Search: owner cannot find a newly uploaded private file #208

Open
opened 2026-09-26 18:46:42 +00:00 by kayg · 2 comments
Owner

Found during the real-server adversarial run for #158 on 2026-09-26 (tests/adversarial/attack2.py, search section).

Reproduction:

  1. Upload ZebraPrivate/zebracorn-private.txt with body zebracorn sentinel private as the owner.
  2. Poll the owner's GET /api/v1/search?q=zebracorn&limit=50 for 30 seconds.

Expected: the owner can find the file they just uploaded. Actual: every result was empty ([]); the probe reported search access setup: the owner does not find their own file. The server stayed alive. The probe classified this as a non-SLOW indexing visibility finding. Please reproduce on a quiet host and trace Files indexing through Search ingestion. No API behavior was changed in #158.

Found during the real-server adversarial run for #158 on 2026-09-26 (`tests/adversarial/attack2.py`, search section). Reproduction: 1. Upload `ZebraPrivate/zebracorn-private.txt` with body `zebracorn sentinel private` as the owner. 2. Poll the owner's `GET /api/v1/search?q=zebracorn&limit=50` for 30 seconds. Expected: the owner can find the file they just uploaded. Actual: every result was empty (`[]`); the probe reported `search access setup: the owner does not find their own file`. The server stayed alive. The probe classified this as a non-SLOW indexing visibility finding. Please reproduce on a quiet host and trace Files indexing through Search ingestion. No API behavior was changed in #158.
Author
Owner

Related reproduction from the real-server adversarial run for #191 (2026-09-27): after creating a Note with title Apartment hunting and body Compare rents and neighborhoods. Check the commute and choose a home near transit., the owner query renting a home close to public transport did not return that Note within 120 seconds. The server stayed alive and the fixture Note was created successfully. This run overlapped other worktree builds and browser/server probes, so please reproduce on a quiet host as requested here. The probe reports this as a correctness timeout, not a SLOW timing finding. It may share Search ingestion with this issue.

Related reproduction from the real-server adversarial run for #191 (2026-09-27): after creating a Note with title `Apartment hunting` and body `Compare rents and neighborhoods. Check the commute and choose a home near transit.`, the owner query `renting a home close to public transport` did not return that Note within 120 seconds. The server stayed alive and the fixture Note was created successfully. This run overlapped other worktree builds and browser/server probes, so please reproduce on a quiet host as requested here. The probe reports this as a correctness timeout, not a SLOW timing finding. It may share Search ingestion with this issue.
Author
Owner

Follow-up from two later full adversarial rounds on the #191 branch: the semantic search probe for renting a home close to public transport returned the expected Note, Apartment hunting, both times. The first run that reported the timeout was on a busier shared host; these two later results show that the timeout did not reproduce in the subsequent runs. No Search code was changed in #191.

Follow-up from two later full adversarial rounds on the #191 branch: the semantic search probe for `renting a home close to public transport` returned the expected Note, `Apartment hunting`, both times. The first run that reported the timeout was on a busier shared host; these two later results show that the timeout did not reproduce in the subsequent runs. No Search code was changed in #191.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#208
No description provided.