Cross-User matrix: add live fixtures for the 39 uncovered identifier routes

kayg commented

2026-10-07 19:58:00 +00:00

Owner

The cross-User isolation matrix (tests/adversarial/xuser_matrix.py, #331) has no live fixture for 39 identifier routes (reported by merge33b and bash-security2 on #1223/#1122). Those routes are classified but never exercised with a real second User's item IDs, so an ownership check missing on any of them would go unnoticed. Cross-User isolation is the worst failure class (merge blocker).

Required: give each of the 39 routes a fixture factory that creates a real item for User A, then call the route as User B (and anonymous, and with a revoked Share) and assert the same denial response as a missing ID (no existence oracle). List the 39 routes in the job report with their result. Any route that is not denied correctly is a blocker: file its own issue with evidence at once.

The cross-User isolation matrix (tests/adversarial/xuser_matrix.py, #331) has no live fixture for 39 identifier routes (reported by merge33b and bash-security2 on #1223/#1122). Those routes are classified but never exercised with a real second User's item IDs, so an ownership check missing on any of them would go unnoticed. Cross-User isolation is the worst failure class (merge blocker). Required: give each of the 39 routes a fixture factory that creates a real item for User A, then call the route as User B (and anonymous, and with a revoked Share) and assert the same denial response as a missing ID (no existence oracle). List the 39 routes in the job report with their result. Any route that is not denied correctly is a blocker: file its own issue with evidence at once.

kayg commented

2026-10-08 04:15:00 +00:00

Author

Owner

Starting #1402 in branch job/xuser39-1402. Worktree is clean. Base SHA: 0419170fe456b58614befcb12d9c9d255118f1c0 (merge base with the local origin/dev ref). I am inventorying the 39 unexercised identifier routes and will add fixture-backed A/B, anonymous, and revoked-Share denial comparisons, then run the classification tests and full requested matrix against the shared release server.

Starting #1402 in branch `job/xuser39-1402`. Worktree is clean. Base SHA: `0419170fe456b58614befcb12d9c9d255118f1c0` (merge base with the local `origin/dev` ref). I am inventorying the 39 unexercised identifier routes and will add fixture-backed A/B, anonymous, and revoked-Share denial comparisons, then run the classification tests and full requested matrix against the shared release server.

kayg commented

2026-10-08 04:18:29 +00:00

Author

Owner

Inventory finding: the current live preflight has 39 identifier operations without a local fixture. The set includes User-owned records, plus Instance selectors, external selectors, client-generated idempotency keys, pagination cursors, and bearer capabilities. DESIGN §§2, 7, 21 and 54 assign different authority rules to those classes; for example, a bearer capability can be intentionally usable without a signed-in User, while a non-recipient Share must be indistinguishable from a missing item. I will add live A-owned fixtures and denial comparisons for User-private records, and explicit positive/negative semantic checks plus a fail-closed reviewed disposition for identifiers that are not private object identities. No product code changes are in scope.

kayg commented

2026-10-08 04:24:53 +00:00

Author

Owner

Starting inventory for #1402. Branch job/xuser39-1402, starting HEAD/base 0419170fe456b58614befcb12d9c9d255118f1c0. The 39 routes reported by the issue are:

#	Operation ID	Starting state
1	`admin_feature_flag_put`	no local A fixture
2	`admin_groups_delete`	no local A fixture
3	`admin_groups_rename`	no local A fixture
4	`admin_groups_restore`	no local A fixture
5	`appearance_unsplash_select`	no local A fixture
6	`appearance_unsplash_thumbnail`	no local A fixture
7	`calendar_create_feed`	no local A fixture
8	`calendar_preferences_put`	no local A fixture
9	`calendar_public_feed`	no local A fixture
10	`canvas_cards_events`	no local A fixture
11	`create_app_password`	no local A fixture
12	`download_app_password_profile`	no local A fixture
13	`integration_delete_account`	no local A fixture
14	`integration_update_account`	no local A fixture
15	`invite_start`	no local A fixture
16	`location_delete_place`	no local A fixture
17	`location_edit_place`	no local A fixture
18	`location_restore_place`	no local A fixture
19	`mail_mutate_preferences`	no local A fixture
20	`mail_unified_inbox`	no local A fixture
21	`mcp_event_revoke`	no local A fixture
22	`money_import_cancel`	no local A fixture
23	`money_import_job_cancel`	no local A fixture
24	`money_import_job_result`	no local A fixture
25	`money_import_preview`	no local A fixture
26	`money_import_progress`	no local A fixture
27	`notes_journal_create_log`	no local A fixture
28	`notes_journal_create_log_batch`	no local A fixture
29	`notes_journal_fix_line`	no local A fixture
30	`notes_template_create`	no local A fixture
31	`notes_templates_default_set`	no local A fixture
32	`notes_voice_transcription`	no local A fixture
33	`notifications_inbox_clear`	no local A fixture
34	`put_config`	no local A fixture
35	`reenrol_start`	no local A fixture
36	`revoke_invite`	no local A fixture
37	`set_instance_plugin`	no local A fixture
38	`set_user_plugin`	no local A fixture
39	`setup_start`	no local A fixture

The classification gate currently reports 429 operations and 1,206 generated entry points. The 39-row list contains private records and non-private selectors/capabilities; final results will identify the disposition for each row.

