 0419170fe456b58614befcb12d9c9d255118f1c0 (base 3601719b80a39f712daf07b37879b22929dfffa0).

Check	Result	Evidence
Production web build	PASS	✓ 5982 modules transformed.; ✓ 8953 modules transformed.; Compressed 917 static variants; saved 21487184 bytes.
Release server build	PASS	Finished \release` profile [optimized] target(s) in 30m 42s`
#1153 Hide name in owner WebDAV PROPFIND	FAIL — blocker	The real release server returned HTTP 207; listing.text.includes('keep.txt') was true after Hide=true. The added assertion stopped at tests/adversarial/reliability_1202.mjs:418 with hidden File name "keep.txt" appeared in owner WebDAV PROPFIND (HTTP 207).
Journalrace	NOT RUN	Stopped after the first required failure; #1295 duplicate count not measured.
Cross-User and authorization matrices	NOT RUN	Stopped after the first required failure.
#1197 real-browser SIGKILL recovery	NOT RUN	Stopped after the first required failure.
bash tests/adversarial/run-split.sh	NOT RUN	Stopped after the first required failure.

The job’s stop rule was followed. No product code changed. The existing Hide probe asserted the opposite WebDAV behavior, so I added only the missing no-name assertion to that probe. It remains a worktree-only test change; candidate HEAD is unchanged.

The runner stopped the server. Cleanup removed the disposable Data directory, Cargo target output, and web build output. cargo clean output: Removed 9263 files, 3.4GiB total.

Decision: the shell supplied CARGO_TARGET_DIR=/home/kayg/build/targets/adv-c1, while the prompt described /mnt/hdd/targets/jobs/adv-c1. I kept the supplied variable unchanged and placed disposable server Data under /mnt/hdd/targets/jobs/adv-c1/data.

Full run log: artifacts/adv-c1/results.md.

## adv-c1 final report — DEPLOY-BLOCK Candidate branch `job/deploy-c1`; HEAD `0419170fe456b58614befcb12d9c9d255118f1c0` (base `3601719b80a39f712daf07b37879b22929dfffa0`). | Check | Result | Evidence | | --- | --- | --- | | Production web build | PASS | `✓ 5982 modules transformed.`; `✓ 8953 modules transformed.`; `Compressed 917 static variants; saved 21487184 bytes.` | | Release server build | PASS | `Finished \`release\` profile [optimized] target(s) in 30m 42s` | | #1153 Hide name in owner WebDAV PROPFIND | FAIL — blocker | The real release server returned HTTP `207`; `listing.text.includes('keep.txt')` was true after Hide=true. The added assertion stopped at `tests/adversarial/reliability_1202.mjs:418` with `hidden File name "keep.txt" appeared in owner WebDAV PROPFIND (HTTP 207)`. | | Journalrace | NOT RUN | Stopped after the first required failure; #1295 duplicate count not measured. | | Cross-User and authorization matrices | NOT RUN | Stopped after the first required failure. | | #1197 real-browser SIGKILL recovery | NOT RUN | Stopped after the first required failure. | | `bash tests/adversarial/run-split.sh` | NOT RUN | Stopped after the first required failure. | The job’s stop rule was followed. No product code changed. The existing Hide probe asserted the opposite WebDAV behavior, so I added only the missing no-name assertion to that probe. It remains a worktree-only test change; candidate HEAD is unchanged. The runner stopped the server. Cleanup removed the disposable Data directory, Cargo target output, and web build output. `cargo clean` output: `Removed 9263 files, 3.4GiB total`. Decision: the shell supplied `CARGO_TARGET_DIR=/home/kayg/build/targets/adv-c1`, while the prompt described `/mnt/hdd/targets/jobs/adv-c1`. I kept the supplied variable unchanged and placed disposable server Data under `/mnt/hdd/targets/jobs/adv-c1/data`. Full run log: `artifacts/adv-c1/results.md`.

kayg commented 2026-10-07 08:26:59 +00:00

Author

Owner

Copy link

Correction/addendum to the final report: the missing no-name assertion in tests/adversarial/reliability_1202.mjs is now committed as 3c2cbaa7c (test(adversarial): catch hidden names in WebDAV after Hide). The release server that exposed the leak was built from the pinned product candidate 0419170fe456b58614befcb12d9c9d255118f1c0; the new commit only adds the failing adversarial assertion. Current branch HEAD is 3c2cbaa7c. DEPLOY-BLOCK remains. No product code changed and no push, deploy or merge was performed.

Correction/addendum to the final report: the missing no-name assertion in `tests/adversarial/reliability_1202.mjs` is now committed as `3c2cbaa7c` (`test(adversarial): catch hidden names in WebDAV after Hide`). The release server that exposed the leak was built from the pinned product candidate `0419170fe456b58614befcb12d9c9d255118f1c0`; the new commit only adds the failing adversarial assertion. Current branch HEAD is `3c2cbaa7c`. DEPLOY-BLOCK remains. No product code changed and no push, deploy or merge was performed.

kayg commented 2026-10-07 08:28:05 +00:00

Author

Owner

Copy link

One test-contract note for the follow-up: the existing assertion immediately after the new guard in probeHideProtocols still expects both keep.txt and keep.png in the PROPFIND response. I left it unchanged after the first runtime failure, per the stop rule. A product fix for the requested no-name behavior must reconcile that old expectation.

One test-contract note for the follow-up: the existing assertion immediately after the new guard in `probeHideProtocols` still expects both `keep.txt` and `keep.png` in the PROPFIND response. I left it unchanged after the first runtime failure, per the stop rule. A product fix for the requested no-name behavior must reconcile that old expectation.

kayg commented 2026-10-07 08:29:13 +00:00

Author

Owner

Copy link

Orchestrator correction on the adv-c1 DEPLOY-BLOCK: the failed check came from a wrong requirement in my brief. DESIGN (Hide, #1153): 'Hiding changes presentation, not access' and 'the owner's file and other Users' views do not change'. The owner's own WebDAV PROPFIND must keep listing a hidden file (a sync client would otherwise treat it as deleted and remove the local copy); the existing probe assertion 'DAV retains hidden content' is correct. Test commit 3c2cbaa7c dropped; candidate stays 0419170fe. Remaining checks are being rerun (adv-c2).

