kayg/calternal
Watch
1
0
Fork
You've already forked calternal
 0
Code Issues 805 Pull requests Projects Releases Packages Wiki Activity Actions 434

Licence keys: free up to 6 users, yearly keys with perpetual fallback, offline Ed25519 #1145

New issue
Open
opened 2026-10-05 12:49:43 +00:00 by kayg · 34 comments
kayg commented 2026-10-05 12:49:43 +00:00
Owner
Copy link

Owner decisions (2026-10-05)

calternal stays AGPL-3.0-only. Paid licences are enforced in code (a neutral feature), not by changing the licence. Prices are kept outside the repo and issue tracker.

Tiers (mechanism only)

  • Free (no key): up to 6 active users per Instance (one household).
  • Licence key: raises the user limit to the key's max_users (e.g. 10, or unlimited for a larger tier). Keys are yearly.
  • Perpetual fallback: an expired key keeps every feature and the user limit on all versions released before the key's expiry date. Only newer versions fall back to the free limit until renewal. Lapsing never locks anyone out of their data.

What counts

  • Only active accounts count. Disabled accounts, pending invites and public share links do not.
  • Over the limit nothing is deleted, locked or degraded: the Admin cannot add or re-enable a user until they add a key or disable a user. The Admin Users page explains this in plain language with the current count ("6 of 6 users").

Key format and checking

  • Offline signed keys: Ed25519 signature over a small canonical payload (licensee, instance label optional, max_users, issued, expires, key ID). The public key is compiled in; the signing key never enters the repo or logs.
  • Checked locally at startup and on change; no phone-home, no telemetry. Admin → Licence page: paste or upload a key, see status (valid until, user limit, fallback version), remove it.
  • Clock tampering: compare against the build date and the newest file mtime seen, fail closed only for new user creation, never for reads.
  • CLI/API parity: calternal admin licence set|show|remove, matching API routes (Admin only), audit-logged.

Do

Implement the limit check at every user-creating/enabling path (signup, invite accept, admin create, re-enable, OIDC first login) with one shared guard; tests for each path, expiry/fallback by version date, malformed and wrongly signed keys, and concurrency (two invites accepted at once at 5/6). Include a test-only signing key under tests/ fixtures; production keys are issued by a separate private tool kept outside this repo. Screenshots of the Admin Licence page and the at-limit Users page at 390/820/1440, light + dark.

## Owner decisions (2026-10-05) calternal stays **AGPL-3.0-only**. Paid licences are enforced in code (a neutral feature), not by changing the licence. Prices are kept outside the repo and issue tracker. ### Tiers (mechanism only) - **Free (no key):** up to **6 active users** per Instance (one household). - **Licence key:** raises the user limit to the key's `max_users` (e.g. 10, or unlimited for a larger tier). Keys are **yearly**. - **Perpetual fallback:** an expired key keeps every feature and the user limit on all versions released before the key's expiry date. Only newer versions fall back to the free limit until renewal. Lapsing never locks anyone out of their data. ### What counts - Only **active accounts** count. Disabled accounts, pending invites and public share links do not. - Over the limit nothing is deleted, locked or degraded: the Admin cannot add or re-enable a user until they add a key or disable a user. The Admin Users page explains this in plain language with the current count ("6 of 6 users"). ### Key format and checking - Offline signed keys: Ed25519 signature over a small canonical payload (licensee, instance label optional, `max_users`, `issued`, `expires`, key ID). The public key is compiled in; the signing key never enters the repo or logs. - Checked locally at startup and on change; **no phone-home**, no telemetry. Admin → Licence page: paste or upload a key, see status (valid until, user limit, fallback version), remove it. - Clock tampering: compare against the build date and the newest file mtime seen, fail closed only for new user creation, never for reads. - CLI/API parity: `calternal admin licence set|show|remove`, matching API routes (Admin only), audit-logged. ### Do Implement the limit check at every user-creating/enabling path (signup, invite accept, admin create, re-enable, OIDC first login) with one shared guard; tests for each path, expiry/fallback by version date, malformed and wrongly signed keys, and concurrency (two invites accepted at once at 5/6). Include a test-only signing key under tests/ fixtures; production keys are issued by a separate private tool kept outside this repo. Screenshots of the Admin Licence page and the at-limit Users page at 390/820/1440, light + dark.
licence-paper-1440.png
580 KiB
licence-paper-390.png
660 KiB
licence-paper-820.png
530 KiB
licence-tokyo-night-1440.png
389 KiB
licence-tokyo-night-390.png
497 KiB
licence-tokyo-night-820.png
507 KiB
users-at-limit-paper-1440.png
629 KiB
users-at-limit-paper-390.png
619 KiB
users-at-limit-paper-820.png
553 KiB
users-at-limit-tokyo-night-1440.png
434 KiB
users-at-limit-tokyo-night-390.png
455 KiB
users-at-limit-tokyo-night-820.png
531 KiB
licence-paper-1440.png
580 KiB
licence-paper-390.png
658 KiB
licence-paper-820.png
528 KiB
licence-tokyo-night-1440.png
392 KiB
licence-tokyo-night-390.png
496 KiB
licence-tokyo-night-820.png
504 KiB
users-at-limit-paper-1440.png
629 KiB
users-at-limit-paper-390.png
619 KiB
users-at-limit-paper-820.png
552 KiB
users-at-limit-tokyo-night-1440.png
433 KiB
users-at-limit-tokyo-night-390.png
455 KiB
users-at-limit-tokyo-night-820.png
530 KiB
licence-paper-1440.png
580 KiB
licence-paper-390.png
659 KiB
licence-paper-820.png
529 KiB
licence-tokyo-night-1440.png
393 KiB
licence-tokyo-night-390.png
497 KiB
licence-tokyo-night-820.png
505 KiB
remove-paper-1440.png
403 KiB
remove-paper-390.png
682 KiB
remove-paper-820.png
484 KiB
remove-tokyo-night-1440.png
198 KiB
remove-tokyo-night-390.png
401 KiB
remove-tokyo-night-820.png
345 KiB
replace-paper-1440.png
415 KiB
replace-paper-390.png
735 KiB
replace-paper-820.png
487 KiB
replace-tokyo-night-1440.png
208 KiB
replace-tokyo-night-390.png
450 KiB
replace-tokyo-night-820.png
345 KiB
users-at-limit-paper-1440.png
629 KiB
users-at-limit-paper-390.png
619 KiB
users-at-limit-paper-820.png
552 KiB
users-at-limit-tokyo-night-1440.png
434 KiB
users-at-limit-tokyo-night-390.png
455 KiB
users-at-limit-tokyo-night-820.png
530 KiB
clippy-auth.log
9.3 KiB
test-auth.log
19 KiB
release.log
26 KiB
web-check-ready.log
5.1 MiB
web-test.log
4.8 KiB
vitest-final.log
631 B
build-script-tests.log
248 B
e2e.log
852 B
merge29-licence-paper-1440.png
573 KiB
merge29-licence-paper-390.png
634 KiB
merge29-licence-paper-820.png
499 KiB
merge29-licence-tokyo-night-1440.png
383 KiB
merge29-licence-tokyo-night-390.png
472 KiB
merge29-licence-tokyo-night-820.png
484 KiB
merge29-users-at-limit-paper-1440.png
629 KiB
merge29-users-at-limit-paper-390.png
619 KiB
merge29-users-at-limit-paper-820.png
553 KiB
merge29-users-at-limit-tokyo-night-1440.png
434 KiB
merge29-users-at-limit-tokyo-night-390.png
455 KiB
merge29-users-at-limit-tokyo-night-820.png
531 KiB
merge29-web-test.log.gz
928 B
merge29-web-check-generated.log.gz
373 KiB
merge29-web-focused.log.gz
397 B
merge29-api-client-test.log.gz
967 B
merge29-bun-install.log.gz
143 B
merge29-licence-e2e.log.gz
215 B
merge29-shell-e2e.log.gz
878 B
merge29-perf-final.log.gz
372 KiB
merge29-selfhost-final.log.gz
73 B
merge29-licence-paper-1440.png
576 KiB
merge29-licence-paper-390.png
660 KiB
merge29-licence-paper-820.png
517 KiB
merge29-licence-tokyo-night-1440.png
385 KiB
merge29-licence-tokyo-night-390.png
500 KiB
merge29-licence-tokyo-night-820.png
500 KiB
merge29-users-at-limit-paper-1440.png
635 KiB
merge29-users-at-limit-paper-390.png
644 KiB
merge29-users-at-limit-paper-820.png
573 KiB
merge29-users-at-limit-tokyo-night-1440.png
438 KiB
merge29-users-at-limit-tokyo-night-390.png
479 KiB
merge29-users-at-limit-tokyo-night-820.png
553 KiB
merge29-web-test-complete.log.gz
933 B
merge29-web-check-complete.log.gz
373 KiB
merge29-web-focused-final.log.gz
401 B
merge29-web-build-complete.log.gz
18 KiB
merge29-licence-e2e-complete.log.gz
224 B
merge29-test-calternal-plugin-notes.log.gz
8.5 KiB
merge29-clippy-calternal-auth.log.gz
914 B
merge29-test-calternal-auth.log.gz
4.1 KiB
merge29-clippy-calternal-plugin-mail.log.gz
853 B
merge29-test-calternal-plugin-mail.log.gz
4.6 KiB
merge29-test-calternal-plugin-mail-final.log.gz
3.7 KiB
merge29-perf-undo-retry.log.gz
372 KiB
merge29-clippy-calternal-server.log.gz
353 B
merge29-test-calternal-server.log.gz
6.9 KiB
merge29-clippy-calternal-plugin-final.log.gz
191 B
merge29-test-calternal-plugin.log.gz
2.4 KiB
merge29-clippy-calternal-plugin-notes.log.gz
1.3 KiB
merge29-mail-delta-focused.log.gz
345 B
merge29-clippy-calternal-plugin-calendar.log.gz
940 B
merge29-test-calternal-plugin-calendar.log.gz
4 KiB
licence-paper-1440.png licence-paper-390.png licence-paper-820.png licence-tokyo-night-1440.png licence-tokyo-night-390.png licence-tokyo-night-820.png users-at-limit-paper-1440.png users-at-limit-paper-390.png users-at-limit-paper-820.png users-at-limit-tokyo-night-1440.png users-at-limit-tokyo-night-390.png users-at-limit-tokyo-night-820.png licence-paper-1440.png licence-paper-390.png licence-paper-820.png licence-tokyo-night-1440.png licence-tokyo-night-390.png licence-tokyo-night-820.png users-at-limit-paper-1440.png users-at-limit-paper-390.png users-at-limit-paper-820.png users-at-limit-tokyo-night-1440.png users-at-limit-tokyo-night-390.png users-at-limit-tokyo-night-820.png licence-paper-1440.png licence-paper-390.png licence-paper-820.png licence-tokyo-night-1440.png licence-tokyo-night-390.png licence-tokyo-night-820.png remove-paper-1440.png remove-paper-390.png remove-paper-820.png remove-tokyo-night-1440.png remove-tokyo-night-390.png remove-tokyo-night-820.png replace-paper-1440.png replace-paper-390.png replace-paper-820.png replace-tokyo-night-1440.png replace-tokyo-night-390.png replace-tokyo-night-820.png users-at-limit-paper-1440.png users-at-limit-paper-390.png users-at-limit-paper-820.png users-at-limit-tokyo-night-1440.png users-at-limit-tokyo-night-390.png users-at-limit-tokyo-night-820.png merge29-licence-paper-1440.png merge29-licence-paper-390.png merge29-licence-paper-820.png merge29-licence-tokyo-night-1440.png merge29-licence-tokyo-night-390.png merge29-licence-tokyo-night-820.png merge29-users-at-limit-paper-1440.png merge29-users-at-limit-paper-390.png merge29-users-at-limit-paper-820.png merge29-users-at-limit-tokyo-night-1440.png merge29-users-at-limit-tokyo-night-390.png merge29-users-at-limit-tokyo-night-820.png merge29-licence-paper-1440.png merge29-licence-paper-390.png merge29-licence-paper-820.png merge29-licence-tokyo-night-1440.png merge29-licence-tokyo-night-390.png merge29-licence-tokyo-night-820.png merge29-users-at-limit-paper-1440.png merge29-users-at-limit-paper-390.png merge29-users-at-limit-paper-820.png merge29-users-at-limit-tokyo-night-1440.png merge29-users-at-limit-tokyo-night-390.png merge29-users-at-limit-tokyo-night-820.png
kayg commented 2026-10-05 15:22:00 +00:00
Author
Owner
Copy link

Starting issue #1145 on branch job/licence-1145 at base SHA 04afb0043c559c59084e4ec12609bb9fe679cbf6 (the branch is based on the prior dev; current origin/dev is de654a42ac4f9a6dca83bed8e0eebc99706f7dfe). I am reading the auth, account, and Admin UI paths and will implement the shared licence check and the issue's Admin flow on this branch.

Starting issue #1145 on branch `job/licence-1145` at base SHA `04afb0043c559c59084e4ec12609bb9fe679cbf6` (the branch is based on the prior `dev`; current `origin/dev` is `de654a42ac4f9a6dca83bed8e0eebc99706f7dfe`). I am reading the auth, account, and Admin UI paths and will implement the shared licence check and the issue's Admin flow on this branch.
kayg commented 2026-10-05 15:27:05 +00:00
Author
Owner
Copy link

Finding: the current auth store has atomic account insertion paths for invite acceptance, open signup, setup and OIDC, plus set_disabled, but no direct Admin-create method or route. Admin → Users can change Roles and sign-in status and issue a passkey link only for an existing User. I will add direct Admin creation with a one-time passkey setup link, and run the same transactional admission guard there.