Starting inventory for #1402. Branch `job/xuser39-1402`, starting HEAD/base `0419170fe456b58614befcb12d9c9d255118f1c0`. The 39 routes reported by the issue are: | # | Operation ID | Starting state | |---:|---|---| | 1 | `admin_feature_flag_put` | no local A fixture | | 2 | `admin_groups_delete` | no local A fixture | | 3 | `admin_groups_rename` | no local A fixture | | 4 | `admin_groups_restore` | no local A fixture | | 5 | `appearance_unsplash_select` | no local A fixture | | 6 | `appearance_unsplash_thumbnail` | no local A fixture | | 7 | `calendar_create_feed` | no local A fixture | | 8 | `calendar_preferences_put` | no local A fixture | | 9 | `calendar_public_feed` | no local A fixture | | 10 | `canvas_cards_events` | no local A fixture | | 11 | `create_app_password` | no local A fixture | | 12 | `download_app_password_profile` | no local A fixture | | 13 | `integration_delete_account` | no local A fixture | | 14 | `integration_update_account` | no local A fixture | | 15 | `invite_start` | no local A fixture | | 16 | `location_delete_place` | no local A fixture | | 17 | `location_edit_place` | no local A fixture | | 18 | `location_restore_place` | no local A fixture | | 19 | `mail_mutate_preferences` | no local A fixture | | 20 | `mail_unified_inbox` | no local A fixture | | 21 | `mcp_event_revoke` | no local A fixture | | 22 | `money_import_cancel` | no local A fixture | | 23 | `money_import_job_cancel` | no local A fixture | | 24 | `money_import_job_result` | no local A fixture | | 25 | `money_import_preview` | no local A fixture | | 26 | `money_import_progress` | no local A fixture | | 27 | `notes_journal_create_log` | no local A fixture | | 28 | `notes_journal_create_log_batch` | no local A fixture | | 29 | `notes_journal_fix_line` | no local A fixture | | 30 | `notes_template_create` | no local A fixture | | 31 | `notes_templates_default_set` | no local A fixture | | 32 | `notes_voice_transcription` | no local A fixture | | 33 | `notifications_inbox_clear` | no local A fixture | | 34 | `put_config` | no local A fixture | | 35 | `reenrol_start` | no local A fixture | | 36 | `revoke_invite` | no local A fixture | | 37 | `set_instance_plugin` | no local A fixture | | 38 | `set_user_plugin` | no local A fixture | | 39 | `setup_start` | no local A fixture | The classification gate currently reports 429 operations and 1,206 generated entry points. The 39-row list contains private records and non-private selectors/capabilities; final results will identify the disposition for each row.

kayg referenced this issue

2026-10-08 04:55:22 +00:00

Review cross-User Money Job cancellation response distinction #1443

kayg referenced this issue

2026-10-08 04:55:26 +00:00

Review cross-User Money preview cancellation response profile #1444

kayg referenced this issue

2026-10-08 04:56:06 +00:00

Investigate XUser removal of A Notification subscription #1445

kayg commented

2026-10-08 04:56:33 +00:00

Author

Owner

Completed the XUser39 route isolation work.

Branch: job/xuser39-1402
Head: 8f1e5f2354768b910e2afc240594f03d417c57e7
Commits: 2b6e07297844f8344dd6dfd444584694a02547e8 (route authority classifications) and 8f1e5f2354768b910e2afc240594f03d417c57e7 (private route fixtures).

The classification unit tests passed. The completed live matrix reported:

Two-User OpenAPI matrix: 429 operations classified; 221 operations replayed; 1028 A-ID vs missing-ID comparisons across B, C, D and anonymous; 16 #1402 non-private identifier routes reviewed by their own authority class; median absolute timing delta 2.1 ms

The matrix ended with 11 observations. Three non-probe findings were filed separately: #1443 (Money Job cancel response differs for foreign versus absent ID), #1444 (Money preview cancel response lengths differ), and #1445 (A's Notification subscription fixture row was absent at final owner-state verification). No cross-User Money cancellation succeeded. Four Mail comparisons and four Journal comparisons used malformed missing-ID controls; they are recorded as probe gaps in artifacts/xuser39/findings.md, not product denial findings. No product code was changed.