Orchestrator correction on the adv-c1 DEPLOY-BLOCK: the failed check came from a wrong requirement in my brief. DESIGN (Hide, #1153): 'Hiding changes presentation, not access' and 'the owner's file and other Users' views do not change'. The owner's own WebDAV PROPFIND must keep listing a hidden file (a sync client would otherwise treat it as deleted and remove the local copy); the existing probe assertion 'DAV retains hidden content' is correct. Test commit 3c2cbaa7c dropped; candidate stays 0419170fe. Remaining checks are being rerun (adv-c2).

kayg commented 2026-10-07 08:30:33 +00:00

Author

Owner

Copy link

Starting adv-c2 for #1202 on job/deploy-c1. Candidate HEAD: 0419170fe456b58614befcb12d9c9d255118f1c0; merge-base with origin/dev: 3601719b80a39f712daf07b37879b22929dfffa0. I read the correction: Hide changes presentation only; the owner's WebDAV view still lists the hidden item. I will verify the corrected Hide contract, dot-name share/public-link probes, journalrace, cross-User matrices and restart safety against this pinned candidate, recording each result in artifacts/adv-c2/results.md. No product code changes.

Starting adv-c2 for #1202 on `job/deploy-c1`. Candidate HEAD: `0419170fe456b58614befcb12d9c9d255118f1c0`; merge-base with `origin/dev`: `3601719b80a39f712daf07b37879b22929dfffa0`. I read the correction: Hide changes presentation only; the owner's WebDAV view still lists the hidden item. I will verify the corrected Hide contract, dot-name share/public-link probes, journalrace, cross-User matrices and restart safety against this pinned candidate, recording each result in `artifacts/adv-c2/results.md`. No product code changes.

kayg commented 2026-10-07 09:58:35 +00:00

Author

Owner

Copy link

adv-c2 final report — DEPLOY-OK

Candidate branch: job/deploy-c1
Candidate HEAD: 0419170fe456b58614befcb12d9c9d255118f1c0
Merge-base with origin/dev: 3601719b80a39f712daf07b37879b22929dfffa0

Check	Result	Evidence
Production web build	PASS	bun run build exited 0; Compressed 917 static variants; saved 21487268 bytes.
Release server build	PASS	cargo build --release -p calternal-server exited 0; Finished \release` profile [optimized] target(s) in 37m 56s`.
Hide presentation and protocol contract	PASS	Unchanged reliability_1202.mjs Hide probe passed. It confirmed the owner's hidden Files remain listed and readable through WebDAV, with CalDAV views preserved. A supplemental live Playwright check confirmed a Hide-marked Note is absent from the default Notes list and Search, and appears in both with show_hidden=true.
Dot-name Share and Public link views	PASS	share-options and search_hidden completed with ==== ROUND 2 FINDINGS 0 and ==== ROUND 2 SLOW 0; the dot-name Share/Public link probe ran listing, unfurl, thumbnail, item= and file-drop cases.
Journalrace	PASS	journalrace: 2021-03-14: 6 seeds, 40 creates answered 201, 0 timed out (0 of them landed), 7 uploads, 46 entries. Zero duplicate lines, duplicate IDs, lost acknowledged creates or damaged lines. Known #1295 duplicate count this round: 0.
Cross-User isolation	PASS	203 operations replayed; 938 owned-ID/missing-ID comparisons across B, C, D and anonymous; 117 Job/Mail/quota ownership comparisons; 0 denial failures.
Authorization matrix	PASS	429 OpenAPI operations; 3,036 requests across four identities plus invalid/stale sessions and 21 App Password scope classes; no !! denial failures.
#1197 real-browser SIGKILL recovery	PASS, with one gap	Playwright killed the server after a durable history append; replaying the real browser's original-epoch edit saved it to the original Note. Output: PASS abrupt: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x. The existing scenario does not assert automatic same-tab reconnect or count reloads.
Optional bash tests/adversarial/run-split.sh	NOT RUN	Required focused checks completed within the 90-minute window.

Verdict: DEPLOY-OK — no crash, lost acknowledged create, damaged Log, cross-User read/write, authorization failure, or unexpected sync duplicate was found. The same-tab reconnect/reload-loop behavior remains unverified.

Cleanup

cargo clean exited 0: Removed 11740 files, 4.7GiB total. Removed the disposable Data root, assigned Cargo target, target/tmp, apps/web/build, and apps/web/.svelte-kit. Worktree is clean; HEAD remains 0419170fe456b58614befcb12d9c9d255118f1c0. No product code changed. No merge, push, or deploy was performed.

Full run evidence is in artifacts/adv-c2/results.md in this worktree.

## adv-c2 final report — DEPLOY-OK Candidate branch: `job/deploy-c1` Candidate HEAD: `0419170fe456b58614befcb12d9c9d255118f1c0` Merge-base with `origin/dev`: `3601719b80a39f712daf07b37879b22929dfffa0` | Check | Result | Evidence | | --- | --- | --- | | Production web build | PASS | `bun run build` exited 0; `Compressed 917 static variants; saved 21487268 bytes.` | | Release server build | PASS | `cargo build --release -p calternal-server` exited 0; `Finished \`release\` profile [optimized] target(s) in 37m 56s`. | | Hide presentation and protocol contract | PASS | Unchanged `reliability_1202.mjs` Hide probe passed. It confirmed the owner's hidden Files remain listed and readable through WebDAV, with CalDAV views preserved. A supplemental live Playwright check confirmed a Hide-marked Note is absent from the default Notes list and Search, and appears in both with `show_hidden=true`. | | Dot-name Share and Public link views | PASS | `share-options` and `search_hidden` completed with `==== ROUND 2 FINDINGS 0` and `==== ROUND 2 SLOW 0`; the dot-name Share/Public link probe ran listing, unfurl, thumbnail, `item=` and file-drop cases. | | Journalrace | PASS | `journalrace: 2021-03-14: 6 seeds, 40 creates answered 201, 0 timed out (0 of them landed), 7 uploads, 46 entries`. Zero duplicate lines, duplicate IDs, lost acknowledged creates or damaged lines. Known #1295 duplicate count this round: 0. | | Cross-User isolation | PASS | 203 operations replayed; 938 owned-ID/missing-ID comparisons across B, C, D and anonymous; 117 Job/Mail/quota ownership comparisons; 0 denial failures. | | Authorization matrix | PASS | 429 OpenAPI operations; 3,036 requests across four identities plus invalid/stale sessions and 21 App Password scope classes; no `!!` denial failures. | | #1197 real-browser SIGKILL recovery | PASS, with one gap | Playwright killed the server after a durable history append; replaying the real browser's original-epoch edit saved it to the original Note. Output: `PASS abrupt: original-epoch delayed browser edit saved; original Note; 6 macOS screenshots at 1x`. The existing scenario does not assert automatic same-tab reconnect or count reloads. | | Optional `bash tests/adversarial/run-split.sh` | NOT RUN | Required focused checks completed within the 90-minute window. | **Verdict: DEPLOY-OK** — no crash, lost acknowledged create, damaged Log, cross-User read/write, authorization failure, or unexpected sync duplicate was found. The same-tab reconnect/reload-loop behavior remains unverified. ## Cleanup `cargo clean` exited 0: `Removed 11740 files, 4.7GiB total`. Removed the disposable Data root, assigned Cargo target, `target/tmp`, `apps/web/build`, and `apps/web/.svelte-kit`. Worktree is clean; HEAD remains `0419170fe456b58614befcb12d9c9d255118f1c0`. No product code changed. No merge, push, or deploy was performed. Full run evidence is in `artifacts/adv-c2/results.md` in this worktree.