Finding: the current auth store has atomic account insertion paths for invite acceptance, open signup, setup and OIDC, plus `set_disabled`, but no direct Admin-create method or route. Admin → Users can change Roles and sign-in status and issue a passkey link only for an existing User. I will add direct Admin creation with a one-time passkey setup link, and run the same transactional admission guard there.
kayg commented 2026-10-05 15:59:18 +00:00
Author
Owner
Copy link

First cargo test -p calternal-auth run found two fixture updates required by the new auth migration: the migration-order assertion stopped at 15, and cached_production_store_keeps_full_authority called startup before applying the auth migrations (Internal from the missing Licence table). Both are fixed in the worktree. The same run also observed the existing review_cache_bounds_ttl_and_keyed_digest assertion at 3,130 entries instead of 4,096 after a 126-second, highly parallel suite; I have not changed that existing expectation and will report its isolated result separately.

First `cargo test -p calternal-auth` run found two fixture updates required by the new auth migration: the migration-order assertion stopped at 15, and `cached_production_store_keeps_full_authority` called startup before applying the auth migrations (`Internal` from the missing Licence table). Both are fixed in the worktree. The same run also observed the existing `review_cache_bounds_ttl_and_keyed_digest` assertion at 3,130 entries instead of 4,096 after a 126-second, highly parallel suite; I have not changed that existing expectation and will report its isolated result separately.
kayg commented 2026-10-05 16:26:24 +00:00
Author
Owner
Copy link

The first server build found one exhaustive error translator in wire.rs that also handles AuthStore failures outside the new Admin route. It lacked the new user_limit, licence_clock and invalid_licence variants, so the server did not compile. The translator now maps them to 409, 409 and 400, matching the Auth API. OpenAPI generation also needs apps/web/build/ to exist because the server embeds the production SPA; the web build has not run yet.

The first server build found one exhaustive error translator in `wire.rs` that also handles AuthStore failures outside the new Admin route. It lacked the new `user_limit`, `licence_clock` and `invalid_licence` variants, so the server did not compile. The translator now maps them to 409, 409 and 400, matching the Auth API. OpenAPI generation also needs `apps/web/build/` to exist because the server embeds the production SPA; the web build has not run yet.
kayg commented 2026-10-05 16:38:31 +00:00
Author
Owner
Copy link

Auth validation exposed a stale API test key signed for nine years. The 366-day term bound rejected it as intended; the fixture now uses the current build date and a one-year term, with an explicit overlong-term regression test.

Auth validation exposed a stale API test key signed for nine years. The 366-day term bound rejected it as intended; the fixture now uses the current build date and a one-year term, with an explicit overlong-term regression test.
kayg commented 2026-10-05 16:51:32 +00:00
Author
Owner
Copy link

Web verification found a shared baseline issue: stops before analyzing sources because the committed exception ledger has 21,977 entries and the committed ratchet allows 21,964. Neither performance file is changed by this branch. I am running Svelte diagnostics and focused tests separately; I will include this exact gate block in the final report.

Web verification found a shared baseline issue: stops before analyzing sources because the committed exception ledger has 21,977 entries and the committed ratchet allows 21,964. Neither performance file is changed by this branch. I am running Svelte diagnostics and focused tests separately; I will include this exact gate block in the final report.
kayg commented 2026-10-05 16:52:20 +00:00
Author
Owner
Copy link

Web verification found a committed performance baseline mismatch. The performance preflight stops before source analysis because contracts/perf/exceptions.json contains 21,977 entries while contracts/perf/ratchet.json allows 21,964. Neither file is changed by this branch. I am running Svelte diagnostics and focused tests separately and will include the exact gate result in the final report.

Web verification found a committed performance baseline mismatch. The performance preflight stops before source analysis because contracts/perf/exceptions.json contains 21,977 entries while contracts/perf/ratchet.json allows 21,964. Neither file is changed by this branch. I am running Svelte diagnostics and focused tests separately and will include the exact gate result in the final report.
kayg commented 2026-10-05 17:11:47 +00:00
Author
Owner
Copy link

The Files crate gate reported one timeout under the shared full-suite run: public_password_rejection_does_not_wait_for_data_mutation_lock returned Elapsed(()) at crates/plugins/files/src/lib.rs:13688. The focused rerun passed 1 test in 1.82 seconds. I did not change its expectation; this is recorded as a shared-suite timing failure.

The Files crate gate reported one timeout under the shared full-suite run: public_password_rejection_does_not_wait_for_data_mutation_lock returned Elapsed(()) at crates/plugins/files/src/lib.rs:13688. The focused rerun passed 1 test in 1.82 seconds. I did not change its expectation; this is recorded as a shared-suite timing failure.
kayg commented 2026-10-05 17:31:25 +00:00
Author
Owner
Copy link

The first server test run found stale migration assertions after registering #1145's Auth 0016 and Files 0028 migrations. It reported 251 passed, 5 failed and 10 ignored: three upgrade tests expected the earlier migration receipt/count, and two existing nested live-app tests returned NotFound during startup. I have updated only upgrade expectations that must include the new migrations. I will rerun the focused upgrade tests and check the two live-app failures separately; no existing production fixture bytes were changed.

The first server test run found stale migration assertions after registering #1145's Auth 0016 and Files 0028 migrations. It reported 251 passed, 5 failed and 10 ignored: three upgrade tests expected the earlier migration receipt/count, and two existing nested live-app tests returned NotFound during startup. I have updated only upgrade expectations that must include the new migrations. I will rerun the focused upgrade tests and check the two live-app failures separately; no existing production fixture bytes were changed.
kayg commented 2026-10-05 17:36:24 +00:00
Author
Owner
Copy link

The two nested live-app failures in the first server test run were caused by the absent production SPA build: apps/web/build/_app/version.json is missing, and retain_frontend_assets returns NotFound when that embedded asset is absent. I will build the real SPA before the final server gate and screenshot run.

The two nested live-app failures in the first server test run were caused by the absent production SPA build: `apps/web/build/_app/version.json` is missing, and `retain_frontend_assets` returns `NotFound` when that embedded asset is absent. I will build the real SPA before the final server gate and screenshot run.
kayg commented 2026-10-05 18:33:37 +00:00
Author
Owner
Copy link

Final merged server gate finding: cargo test -p calternal-server -- --test-threads=4 completed with 255 passed, 1 failed, and 10 ignored. The nested wire::tests::startup_serves_http_while_upgrade_backfills_wait test timed out at its existing 15-second build_live_app bound. Multiple other Rust jobs were compiling/running on the shared host during this run. I will run the failing test once in isolation to classify the timeout.

Final merged server gate finding: `cargo test -p calternal-server -- --test-threads=4` completed with 255 passed, 1 failed, and 10 ignored. The nested `wire::tests::startup_serves_http_while_upgrade_backfills_wait` test timed out at its existing 15-second `build_live_app` bound. Multiple other Rust jobs were compiling/running on the shared host during this run. I will run the failing test once in isolation to classify the timeout.
kayg commented 2026-10-05 18:36:57 +00:00
Author
Owner
Copy link

Follow-up on the server gate finding: the single nested startup test also failed when run by itself. wire::tests::startup_serves_http_while_upgrade_backfills_wait took 15.38s and hit its unchanged 15s build_live_app timeout at crates/calternal-server/src/wire.rs:8436. I did not change the assertion. This remains a startup-timeout gap for the merge round to rerun on a quiet host; the feature's auth, Files, API and CLI crates passed their final gates.

Follow-up on the server gate finding: the single nested startup test also failed when run by itself. `wire::tests::startup_serves_http_while_upgrade_backfills_wait` took 15.38s and hit its unchanged 15s `build_live_app` timeout at `crates/calternal-server/src/wire.rs:8436`. I did not change the assertion. This remains a startup-timeout gap for the merge round to rerun on a quiet host; the feature's auth, Files, API and CLI crates passed their final gates.
kayg commented 2026-10-05 19:08:14 +00:00
Author
Owner
Copy link

Complete

Implemented the AGPL-compatible offline Licence feature for #1145. The server verifies bounded canonical Ed25519 keys locally and applies a shared active-User limit inside the SQLite writer transaction for setup, open signup, invite acceptance, Admin create, OIDC first login, and re-enable. It preserves access and data on lapse, supports pre-expiry build fallback, reports clock rollback without blocking reads, and writes audit records without key bytes. Added matching Admin API and CLI operations.

Settings now has Admin → Licence and an at-limit Users state with a live count, plain-language explanation, stable User links, verified key status, create/enable guards, and Undo for account changes. The browser never receives a stored key. The production-build browser flow created six active Users and captured all requested macOS-emulated sizes and themes. All 12 refreshed screenshots are attached below.

Files

  • Backend and schema: crates/calternal-auth/Cargo.toml, build.rs, migrations/0016_instance_licence.sql, src/{api.rs,error.rs,lib.rs,licence.rs,store.rs}; crates/plugins/files/migrations/0028_modified_mtime_lookup.sql and src/lib.rs; crates/calternal-api/src/lib.rs; crates/calternal-cli/src/main.rs; crates/calternal-server/src/{main.rs,upgrade_tests.rs,wire.rs}; Cargo.lock.
  • Contracts and client: contracts/{action-policy.json,cli.json,openapi.json,perf/registry.json}; packages/api-client/src/{generated.ts,index.ts,index.test.ts}.
  • UI and browser evidence: apps/web/e2e/licence-1145.mjs; apps/web/src/lib/auth/components/CreateAccountFlow.svelte; apps/web/src/routes/settings/admin/{AdminSection.svelte,LicenceGroup.svelte,LicenceGroup.svelte.test.ts,UsersGroup.svelte,UsersGroup.svelte.test.ts}; apps/web/src/routes/settings/{api.svelte.ts,api.svelte.test.ts,sections.ts,sections.test.ts}.
  • Design, test key and probes: docs/DESIGN.md; tests/fixtures/licence-test-seed.hex; tests/adversarial/{attack.py,authz_matrix.py,test_admin_classification.py}; bench/licence-1145.py.

Decisions beyond DESIGN §43

  • Key envelope: calternal-licence-v1.<base64url canonical JSON>.<base64url Ed25519 signature>, with fixed JSON field order and no padding. A yearly term is capped at 366 days; max_users: 0 means unlimited.
  • CLI mutations require --confirm; set reads bounded key text from a file or stdin, never from process arguments.
  • Release builds require CALTERNAL_LICENCE_PUBLIC_KEY. No production public key was supplied, so the release build remains an owner step. Debug builds default to an invalid sentinel; the screenshot run used a public key derived from the committed test-only fixture seed.
  • The newest clock-observed file time is MAX(files_index.modified) from the Files Index.

UX gaps

  • Closed: create, re-enable, disable, Role and quota changes use server authority; account changes offer Undo; the Users page reports “6 of 6 users”; Licence state and at-limit views have stable links and standard actions.
  • Left: after a page reload, the server does not return the stored key, so replacing or removing an existing key cannot restore that previous key through Undo. First-time installation can be undone while its key remains in page memory.

Screenshots

Admin Licence, light: 390, 820, 1440

Admin Licence, dark: 390, 820, 1440

Users at limit, light: 390, 820, 1440

Users at limit, dark: 390, 820, 1440

Gates (verbatim summaries)

  • cargo fmt --check: exit 0, no output.
  • Clippy passed for calternal-auth, calternal-plugin-files, calternal-api, calternal-cli, and calternal-server, each with --all-targets -- -D warnings.
  • Auth tests: test result: ok. 134 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 106.65s.
  • Files tests: test result: ok. 258 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 272.27s.
  • API tests: test result: ok. 18 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s.
  • CLI tests: 52 passed; 0 failed; 0 ignored; output-contract tests: 17 passed; 0 failed; 0 ignored.
  • Server tests: test result: FAILED. 255 passed; 1 failed; 10 ignored; 0 measured; 0 filtered out; finished in 123.91s. The nested startup_serves_http_while_upgrade_backfills_wait test hit its unchanged 15-second build_live_app timeout. An isolated retry also failed at 15.38s. The assertion was not changed; this needs a merge-round rerun.
  • bun run --cwd apps/web check stopped at the pre-existing shared perf-lint ratchet. Exact output:
perf-lint: INVALID: exception ratchet: contract.blaze: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.blocked-network: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; contract.dom-bound: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.model-bound: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.row-identity: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.snapshot: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; coverage.profile: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; coverage.readiness: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; io.unresolved-call: 16191 exceptions exceed the ratchet ceiling 16190; fix the new violation instead; render.blaze-adapter: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; render.bound: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; render.model_byte_cap: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; render.model_row_cap: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; total: ledger has 21977 exceptions; ratchet total is 21964
  • Direct Svelte check: svelte-check found 0 errors and 4 warnings in 3 files (the existing warnings are two empty UI rulesets and two Notes CSS selectors).
  • Focused Vitest: Test Files 4 passed (4) and Tests 38 passed (38); API client: 21 pass, 0 fail.
  • Static adversarial classification: Ran 15 tests in 2.636s / OK.
  • Production SPA build completed; the real-server browser run ended with PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS.
  • cargo clean completed: Removed 22791 files, 17.9GiB total. Web build output was deleted. Screenshots remain attached to this issue and are not committed.

For the merge round

  • bun run --cwd apps/web test — run the full web suite.
  • bun run --cwd apps/web test:e2e — run the full browser suite.
  • bash tests/adversarial/run.sh — run the XUser, authorization and robustness matrices against the real server.
  • cargo test -p calternal-server -- --test-threads=4 — rerun the server suite and prove live startup serves before the held upgrade backfill.
  • bun run --cwd apps/web check — rerun after the shared perf-lint exception ledger is reconciled.
  • Release build still needs the owner-supplied public key: CALTERNAL_LICENCE_PUBLIC_KEY=<owner-issued-public-key> cargo build -p calternal-server --release.

The Licence hot-path benchmark profile is committed at bench/licence-1145.py; I did not measure it because this issue is not a performance issue and the current verification policy runs perf measurements only for performance issues.

Head SHA: d7eacef9053913a95710d252aff4849e2bc32a0e.

