kayg/calternal-v0

Archived

Watch

Fork 0

Merge35: live xuser matrix fails private identifier and owner-state contracts #1466

Open

opened 2026-10-08 13:18:30 +00:00 by kayg · 2 comments

kayg commented

2026-10-08 13:18:30 +00:00

Owner

Coverage reported: 429 OpenAPI operations classified, 221 replayed, 1028 owned-ID/missing-ID comparisons across B/C/D/anonymous, 16 #1402 non-private identifier routes reviewed by authority class, and 122 Job/Mail/quota comparisons.

Exact finding lines:

!! B GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400
!! C GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400
!! D GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400
!! admin GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400
!! B DELETE /api/v1/money/imports/jobs/{job_id}: exists/missing response profiles differ: (404, 69, '69', 'application/json') vs (204, 0, None, '')
!! B DELETE /api/v1/money/imports/{import_id}: exists/missing response profiles differ: (404, 69, '69', 'application/json') vs (404, 67, '67', 'application/json')
!! B POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json')
!! C POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json')
!! D POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json')
!! admin POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json')
!! A VERIFY owner state: A's Notification subscription changed after cross-User replay

The Mail 400/400 rows are identical profiles, so they alone do not prove a leak. Check whether their fixture IDs satisfy the tightened #1419 grammar. The other response differences can reveal private existence; check valid missing-ID grammar too. The Notification invariant reports changed owner state, but its causal operation is not yet identified. Do not weaken the invariant to make the run pass.

Passing controls: Calendar subscription ownership (15 comparisons), Photos Share surfaces before/after revoke, and revoked Share identical HTTP 404 profiles (12 alternating pairs, median delta 3.0 ms). Overall matrix median absolute timing delta was 1.9 ms.

Command path: full tests/adversarial/run.sh invokes ADVERSARIAL_MATRIX_DIRECT=1 python3 tests/adversarial/xuser_matrix.py after real browser/session fixtures and server settlement. Product build 938a141d5; integration head 0ba15bd945. Local log: artifacts/merge35/adversarial.log.

Merge35 (#1458) live xuser matrix failed on the real merged release server. Treat the private identifier and owner-state findings as blockers until they are fixed or explained with evidence. No test expectation or fixture was changed. Coverage reported: 429 OpenAPI operations classified, 221 replayed, 1028 owned-ID/missing-ID comparisons across B/C/D/anonymous, 16 #1402 non-private identifier routes reviewed by authority class, and 122 Job/Mail/quota comparisons. Exact finding lines: ``` !! B GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400 !! C GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400 !! D GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400 !! admin GET /api/v1/mail/threads/{id}/messages: ownership denial expected [404], got 400/400 !! B DELETE /api/v1/money/imports/jobs/{job_id}: exists/missing response profiles differ: (404, 69, '69', 'application/json') vs (204, 0, None, '') !! B DELETE /api/v1/money/imports/{import_id}: exists/missing response profiles differ: (404, 69, '69', 'application/json') vs (404, 67, '67', 'application/json') !! B POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json') !! C POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json') !! D POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json') !! admin POST /api/v1/notes/journal/{date}/lines/{hash}/fix: exists/missing response profiles differ: (409, 60, '60', 'application/json') vs (400, 57, '57', 'application/json') !! A VERIFY owner state: A's Notification subscription changed after cross-User replay ``` The Mail 400/400 rows are identical profiles, so they alone do not prove a leak. Check whether their fixture IDs satisfy the tightened #1419 grammar. The other response differences can reveal private existence; check valid missing-ID grammar too. The Notification invariant reports changed owner state, but its causal operation is not yet identified. Do not weaken the invariant to make the run pass. Passing controls: Calendar subscription ownership (15 comparisons), Photos Share surfaces before/after revoke, and revoked Share identical HTTP 404 profiles (12 alternating pairs, median delta 3.0 ms). Overall matrix median absolute timing delta was 1.9 ms. Command path: full `tests/adversarial/run.sh` invokes `ADVERSARIAL_MATRIX_DIRECT=1 python3 tests/adversarial/xuser_matrix.py` after real browser/session fixtures and server settlement. Product build 938a141d5; integration head 0ba15bd9459c66dd820297474b71d603ca8e637f. Local log: `artifacts/merge35/adversarial.log`.