kayg referenced this issue 2026-10-07 15:19:41 +00:00

Merged feature-key classification tests require incompatible names #1350

kayg referenced this issue 2026-10-07 15:58:38 +00:00

Search: footer band and top blur are back (regression of the floating action Pills decision) #1360

Commenting is not possible because the repository is archived.

No Branch/Tag specified

Branches Tags

dev

wip/cards2-1083

wip/cards-1083

wip/canvas-visual

wip/canvasvis2-976

wip/calhdr-1112

wip/blocks-1125

wip/allday-1107

wip/agenda-1086

wip/trayicons2-1095

wip/trayicons-1095

wip/sidebar3-1094

wip/previewcard-1098

wip/palette2-1123

wip/palette-1093

wip/nlpchip-1127

wip/mchrome-1084

wip/mailghost2-1094

wip/mailghost-1094

wip/kbpreview2-1118

wip/kbpreview-1118

wip/kanban-1092

wip/editreg-1132

wip/editorrail3-1113

wip/editorrail2-1113

wip/editorrail-1113

wip/draw4-1101

wip/draw3-1101

wip/draw2-1101

wip/draw-1101

wip/delete-1119

job/txentry-1198

job/rev1586

job/rev2-money-ident

job/rev2-webperf

job/morph-1104

job/previewcard-1098

job/importhang-1121

job/kanban-1092

job/merge-round-7b

job/merge-round-7c

job/calcards-1115

job/collabrev3-1197

job/e2e-b-1071

job/agenda-1086

job/agenda-decks

job/allday-1107

job/browserfix

job/calact9

job/adv7c-1105

wip/collabrev3-1197

wip/calcards-1115

wip/calact9

wip/calact10

wip/browserfix

wip/agenda-decks

wip/adv7c-1105

wip/txentry-1198

wip/rev2-webperf

wip/rev2-money-ident

wip/rev1586

wip/morph-1104

wip/merge-round-7c5

wip/merge-round-7c4

wip/merge-round-7c3

wip/merge-round-7c2

wip/merge-round-7c

wip/importhang-1121

wip/fix1586

wip/e2e-b2-1071

wip/e2e-b-1071

job/noncanon-1618

wip/noncanon-1618

job/edrevert-1616

job/partial-1605

wip/partial-1605

job/calact6

job/cold-1586

job/perfvm-1587

wip/cold-1586

job/cal404-1581

wip/calact6

wip/cal404-1581

job/dname-1584

wip/dname-1584

job/merge41

wip/merge41b

wip/merge41

job/rev1573c

job/hscroll-1579

wip/rev1573c

job/rev1573b

job/rev1573

wip/fix1573

wip/hscroll2

wip/hscroll-1579

job/rev1574

wip/fix1574

wip/rev1574

job/startup-1573c

job/merge40

wip/startup-1573d

wip/startup-1573c

job/calact5

wip/remtext2

wip/merge40c

wip/merge40b

wip/merge40

job/calact4

job/startup-1573

job/calprof

wip/calprof

wip/startup-1573

job/fs1575

job/fix1570

job/calact3

job/rec1540c

wip/fix1570

job/rev1570-review

wip/calact3

job/calact2

wip/calact2

job/calcold-1560

wip/calcold-1560

wip/rec1540c

job/fix1569

wip/fix1569

job/calact-1557

wip/calact-1557

job/remtext-1568

wip/remtext-1568

job/fix1566

wip/fix1566

job/rec1540b

job/reconcile-1540

job/money2rev

wip/money2rev

job/merge39

wip/merge39

wip/reconcile-1540

job/tabswitch2

job/merge38

wip/merge38

job/autherr-1553

wip/autherr-1553

job/money-688

wip/money688rev3

wip/money688rev2

wip/money688rev

wip/money688l

wip/money688k

wip/money688j

wip/money688i

wip/money688h

wip/money688g

wip/money688f

wip/money688e

wip/money688d

wip/money688c

wip/money688b

wip/money-688

wip/tabswitch2

wip/merge37

job/merge37

job/jobnames-1538

wip/jobnames-1538

job/tabcomp-perf

job/calscript-1492

wip/tabcomp-perf

wip/calscript-1492

job/mailbody-1533

wip/mailbody-1533

job/intlfmt-1461

job/merge36

wip/intlfmt2

wip/intlfmt-1461

wip/merge36

job/merge35c

job/tagperf-1186

wip/tagrev2

wip/tagrev

wip/tagperf4

wip/tagperf2-1186

wip/tagperf-1186

wip/tagfix5

wip/tagfix3

wip/tagfast2

wip/tagfast

wip/merge35c

job/notesel-1493

wip/notesel2

wip/notesel-1493

job/merge35b

wip/merge35b

wip/m35btriage

wip/m35bratchet

wip/calsel-1491

job/calsel-1491

job/notifread-1387

job/bulkwrite-1393

wip/notifread2

wip/notifread-1387

job/slowsel-1392

wip/bulkwrite-1393

wip/bulkrev4

wip/bulkrev3

wip/bulkrev2

wip/bulkrev

wip/bulkfix4

wip/bulkfix3

wip/bulkfix2

wip/bulkfix

job/mail7-1340

job/bigscroll-1481

job/searchperf-1425

wip/mailrev4

wip/mailrev3

wip/mailrev2

wip/mailrev

wip/mail7f

wip/mail7e

wip/mail7d

wip/searchperf2

wip/searchperf-1425

wip/mail7c

wip/mail7b

wip/mail7-1340

job/photoopen-1367

job/mailsel-1449

wip/bigscroll-1481

wip/slowsel3

wip/slowsel2

wip/slowsel-1392

wip/selroot

job/journaldup

wip/journaldup8

wip/journaldup7

wip/journaldup6

wip/journaldup5

wip/journaldup4

wip/journaldup3

wip/journaldup2

wip/journaldup

wip/jdrev5

wip/jdrev4

wip/jdrev3

wip/jdrev2

wip/jdrev

wip/jdfix9

job/bignote-1349

wip/mailsel-1449

wip/bignote3

wip/bignote2

wip/bignote-1349

job/statusmark-1457

wip/statusmark-1457

wip/photoopen4

wip/photoopen3

wip/photoopen2

wip/photoopen-1367

job/authflash-1473

job/merge35

wip/authflash-1473