## Complete Implemented the AGPL-compatible offline Licence feature for #1145. The server verifies bounded canonical Ed25519 keys locally and applies a shared active-User limit inside the SQLite writer transaction for setup, open signup, invite acceptance, Admin create, OIDC first login, and re-enable. It preserves access and data on lapse, supports pre-expiry build fallback, reports clock rollback without blocking reads, and writes audit records without key bytes. Added matching Admin API and CLI operations. Settings now has Admin → Licence and an at-limit Users state with a live count, plain-language explanation, stable User links, verified key status, create/enable guards, and Undo for account changes. The browser never receives a stored key. The production-build browser flow created six active Users and captured all requested macOS-emulated sizes and themes. All 12 refreshed screenshots are attached below. ## Files - Backend and schema: `crates/calternal-auth/Cargo.toml`, `build.rs`, `migrations/0016_instance_licence.sql`, `src/{api.rs,error.rs,lib.rs,licence.rs,store.rs}`; `crates/plugins/files/migrations/0028_modified_mtime_lookup.sql` and `src/lib.rs`; `crates/calternal-api/src/lib.rs`; `crates/calternal-cli/src/main.rs`; `crates/calternal-server/src/{main.rs,upgrade_tests.rs,wire.rs}`; `Cargo.lock`. - Contracts and client: `contracts/{action-policy.json,cli.json,openapi.json,perf/registry.json}`; `packages/api-client/src/{generated.ts,index.ts,index.test.ts}`. - UI and browser evidence: `apps/web/e2e/licence-1145.mjs`; `apps/web/src/lib/auth/components/CreateAccountFlow.svelte`; `apps/web/src/routes/settings/admin/{AdminSection.svelte,LicenceGroup.svelte,LicenceGroup.svelte.test.ts,UsersGroup.svelte,UsersGroup.svelte.test.ts}`; `apps/web/src/routes/settings/{api.svelte.ts,api.svelte.test.ts,sections.ts,sections.test.ts}`. - Design, test key and probes: `docs/DESIGN.md`; `tests/fixtures/licence-test-seed.hex`; `tests/adversarial/{attack.py,authz_matrix.py,test_admin_classification.py}`; `bench/licence-1145.py`. ## Decisions beyond DESIGN §43 - Key envelope: `calternal-licence-v1.<base64url canonical JSON>.<base64url Ed25519 signature>`, with fixed JSON field order and no padding. A yearly term is capped at 366 days; `max_users: 0` means unlimited. - CLI mutations require `--confirm`; `set` reads bounded key text from a file or stdin, never from process arguments. - Release builds require `CALTERNAL_LICENCE_PUBLIC_KEY`. No production public key was supplied, so the release build remains an owner step. Debug builds default to an invalid sentinel; the screenshot run used a public key derived from the committed test-only fixture seed. - The newest clock-observed file time is `MAX(files_index.modified)` from the Files Index. ## UX gaps - Closed: create, re-enable, disable, Role and quota changes use server authority; account changes offer Undo; the Users page reports “6 of 6 users”; Licence state and at-limit views have stable links and standard actions. - Left: after a page reload, the server does not return the stored key, so replacing or removing an existing key cannot restore that previous key through Undo. First-time installation can be undone while its key remains in page memory. ## Screenshots Admin Licence, light: [390](https://git.kayg.org/attachments/11fddf31-9893-46cd-8492-58fa5a66ef75), [820](https://git.kayg.org/attachments/231d5741-3766-4ffd-9e14-ff494cc94be2), [1440](https://git.kayg.org/attachments/3d4b20c7-5398-42b0-aa1f-10a36be20270) Admin Licence, dark: [390](https://git.kayg.org/attachments/1d0d18cd-9221-4329-97f8-d49bfa5acf9a), [820](https://git.kayg.org/attachments/1e60747d-ef8e-4a08-a921-47f4dc2b6df6), [1440](https://git.kayg.org/attachments/b8e6b47b-7c43-4a0a-9225-d47f9dea3ec9) Users at limit, light: [390](https://git.kayg.org/attachments/a0a5c03d-9b21-4379-8121-43af837498cd), [820](https://git.kayg.org/attachments/5dfd4fac-ed2a-4a3e-a11b-cc8c9d4e21f8), [1440](https://git.kayg.org/attachments/29c86b90-034d-4713-8733-9e081c9cbf6d) Users at limit, dark: [390](https://git.kayg.org/attachments/e90d38d3-aaba-4848-a677-fe456232daab), [820](https://git.kayg.org/attachments/8314cc90-c0a2-4f6f-8705-5872274f2b89), [1440](https://git.kayg.org/attachments/682de548-1023-44b5-b2ea-bbb80b4b6c1d) ## Gates (verbatim summaries) - `cargo fmt --check`: exit 0, no output. - Clippy passed for `calternal-auth`, `calternal-plugin-files`, `calternal-api`, `calternal-cli`, and `calternal-server`, each with `--all-targets -- -D warnings`. - Auth tests: `test result: ok. 134 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 106.65s`. - Files tests: `test result: ok. 258 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 272.27s`. - API tests: `test result: ok. 18 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s`. - CLI tests: `52 passed; 0 failed; 0 ignored`; output-contract tests: `17 passed; 0 failed; 0 ignored`. - Server tests: `test result: FAILED. 255 passed; 1 failed; 10 ignored; 0 measured; 0 filtered out; finished in 123.91s`. The nested `startup_serves_http_while_upgrade_backfills_wait` test hit its unchanged 15-second `build_live_app` timeout. An isolated retry also failed at `15.38s`. The assertion was not changed; this needs a merge-round rerun. - `bun run --cwd apps/web check` stopped at the pre-existing shared perf-lint ratchet. Exact output: ```text perf-lint: INVALID: exception ratchet: contract.blaze: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.blocked-network: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; contract.dom-bound: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.model-bound: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.row-identity: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; contract.snapshot: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; coverage.profile: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; coverage.readiness: 356 exceptions exceed the ratchet ceiling 355; fix the new violation instead; io.unresolved-call: 16191 exceptions exceed the ratchet ceiling 16190; fix the new violation instead; render.blaze-adapter: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; render.bound: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; render.model_byte_cap: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; render.model_row_cap: 290 exceptions exceed the ratchet ceiling 289; fix the new violation instead; total: ledger has 21977 exceptions; ratchet total is 21964 ``` - Direct Svelte check: `svelte-check found 0 errors and 4 warnings in 3 files` (the existing warnings are two empty UI rulesets and two Notes CSS selectors). - Focused Vitest: `Test Files 4 passed (4)` and `Tests 38 passed (38)`; API client: `21 pass`, `0 fail`. - Static adversarial classification: `Ran 15 tests in 2.636s` / `OK`. - Production SPA build completed; the real-server browser run ended with `PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS`. - `cargo clean` completed: `Removed 22791 files, 17.9GiB total`. Web build output was deleted. Screenshots remain attached to this issue and are not committed. ## For the merge round - `bun run --cwd apps/web test` — run the full web suite. - `bun run --cwd apps/web test:e2e` — run the full browser suite. - `bash tests/adversarial/run.sh` — run the XUser, authorization and robustness matrices against the real server. - `cargo test -p calternal-server -- --test-threads=4` — rerun the server suite and prove live startup serves before the held upgrade backfill. - `bun run --cwd apps/web check` — rerun after the shared perf-lint exception ledger is reconciled. - Release build still needs the owner-supplied public key: `CALTERNAL_LICENCE_PUBLIC_KEY=<owner-issued-public-key> cargo build -p calternal-server --release`. The Licence hot-path benchmark profile is committed at `bench/licence-1145.py`; I did not measure it because this issue is not a performance issue and the current verification policy runs perf measurements only for performance issues. Head SHA: `d7eacef9053913a95710d252aff4849e2bc32a0e`.
kayg commented 2026-10-05 19:08:54 +00:00
Author
Owner
Copy link

Clippy gate output addendum

The final post-merge clippy commands exited 0. Their terminal summaries were:

$ cargo clippy -p calternal-auth --all-targets -- -D warnings
    Checking calternal-auth v0.1.0 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-auth)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 14.52s

$ cargo clippy -p calternal-plugin-files --all-targets -- -D warnings
    Checking calternal-auth v0.1.0 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-auth)
    Checking calternal-plugin-files v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/files)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 29.06s

$ cargo clippy -p calternal-api --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.93s

$ cargo clippy -p calternal-cli --all-targets -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.59s

$ cargo clippy -p calternal-server --all-targets -- -D warnings
    Checking calternal-auth v0.1.0 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-auth)
   Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-server)
    Checking calternal-plugin-files v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/files)
    Checking calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-collab)
    Checking calternal-plugin-calendar v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/calendar)
    Checking calternal-plugin-video v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/video)
    Checking calternal-plugin-ai v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/ai)
    Checking calternal-plugin-photos v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/photos)
    Checking calternal-plugin-notifications v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/notifications)
    Checking calternal-plugin-analytics v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/analytics)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 04s
## Clippy gate output addendum The final post-merge clippy commands exited 0. Their terminal summaries were: ```text $ cargo clippy -p calternal-auth --all-targets -- -D warnings Checking calternal-auth v0.1.0 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-auth) Finished `dev` profile [unoptimized + debuginfo] target(s) in 14.52s $ cargo clippy -p calternal-plugin-files --all-targets -- -D warnings Checking calternal-auth v0.1.0 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-auth) Checking calternal-plugin-files v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/files) Finished `dev` profile [unoptimized + debuginfo] target(s) in 29.06s $ cargo clippy -p calternal-api --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.93s $ cargo clippy -p calternal-cli --all-targets -- -D warnings Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.59s $ cargo clippy -p calternal-server --all-targets -- -D warnings Checking calternal-auth v0.1.0 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-auth) Compiling calternal-server v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-server) Checking calternal-plugin-files v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/files) Checking calternal-collab v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/calternal-collab) Checking calternal-plugin-calendar v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/calendar) Checking calternal-plugin-video v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/video) Checking calternal-plugin-ai v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/ai) Checking calternal-plugin-photos v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/photos) Checking calternal-plugin-notifications v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/notifications) Checking calternal-plugin-analytics v0.0.1 (/home/kayg/Developer/calternal-wt/licence-1145/crates/plugins/analytics) Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 04s ```
kayg commented 2026-10-05 22:06:24 +00:00
Author
Owner
Copy link

Finish pass started on job/licence-1145. Original head: 6c0c0ca54. Merged origin/dev (41bf97fb2861ea6e4ea70aab7d3b15a1c9aa278d); current base: 5cbe0b4fc1a78fbd95d2350d9e7cab6080143ec0. Scope: committed public verification key, optional build override, and explicit Remove/Replace confirmation. No push or deploy.

Finish pass started on `job/licence-1145`. Original head: `6c0c0ca54`. Merged `origin/dev` (`41bf97fb2861ea6e4ea70aab7d3b15a1c9aa278d`); current base: `5cbe0b4fc1a78fbd95d2350d9e7cab6080143ec0`. Scope: committed public verification key, optional build override, and explicit Remove/Replace confirmation. No push or deploy.
kayg commented 2026-10-05 22:11:20 +00:00
Author
Owner
Copy link

Findings from the finish pass:

  • build.rs required an environment value for release and used an unconfigured key for other normal builds. It now reads the committed official public verifying key by default; the override must contain exactly 64 hex characters. Standalone checks passed for the no-override release path, a valid override, and malformed override rejection. Existing cfg(test) verification continues to use the separate fixture.
  • Replace previously saved immediately. It now uses the existing ConfirmSheet; both Remove and Replace say “You can add the key again from your licence email”. Removal no longer offers Undo. First-install Undo remains. The existing removal Undo expectation was changed because this finish-pass brief explicitly changes that behaviour; a replacement/Cancel regression was added. Focused Vitest: 2 tests passed.
  • After merging origin/dev, bun run check found a stale UsersGroup exact cache-read pin and local focus rings in LicenceGroup/UsersGroup. The rings are removed so shared focus tokens apply; exact live pins are being refreshed without changing limits.

Decisions: the brief specifies the recovery wording and default key. No new product decision was needed.

Findings from the finish pass: - `build.rs` required an environment value for release and used an unconfigured key for other normal builds. It now reads the committed official public verifying key by default; the override must contain exactly 64 hex characters. Standalone checks passed for the no-override release path, a valid override, and malformed override rejection. Existing `cfg(test)` verification continues to use the separate fixture. - Replace previously saved immediately. It now uses the existing ConfirmSheet; both Remove and Replace say “You can add the key again from your licence email”. Removal no longer offers Undo. First-install Undo remains. The existing removal Undo expectation was changed because this finish-pass brief explicitly changes that behaviour; a replacement/Cancel regression was added. Focused Vitest: 2 tests passed. - After merging origin/dev, `bun run check` found a stale UsersGroup exact cache-read pin and local focus rings in LicenceGroup/UsersGroup. The rings are removed so shared focus tokens apply; exact live pins are being refreshed without changing limits. Decisions: the brief specifies the recovery wording and default key. No new product decision was needed.
kayg commented 2026-10-05 22:24:48 +00:00
Author
Owner
Copy link

Gate progress:

  • cargo clippy -p calternal-auth --all-targets -- -D warnings passed: Finished dev profile [unoptimized + debuginfo] target(s) in 14m 47s.
  • bun run test --maxWorkers=2 passed: Test Files 268 passed (268); Tests 1838 passed (1838).
  • Focused Licence/Users tests passed: Test Files 2 passed (2); Tests 4 passed (4).
  • Perf-lint passes after refreshing the exact Users and auth-route scopes changed by #1145: perf-lint: PASS; 0 violations; 22114 scoped exceptions. All refreshed limits equal the live findings. The unchanged guards and future ratchet remain active.
  • Svelte type checking, auth tests, and the required no-override release build are in progress.
Gate progress: - `cargo clippy -p calternal-auth --all-targets -- -D warnings` passed: `Finished `dev` profile [unoptimized + debuginfo] target(s) in 14m 47s`. - `bun run test --maxWorkers=2` passed: `Test Files 268 passed (268)`; `Tests 1838 passed (1838)`. - Focused Licence/Users tests passed: `Test Files 2 passed (2)`; `Tests 4 passed (4)`. - Perf-lint passes after refreshing the exact Users and auth-route scopes changed by #1145: `perf-lint: PASS; 0 violations; 22114 scoped exceptions`. All refreshed limits equal the live findings. The unchanged guards and future ratchet remain active. - Svelte type checking, auth tests, and the required no-override release build are in progress.
kayg commented 2026-10-05 22:44:28 +00:00
Author
Owner
Copy link

Finish-pass commits are saved on job/licence-1145 (current head c74f82cee167b2492b6942b952745c85702a66ce). The worktree is clean. For the audit record, the actual starting worktree head was d7eacef9053913a95710d252aff4849e2bc32a0e; the brief cited the earlier 6c0c0ca54 feature head. origin/dev was merged once at 41bf97fb2861ea6e4ea70aab7d3b15a1c9aa278d.

