Calendar feed adversarial phase inherits disabled plugin state #1520

Open
opened 2026-10-09 08:48:04 +00:00 by kayg · 0 comments
Owner

The full #1500 adversarial campaign expects HTTP 404 for foreign Calendar feed rotate/revoke/delete and receives HTTP 403 after its plugin User-toggle phase. The requests are denied. The cross-User matrix separately passes its non-private route authority-class comparisons, with no identifier leak or accepted foreign write.

Production 9dc65437e focused comparison: ADVERSARIAL_FOCUSED_ROUND2_ONLY=1 ROUND2_SECTIONS=calendar-feeds tests/adversarial/run.sh passes with zero findings and zero SLOW results. The merged Calendar change only changes UI selection; feed authorization code is unchanged from production.

Keep the existing assertions. Make the full campaign establish its required enabled Calendar state before the feed phase, or review the intended disabled-plugin status contract. Do not weaken the cross-User checks. Evidence: merge35c calendar-feeds-production.log and adversarial.log.

The full #1500 adversarial campaign expects HTTP 404 for foreign Calendar feed rotate/revoke/delete and receives HTTP 403 after its plugin User-toggle phase. The requests are denied. The cross-User matrix separately passes its non-private route authority-class comparisons, with no identifier leak or accepted foreign write. Production 9dc65437e focused comparison: `ADVERSARIAL_FOCUSED_ROUND2_ONLY=1 ROUND2_SECTIONS=calendar-feeds tests/adversarial/run.sh` passes with zero findings and zero SLOW results. The merged Calendar change only changes UI selection; feed authorization code is unchanged from production. Keep the existing assertions. Make the full campaign establish its required enabled Calendar state before the feed phase, or review the intended disabled-plugin status contract. Do not weaken the cross-User checks. Evidence: merge35c calendar-feeds-production.log and adversarial.log.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1520
No description provided.