job/phototags-1370

wip/phototags-1370

wip/merge35

wip/m35triage

job/tick-1446

wip/tick-1446

job/restartidx-1450

job/exmove-1333

job/coldnote-1451

wip/restartidx-1450

wip/exmove-1333

wip/coldnote-1451

job/undo412-1430

wip/undo412-1430

job/calwrite-1441

job/xcancel-1443

job/calscroll-1362

wip/xcancel-1443

wip/calwrite-1441

job/xsub-1445

wip/calscroll3

wip/calscroll2

wip/calscroll-1362

wip/xsub-1445

job/linkdup-1440

wip/linkdup2

wip/linkdup-1440

wip/tabswitch4

wip/tabswitch3

wip/tabswitch-1233

wip/navrev

job/tabswitch-1233

job/mdpaste-1431

job/taskundo-1433

job/directory-1199

wip/taskundo-1433

job/remind-1432

job/nfd-1411

wip/remind-1432

wip/dirfix4

wip/dirfix3

wip/dirfix2

wip/dirfix-1199

wip/directory-1199-r

wip/directory-1199

job/readerx-1427

wip/readerx-1427

job/scrollfade-1416

job/tipphone-1439

wip/nfd-1411

job/purge-1420

job/notifrow-1414

wip/purge-1420

wip/notifrow-1414

job/slop-1385

wip/slop2

wip/slop-1385

job/tbover-1409

job/qltitle-1408

job/grantlive-1405

job/taskclick-1434

wip/tbover-1409

wip/taskclick-1434

wip/qltitle-1408

job/scrub-1422

job/hotfix35

job/ticks-1361

wip/scrub-1422

job/taskprev-1401

wip/grantlive-1405

job/ghost-1323

wip/ticks3

wip/ticks2

wip/ticks-1361

wip/taskprev-1401

job/bash3-settings

wip/ghost-1323

job/mailmorph-1368

wip/bash3-settings

job/apiaudit-1374

wip/bash3-filesphotos

job/bash3-filesphotos

job/xuser39-1402

job/bash3-money

job/mailhtml-1372

wip/mailhtml2

wip/mailhtml-1372

job/bash3-interop

job/bash3-calendar

wip/bash3-money

wip/bash3-interop

wip/bash3-calendar

wip/mailmorph2

wip/mailmorph-1368

wip/bash3-tasks

job/outro-1391

job/linkpick-1379

job/linkdel-1384

wip/linkpick2

wip/linkpick-1379

wip/linkdel3

wip/linkdel2

wip/linkdel-1384

job/mailrows-1390

wip/mailrows-1390

wip/apiaudit2

wip/apiaudit-1374

job/bash-core

wip/outro-1391

wip/bash-core2

wip/bash-core

job/bash3-notes

job/bash3-tasks

job/merge34

job/notifdel-1363

wip/merge34

wip/notifdel2

wip/notifdel-1363

job/wklink-1371

wip/wklink-1371

job/searchbar-1360

wip/searchbar2

wip/searchbar-1360

job/merge33-1122

wip/merge33c

wip/merge33b

wip/merge33-1122

job/bash-security

job/mailglass-1373

wip/bash-security2

wip/bash-security

wip/mailglass-1373

job/instaudit-1369

wip/instaudit-1369

job/tabstorm-1338

wip/tabstorm2

wip/tabstorm-1338

wip/bash-files2

wip/bash-files

job/bash-files

job/bash-money

job/editfuzz-1335

wip/bash-money

wip/moneyrev

job/tasksperf-1286

wip/tasksperf3

wip/tasksperf2

wip/tasksperf-1286

wip/editfuzz2

wip/editfuzz-1335

review/dirrev-1199

job/merge32

wip/merge32b

wip/merge32

job/bash-chrome

job/tagdnd-1187

job/bash-notes

wip/bash-notes2

wip/bash-notes

wip/bash-chrome

wip/reconcile-c1

wip/adv-c1

wip/tagdnd2-1187

wip/tagdnd-1187

job/bash-calendar

job/deploy-c1

job/editbreak-1334

job/bash-perf

wip/bash-calendar2

wip/bash-calendar

wip/bash-perf

job/hunt-20261006

job/bash-interop

job/collabloss-1197

wip/collabrev-1197

wip/collabloss5-1197

wip/collabloss4-1197

wip/collabloss3-1197

wip/collabloss2-1197

wip/collabloss-1197

wip/bash-interop

job/bash-mail

wip/bash-mail

job/vis-1293

wip/vis-1293

wip/restyle-search-r

wip/restyle-search-fix2

wip/restyle-search-fix

wip/restyle-search

job/restyle-settings

job/restyle-search

wip/restyle-settings-fix

wip/restyle-settings

job/adv31

wip/advfix-a

wip/adv31

job/bash-tasks

wip/bash-tasks

job/restyle-files

wip/restyle-files-fix

wip/restyle-files

job/fmtbar-1210

wip/fmtbar2-1210

wip/fmtbar-1210

job/perf2-1124

wip/perf2-1124

job/proflog-1204

job/merge31

wip/restyle-notes

wip/merge31

wip/proflog-1204

job/restyle-notes

job/fix-1213

wip/fix-1213

job/hide-1153

job/restyle-mailmoney

job/notestatus-1209

wip/hide-1153

wip/hiderev2-1153

wip/hiderev-1153

wip/hide5-1153

wip/hide4-1153

wip/hide3-1153

wip/hide2-1153

job/sidebarblur-1208

wip/notestatus-1209

wip/sidebarblur-1208

wip/restyle-mailmoney

job/onboard-1141

wip/onboard2-1141

wip/onboard-1141.aborted-early

wip/onboard-1141

job/adv-1202

job/segmented-1200

wip/segmented-1200

job/merge30

job/notifloop-1194

job/toastmorph-1201

wip/notifloop-1194

job/perf-1124

job/tocrail-1191

job/cards-1179

wip/cards2-1179

wip/cards-1179

wip/tocrail-1191

wip/perf-1124

wip/merge30j

job/wizchoices-1140

wip/wizchoices-1140

wip/restyle-1190

job/moneyfmt-1180

wip/moneyfmt2-1180

wip/moneyfmt-1180-r

wip/moneyfmt-1180

job/pillglass-1189

job/flags-1181

wip/flags-1181

job/restyle-1190

job/settingsreg-1195

job/wizard-1140

site/website

wip/wizardrev2-1140

wip/wizardrev-1140