Required auth and web gates have passed. Verbatim summaries:

Finished `dev` profile [unoptimized + debuginfo] target(s) in 14m 47s
test result: ok. 134 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 120.45s
svelte-check found 0 errors and 4 warnings in 3 files
Test Files  268 passed (268)
Tests  1838 passed (1838)

The release build with CALTERNAL_LICENCE_PUBLIC_KEY explicitly absent is still running. Screenshot capture follows it. No push or deploy.

Finish-pass commits are saved on `job/licence-1145` (current head `c74f82cee167b2492b6942b952745c85702a66ce`). The worktree is clean. For the audit record, the actual starting worktree head was `d7eacef9053913a95710d252aff4849e2bc32a0e`; the brief cited the earlier `6c0c0ca54` feature head. `origin/dev` was merged once at `41bf97fb2861ea6e4ea70aab7d3b15a1c9aa278d`. Required auth and web gates have passed. Verbatim summaries: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 14m 47s test result: ok. 134 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 120.45s svelte-check found 0 errors and 4 warnings in 3 files Test Files 268 passed (268) Tests 1838 passed (1838) ``` The release build with `CALTERNAL_LICENCE_PUBLIC_KEY` explicitly absent is still running. Screenshot capture follows it. No push or deploy.
kayg commented 2026-10-05 23:30:36 +00:00
Author
Owner
Copy link

Current head: 9489a2c41766eea210577ae2de8606faad044812. The screenshot fixture now selects macOS defaults at its first sign-in, before saving browser state for the width/theme matrix.

The no-override release build has generated its auth build information. I decoded COMPILED_LICENCE_PUBLIC_KEY from the release output and confirmed it matches the committed official key. The complete server release build is still compiling; no build failure is reported. Required auth and web gates remain passed.

Current head: `9489a2c41766eea210577ae2de8606faad044812`. The screenshot fixture now selects macOS defaults at its first sign-in, before saving browser state for the width/theme matrix. The no-override release build has generated its auth build information. I decoded `COMPILED_LICENCE_PUBLIC_KEY` from the release output and confirmed it matches the committed official key. The complete server release build is still compiling; no build failure is reported. Required auth and web gates remain passed.
kayg commented 2026-10-05 23:40:25 +00:00
Author
Owner
Copy link

Required no-override release build passed at head 9489a2c41766eea210577ae2de8606faad044812. Command: env -u CALTERNAL_LICENCE_PUBLIC_KEY cargo build --release -p calternal-server. Exit: 0. Verbatim completion:

    Finished `release` profile [optimized] target(s) in 91m 29s

The generated release public key matches crates/calternal-auth/licence-public-key.hex. The official-build binary SHA-256 is recorded locally in artifacts/licence-1145/official-server.sha256. I am now using the explicit test authority override for the real-server screenshot fixture; the committed default key stays unchanged.

Required no-override release build passed at head `9489a2c41766eea210577ae2de8606faad044812`. Command: `env -u CALTERNAL_LICENCE_PUBLIC_KEY cargo build --release -p calternal-server`. Exit: 0. Verbatim completion: ```text Finished `release` profile [optimized] target(s) in 91m 29s ``` The generated release public key matches `crates/calternal-auth/licence-public-key.hex`. The official-build binary SHA-256 is recorded locally in `artifacts/licence-1145/official-server.sha256`. I am now using the explicit test authority override for the real-server screenshot fixture; the committed default key stays unchanged.
kayg commented 2026-10-05 23:58:49 +00:00
Author
Owner
Copy link

Real-server review finding: the first capture run completed Licence and both confirmation sheets in all six width/theme combinations, then PUT /api/v1/appearance returned 507 with “Home storage quota or server free-space reserve reached”. The shared root disk had 29 GiB available on a 591 GiB filesystem; the existing reserve is at least 5% of filesystem size. The failed run is preserved in artifacts/licence-1145/e2e-disk-reserve.log.

I preserved the fixture server binary, ran the required cargo clean (Removed 14254 files, 5.3GiB total), and pointed this worktree’s target/tmp at a job-owned temporary directory on the secondary disk (241 GiB available). The complete capture is rerunning there. No production storage guard or test expectation was changed.

Real-server review finding: the first capture run completed Licence and both confirmation sheets in all six width/theme combinations, then `PUT /api/v1/appearance` returned 507 with “Home storage quota or server free-space reserve reached”. The shared root disk had 29 GiB available on a 591 GiB filesystem; the existing reserve is at least 5% of filesystem size. The failed run is preserved in `artifacts/licence-1145/e2e-disk-reserve.log`. I preserved the fixture server binary, ran the required `cargo clean` (`Removed 14254 files, 5.3GiB total`), and pointed this worktree’s `target/tmp` at a job-owned temporary directory on the secondary disk (241 GiB available). The complete capture is rerunning there. No production storage guard or test expectation was changed.
kayg commented 2026-10-06 00:08:24 +00:00
Author
Owner
Copy link

Finish pass complete for #1145. Head: 9489a2c41766eea210577ae2de8606faad044812 on job/licence-1145. The worktree is clean. origin/dev (41bf97fb2861ea6e4ea70aab7d3b15a1c9aa278d) was merged once. No push or deploy.

Built:

  • Normal debug and release builds read the committed official public verifying key. CALTERNAL_LICENCE_PUBLIC_KEY remains an explicit override. Both inputs require 64 hex characters. The build comments state that the owner holds the signing key privately. Existing cfg(test) fixture verification stays unchanged.
  • Remove and Replace confirm with “You can add the key again from your licence email”. Neither action promises Undo. First-install Undo stays as built. Replace supports Cancel, focus return, and the dialog hint for screen readers.
  • Licence and Users use the shared focus ring. Exact performance pins changed by #1145 were refreshed from live findings; limits and the future ratchet remain active.
  • The real-server review covers Licence, Users at six active Users, and both confirmation sheets at 390/820/1440 px, light/dark, with macOS defaults from first sign-in.

Files:

  • apps/web/e2e/licence-1145.mjs
  • apps/web/src/routes/settings/admin/LicenceGroup.svelte
  • apps/web/src/routes/settings/admin/LicenceGroup.svelte.test.ts
  • apps/web/src/routes/settings/admin/UsersGroup.svelte
  • contracts/perf/adoption-1058.json
  • contracts/perf/exceptions.json
  • contracts/perf/ratchet.json
  • crates/calternal-auth/build.rs
  • crates/calternal-auth/licence-public-key.hex

Gates passed. These are verbatim summaries; the links below contain complete logs.

env -u CALTERNAL_LICENCE_PUBLIC_KEY cargo build --release -p calternal-server (exit 0):

    Finished `release` profile [optimized] target(s) in 91m 29s

The generated release verifying key matched the committed official key. The binary SHA-256 was recorded before the explicit test-authority rebuild.

cargo fmt --check: exit 0, no output.

cargo clippy -p calternal-auth --all-targets -- -D warnings (exit 0):

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 14m 47s

cargo test -p calternal-auth (exit 0):

test result: ok. 134 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 120.45s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Standalone build-script regressions (exit 0):

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

The compiled build script also passed direct checks for a no-override release, an explicit public-key override, and clear malformed-override rejection.

cd apps/web && bun run check (exit 0):

perf-lint: PASS; 0 violations; 22114 scoped exceptions
svelte-check found 0 errors and 4 warnings in 3 files

cd apps/web && bun run test --maxWorkers=2 (exit 0):

 Test Files  268 passed (268)
      Tests  1838 passed (1838)

Focused Licence/Users Vitest (exit 0):

 Test Files  2 passed (2)
      Tests  4 passed (4)

Production web build: exit 0. Real-server review (exit 0):

PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS

UX gaps closed: Replace now waits for confirmation; Cancel keeps the draft and old key. Remove and Replace state how to recover the key without an Undo promise. Shared focus styling and macOS review defaults are used.

UX gaps left / known gaps: restoring an old key after reload needs the licence email, as accepted in this brief. Auth has three existing ignored tests. Svelte reports four warnings in unchanged CSS files. The separate startup_serves_http_while_upgrade_backfills_wait timeout was not chased. Visual review remains with Claude.

Review environment: the first capture hit the shared root disk's 5% reserve and returned the expected storage-full 507 on an Appearance write. I preserved that log, cleaned the job's Cargo output, and moved this worktree's temporary test data to the secondary disk. Cleaning also removed the preserved server's shared runtime; I restored the pinned 1.13.8 runtime for the fixture. The final complete capture passed. No storage guard or status expectation was changed.

Decisions: no new product decisions beyond the brief. Normal builds use the official key; tests and self-hosters can explicitly choose another authority. No new dependencies or migrations were added. Performance measurement is deferred under the current verification policy because this is not a performance issue.

For the merge round: Claude reviews the attached screenshot set. Run cargo clippy -p calternal-server --all-targets -- -D warnings and cargo test -p calternal-server -- --test-threads=4 on the combined branch to check the full server/API integration; the separately filed startup timeout stays with its owner. Full adversarial matrices remain with the merge round under the verification policy.

Evidence:

Screenshots (all macOS rendering):

Cleanup: cargo clean removed 14254 files (5.3GiB). The web build output, temporary review server, pinned runtime and test data were deleted. Review screenshots and logs remain in the worktree and on the issue. Doc comments were re-read before this report.