kayg referenced this issue

2026-10-08 13:25:18 +00:00

Merge round 35a #1458

kayg referenced this issue

2026-10-08 13:50:14 +00:00

Merge35: foreign Calendar feed actions return 403 instead of private 404 #1472

kayg referenced this issue

2026-10-08 14:06:32 +00:00

Merge round 35a #1458

kayg referenced this issue

2026-10-08 15:17:04 +00:00

Merge round 35a #1458

kayg commented

2026-10-08 15:27:09 +00:00

Author

Owner

m35triage evidence on production af202e151: the unchanged live matrix stopped during owner fixture creation because the detached Money preview did not become ready within 45 seconds. No foreign replay ran. The Notification binding was present immediately before the owner Money import; the retained Index has zero notification_subscriptions rows after the deadline. This verifies pre-replay background cleanup on production, consistent with #1445. The incomplete run is retained in artifacts/m35triage/production-matrix.log. A completion run will use the separately documented #1445 180-second fixture budget only; no response, content, ownership or state assertion changes.

m35triage evidence on production af202e151: the unchanged live matrix stopped during owner fixture creation because the detached Money preview did not become ready within 45 seconds. No foreign replay ran. The Notification binding was present immediately before the owner Money import; the retained Index has zero notification_subscriptions rows after the deadline. This verifies pre-replay background cleanup on production, consistent with #1445. The incomplete run is retained in artifacts/m35triage/production-matrix.log. A completion run will use the separately documented #1445 180-second fixture budget only; no response, content, ownership or state assertion changes.

kayg commented

2026-10-08 16:38:16 +00:00

Author

Owner

m35triage (#1458): all eleven original finding lines are identical on production af202e151 and the merged release. Each matrix completed 221 replayed operations and 1,028 owned-ID/missing-ID comparisons, plus 16 non-private authority reviews. Median absolute timing delta: production 0.6 ms; merged 0.3 ms. Calendar subscription ownership, Photos Share surfaces/revoke and revoked-Share response controls passed.

Original line	Production	Merge	Classification and separate control
B Mail thread messages	400/400	400/400	Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases.
C Mail thread messages	400/400	400/400	Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases.
D Mail thread messages	400/400	400/400	Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases.
admin Mail thread messages	400/400	400/400	Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases.
B Money import Job cancel	404/204	404/204	Real pre-existing private-ID response distinction: 69 bytes versus 0. #1443; job/xcancel-1443 is outside this round.
B Money import cancel	404/404	404/404	Real pre-existing private-ID response distinction: 69 versus 67 bytes. #1444; the cancellation fix is outside this round.
B Journal line fix	409/400	409/400	Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases.
C Journal line fix	409/400	409/400	Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases.
D Journal line fix	409/400	409/400	Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases.
admin Journal line fix	409/400	409/400	Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases.
A Notification binding	Absent before replay	Absent before replay	Pre-existing fixture cleanup. Binding exists before/after the owner Money import, then is absent at the end of fixture creation and before any matrix replay. Final binding count remains 0.

Mail errors explicitly say "Both message cursor fields are required" (84-byte profiles for both requests). Journal controls explicitly say "invalid date" for the malformed control and "Daily note is gone" for the valid date in the caller's Home. The corrected controls are additional checks; they do not replace or weaken any old expectation.

The Notification fixture uses the fake FCM path documented in #1445. Both retained Indexes contain one matrix-A money_import_finished Notification and zero A bindings after replay. The same binding was already absent before replay. Notification source files are identical between af202e151 and this merge; push.rs expires the scheduled binding on permanent endpoint failure / invalid provider endpoints. This verifies the pre-replay fixture cause, consistent with #1445's controlled delivery investigation, rather than a foreign mutation. job/xsub-1445's fixture repair is not merged here.