wip/wizard5-1140

wip/wizard4-1140

wip/wizard3-1140

wip/wizard2-1140

wip/wizard-1140

wip/pillglass-1189

wip/settingsreg-1195

job/merge29

job/fu-1171

wip/merge29j

wip/fu-1171

job/fu-1166

job/txresearch-1188

wip/fu-1166

job/merge28

job/search-1066

wip/search-1066

wip/merge28j

job/gateslot-1182

job/bulkimport-1157

job/mailnet-1160

wip/mailnetrev-1160

wip/mailnet-1160

wip/bulkrev-1157

wip/bulkimport-1157

job/startup-1161

wip/startup-1161

job/merge27

job/linkcards-1151

wip/linkcards3-1151

wip/linkcards2-1151

wip/linkcards-1151

job/traydate-1144

wip/traydate3-1144

wip/traydate2-1144

wip/traydate-1144

job/draw-1101

wip/merge27j

job/blockpill-1152

wip/blockpill3-1152

wip/blockpill2-1152

wip/blockpill-1152

job/minihover-1149

wip/minihover2-1149

wip/minihover-1149

job/merge25

wip/merge25-r

wip/merge25b

wip/merge25

job/inspector-1129

job/tags-1110

wip/inspector3-1129

wip/inspector2-1129

wip/inspector-1129

wip/tagsrev-1110

wip/tags2-1110

wip/tags-1110

job/dates-1148

wip/datesrev-1148

wip/dates2-1148

wip/dates-1148

job/licence-1145

wip/licence2-1145

wip/licence-1145

job/selfhost-1156

fixbatch-25

job/merge23

wip/merge23

job/tagfilter-1109

wip/tagfilter2-1109

wip/tagfilter-1109

job/kbd-1134

wip/kbd2-1134

wip/kbd-1134

job/palfoot-1137

wip/selfhost-1156

wip/palfoot2-1137

wip/palfoot-1137

job/toggle-1158

wip/toggle-1158

fixbatch-23

job/kbpreview-1118

job/docratchet-1155

job/perflint-1133

job/devtests-1159

wip/docratchet-1155

wip/devtests-1159

job/segv-1136

wip/toast-1142

wip/segv-1136

job/toast-1142

job/blockreload-1147

wip/blockreload-1147

job/font-1150

wip/font-1150

job/importui-1120

job/minimonth-1149

wip/importui-1120

wip/minimonth-1149

job/depcheck-1146

wip/perflint-1133

wip/depcheck-1146

job/blocks-1125

job/plus-1128

job/shift-1138

wip/plus2-1128

wip/plus-1128

wip/shift-1138

job/moneyfid-1130

job/editorrail-1113

wip/moneyrev-1130

wip/moneyfid-1130

job/noext-851

wip/noext-851

wip/noext3-851

wip/noext2-851

job/week-1135

wip/week-1135

job/editreg-1132

job/smoke-1122

wip/smoke-1122

job/docs-1143

job/palette2-1123

job/calhdr-1112

job/nlpchip-1127

job/mailghost-1094

job/reconnect-1131

wip/reconnect-1131

job/trayicons-1095

job/delete-1119

hotfix-sidebar2

job/cards-1083

job/palette-1093

job/mchrome-1084

job/e2e-a-1071

job/canvas-visual

wip/e2e-a2-1071

wip/e2e-a-1071

backup/canvas-visual-before-reconcile

wip/surfaces-p2

job/merge-round-9

wip/merge-round-9

job/7cfix-small

wip/7cfix-small

job/mailui-1078

job/merge-round-8

wip/merge-round-8

wip/mailui-1078

job/mailround-1038

job/applemail-accept

wip/settitle-1068

wip/mailround2-1038

wip/mailround-1038

wip/e2e-7b

job/crash-1069

wip/crash-1069

job/searchlost-1066

wip/searchlost-1066

job/7b-reconcile

job/flake-1065

wip/flake-1065

wip/merge-round-7b7

wip/merge-round-7b6

wip/merge-round-7b5

wip/merge-round-7b4

wip/7b-reconcile

job/appupdate-1059

job/nfd-1044

wip/appupdate-1059

job/e2e-7b

job/loop-1062

wip/loop-1062

job/pdfprev-1045

job/invtoggle-1053

wip/pdfprev-1045

wip/nfd-1044

wip/invtoggle-1053

job/7bfix-e2e

job/mailstress-b

wip/7bfix-e2e

wip/mailstress-b

job/7bfix-adv

wip/7bfix-adv

job/mailstress-a

job/stack-1054

wip/stack-1054

wip/mailstress-a

job/mailstress-1038

wip/mailstress-1038

job/upload500-1051

wip/upload500-1051

job/share-1034

wip/share-1034

job/syncerr-1037

job/7bfix-photos

wip/7bfix-photos

job/paste-1036

job/setside-1039

wip/setside-1039

wip/paste-1036

job/lease-1042

wip/syncerr-1037

wip/lease-1042

job/7bfix-data

job/passkeybind-1043

wip/apprevoke-1041

job/invite-1035

wip/invite-1035

job/merge-round-7b2

wip/merge-round-7b2

job/mailproxy-486

job/apprevoke-1041

job/rebuild-1033

job/pillborder-1029

wip/pillborder-1029

wip/mailproxy-486

wip/applemail-486

job/headless-998

wip/headless-998

job/groups-1028

wip/groups-1028

job/rebuildwarn-1016

wip/rebuildwarn-1016

job/startup-1011

wip/startup-1011

job/monthpill-1009

job/bgthumb-1025

job/sharetitle-1012

wip/monthpill-1009

wip/bgthumb-1025

wip/sharetitle-1012

job/canvas-cards-977

wip/canvas-cards-977

job/canvas-pencil-978

job/canvas-sketch-990

wip/canvas-sketch-990

wip/canvas-pencil-978

job/canvas-files-989

wip/canvas-files-989

job/canvas-collab-991

wip/canvas-collab-991

job/weekscroll-1018

wip/weekscroll-1018

wip/canvas-core-976

job/canvas-core-976

job/round-drag

wip/round-drag

job/round-settings

wip/oapi-974

job/oapi-974

job/hist2-integrate

job/mailhtml-726

wip/mailhtml-726

wip/hist2-integrate

job/moneyfu-984

job/drag-1015

wip/drag-1015

job/rename-1017

