Reliability round: probe the routes added 2026-10-05/06 on a real server #1202

Open
opened 2026-10-06 12:09:05 +00:00 by kayg · 1 comment
Owner

Defensive reliability round (owner rule: after every merge that touches an API, probe it on a real local server). Build a release server from origin/dev in this worktree and run it locally with two Users and an Admin. Extend tests/adversarial with probes for the routes added in the last two days and run the whole suite: tag rewrite/merge/undo (#1110), Note date backfill writer (#1148), link-preview fetcher (#1151; SSRF to private/link-local/metadata ranges, DNS rebinding, redirects to localhost, huge/slow/gzip-bomb/non-HTML bodies, IDN hosts), Mail allowed networks (#1160), licence keys (#1145; malformed, wrongly signed, expired, clock skew, concurrent invites at the cap), healthz startup progress (#1161), toasts → Notifications persistence (#1142), Inspector history (#1129), drawings (#1103), feature flags (#1181), the import wizard routes (#1140, branch job/wizard-1140). Categories per CLAUDE.md: cursed paths, Unicode tricks, malformed and oversized payloads, protocol misuse, concurrency storms, cross-plugin and cross-User interactions. Fix every 5xx, crash, accepted hostile input and inconsistency with a regression test, in separate commits; file anything outside a quick fix as an issue with evidence. Report a table: route, probes, result. Gates per crate + bun run check + bun run test quoted. Do not push.

Defensive reliability round (owner rule: after every merge that touches an API, probe it on a real local server). Build a release server from origin/dev in this worktree and run it locally with two Users and an Admin. Extend tests/adversarial with probes for the routes added in the last two days and run the whole suite: tag rewrite/merge/undo (#1110), Note date backfill writer (#1148), link-preview fetcher (#1151; SSRF to private/link-local/metadata ranges, DNS rebinding, redirects to localhost, huge/slow/gzip-bomb/non-HTML bodies, IDN hosts), Mail allowed networks (#1160), licence keys (#1145; malformed, wrongly signed, expired, clock skew, concurrent invites at the cap), healthz startup progress (#1161), toasts → Notifications persistence (#1142), Inspector history (#1129), drawings (#1103), feature flags (#1181), the import wizard routes (#1140, branch job/wizard-1140). Categories per CLAUDE.md: cursed paths, Unicode tricks, malformed and oversized payloads, protocol misuse, concurrency storms, cross-plugin and cross-User interactions. Fix every 5xx, crash, accepted hostile input and inconsistency with a regression test, in separate commits; file anything outside a quick fix as an issue with evidence. Report a table: route, probes, result. Gates per crate + bun run check + bun run test quoted. Do not push.
Author
Owner

Starting #1202 on branch job/adv-1202 from base SHA 5301e02085. I am reading the route contracts and setting up the real-server adversarial run.

Starting #1202 on branch job/adv-1202 from base SHA 5301e020859c1d61b4a7f812a5049a64241203e8. I am reading the route contracts and setting up the real-server adversarial run.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#1202
No description provided.