Finish pass complete for #1145. Head: `9489a2c41766eea210577ae2de8606faad044812` on `job/licence-1145`. The worktree is clean. `origin/dev` (`41bf97fb2861ea6e4ea70aab7d3b15a1c9aa278d`) was merged once. No push or deploy. Built: - Normal debug and release builds read the committed official public verifying key. `CALTERNAL_LICENCE_PUBLIC_KEY` remains an explicit override. Both inputs require 64 hex characters. The build comments state that the owner holds the signing key privately. Existing `cfg(test)` fixture verification stays unchanged. - Remove and Replace confirm with “You can add the key again from your licence email”. Neither action promises Undo. First-install Undo stays as built. Replace supports Cancel, focus return, and the dialog hint for screen readers. - Licence and Users use the shared focus ring. Exact performance pins changed by #1145 were refreshed from live findings; limits and the future ratchet remain active. - The real-server review covers Licence, Users at six active Users, and both confirmation sheets at 390/820/1440 px, light/dark, with macOS defaults from first sign-in. Files: - `apps/web/e2e/licence-1145.mjs` - `apps/web/src/routes/settings/admin/LicenceGroup.svelte` - `apps/web/src/routes/settings/admin/LicenceGroup.svelte.test.ts` - `apps/web/src/routes/settings/admin/UsersGroup.svelte` - `contracts/perf/adoption-1058.json` - `contracts/perf/exceptions.json` - `contracts/perf/ratchet.json` - `crates/calternal-auth/build.rs` - `crates/calternal-auth/licence-public-key.hex` Gates passed. These are verbatim summaries; the links below contain complete logs. `env -u CALTERNAL_LICENCE_PUBLIC_KEY cargo build --release -p calternal-server` (exit 0): ```text Finished `release` profile [optimized] target(s) in 91m 29s ``` The generated release verifying key matched the committed official key. The binary SHA-256 was recorded before the explicit test-authority rebuild. `cargo fmt --check`: exit 0, no output. `cargo clippy -p calternal-auth --all-targets -- -D warnings` (exit 0): ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 14m 47s ``` `cargo test -p calternal-auth` (exit 0): ```text test result: ok. 134 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 120.45s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Standalone build-script regressions (exit 0): ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ``` The compiled build script also passed direct checks for a no-override release, an explicit public-key override, and clear malformed-override rejection. `cd apps/web && bun run check` (exit 0): ```text perf-lint: PASS; 0 violations; 22114 scoped exceptions svelte-check found 0 errors and 4 warnings in 3 files ``` `cd apps/web && bun run test --maxWorkers=2` (exit 0): ```text Test Files 268 passed (268) Tests 1838 passed (1838) ``` Focused Licence/Users Vitest (exit 0): ```text Test Files 2 passed (2) Tests 4 passed (4) ``` Production web build: exit 0. Real-server review (exit 0): ```text PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS ``` UX gaps closed: Replace now waits for confirmation; Cancel keeps the draft and old key. Remove and Replace state how to recover the key without an Undo promise. Shared focus styling and macOS review defaults are used. UX gaps left / known gaps: restoring an old key after reload needs the licence email, as accepted in this brief. Auth has three existing ignored tests. Svelte reports four warnings in unchanged CSS files. The separate `startup_serves_http_while_upgrade_backfills_wait` timeout was not chased. Visual review remains with Claude. Review environment: the first capture hit the shared root disk's 5% reserve and returned the expected storage-full 507 on an Appearance write. I preserved that log, cleaned the job's Cargo output, and moved this worktree's temporary test data to the secondary disk. Cleaning also removed the preserved server's shared runtime; I restored the pinned 1.13.8 runtime for the fixture. The final complete capture passed. No storage guard or status expectation was changed. Decisions: no new product decisions beyond the brief. Normal builds use the official key; tests and self-hosters can explicitly choose another authority. No new dependencies or migrations were added. Performance measurement is deferred under the current verification policy because this is not a performance issue. For the merge round: Claude reviews the attached screenshot set. Run `cargo clippy -p calternal-server --all-targets -- -D warnings` and `cargo test -p calternal-server -- --test-threads=4` on the combined branch to check the full server/API integration; the separately filed startup timeout stays with its owner. Full adversarial matrices remain with the merge round under the verification policy. Evidence: - [release.log](https://git.kayg.org/attachments/13350308-7fe2-462d-8718-9b1051fb5af5) - [clippy-auth.log](https://git.kayg.org/attachments/e6caf174-3283-4285-bbf1-0fe9c54d8122) - [test-auth.log](https://git.kayg.org/attachments/4815c8e0-9fca-4354-91bd-b7332c2e788d) - [web-check-ready.log](https://git.kayg.org/attachments/0555b9e3-800a-4591-8dee-870e15bc9b3a) - [web-test.log](https://git.kayg.org/attachments/5c3db38b-25f1-49cd-8ebc-6333014ed71f) - [vitest-final.log](https://git.kayg.org/attachments/fc72c41a-9635-4056-894d-67575bec58d5) - [build-script-tests.log](https://git.kayg.org/attachments/599b5833-db84-46a0-8821-94f011448971) - [e2e.log](https://git.kayg.org/attachments/c5d60588-d2a2-41ed-ab21-fa1510c42b38) Screenshots (all macOS rendering): - licence: [paper 390](https://git.kayg.org/attachments/5f186891-a64b-4dd9-b484-ccda941b9099), [paper 820](https://git.kayg.org/attachments/394b7e63-3b0a-4942-acda-2069c6168c43), [paper 1440](https://git.kayg.org/attachments/17d8ae2a-3ec9-4cae-ad46-e23c64879fc0), [tokyo-night 390](https://git.kayg.org/attachments/08a2ef7c-5183-4765-87b0-505682ae7441), [tokyo-night 820](https://git.kayg.org/attachments/72a7518f-14ff-4323-8022-1ce6d67496bd), [tokyo-night 1440](https://git.kayg.org/attachments/c70040cf-8580-4d3c-b1e9-a15e5852ac2e) - users-at-limit: [paper 390](https://git.kayg.org/attachments/bdb6a499-bf16-4fbf-ac8c-1520f7c20364), [paper 820](https://git.kayg.org/attachments/064825a1-e3bd-420a-958d-4738d03c7988), [paper 1440](https://git.kayg.org/attachments/9a5708ec-ea5a-4ed0-b3bd-7a3854710df0), [tokyo-night 390](https://git.kayg.org/attachments/d658c790-d414-4da3-b15e-3c9d48bf3408), [tokyo-night 820](https://git.kayg.org/attachments/282003da-735c-4900-aec0-d28971b49073), [tokyo-night 1440](https://git.kayg.org/attachments/5430d131-1fb8-4c8b-9ef8-242127848565) - remove: [paper 390](https://git.kayg.org/attachments/c872afac-dba0-43a5-afcd-e2b2c7515f4f), [paper 820](https://git.kayg.org/attachments/6822b374-476a-4dba-a426-155d0b6842a9), [paper 1440](https://git.kayg.org/attachments/23af0200-f69e-4ade-b187-4f7e613663de), [tokyo-night 390](https://git.kayg.org/attachments/ae610159-ea21-44e0-bc11-cfd929c88f33), [tokyo-night 820](https://git.kayg.org/attachments/76c8a979-8a20-406d-83d8-8c26882b0b0e), [tokyo-night 1440](https://git.kayg.org/attachments/9a9bbe8c-0c22-45ff-be66-a317c8b0a5e5) - replace: [paper 390](https://git.kayg.org/attachments/b96b412b-e8a2-4bc4-ad7a-0773c146532a), [paper 820](https://git.kayg.org/attachments/0b90c08b-a28e-4fa9-87c8-6400dcbb1654), [paper 1440](https://git.kayg.org/attachments/ae4cef29-f8e7-4820-b639-63fb2e4cf421), [tokyo-night 390](https://git.kayg.org/attachments/8c688430-44fb-43d3-a6e2-3e2e54bb7482), [tokyo-night 820](https://git.kayg.org/attachments/ca232dd9-2d7c-4086-a6d9-932c172961d5), [tokyo-night 1440](https://git.kayg.org/attachments/18066122-6e73-4913-9e5f-329b7855051f) Cleanup: `cargo clean` removed 14254 files (5.3GiB). The web build output, temporary review server, pinned runtime and test data were deleted. Review screenshots and logs remain in the worktree and on the issue. Doc comments were re-read before this report.
kayg commented 2026-10-06 06:45:19 +00:00
Author
Owner
Copy link

Starting merge round 29 on job/merge29, base f5fbced3c. I will integrate reviewed #1145, #1161, #1160 and #1157 one at a time, retain both sides of conflicts, reconcile health/config contracts and exact perf pins, then run the requested combined gates. No push or deployment.

Starting merge round 29 on `job/merge29`, base `f5fbced3c`. I will integrate reviewed #1145, #1161, #1160 and #1157 one at a time, retain both sides of conflicts, reconcile health/config contracts and exact perf pins, then run the requested combined gates. No push or deployment.
kayg commented 2026-10-06 06:52:05 +00:00
Author
Owner
Copy link

Merge integration heads: Licence 1b1211347, Startup 392ae9cd0, Mail network 951870716, Bulk import ab4f7688f. Required git fetch origin and git merge origin/dev completed once; already up to date at f5fbced3c. No migration collisions (Auth 0016, Files 0028 added; Notes 0034/0035 retained).

Health reconciliation uses #1161’s one shape: {"state":"migrating","progress":{"phase":"…"}}, then {"state":"ok","progress":null}. Both schema work and post-bind stages use the same shared state; #1156’s operations contract and corresponding changed-behavior tests are updated. Content-free phases retain background-worker and private-search stages too. No percentage is emitted because stages use unlike units. The config contract will distinguish CALTERNAL_LICENCE_PUBLIC_KEY as a build-time override, separate from runtime Mail CIDRs.

Toast conflict: Licence Undo is retained under #1142’s policy. Failed Undo now offers Try again so its error stays visible; simple confirmations are dropped. Existing public preview checks delegate to the shared public classifier; Mail CIDR allowances never apply to previews. Cold combined builds and full web tests are running.

Merge integration heads: Licence `1b1211347`, Startup `392ae9cd0`, Mail network `951870716`, Bulk import `ab4f7688f`. Required `git fetch origin` and `git merge origin/dev` completed once; already up to date at `f5fbced3c`. No migration collisions (Auth 0016, Files 0028 added; Notes 0034/0035 retained). Health reconciliation uses #1161’s one shape: `{"state":"migrating","progress":{"phase":"…"}}`, then `{"state":"ok","progress":null}`. Both schema work and post-bind stages use the same shared state; #1156’s operations contract and corresponding changed-behavior tests are updated. Content-free phases retain background-worker and private-search stages too. No percentage is emitted because stages use unlike units. The config contract will distinguish `CALTERNAL_LICENCE_PUBLIC_KEY` as a build-time override, separate from runtime Mail CIDRs. Toast conflict: Licence Undo is retained under #1142’s policy. Failed Undo now offers Try again so its error stays visible; simple confirmations are dropped. Existing public preview checks delegate to the shared public classifier; Mail CIDR allowances never apply to previews. Cold combined builds and full web tests are running.
kayg commented 2026-10-06 07:04:04 +00:00
Author
Owner
Copy link

Combined web verification passed on the merged branch after exact live pin refresh. Generated action registry is committed at 8b5e7dcb8; failed-Undo Retry integration and regression are committed at 8f1654134.

Verbatim summaries:

911 packages installed [4.54s]
perf-lint: PASS; 0 violations; 22292 scoped exceptions
svelte-check found 0 errors and 2 warnings in 2 files
 Test Files  276 passed (276)
      Tests  1920 passed (1920)
 21 pass
 0 fail

Focused Licence/Users/toast policy verification: 3 files, 6 tests passed. Self-host artifact tests: 6 passed. The initial web check used the pre-Undo pin and failed; final bun run check passed after refreshing that exact pin. Rust combined gates are still compiling on the cold job target. No test timing threshold was changed.

Combined web verification passed on the merged branch after exact live pin refresh. Generated action registry is committed at `8b5e7dcb8`; failed-Undo Retry integration and regression are committed at `8f1654134`. Verbatim summaries: ```text 911 packages installed [4.54s] perf-lint: PASS; 0 violations; 22292 scoped exceptions svelte-check found 0 errors and 2 warnings in 2 files Test Files 276 passed (276) Tests 1920 passed (1920) 21 pass 0 fail ``` Focused Licence/Users/toast policy verification: 3 files, 6 tests passed. Self-host artifact tests: 6 passed. The initial web check used the pre-Undo pin and failed; final `bun run check` passed after refreshing that exact pin. Rust combined gates are still compiling on the cold job target. No test timing threshold was changed.
kayg commented 2026-10-06 07:07:30 +00:00
Author
Owner
Copy link

Combined Rust check found an integration syntax error: after moving startup progress from AppState to the shared Extension, an AppState field doc comment remained without a field (error[E0585] at main.rs:345). Removed that obsolete comment. The cold dependency check had otherwise reached all merged Plugin crates. Regeneration and the final per-crate gates follow the fix. No test expectation changed for this fix.

Standalone official public-key build-script regressions pass under Rust edition 2024: test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s.

Combined Rust check found an integration syntax error: after moving startup progress from AppState to the shared Extension, an AppState field doc comment remained without a field (`error[E0585]` at main.rs:345). Removed that obsolete comment. The cold dependency check had otherwise reached all merged Plugin crates. Regeneration and the final per-crate gates follow the fix. No test expectation changed for this fix. Standalone official public-key build-script regressions pass under Rust edition 2024: `test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s`.
kayg commented 2026-10-06 07:39:25 +00:00
Author
Owner
Copy link

Fresh combined-build browser evidence: the official-key build uses Free policy and admits exactly six active Users. The real Admin form created five Users beside the Owner. The run passed, and all 12 screenshots are attached. macOS is emulated from the first sign-in; visual review remains with Claude.

View Width Light Dark
licence 390 paper tokyo-night
licence 820 paper tokyo-night
licence 1440 paper tokyo-night
users-at-limit 390 paper tokyo-night
users-at-limit 820 paper tokyo-night
users-at-limit 1440 paper tokyo-night

Verbatim browser result:

PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS

Operations contract generation passed 5 tests. Self-host artifacts passed 6 tests. Configuration and operations outputs are committed at d7f5d62b9 and e03e16d6e. The final OpenAPI regeneration and Rust gates are in progress. The separate signed-key and Remove/Replace screenshot set remains on this issue from the reviewed feature branch.

Fresh combined-build browser evidence: the official-key build uses Free policy and admits exactly six active Users. The real Admin form created five Users beside the Owner. The run passed, and all 12 screenshots are attached. macOS is emulated from the first sign-in; visual review remains with Claude. | View | Width | Light | Dark | | --- | ---: | --- | --- | | licence | 390 | [paper](https://git.kayg.org/attachments/9b57ec5c-0d11-44cf-ae54-f977fb145ef4) | [tokyo-night](https://git.kayg.org/attachments/a61d7c2a-c5b5-4ed5-b8b6-a1aef8655380) | | licence | 820 | [paper](https://git.kayg.org/attachments/aac41a41-1611-4268-ae54-c79bab6990ff) | [tokyo-night](https://git.kayg.org/attachments/6424a329-5508-4150-a097-9be97754af1c) | | licence | 1440 | [paper](https://git.kayg.org/attachments/94cdf430-6b11-4dd5-8ed6-f01a84d0b913) | [tokyo-night](https://git.kayg.org/attachments/eb3485f2-27dc-4db3-94ff-0137f56bc04b) | | users-at-limit | 390 | [paper](https://git.kayg.org/attachments/ed4d0084-0941-4bee-9248-b6e8bec1a4a5) | [tokyo-night](https://git.kayg.org/attachments/459fff6f-9304-4f85-83ae-dd0818c90185) | | users-at-limit | 820 | [paper](https://git.kayg.org/attachments/00373774-e5a7-4193-9206-99f24bfa78c7) | [tokyo-night](https://git.kayg.org/attachments/0828619e-fbe4-4de5-a27e-baeef6bce717) | | users-at-limit | 1440 | [paper](https://git.kayg.org/attachments/276b54bd-fc7d-4451-b162-7fb1083d55c6) | [tokyo-night](https://git.kayg.org/attachments/fa8330a5-b658-449f-90a8-80148e56c503) | Verbatim browser result: ```text PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS ``` Operations contract generation passed 5 tests. Self-host artifacts passed 6 tests. Configuration and operations outputs are committed at `d7f5d62b9` and `e03e16d6e`. The final OpenAPI regeneration and Rust gates are in progress. The separate signed-key and Remove/Replace screenshot set remains on this issue from the reviewed feature branch.
kayg commented 2026-10-06 07:43:02 +00:00
Author
Owner
Copy link

Merge29j reproduced #1172 on combined source e03e16d6e, based on f5fbced3c. bun run --cwd apps/web test:e2e used the real merged server, current production SPA, macOS emulation and a fresh Instance. Setup/passkey/recovery, real Daily note Log creation and real Note creation passed. CSP reports were zero across two pages. The run then stopped at the existing Ask geometry check. Tab Bar, SegmentedControl and shell.mjs have no diff from this round’s base. No expectation or timing threshold was changed.