wip/rename-1017

job/hist2-api

wip/hist2-api

job/oneacct-1014

wip/oneacct-1014

wip/moneyfu-984

job/hist2-bench

job/hist2-restore

wip/hist2-bench

job/hist2-write

job/hotfix-724

wip/hotfix-724

wip/hist2-write

wip/hist2-restore

job/hist2-store

job/hist2-ui

wip/hist2-ui

wip/hist2-store

job/searchstarve-965

job/shutdown-963

wip/shutdown-963

wip/pubedit-981

job/pubedit-981

job/analytics-973

wip/searchstarve-965

job/authflash-850

job/weeklane-969

job/pvtitle-1004

job/hist-975

wip/authflash-850

job/voicepill-617

wip/pvtitle-1004

job/headring-1003

wip/weeklane-969

wip/voicepill-617

wip/headring-1003

wip/analytics-973

job/agentscope-980

wip/thumbsandbox-988

job/thumbsandbox-988

wip/hist-975

job/links-856

wip/links-856

job/davetag-966

wip/davetag-966

job/filesstorm-1000

job/hoverpad-725

wip/filesstorm-1000

job/ffmpegblas-993

job/merge-round-7a

wip/hoverpad-725

wip/ffmpegblas-993

job/nowdot-1002

wip/verify-7a

job/noteid-857

wip/nowdot-1002

wip/noteid-857

wip/merge-round-7a

wip/agentscope-980

job/imapedge

job/a11yfix2

wip/imapedge-941

wip/imapedge

wip/a11yfix2

job/notetask-986

job/logheading

wip/logheading-998

job/textthumb-652

job/photolive-987

wip/photolive-987

job/davactive-983

job/savefix-985

job/tabicons-607

wip/davactive-983

wip/tabicons-607

wip/notetask-986

wip/savefix-985

job/dirid-627

job/buildspeed-1007

wip/dirid-627

job/staging-imap

job/perfguards-impl

job/undo-a11y

wip/undo-a11y

job/mailperf

job/wal-824

wip/settings-50

job/settings-50

job/notesfilter-606

wip/notesfilter-606

job/surfaces-p2

wip/wal-824

job/maillayouts

wip/mailperf

wip/maillayouts

job/taskmeta-659

job/money-ident

wip/money-ident

wip/taskmeta-659

job/errstates

wip/perfguards-impl

job/headings-881

wip/headings-881

wip/errstates

job/voice-619

job/gaps-827

job/notesperf

wip/notesperf

wip/voice-619

job/hddsql-549

job/perf-stream-668

wip/perf-stream-668

wip/deeplinks-fix

job/deeplinks-fix

job/authfix

job/docsfix-rust

wip/docsfix-rust

job/webperf

job/docsfix-web

job/datafix2

job/webdav-lock-476

job/copyfix

wip/copyfix

wip/webperf

job/focus-658

wip/protofix

job/mediafix

job/protofix

wip/mediafix

job/agentfix

job/hhmm-724

wip/agentfix

job/undo-722

job/reuse

wip/webdav-lock-476

wip/reuse

job/scopefix

job/datafix

wip/hhmm-724

wip/undo-722

job/surfaces-p1

wip/hddsql-549

job/voicememos-618

wip/datafix2

wip/surfaces-p1

job/fix-940

wip/fix-940

job/blaze-surfaces

wip/datafix

wip/blaze-surfaces

job/taskday-655

job/linknav-639

wip/linknav-639

wip/gaps-827

job/isolation-707

job/audiophotos-720

wip/audiophotos-720

job/advfind-664

wip/voicememos-618

wip/taskday-655

wip/isolation-707

wip/advfind-664

wip/scopefix

wip/focus-658

job/testgaps

wip/testgaps

job/overscroll-718

wip/authfix

job/deps

wip/overscroll-718

job/rev2-agentfix

job/rev2-mailperf

wip/deps

job/hardening-728

wip/hardening-728

job/searchgen-832

wip/searchgen-832

job/photopw-849

job/mailsql-825

wip/photopw-849

job/sharefix

wip/sharefix

job/rev2-mailhtml-726

job/rev2-perfguards

job/copyval-723

job/lightglass-r2

wip/lightglass-r2

wip/docsfix-web

job/copy-audit

job/macinterop-staging-r2

job/design-sync

job/rev2-taskmeta-659

job/docs-audit

job/rev2-advfind-664

job/rev2-mailproxy-486

job/states-audit

job/rev2-datafix

job/design-drift

job/test-gaps

job/rev2-voicememos-618

job/rev2-mediafix

job/rev2-deps

job/rev2-datafix2

job/licence-audit

job/issue-hygiene

job/rev2-protofix

job/rev2-voice-619

job/rev2-isolation-707

job/rev2-surfaces-p1

job/deeplink-audit2

job/rev2-audiophotos-720

wip/test-gaps

job/rev2-overscroll-718

job/rev2-undo-722

wip/states-audit

job/rev2-dropmd-719

job/rev2-linknav-639

job/merge-7b-plan

wip/merge-7b-plan

job/rev2-taskday-655

wip/mailsql-825

job/rev2-webdav-lock-476

job/rev2-browserfix

wip/design-drift

job/rev2-hddsql-549

wip/deeplink-audit2

job/rev2-scopefix

job/rev2-authfix

job/rev2-hardening-728

job/rev2-wal-824

job/rev2-sharefix

job/calsidebar-638

job/chrome-audit

job/ioperf

wip/ioperf

wip/chrome-audit

wip/calsidebar-638

job/dropmd-719

wip/dropmd-719

job/ocr-build

wip/ocr-build

job/blaze-settings

wip/copyval-723

job/toastring-721

wip/toastring-721

job/deployfix-732

wip/deployfix-732

wip/blaze-settings

job/money-import-recheck

job/rev-a11y

job/perf-arch-db

job/rev-7b-data

wip/textthumb-652

wip/perf-arch-db

job/sec-protocols

job/sidehdr-660

job/rev-7b-security

job/research-surfaces

job/rev-design-gaps

job/rev-mcp-api

wip/sidehdr-660

job/perf-arch-memory

wip/sec-protocols

job/perf-arch-bundle