No new cross-User leak, accepted foreign cancellation or owner-state difference introduced by this round was found. The two Money response distinctions remain real pre-existing findings for their own fix job. The eight Mail/Journal lines are control errors, and the Notification line is a pre-existing fixture invariant error. The matrix still exits 1 with all original assertions intact; that failure is fully classified, not suppressed. Keep #1466 open. Logs: artifacts/m35triage/production-matrix-complete.log and merged-matrix-complete.log.

m35triage (#1458): all eleven original finding lines are identical on production af202e151 and the merged release. Each matrix completed 221 replayed operations and 1,028 owned-ID/missing-ID comparisons, plus 16 non-private authority reviews. Median absolute timing delta: production 0.6 ms; merged 0.3 ms. Calendar subscription ownership, Photos Share surfaces/revoke and revoked-Share response controls passed. | Original line | Production | Merge | Classification and separate control | |---|---|---|---| | B Mail thread messages | 400/400 | 400/400 | Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases. | | C Mail thread messages | 400/400 | 400/400 | Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases. | | D Mail thread messages | 400/400 | 400/400 | Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases. | | admin Mail thread messages | 400/400 | 400/400 | Probe sends before_id without before_received_ms. Removing that cursor gives identical 404/404 profiles (62 bytes) on both releases. | | B Money import Job cancel | 404/204 | 404/204 | Real pre-existing private-ID response distinction: 69 bytes versus 0. #1443; job/xcancel-1443 is outside this round. | | B Money import cancel | 404/404 | 404/404 | Real pre-existing private-ID response distinction: 69 versus 67 bytes. #1444; the cancellation fix is outside this round. | | B Journal line fix | 409/400 | 409/400 | Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases. | | C Journal line fix | 409/400 | 409/400 | Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases. | | D Journal line fix | 409/400 | 409/400 | Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases. | | admin Journal line fix | 409/400 | 409/400 | Missing control date is xxxxxxxxxx. A valid date plus an absent hash gives identical 409/409 profiles (60 bytes) on both releases. | | A Notification binding | Absent before replay | Absent before replay | Pre-existing fixture cleanup. Binding exists before/after the owner Money import, then is absent at the end of fixture creation and before any matrix replay. Final binding count remains 0. | Mail errors explicitly say "Both message cursor fields are required" (84-byte profiles for both requests). Journal controls explicitly say "invalid date" for the malformed control and "Daily note is gone" for the valid date in the caller's Home. The corrected controls are additional checks; they do not replace or weaken any old expectation. The Notification fixture uses the fake FCM path documented in #1445. Both retained Indexes contain one matrix-A money_import_finished Notification and zero A bindings after replay. The same binding was already absent before replay. Notification source files are identical between af202e151 and this merge; push.rs expires the scheduled binding on permanent endpoint failure / invalid provider endpoints. This verifies the pre-replay fixture cause, consistent with #1445's controlled delivery investigation, rather than a foreign mutation. job/xsub-1445's fixture repair is not merged here. No new cross-User leak, accepted foreign cancellation or owner-state difference introduced by this round was found. The two Money response distinctions remain real pre-existing findings for their own fix job. The eight Mail/Journal lines are control errors, and the Notification line is a pre-existing fixture invariant error. The matrix still exits 1 with all original assertions intact; that failure is fully classified, not suppressed. Keep #1466 open. Logs: artifacts/m35triage/production-matrix-complete.log and merged-matrix-complete.log.

kayg referenced this issue

2026-10-08 16:58:11 +00:00

Merge round 35a #1458

kayg referenced this issue

2026-10-08 18:07:03 +00:00

Merge round 35a #1458

Commenting is not possible because the repository is archived.

No labels

No milestone

No project

No assignees

1 participant

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/calternal-v0#1466

No description provided.

Rows
Columns