Exact failure:

Error: tray viewport did not settle: {"viewport":1440,"visible":["Files","Photos","Mail","Ask"],"selected":"Ask","scrollLeft":106,"trackWidth":274,"clientWidth":274,"scrollWidth":380,"inputModality":"pointer","selectedAnimations":[],"tabs":[{"label":"Calendar","left":483,"right":528},{"label":"Tasks","left":528,"right":573},{"label":"Notes","left":573,"right":618},{"label":"Files","left":618,"right":663},{"label":"Photos","left":663,"right":708},{"label":"Mail","left":708,"right":753},{"label":"Ask","left":753,"right":835}]}

This is the same non-SLOW cosmetic finding already filed in #1172; no duplicate issue was created. All 12 fresh Licence/at-limit Users screenshots passed and are attached to #1145. The requested Rust gates continue separately.

Merge29j reproduced #1172 on combined source `e03e16d6e`, based on `f5fbced3c`. `bun run --cwd apps/web test:e2e` used the real merged server, current production SPA, macOS emulation and a fresh Instance. Setup/passkey/recovery, real Daily note Log creation and real Note creation passed. CSP reports were zero across two pages. The run then stopped at the existing Ask geometry check. Tab Bar, SegmentedControl and shell.mjs have no diff from this round’s base. No expectation or timing threshold was changed. Exact failure: ```text Error: tray viewport did not settle: {"viewport":1440,"visible":["Files","Photos","Mail","Ask"],"selected":"Ask","scrollLeft":106,"trackWidth":274,"clientWidth":274,"scrollWidth":380,"inputModality":"pointer","selectedAnimations":[],"tabs":[{"label":"Calendar","left":483,"right":528},{"label":"Tasks","left":528,"right":573},{"label":"Notes","left":573,"right":618},{"label":"Files","left":618,"right":663},{"label":"Photos","left":663,"right":708},{"label":"Mail","left":708,"right":753},{"label":"Ask","left":753,"right":835}]} ``` This is the same non-SLOW cosmetic finding already filed in #1172; no duplicate issue was created. All 12 fresh Licence/at-limit Users screenshots passed and are attached to #1145. The requested Rust gates continue separately.
kayg commented 2026-10-06 08:08:00 +00:00
Author
Owner
Copy link

Server clippy passed with warnings denied. The isolated live-app runner advanced past startup_serves_http_while_upgrade_backfills_wait, so #1161's startup HTTP timeout regression passed in this run. No timing budget was changed.

One static test observation for owner review: the existing completion loop still waits for count == 3 in notes_daily_note_migrations_by_user, while Notes now runs five metadata migrations (the additional stable identity and date paths are retained). The current run passed that check, likely at the intermediate receipt count. I retained the existing expectation as required; this is not reported as a runtime failure. The final server suite is still running its remaining isolated checks.

Server clippy passed with warnings denied. The isolated live-app runner advanced past `startup_serves_http_while_upgrade_backfills_wait`, so #1161's startup HTTP timeout regression passed in this run. No timing budget was changed. One static test observation for owner review: the existing completion loop still waits for `count == 3` in `notes_daily_note_migrations_by_user`, while Notes now runs five metadata migrations (the additional stable identity and date paths are retained). The current run passed that check, likely at the intermediate receipt count. I retained the existing expectation as required; this is not reported as a runtime failure. The final server suite is still running its remaining isolated checks.
kayg commented 2026-10-06 08:12:41 +00:00
Author
Owner
Copy link

The standalone calternal-plugin clippy gate found clippy::items_after_test_module in outbound.rs: the retained public-preview compatibility wrapper was placed after the reviewed branch's test module. The fix moves the same documented function above the test module. Its body and policy are unchanged; no lint allow is added.

Server gates passed: 265 unit tests plus both integration tests, with the isolated startup checks included. Web check and the full web suite passed. Remaining crate gates continue sequentially. The failing Plugin log is retained; the final gate will be rerun for this fix.

The standalone `calternal-plugin` clippy gate found `clippy::items_after_test_module` in outbound.rs: the retained public-preview compatibility wrapper was placed after the reviewed branch's test module. The fix moves the same documented function above the test module. Its body and policy are unchanged; no lint allow is added. Server gates passed: 265 unit tests plus both integration tests, with the isolated startup checks included. Web check and the full web suite passed. Remaining crate gates continue sequentially. The failing Plugin log is retained; the final gate will be rerun for this fix.
kayg commented 2026-10-06 08:39:31 +00:00
Author
Owner
Copy link

Combined gates now pass for calternal-server, calternal-plugin, calternal-plugin-notes and calternal-auth (clippy with warnings denied plus each crate's tests). Mail and Calendar remain in the sequential run.

The final full web run on committed source also passed; its earlier run overlapped the Undo edit, so the final one removes that uncertainty. Verbatim summaries:

 Test Files  276 passed (276)
      Tests  1920 passed (1920)
test result: ok. 265 passed; 0 failed; 11 ignored; 0 measured; 0 filtered out; finished in 365.85s
test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.91s
test result: ok. 306 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 688.43s
test result: ok. 135 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 114.54s

Server's isolated live-app group includes and passed both #1161 startup regressions. Notes includes and passed date mtime preservation, Tag writer serialization, and the 700-Note reconcile test. Original ignore markers remain unchanged; ignored performance/explicit review tests are listed in the final report.

Head 01b0d3b94; worktree clean. Plugin clippy's item-order failure was fixed without a lint allow, and its final clippy gate passed. Exact pins still pass at 22,292 entries.

Combined gates now pass for calternal-server, calternal-plugin, calternal-plugin-notes and calternal-auth (clippy with warnings denied plus each crate's tests). Mail and Calendar remain in the sequential run. The final full web run on committed source also passed; its earlier run overlapped the Undo edit, so the final one removes that uncertainty. Verbatim summaries: ```text Test Files 276 passed (276) Tests 1920 passed (1920) test result: ok. 265 passed; 0 failed; 11 ignored; 0 measured; 0 filtered out; finished in 365.85s test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.91s test result: ok. 306 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 688.43s test result: ok. 135 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 114.54s ``` Server's isolated live-app group includes and passed both #1161 startup regressions. Notes includes and passed date mtime preservation, Tag writer serialization, and the 700-Note reconcile test. Original ignore markers remain unchanged; ignored performance/explicit review tests are listed in the final report. Head `01b0d3b94`; worktree clean. Plugin clippy's item-order failure was fixed without a lint allow, and its final clippy gate passed. Exact pins still pass at 22,292 entries.
kayg commented 2026-10-06 08:49:25 +00:00
Author
Owner
Copy link

Merge29j at 01b0d3b94 reproduced the same delta regression in the full Mail crate run. No Mail sync.rs code or assertion changed in this merge set. Mail clippy passed.

Verbatim failure:

first delta pass failed: Transport; classified log:  WARN mail sync step failed step="cache" error_kind="storage"
test result: FAILED. 127 passed; 1 failed; 6 ignored; 0 measured; 0 filtered out; finished in 28.90s

The isolated follow-up retained the real 8,100-UID fixture, UID 8,000 cursor assertion and second-pass completion. It passed with --exact --test-threads=1 --nocapture:

test sync::tests::delta_catch_up_shares_the_bounded_window_budget_and_resumes ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 133 filtered out; finished in 22.85s

A single full crate follow-up is now running with --test-threads=4. No SLOW-only diagnosis is claimed: the captured failure class is storage, and the underlying error is intentionally private. The original failure log is retained for attachment to #1145.

Merge29j at `01b0d3b94` reproduced the same delta regression in the full Mail crate run. No Mail sync.rs code or assertion changed in this merge set. Mail clippy passed. Verbatim failure: ```text first delta pass failed: Transport; classified log: WARN mail sync step failed step="cache" error_kind="storage" test result: FAILED. 127 passed; 1 failed; 6 ignored; 0 measured; 0 filtered out; finished in 28.90s ``` The isolated follow-up retained the real 8,100-UID fixture, UID 8,000 cursor assertion and second-pass completion. It passed with `--exact --test-threads=1 --nocapture`: ```text test sync::tests::delta_catch_up_shares_the_bounded_window_budget_and_resumes ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 133 filtered out; finished in 22.85s ``` A single full crate follow-up is now running with `--test-threads=4`. No SLOW-only diagnosis is claimed: the captured failure class is storage, and the underlying error is intentionally private. The original failure log is retained for attachment to #1145.
kayg commented 2026-10-06 08:52:10 +00:00
Author
Owner
Copy link

A comment review found one remaining Users Undo gap: a successful Retry after a rejected disable did not clear the new User's one-time passkey link. The cleanup now belongs to the same protected mutation callback used by Undo and Retry, and checks the stable User ID so it keeps a newer User's link. This extends the existing helper and test fixture; no new component or helper was added.

The original creation/Undo assertions remain. The same test now also runs with one rejected disable, proves the link remains on failure, invokes Try again, and proves the link is removed after success. Focused tests passed:

 Test Files  3 passed (3)
      Tests  7 passed (7)

Web check passed with zero errors and the same two existing CSS warnings. Exact pins remain at 22,292. Commit 2a2d9f009 contains the fix, regression and exact pin refresh. The final full web suite, production build and fresh six-size/theme Admin screenshot matrix are running.

All six requested Rust crate gates now pass. Mail's initial classified storage failure is retained and reported on existing #1021; its isolated follow-up and one full crate follow-up passed without code, assertion or timing-budget changes.

A comment review found one remaining Users Undo gap: a successful Retry after a rejected disable did not clear the new User's one-time passkey link. The cleanup now belongs to the same protected mutation callback used by Undo and Retry, and checks the stable User ID so it keeps a newer User's link. This extends the existing helper and test fixture; no new component or helper was added. The original creation/Undo assertions remain. The same test now also runs with one rejected disable, proves the link remains on failure, invokes Try again, and proves the link is removed after success. Focused tests passed: ```text Test Files 3 passed (3) Tests 7 passed (7) ``` Web check passed with zero errors and the same two existing CSS warnings. Exact pins remain at 22,292. Commit `2a2d9f009` contains the fix, regression and exact pin refresh. The final full web suite, production build and fresh six-size/theme Admin screenshot matrix are running. All six requested Rust crate gates now pass. Mail's initial classified storage failure is retained and reported on existing #1021; its isolated follow-up and one full crate follow-up passed without code, assertion or timing-budget changes.
kayg commented 2026-10-06 09:06:18 +00:00
Author
Owner
Copy link

Merge29j head: 2a2d9f00917014606968289ee6c4aedf53d3f636. Final required gates pass; the worktree is clean.

Merge29j integrates the four reviewed branches on job/merge29, starting at f5fbced3c. No push or deployment was performed. The required single fetch and merge of origin/dev reported Already up to date.

Built:

  • Licence admission and Admin controls, including the committed official Ed25519 public key, active User limits and server-side serialization of admission decisions (#1145).
  • HTTP binding before schema work and one content-free /healthz progress state for both schema and later migration stages (#1161, #1156).
  • Shared outbound address classification and explicitly allowed Mail CIDRs, with separate Calendar subscription CIDRs and public-only preview policy (#1160).
  • Retained bulk import recovery and SQLITE_BUSY handling, preserving Notes date backfill and Tag rewrite paths (#1157, #1148, #1110).
  • Regenerated configuration, operations, OpenAPI, action adapters, API client types and exact live performance pins.

Merge commits:

  • 1b1211347: Licence branch, reviewed head 9489a2c417.
  • 392ae9cd0: startup branch, reviewed head 49cdeed981.
  • 951870716: Mail network branch, reviewed head 51b8aabffe.
  • ab4f7688f: bulk import branch, reviewed head a82f2e567.

Decisions:

  • Adopt #1161's one health shape: {"state":"migrating","progress":{"phase":"…"}}, then {"state":"ok","progress":null}. Preserve #1156's later background-worker and private-search stages. Do not report percentages for work with different units. Hosting health checks and generated operating facts use this same shape.
  • Keep CALTERNAL_LICENCE_PUBLIC_KEY in a separate generated build_variables list. It is a build-time public verifying-key override, not a runtime server setting. Normal builds use the committed official key.
  • Retain the existing public-preview helper as a documented wrapper around the shared public-address classifier. Mail CIDR exceptions do not widen preview or Calendar subscription access. Calendar uses its own configured subscription CIDR list and defaults to public-only destinations.
  • Retain Licence Undo under the shared toast policy. Failed inverse actions offer Try again; plain completion confirmations use the shared drop policy.
  • Refresh performance exceptions and the ratchet from exact live entries only. No performance rule was weakened. Total live entries decreased from 22,359 to 22,292.
  • Auth migration 0016 and Files migration 0028 do not collide with fetched dev; Notes 0034 and 0035 remain intact. Upgrade expectations changed only for the added migrations.

UX gaps closed:

  • Failed Licence/User Undo now remains actionable through Try again.
  • Added a regression that rejects Licence removal on Undo, then retries successfully and returns to Free.
  • New User Undo now clears its passkey link after a successful Retry. Cleanup checks the stable User ID so an older Undo keeps a newer User’s link. The existing creation test retains its original assertions and also runs a rejected-Undo retry case.
  • Reused the feature's real production browser matrix with the official-key build's Free admission policy. The real Admin form admitted exactly six active Users; no sample data shipped.