job/snapedge-714

wip/rev-mcp-api

job/sec-supplychain

wip/research-surfaces

job/perf-arch-sync

job/rev-consistency

job/perf-arch-server

wip/perf-arch-server

wip/perf-arch-memory

job/perf-arch-io

job/perf-arch-client

job/sec-fs

job/sec-mcp-scopes

job/sec-sharing

job/perf-guards

job/sec-browser

job/sec-admin-deploy

job/sec-auth

wip/snapedge-714

job/bgpicker-717

wip/perf-arch-bundle

wip/money-import-recheck

job/advsetup-654

wip/bgpicker-717

wip/advsetup-654

job/burst-709

job/kbdcaps-710

job/app-pw-chooser

wip/burst-709

wip/app-pw-chooser

job/imaptest-625

wip/kbdcaps-710

job/fix-499

wip/fix-499

job/perf-mut-667

job/calimg-589

job/perf-snap-666

wip/calimg-589

wip/perf-snap-666

wip/perf-mut-667

job/perf-cache-665

wip/perf-cache-665

job/voicefiles-620

wip/voicefiles-620

job/admin-burst-705

wip/admin-burst-705

job/voicememos-review

wip/voicememos-review

wip/ryw-653

job/ryw-653

job/writeonopen-661

job/instant-663

wip/writeonopen-661

job/money-import-review

wip/money-import-review

wip/importjs-610

review/integrations-407-round6

wip/integrations-review

job/dragghost-612

wip/dragghost-612

job/integrations

wip/integrations

job/decider-656

job/merge-round-6

job/perf-rerun

wip/merge-round-6

job/integrations-review-round5

job/selalign-576

wip/selalign-576

job/mcp-events-491

job/files-631

job/cal-e2e-569

wip/cal-e2e-569

job/reload-423

wip/reload-423

wip/mcp-events-491

wip/files-631

job/notesbridge-644

wip/notesbridge-644

job/editor-series

job/calcard-series

wip/calcard-series

job/mcp-events-review-491

wip/mcp-events-review

wip/editor-series

job/quirks-546

job/integrations-recheck

job/tocrail-636

wip/tocrail-636

wip/quirks-546

wip/reminders-643

job/reminders-643

wip/davscale-573

job/davscale-573

job/integrations-review

wip/ocr-eval-584

job/ocr-eval-584

job/esc-537

wip/esc-537

job/toastname-586

wip/toastname-586

job/submenu-579

wip/submenu-579

job/tasks-mode

wip/tasks-mode

job/agentdocs-630

job/dupwrite-634

wip/agentdocs-630

wip/dupwrite-634

job/lightglass-588

wip/lightglass-588

job/tabswitch-549

job/ghosttask-623

wip/ghosttask-623

job/toaststack-616

job/weekstate-609

job/mailsync-613

wip/mailsync-613

wip/weekstate-609

job/maildup-626

wip/tabswitch-549

wip/maildup-626

wip/toaststack-616

job/motion-611

wip/motion-611

job/tlstest-601

wip/tlstest-601

job/perf-495

job/floating-sheet

wip/floating-sheet

job/remdup-585

wip/remdup-585

job/fix-502

wip/fix-502

job/attachplay-622

job/perf-batch

wip/perf-batch-563

wip/perf-495

hotfix/mail-sync-diag

job/mail-m3

wip/mail-m3

job/attach-poof-603

job/calhover-608

job/editorbar-604

job/mentions-605

job/merge-round-4

job/allday-514

wip/merge-round-4

wip/allday-514

job/merge-round-4a

wip/merge-round-4a

job/sharestack-580

job/fix-501

wip/sharestack-580

wip/fix-501

job/perf-batch-563

job/theme-detail

job/apw-cache-review

wip/apw-cache-review

job/probe-520

wip/probe-520

job/mac-393

wip/mac-393

job/header-571

job/flake-513

wip/flake-513

job/docs-thumb-547

wip/header-571

job/webcal-572

wip/webcal-572

wip/shortcuts-542

job/shortcuts-542

wip/docs-thumb-547

job/caldav-stress

wip/caldav-stress

wip/sweep-478

job/apw-cache-512

wip/apw-cache-512

job/money-empty-540

wip/restart-505

wip/money-empty-540

wip/fix-510

job/restart-505

job/fix-503

job/perf-496

wip/perf-496

job/fix-498

wip/fix-498

job/info-inspector-465

wip/info-inspector-465

job/fix-510

job/fix-507

wip/fix-507

wip/fix-503

job/fix-493

job/money-kinds

wip/money-kinds

job/hygiene-548

job/merge-round-3

wip/fix-493

job/drag-snap-536

wip/merge-round-3

wip/merge-round-0930

wip/drag-snap-536

job/align-538

wip/align-538

job/bg-flash

wip/bg-flash

job/money-import

job/search-count-544

wip/search-count-544

wip/money-import

job/settings-key-541

wip/settings-key-541

job/toast-539

job/preview-421

wip/preview-421

wip/toast-539

job/tasks-500-531

job/title-plain-526

wip/title-plain-526

wip/tasks-500-531

job/notes-bridge

wip/parity-484

job/parity-484

job/files-slow

job/crash-525

wip/notes-bridge

wip/files-slow

wip/crash-525

job/kbd-motion-527

wip/bg-422

job/analytics-504

wip/analytics-504

wip/kbd-motion-527

job/upload-pill-523

wip/upload-pill-523

wip/tray-order

job/tray-order

wip/overflow-mid

wip/merge-round-2

job/perf-494

wip/perf-494

job/merge-round-3-pre-rebuild

wip/mcp-fast-492

wip/motion-477

wip/asr-ab-489

wip/theme-variants-506

wip/overflow-511

wip/week-header-508

wip/attach-427

job/dav-delete-471

job/iso-435

wip/iso-435

wip/files-sel-keys

wip/dav-delete-471

job/align-253