Operation	Authority class
`put_config`	`instance-admin`
`admin_feature_flag_put`	`instance-admin`
`admin_groups_rename`	`instance-admin`
`admin_groups_delete`	`instance-admin`
`admin_groups_restore`	`instance-admin`
`set_instance_plugin`	`instance-admin`
`appearance_unsplash_thumbnail`	`public-source-selector`
`appearance_unsplash_select`	`public-source-selector`
`mcp_event_revoke`	`user-security-state`
`download_app_password_profile`	`bearer-capability`
`create_app_password`	`resource-selector`
`invite_start`	`bearer-capability`
`revoke_invite`	`instance-admin`
`reenrol_start`	`bearer-capability`
`setup_start`	`instance-capability`
`calendar_create_feed`	`user-home-selector`
`calendar_preferences_put`	`user-home-selector`
`canvas_cards_events`	`user-home-item`
`location_edit_place`	`user-home-item`
`location_delete_place`	`user-home-item`
`location_restore_place`	`user-home-item`
`mail_unified_inbox`	`user-scoped-cursor`
`mail_mutate_preferences`	`client-idempotency`
`money_import_progress`	`user-job`
`money_import_job_cancel`	`user-job`
`money_import_job_result`	`user-job`
`money_import_preview`	`client-job-id`
`money_import_cancel`	`user-import`
`notes_template_create`	`user-home-item`
`notes_journal_create_log`	`client-idempotency`
`notes_journal_create_log_batch`	`client-idempotency`
`notes_journal_fix_line`	`user-home-item`
`notes_templates_default_set`	`user-home-item`
`notes_voice_transcription`	`user-job`
`notifications_inbox_clear`	`client-idempotency`
`set_user_plugin`	`plugin-selector`
`integration_delete_account`	`user-security-state`
`integration_update_account`	`user-security-state`
`calendar_public_feed`	`bearer-capability`

Completed the XUser39 route isolation work. Branch: `job/xuser39-1402` Head: `8f1e5f2354768b910e2afc240594f03d417c57e7` Commits: `2b6e07297844f8344dd6dfd444584694a02547e8` (route authority classifications) and `8f1e5f2354768b910e2afc240594f03d417c57e7` (private route fixtures). The classification unit tests passed. The completed live matrix reported: ```text Two-User OpenAPI matrix: 429 operations classified; 221 operations replayed; 1028 A-ID vs missing-ID comparisons across B, C, D and anonymous; 16 #1402 non-private identifier routes reviewed by their own authority class; median absolute timing delta 2.1 ms ``` The matrix ended with 11 observations. Three non-probe findings were filed separately: #1443 (Money Job cancel response differs for foreign versus absent ID), #1444 (Money preview cancel response lengths differ), and #1445 (A's Notification subscription fixture row was absent at final owner-state verification). No cross-User Money cancellation succeeded. Four Mail comparisons and four Journal comparisons used malformed missing-ID controls; they are recorded as probe gaps in `artifacts/xuser39/findings.md`, not product denial findings. No product code was changed. | Operation | Authority class | | --- | --- | | `put_config` | `instance-admin` | | `admin_feature_flag_put` | `instance-admin` | | `admin_groups_rename` | `instance-admin` | | `admin_groups_delete` | `instance-admin` | | `admin_groups_restore` | `instance-admin` | | `set_instance_plugin` | `instance-admin` | | `appearance_unsplash_thumbnail` | `public-source-selector` | | `appearance_unsplash_select` | `public-source-selector` | | `mcp_event_revoke` | `user-security-state` | | `download_app_password_profile` | `bearer-capability` | | `create_app_password` | `resource-selector` | | `invite_start` | `bearer-capability` | | `revoke_invite` | `instance-admin` | | `reenrol_start` | `bearer-capability` | | `setup_start` | `instance-capability` | | `calendar_create_feed` | `user-home-selector` | | `calendar_preferences_put` | `user-home-selector` | | `canvas_cards_events` | `user-home-item` | | `location_edit_place` | `user-home-item` | | `location_delete_place` | `user-home-item` | | `location_restore_place` | `user-home-item` | | `mail_unified_inbox` | `user-scoped-cursor` | | `mail_mutate_preferences` | `client-idempotency` | | `money_import_progress` | `user-job` | | `money_import_job_cancel` | `user-job` | | `money_import_job_result` | `user-job` | | `money_import_preview` | `client-job-id` | | `money_import_cancel` | `user-import` | | `notes_template_create` | `user-home-item` | | `notes_journal_create_log` | `client-idempotency` | | `notes_journal_create_log_batch` | `client-idempotency` | | `notes_journal_fix_line` | `user-home-item` | | `notes_templates_default_set` | `user-home-item` | | `notes_voice_transcription` | `user-job` | | `notifications_inbox_clear` | `client-idempotency` | | `set_user_plugin` | `plugin-selector` | | `integration_delete_account` | `user-security-state` | | `integration_update_account` | `user-security-state` | | `calendar_public_feed` | `bearer-capability` |

kayg referenced this issue

2026-10-08 10:35:34 +00:00

Investigate XUser removal of A Notification subscription #1445

kayg referenced this issue from a commit

2026-10-08 10:41:40 +00:00

Merge job/xuser39-1402 (#1402)

kayg referenced this issue

2026-10-08 12:11:13 +00:00

Investigate XUser removal of A Notification subscription #1445

kayg referenced this issue

2026-10-08 13:18:30 +00:00

Merge35: live xuser matrix fails private identifier and owner-state contracts #1466