Known gaps / UX gaps left:

  • Mail’s first full crate run reproduced the existing #1021 delta catch-up failure (Transport, classified storage error). The isolated test then passed (22.85s), and one full rerun passed all 128 tests (40.57s). No assertions or timing budgets changed. Both logs are retained; no SLOW-only or root-cause diagnosis is claimed. Current evidence is posted on #1021 and #1145.
  • The broader shell browser smoke passed account setup, passkey/recovery, Log creation, Note creation and zero CSP violations, then stopped at the existing cosmetic Tab Bar viewport defect #1172. Selecting Ask works, but only four complete tabs are shown where the test expects five at 1440 px. Relevant source is unchanged from the starting dev commit. Evidence is posted on #1172 and #1145; the test was not weakened.
  • Operational adversarial/DoS probes were not run under this session's safety constraints. Normal regression and browser checks were run; static Admin probe classification tests passed. This report does not certify the operational adversarial matrices.
  • The combined browser matrix uses the official public key and Free policy. The reviewed feature branch's signed-key and Remove/Replace visual set remains on this issue; no private official signing material was used.
  • The existing startup regression still waits for three migration receipts, while Notes now has five metadata migrations. Its isolated subtest passed in this run. The expectation was retained under the owner rule; review this possible transient completion check separately.
  • Existing ignored tests remain: server performance/DAV review cases, explicit Auth diagnostics, Notes performance profiles, the Daily Log E2E fixture seeder, optional Voice benchmark and existing Mail/Calendar profiles or explicit reviews. Process-isolated server children were run by their wrapper.
  • Web check retains two existing empty-CSS-ruleset warnings in AttachmentDeck and AgendaList.
  • Visual review belongs to Claude. Twelve macOS-emulated production screenshots cover Licence and Users at 390, 820 and 1440 px in light and dark, and are attached to this issue.
  • No staging deploy or Apple-client interop run was performed. Performance profiles from the reviewed branches are retained; this issue is not a performance measurement job.

Changed test expectations are limited to explicitly changed behavior: early HTTP health and readiness shape, shared dropped completion toast behavior, and additive migration counts. No timing budget or unrelated existing assertion was relaxed.

Gate output below is quoted verbatim from the retained logs. Formatting passed with exit 0 and no output.

Fresh bun install --frozen-lockfile:

911 packages installed [4.54s]

bun run check:

perf-lint: PASS; 0 violations; 22292 scoped exceptions
svelte-check found 0 errors and 2 warnings in 2 files

bun run test --maxWorkers=2 (final committed web source):

Ran 136 tests in 0.035s
OK
 8 pass
 0 fail
Ran 8 tests across 1 file. [540.00ms]
 Test Files  276 passed (276)
      Tests  1921 passed (1921)

Focused Admin and toast regression tests:

 Test Files  3 passed (3)
      Tests  7 passed (7)

Production SPA build:

Compressed 905 static variants; saved 21218555 bytes.

API client tests:

 21 pass
 0 fail
Ran 21 tests across 1 file. [1047.00ms]

cargo clippy -p calternal-server --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 58s

cargo test -p calternal-server -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 6m 16s
test result: ok. 265 passed; 0 failed; 11 ignored; 0 measured; 0 filtered out; finished in 365.85s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 62.62s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s

cargo clippy -p calternal-plugin --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 6.55s

cargo test -p calternal-plugin -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 15s
test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.91s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 39s

cargo test -p calternal-plugin-notes -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 5m 00s
test result: ok. 306 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 688.43s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.70s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-auth --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 05s

cargo test -p calternal-auth -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 58s
test result: ok. 135 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 114.54s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 09s

cargo test -p calternal-plugin-mail -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 8.81s
test result: ok. 128 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 40.57s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy -p calternal-plugin-calendar --all-targets -- -D warnings:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 15s

cargo test -p calternal-plugin-calendar -- --test-threads=4:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 51s
test result: ok. 100 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 16.51s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.53s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Action registry --check:

Action registry: 418 operations, 395 generated tools

Performance pins after final Plugin fix:

perf-lint: PASS; 0 violations; 22292 scoped exceptions

Self-host artifact tests:

Ran 6 tests in 0.588s
OK

Build-time public-key regression tests:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Static Admin probe classification tests:

Ran 15 tests in 3.005s
OK

Mail delta isolated follow-up:

    Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 16s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 133 filtered out; finished in 22.85s

Combined production Admin browser matrix:

PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS

Build cleanup:

     Removed 25385 files, 22.0GiB total

The server live-app group passed and invokes the two startup regressions with --exact --ignored --test-threads=1. The ignored summary includes those process-isolated children; it does not mean they were skipped. The separate performance-profile and DAV review tests retain their existing ignore markers.

Initial failures fixed: a dangling AppState doc comment (E0585), three formatting differences, a stale Users performance pin after Undo reconciliation, and the Plugin item after its test module. The original failure logs were retained where available. No lint allow or timing-budget increase was added.

Screenshots and evidence:

Fresh combined-build macOS evidence for head 2a2d9f009: the official-key build uses Free policy and admits exactly six active Users. All 12 production screenshots are attached. Visual review remains with Claude.

View Width Light Dark
licence 390 paper tokyo-night
licence 820 paper tokyo-night
licence 1440 paper tokyo-night
users-at-limit 390 paper tokyo-night
users-at-limit 820 paper tokyo-night
users-at-limit 1440 paper tokyo-night

Files changed across the reviewed branches and integration commits:

Cargo.lock
Cargo.toml
Containerfile
apps/web/e2e/licence-1145.mjs
apps/web/src/lib/auth/components/CreateAccountFlow.svelte
apps/web/src/routes/settings/admin/AdminSection.svelte
apps/web/src/routes/settings/admin/LicenceGroup.svelte
apps/web/src/routes/settings/admin/LicenceGroup.svelte.test.ts
apps/web/src/routes/settings/admin/UsersGroup.svelte
apps/web/src/routes/settings/admin/UsersGroup.svelte.test.ts
apps/web/src/routes/settings/api.svelte.test.ts
apps/web/src/routes/settings/api.svelte.ts
apps/web/src/routes/settings/sections.test.ts
apps/web/src/routes/settings/sections.ts
bench/bulk-import-1157.py
bench/licence-1145.py
bench/mail-network-policy.sh
contracts/action-policy.json
contracts/actions.json
contracts/cli.json
contracts/config.json
contracts/openapi.json
contracts/operations.json
contracts/perf/adoption-1058.json
contracts/perf/exceptions.json
contracts/perf/ratchet.json
contracts/perf/registry.json
crates/calternal-api/Cargo.toml
crates/calternal-api/src/lib.rs
crates/calternal-api/src/public_address.rs
crates/calternal-auth/Cargo.toml
crates/calternal-auth/build.rs
crates/calternal-auth/licence-public-key.hex
crates/calternal-auth/migrations/0016_instance_licence.sql
crates/calternal-auth/src/api.rs
crates/calternal-auth/src/error.rs
crates/calternal-auth/src/lib.rs
crates/calternal-auth/src/licence.rs
crates/calternal-auth/src/store.rs
crates/calternal-cli/src/main.rs
crates/calternal-db/src/db.rs
crates/calternal-db/src/jobs.rs
crates/calternal-db/src/sqlite.rs
crates/calternal-db/src/worker.rs
crates/calternal-embed/src/store.rs
crates/calternal-fs/src/root.rs
crates/calternal-plugin/src/outbound.rs
crates/calternal-server/Cargo.toml
crates/calternal-server/src/config_contract.rs
crates/calternal-server/src/main.rs
crates/calternal-server/src/operations_contract.rs
crates/calternal-server/src/serve.rs
crates/calternal-server/src/upgrade_tests.rs
crates/calternal-server/src/wire.rs
crates/plugins/calendar/Cargo.toml
crates/plugins/calendar/src/feeds/subscriptions.rs
crates/plugins/calendar/src/lib.rs
crates/plugins/files/migrations/0028_modified_mtime_lookup.sql
crates/plugins/files/src/lib.rs
crates/plugins/mail/src/imap.rs
crates/plugins/mail/src/lib.rs
crates/plugins/mail/src/routes.rs
crates/plugins/notes/src/lib.rs
crates/plugins/notes/src/store.rs
crates/plugins/notes/src/tasks_store.rs
deploy/selfhost/calternal.container
deploy/selfhost/calternal.env.example
deploy/selfhost/compose.yaml
deploy/selfhost/test_artifacts.py
docs/DESIGN.md
packages/api-client/src/generated.ts
packages/api-client/src/index.test.ts
packages/api-client/src/index.ts
review-1157.md
review-1160.md
tests/adversarial/attack.py
tests/adversarial/authz_matrix.py
tests/adversarial/bulk_import_1157.py
tests/adversarial/mail_network_policy.mjs
tests/adversarial/run.sh
tests/adversarial/setup.mjs
tests/adversarial/test_admin_classification.py
tests/adversarial/webdav.py
tests/fixtures/licence-test-seed.hex
Merge29j head: `2a2d9f00917014606968289ee6c4aedf53d3f636`. Final required gates pass; the worktree is clean. Merge29j integrates the four reviewed branches on `job/merge29`, starting at `f5fbced3c`. No push or deployment was performed. The required single fetch and merge of `origin/dev` reported `Already up to date.` Built: - Licence admission and Admin controls, including the committed official Ed25519 public key, active User limits and server-side serialization of admission decisions (#1145). - HTTP binding before schema work and one content-free `/healthz` progress state for both schema and later migration stages (#1161, #1156). - Shared outbound address classification and explicitly allowed Mail CIDRs, with separate Calendar subscription CIDRs and public-only preview policy (#1160). - Retained bulk import recovery and SQLITE_BUSY handling, preserving Notes date backfill and Tag rewrite paths (#1157, #1148, #1110). - Regenerated configuration, operations, OpenAPI, action adapters, API client types and exact live performance pins. Merge commits: - `1b1211347`: Licence branch, reviewed head `9489a2c417`. - `392ae9cd0`: startup branch, reviewed head `49cdeed981`. - `951870716`: Mail network branch, reviewed head `51b8aabffe`. - `ab4f7688f`: bulk import branch, reviewed head `a82f2e567`. Decisions: - Adopt #1161's one health shape: `{"state":"migrating","progress":{"phase":"…"}}`, then `{"state":"ok","progress":null}`. Preserve #1156's later background-worker and private-search stages. Do not report percentages for work with different units. Hosting health checks and generated operating facts use this same shape. - Keep `CALTERNAL_LICENCE_PUBLIC_KEY` in a separate generated `build_variables` list. It is a build-time public verifying-key override, not a runtime server setting. Normal builds use the committed official key. - Retain the existing public-preview helper as a documented wrapper around the shared public-address classifier. Mail CIDR exceptions do not widen preview or Calendar subscription access. Calendar uses its own configured subscription CIDR list and defaults to public-only destinations. - Retain Licence Undo under the shared toast policy. Failed inverse actions offer Try again; plain completion confirmations use the shared drop policy. - Refresh performance exceptions and the ratchet from exact live entries only. No performance rule was weakened. Total live entries decreased from 22,359 to 22,292. - Auth migration 0016 and Files migration 0028 do not collide with fetched dev; Notes 0034 and 0035 remain intact. Upgrade expectations changed only for the added migrations. UX gaps closed: - Failed Licence/User Undo now remains actionable through Try again. - Added a regression that rejects Licence removal on Undo, then retries successfully and returns to Free. - New User Undo now clears its passkey link after a successful Retry. Cleanup checks the stable User ID so an older Undo keeps a newer User’s link. The existing creation test retains its original assertions and also runs a rejected-Undo retry case. - Reused the feature's real production browser matrix with the official-key build's Free admission policy. The real Admin form admitted exactly six active Users; no sample data shipped. Known gaps / UX gaps left: - Mail’s first full crate run reproduced the existing #1021 delta catch-up failure (`Transport`, classified storage error). The isolated test then passed (22.85s), and one full rerun passed all 128 tests (40.57s). No assertions or timing budgets changed. Both logs are retained; no SLOW-only or root-cause diagnosis is claimed. Current evidence is posted on #1021 and #1145. - The broader shell browser smoke passed account setup, passkey/recovery, Log creation, Note creation and zero CSP violations, then stopped at the existing cosmetic Tab Bar viewport defect #1172. Selecting Ask works, but only four complete tabs are shown where the test expects five at 1440 px. Relevant source is unchanged from the starting dev commit. Evidence is posted on #1172 and #1145; the test was not weakened. - Operational adversarial/DoS probes were not run under this session's safety constraints. Normal regression and browser checks were run; static Admin probe classification tests passed. This report does not certify the operational adversarial matrices. - The combined browser matrix uses the official public key and Free policy. The reviewed feature branch's signed-key and Remove/Replace visual set remains on this issue; no private official signing material was used. - The existing startup regression still waits for three migration receipts, while Notes now has five metadata migrations. Its isolated subtest passed in this run. The expectation was retained under the owner rule; review this possible transient completion check separately. - Existing ignored tests remain: server performance/DAV review cases, explicit Auth diagnostics, Notes performance profiles, the Daily Log E2E fixture seeder, optional Voice benchmark and existing Mail/Calendar profiles or explicit reviews. Process-isolated server children were run by their wrapper. - Web check retains two existing empty-CSS-ruleset warnings in AttachmentDeck and AgendaList. - Visual review belongs to Claude. Twelve macOS-emulated production screenshots cover Licence and Users at 390, 820 and 1440 px in light and dark, and are attached to this issue. - No staging deploy or Apple-client interop run was performed. Performance profiles from the reviewed branches are retained; this issue is not a performance measurement job. Changed test expectations are limited to explicitly changed behavior: early HTTP health and readiness shape, shared dropped completion toast behavior, and additive migration counts. No timing budget or unrelated existing assertion was relaxed. Gate output below is quoted verbatim from the retained logs. Formatting passed with exit 0 and no output. Fresh bun install --frozen-lockfile: ```text 911 packages installed [4.54s] ``` bun run check: ```text perf-lint: PASS; 0 violations; 22292 scoped exceptions svelte-check found 0 errors and 2 warnings in 2 files ``` bun run test --maxWorkers=2 (final committed web source): ```text Ran 136 tests in 0.035s OK 8 pass 0 fail Ran 8 tests across 1 file. [540.00ms] Test Files 276 passed (276) Tests 1921 passed (1921) ``` Focused Admin and toast regression tests: ```text Test Files 3 passed (3) Tests 7 passed (7) ``` Production SPA build: ```text Compressed 905 static variants; saved 21218555 bytes. ``` API client tests: ```text 21 pass 0 fail Ran 21 tests across 1 file. [1047.00ms] ``` cargo clippy -p calternal-server --all-targets -- -D warnings: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 58s ``` cargo test -p calternal-server -- --test-threads=4: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 6m 16s test result: ok. 265 passed; 0 failed; 11 ignored; 0 measured; 0 filtered out; finished in 365.85s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 62.62s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s ``` cargo clippy -p calternal-plugin --all-targets -- -D warnings: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 6.55s ``` cargo test -p calternal-plugin -- --test-threads=4: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 2m 15s test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.91s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo clippy -p calternal-plugin-notes --all-targets -- -D warnings: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 2m 39s ``` cargo test -p calternal-plugin-notes -- --test-threads=4: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 5m 00s test result: ok. 306 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 688.43s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.70s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo clippy -p calternal-auth --all-targets -- -D warnings: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 05s ``` cargo test -p calternal-auth -- --test-threads=4: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 58s test result: ok. 135 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 114.54s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo clippy -p calternal-plugin-mail --all-targets -- -D warnings: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 09s ``` cargo test -p calternal-plugin-mail -- --test-threads=4: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 8.81s test result: ok. 128 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 40.57s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` cargo clippy -p calternal-plugin-calendar --all-targets -- -D warnings: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 15s ``` cargo test -p calternal-plugin-calendar -- --test-threads=4: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 51s test result: ok. 100 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 16.51s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.53s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Action registry --check: ```text Action registry: 418 operations, 395 generated tools ``` Performance pins after final Plugin fix: ```text perf-lint: PASS; 0 violations; 22292 scoped exceptions ``` Self-host artifact tests: ```text Ran 6 tests in 0.588s OK ``` Build-time public-key regression tests: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Static Admin probe classification tests: ```text Ran 15 tests in 3.005s OK ``` Mail delta isolated follow-up: ```text Finished `test` profile [unoptimized + debuginfo] target(s) in 3m 16s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 133 filtered out; finished in 22.85s ``` Combined production Admin browser matrix: ```text PASS Licence admission at six active Users; Admin screenshots cover 390/820/1440px, light/dark, macOS ``` Build cleanup: ```text Removed 25385 files, 22.0GiB total ``` The server live-app group passed and invokes the two startup regressions with `--exact --ignored --test-threads=1`. The ignored summary includes those process-isolated children; it does not mean they were skipped. The separate performance-profile and DAV review tests retain their existing ignore markers. Initial failures fixed: a dangling AppState doc comment (E0585), three formatting differences, a stale Users performance pin after Undo reconciliation, and the Plugin item after its test module. The original failure logs were retained where available. No lint allow or timing-budget increase was added. Screenshots and evidence: Fresh combined-build macOS evidence for head `2a2d9f009`: the official-key build uses Free policy and admits exactly six active Users. All 12 production screenshots are attached. Visual review remains with Claude. | View | Width | Light | Dark | | --- | ---: | --- | --- | | licence | 390 | [paper](https://git.kayg.org/attachments/e04b2944-65e3-47ff-9a11-ae1099e5d1c6) | [tokyo-night](https://git.kayg.org/attachments/32733ce0-839a-4a89-bd8d-7a0e08672753) | | licence | 820 | [paper](https://git.kayg.org/attachments/f7ec00d9-1a47-44b1-8423-72aaa1b7a8b8) | [tokyo-night](https://git.kayg.org/attachments/6a7b83a9-322e-4ce5-b666-12533d88da2e) | | licence | 1440 | [paper](https://git.kayg.org/attachments/5c0b1b43-7521-463d-827e-f0f2e485c250) | [tokyo-night](https://git.kayg.org/attachments/f1149a12-6a3e-4ea3-9612-a13d8a98ae76) | | users-at-limit | 390 | [paper](https://git.kayg.org/attachments/021bd865-8fda-4f17-8bf3-510eac1d4c39) | [tokyo-night](https://git.kayg.org/attachments/97d07aca-ae2d-4041-adef-f7fd56e1bfa4) | | users-at-limit | 820 | [paper](https://git.kayg.org/attachments/e1715d0c-a96d-4390-8954-afc061ed7104) | [tokyo-night](https://git.kayg.org/attachments/c3d5a427-c018-43db-a5ff-0427cdabc9b9) | | users-at-limit | 1440 | [paper](https://git.kayg.org/attachments/c46a7fc1-0090-4352-a3bd-b1096ac7d6b2) | [tokyo-night](https://git.kayg.org/attachments/6a346782-487d-40e7-9e7a-2520969ce8ac) | - [web-test.log.gz](https://git.kayg.org/attachments/d60f3606-e7ad-4bf9-a46f-a04cfd7b3434) - [web-check-generated.log.gz](https://git.kayg.org/attachments/c7d0865f-ee9e-4726-a940-22c025209ec7) - [web-focused.log.gz](https://git.kayg.org/attachments/f7a433ba-a9f2-423e-bf7a-78803dcdc9b5) - [api-client-test.log.gz](https://git.kayg.org/attachments/7fce8016-c575-401b-9703-d843367216b7) - [bun-install.log.gz](https://git.kayg.org/attachments/636f0282-66ee-4e0d-85e8-a3220c37b098) - [licence-e2e.log.gz](https://git.kayg.org/attachments/518849dc-1f0a-4c4c-8c29-efbf3221464d) - [shell-e2e.log.gz](https://git.kayg.org/attachments/21ad7220-3d6d-474b-9916-292d24d61179) - [perf-final.log.gz](https://git.kayg.org/attachments/1d8addfc-da31-4f47-8645-5f61e78809ae) - [selfhost-final.log.gz](https://git.kayg.org/attachments/98dfdd8d-1e58-4275-a8d4-a3d8f412774e) - [web-test-complete.log.gz](https://git.kayg.org/attachments/ba01caaa-fefc-417c-a86c-030f359f52a7) - [web-check-complete.log.gz](https://git.kayg.org/attachments/56fff318-97b3-4405-91c4-bfc711c3ad48) - [web-focused-final.log.gz](https://git.kayg.org/attachments/7d8974df-e9ed-40dc-911b-5f5ac4ba4a16) - [web-build-complete.log.gz](https://git.kayg.org/attachments/d769cf0b-7fe8-4ccc-b243-7cc37ef9e1f3) - [licence-e2e-complete.log.gz](https://git.kayg.org/attachments/08f1473e-71c7-414e-9844-786833a4f6c8) - [perf-undo-retry.log.gz](https://git.kayg.org/attachments/21988ed9-f02b-44ac-b7ab-faae9d34bea0) - [clippy-calternal-server.log.gz](https://git.kayg.org/attachments/d3e47368-13db-4e27-aa2d-7179ceac99ee) - [test-calternal-server.log.gz](https://git.kayg.org/attachments/1843a794-3e2b-41ed-b1b2-5e144f0849be) - [clippy-calternal-plugin-final.log.gz](https://git.kayg.org/attachments/f49148b2-51f5-4259-8d72-8853a137fe8c) - [test-calternal-plugin.log.gz](https://git.kayg.org/attachments/4cf82f86-88e4-4653-9f4e-b398594ea6b3) - [clippy-calternal-plugin-notes.log.gz](https://git.kayg.org/attachments/30edd64d-f6ff-4ca1-b5b2-2df8cf5d4a5e) - [test-calternal-plugin-notes.log.gz](https://git.kayg.org/attachments/f9480e17-493b-4716-bace-452b861568e5) - [clippy-calternal-auth.log.gz](https://git.kayg.org/attachments/8a2f6443-bf4f-4ff7-b944-a78a27372cae) - [test-calternal-auth.log.gz](https://git.kayg.org/attachments/f6507e83-667d-4220-8d9f-61775820b1c6) - [clippy-calternal-plugin-mail.log.gz](https://git.kayg.org/attachments/da2f607e-a006-4fa4-906f-610a456ebaa1) - [test-calternal-plugin-mail.log.gz](https://git.kayg.org/attachments/c947cfe0-390d-4556-af61-e2d62ea3701a) - [test-calternal-plugin-mail-final.log.gz](https://git.kayg.org/attachments/3cf86f2d-bee2-4bc5-b4f3-47932a1a40c8) - [mail-delta-focused.log.gz](https://git.kayg.org/attachments/3b9f922e-4cad-463f-87ee-35e3ac1a8bb4) - [clippy-calternal-plugin-calendar.log.gz](https://git.kayg.org/attachments/e4a617ca-2442-471c-a058-0f5a0609335f) - [test-calternal-plugin-calendar.log.gz](https://git.kayg.org/attachments/419d4ee4-c7e5-43fe-a896-d96dda72a912) Files changed across the reviewed branches and integration commits: ```text Cargo.lock Cargo.toml Containerfile apps/web/e2e/licence-1145.mjs apps/web/src/lib/auth/components/CreateAccountFlow.svelte apps/web/src/routes/settings/admin/AdminSection.svelte apps/web/src/routes/settings/admin/LicenceGroup.svelte apps/web/src/routes/settings/admin/LicenceGroup.svelte.test.ts apps/web/src/routes/settings/admin/UsersGroup.svelte apps/web/src/routes/settings/admin/UsersGroup.svelte.test.ts apps/web/src/routes/settings/api.svelte.test.ts apps/web/src/routes/settings/api.svelte.ts apps/web/src/routes/settings/sections.test.ts apps/web/src/routes/settings/sections.ts bench/bulk-import-1157.py bench/licence-1145.py bench/mail-network-policy.sh contracts/action-policy.json contracts/actions.json contracts/cli.json contracts/config.json contracts/openapi.json contracts/operations.json contracts/perf/adoption-1058.json contracts/perf/exceptions.json contracts/perf/ratchet.json contracts/perf/registry.json crates/calternal-api/Cargo.toml crates/calternal-api/src/lib.rs crates/calternal-api/src/public_address.rs crates/calternal-auth/Cargo.toml crates/calternal-auth/build.rs crates/calternal-auth/licence-public-key.hex crates/calternal-auth/migrations/0016_instance_licence.sql crates/calternal-auth/src/api.rs crates/calternal-auth/src/error.rs crates/calternal-auth/src/lib.rs crates/calternal-auth/src/licence.rs crates/calternal-auth/src/store.rs crates/calternal-cli/src/main.rs crates/calternal-db/src/db.rs crates/calternal-db/src/jobs.rs crates/calternal-db/src/sqlite.rs crates/calternal-db/src/worker.rs crates/calternal-embed/src/store.rs crates/calternal-fs/src/root.rs crates/calternal-plugin/src/outbound.rs crates/calternal-server/Cargo.toml crates/calternal-server/src/config_contract.rs crates/calternal-server/src/main.rs crates/calternal-server/src/operations_contract.rs crates/calternal-server/src/serve.rs crates/calternal-server/src/upgrade_tests.rs crates/calternal-server/src/wire.rs crates/plugins/calendar/Cargo.toml crates/plugins/calendar/src/feeds/subscriptions.rs crates/plugins/calendar/src/lib.rs crates/plugins/files/migrations/0028_modified_mtime_lookup.sql crates/plugins/files/src/lib.rs crates/plugins/mail/src/imap.rs crates/plugins/mail/src/lib.rs crates/plugins/mail/src/routes.rs crates/plugins/notes/src/lib.rs crates/plugins/notes/src/store.rs crates/plugins/notes/src/tasks_store.rs deploy/selfhost/calternal.container deploy/selfhost/calternal.env.example deploy/selfhost/compose.yaml deploy/selfhost/test_artifacts.py docs/DESIGN.md packages/api-client/src/generated.ts packages/api-client/src/index.test.ts packages/api-client/src/index.ts review-1157.md review-1160.md tests/adversarial/attack.py tests/adversarial/authz_matrix.py tests/adversarial/bulk_import_1157.py tests/adversarial/mail_network_policy.mjs tests/adversarial/run.sh tests/adversarial/setup.mjs tests/adversarial/test_admin_classification.py tests/adversarial/webdav.py tests/fixtures/licence-test-seed.hex ```
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
wip/tagperf-1186
wip/sidebar3-1094
wip/segmented-1200
job/tagperf-1186
wip/rev2-webperf
wip/rev2-money-ident
wip/restyle-mailmoney
wip/restyle-files
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
wip/nlpchip-1127
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/importhang-1121
wip/hiderev-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
wip/hide-1153
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/e2e-b2-1071
wip/e2e-b-1071
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/directory-1199-r
wip/directory-1199
wip/delete-1119
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/calcards-1115
wip/browserfix
wip/blocks-1125
job/collabloss-1197
wip/allday-1107
wip/agenda-decks
wip/agenda-1086
wip/adv7c-1105
wip/txentry-1198
wip/trayicons2-1095
wip/trayicons-1095
wip/collabrev-1197
wip/collabloss2-1197
wip/collabloss-1197
job/merge30
job/restyle-notes
job/adv-1202
job/notifloop-1194
job/restyle-mailmoney
job/onboard-1141
wip/restyle-notes
job/segmented-1200
job/hide-1153
wip/notifloop-1194
job/txentry-1198
job/perf-1124
job/perf2-1124
job/tocrail-1191
job/restyle-settings
wip/restyle-settings
job/restyle-files
job/tagdnd-1187
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/tagdnd-1187
wip/perf-1124
wip/merge30j
job/wizchoices-1140
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/restyle-search
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/directory-1199
job/proflog-1204
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/calcards-1115
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
job/importhang-1121
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
job/previewcard-1098
job/allday-1107
wip/e2e-a2-1071
wip/e2e-a-1071
job/e2e-b-1071
job/adv7c-1105
job/kanban-1092
job/agenda-1086
job/merge-round-7c
job/morph-1104
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
job/browserfix
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/agenda-decks
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-money-ident
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/rev2-webperf
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#1145
No description provided.