job/siwc-490

wip/siwc-490

job/money-kinds-review

wip/align-253

wip/money-kinds-review

job/small-bugs-3

wip/overlay-title-487

wip/multiget-500

wip/hidden-420

wip/webcal-ui

wip/webcal-431

job/perf-367

job/location

wip/small-bugs-3

wip/location

wip/perf-367

wip/admin-deny-483

job/tag-unicode-473

wip/tag-unicode-473

job/blur-436

wip/photos-470

wip/blur-436

wip/small-bugs-4

wip/hunt-20260930

wip/settings-hdr-482

wip/chips-416

job/dedup-375

wip/dedup-375

job/doc-stack

wip/doc-stack

job/tokens-literals

wip/tokens-literals

job/jobs-leftovers

wip/send-fast

wip/paste-467

wip/money-numbers

job/money-plugin

wip/money-plugin

backup/doc-stack-r3-reset-source

job/break-dav

wip/merge-batch

wip/crossday-469

wip/mac-verify

wip/mail-m2

wip/break-dav

wip/money-review2

job/money-md

job/modes-424

wip/money-md

wip/jobs-leftovers

job/agenda-413

wip/agenda-413

job/dedup-375-clean

job/dedup-375-before-rebase

wip/modes-424

job/recog-417

wip/recog-417

wip/bounce-425

wip/ab-384-luna

backup/doc-stack-round3-before-rebuild

job/webdav-perf

wip/webdav-perf

job/toast-ring

wip/toast-ring

job/money-review

wip/money-review

wip/micro-motion

wip/settings-card

wip/minical

job/notes-imap-428

job/least-priv

wip/ui-small-2

wip/flaky-426

wip/drag-end-418

job/jank

wip/jank

wip/least-priv

wip/docs-site

job/agenda

job/sec-batch

wip/sec-batch

wip/per-user-index

job/area-calendars

wip/area-calendars

job/parity

wip/parity

job/documents-research

wip/documents-research

job/test-infra

job/reminders-sync

wip/small-bugs-2

wip/reminders-sync

wip/gestures

job/google-oauth

wip/tags-merge

wip/tags

job/e2e-theme

wip/e2e-theme

job/icon-align

wip/test-infra

wip/select-align

wip/editor-385

job/voice

wip/webdav

job/webdav

job/app-pw-ui

job/editor-integrity

wip/editor-integrity

wip/voice

wip/quota

wip/cal-followups

wip/icon-align

job/composer-scale

wip/composer-scale

job/jobs-page

wip/jobs-page

job/hig-type

wip/hig-type

wip/app-pw-ui

job/motion-spring

job/mcp

wip/motion-spring

wip/mcp

job/small-bugs

wip/push-hosts

job/profile-sign

wip/touch-369

wip/profile-sign

job/mobile-focus

wip/mobile-focus

wip/ui-polish-354

wip/small-bugs

wip/dup-task

job/toast-polish

job/app-pw-scopes

wip/toast-polish

wip/app-pw-scopes

wip/cli-agent

wip/selection-pills

job/preview-attach

wip/preview-attach

job/dav-proppatch

wip/dav-proppatch

wip/cal-switcher

job/atomic-race

wip/atomic-race

job/photos-shared

wip/photos-shared

wip/cal-grid

wip/note-rewrite

wip/search-rebuild

job/mail-m1

job/paperless-import

wip/paperless-import

wip/mail-m1

wip/hidden-activity

wip/search-d

wip/pricing-research

wip/cursors

wip/auto-scheme

job/single-pills

wip/single-pills

wip/xuser-matrix

wip/money-format

wip/app-pw-setup

wip/purge-dos

wip/vault-health

wip/caldav-apple

wip/xuser-audit

wip/e2e-green

wip/tabbar

wip/adv-harness

wip/maple-mono

job/search-fix

wip/search-fix

wip/search-perf-c

job/adv-harness

wip/sidebar-headers

job/glass

wip/temp-index

job/polish

wip/polish

wip/file-protocols

wip/money-research

wip/glass

wip/voice-models

wip/collab-redo

job/voice-research

wip/hunt-20260928

wip/notes-actions-research

wip/search-pad

wip/search-perf

wip/search-sticky

wip/editor-undo

wip/chrome-rules

wip/motion

wip/appearance-research

wip/appearance

wip/audit-bugs

wip/cal-glass

wip/block-actions

wip/authz-order

wip/event-stripes

wip/chrome-sidebar

wip/auth-flaky

wip/robust-2

wip/gate-fix

wip/menu-blur

wip/import-calternaljs

wip/tray-fix

job/import-calternaljs

wip/index-order

wip/audit-fixes

wip/search-chevrons

research/mail

wip/phone-chrome

wip/dedup-break

wip/csp

wip/ui-audit

wip/select-toast

wip/perf

wip/flat-layout

wip/fonts

wip/event-tint

wip/sync-converge

wip/data-split

wip/glass-audit

wip/robustness

wip/sync-chaos

wip/search-thumbs

wip/fuzz

wip/menu-icons

wip/search-pill

wip/sync-changing

wip/heading-links

wip/date-formats

wip/a11y

wip/break-editor

wip/e2e-fix

wip/settings-sections

wip/sync-root-guard

wip/search-palette

wip/share-edit

job/toasts

wip/toasts

wip/cont-analytics

wip/authz-review

wip/popovers

wip/overlay-glass

wip/change-feed

wip/editor-modes

wip/composer-align

wip/cont-agenda

wip/agenda-merge

job/agent-conventions

wip/agent-conventions

wip/backend-misc

job/route-audit

wip/route-audit

wip/ui-batch

wip/heif-hardening

wip/grid-resize

wip/ask-page

wip/webmcp

job/deeplink-audit

wip/deeplinks

wip/shortcuts

wip/cont-tz-days

main

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/calternal-v0#1202

No description provided.