[adversarial] API probes timed out during shared-host load

kayg commented

2026-09-27 19:51:58 +00:00

Owner

Context

During the one time-boxed adversarial round for Forgejo #152, several non-SLOW requests exceeded the probe's 30-second timeout. The probes ran against the existing local dev server binary at /home/kayg/Developer/calternal-wt/gates/target/debug/calternal-server, not a server built from the import branch. The shared host had several other calternal-server builds and another adversarial attack process active at the same time.

Evidence

Template create storm: 2 of 16 requests timed out; 14 unique Note IDs were observed.
Template path traversal and both Reminders discovery requests timed out; adjacent invalid-template requests returned 400, and later Reminders sync and VTODO create/read/delete requests returned 207/201/200/204.
Bookmark capture storm: 4 requests timed out. The other returned statuses were 429, which the probe accepts.
DAV initial sync and Calendar Event-from-Log also timed out. Later Calendar create, retry, status, and link operations completed.
attack2.py reached feed, isolation, collaboration, public-share, exhaustion, and CLI checks. Its local sync section did not run because target/debug/calternald was not built at the time; the harness exited with FileNotFoundError.
No server crash or HTTP 5xx was observed. Hostile-byte checks reported zero findings. Many additional responses were marked SLOW and are treated as host load.

Follow-up

Repeat these timeout cases against an isolated server built from the target branch, then fix any reproducible server-side timeout or unexpected behavior. This report records the non-SLOW probe failures for triage; it does not attribute them to the importer.

## Context During the one time-boxed adversarial round for Forgejo #152, several non-SLOW requests exceeded the probe's 30-second timeout. The probes ran against the existing local dev server binary at `/home/kayg/Developer/calternal-wt/gates/target/debug/calternal-server`, not a server built from the import branch. The shared host had several other `calternal-server` builds and another adversarial attack process active at the same time. ## Evidence - Template create storm: 2 of 16 requests timed out; 14 unique Note IDs were observed. - Template path traversal and both Reminders discovery requests timed out; adjacent invalid-template requests returned 400, and later Reminders sync and VTODO create/read/delete requests returned 207/201/200/204. - Bookmark capture storm: 4 requests timed out. The other returned statuses were 429, which the probe accepts. - DAV initial sync and Calendar Event-from-Log also timed out. Later Calendar create, retry, status, and link operations completed. - `attack2.py` reached feed, isolation, collaboration, public-share, exhaustion, and CLI checks. Its local sync section did not run because `target/debug/calternald` was not built at the time; the harness exited with `FileNotFoundError`. - No server crash or HTTP 5xx was observed. Hostile-byte checks reported zero findings. Many additional responses were marked SLOW and are treated as host load. ## Follow-up Repeat these timeout cases against an isolated server built from the target branch, then fix any reproducible server-side timeout or unexpected behavior. This report records the non-SLOW probe failures for triage; it does not attribute them to the importer.

kayg commented

2026-09-27 20:33:52 +00:00

Author

Owner

Additional matrix result from the same round: PUT /api/v1/admin/config as a standard user returned HTTP 422, while the matrix expected 403. The route has a JSON body extractor before the authorization handler; the probe reused an incompatible owner-config body, so the extractor rejected the request before any config write. This is a response-contract mismatch in the probe/server path, not evidence of an authorization write.

Additional matrix result from the same round: `PUT /api/v1/admin/config` as a standard user returned HTTP 422, while the matrix expected 403. The route has a JSON body extractor before the authorization handler; the probe reused an incompatible owner-config body, so the extractor rejected the request before any config write. This is a response-contract mismatch in the probe/server path, not evidence of an authorization write.

kayg referenced this issue

2026-09-27 20:35:01 +00:00

Import: calternal.js vault → calternal (CLI 'calternal import calternal-js <vault>') #152

kayg commented

2026-09-27 20:56:28 +00:00

Author

Owner

One-time real-server adversarial round on job/index-order after merge dev at 418fcdfce8: the DAV Reminders collection discovery request PROPFIND /dav/calendars/<user>/ with Depth: 1 returned no response (timed out). The preceding VTODO discovery returned 207 after 22.1 seconds. The runner continued after the timeout.

One-time real-server adversarial round on job/index-order after merge dev at 418fcdfce8fc1300eddb71fc6e1301d5afdedece: the DAV Reminders collection discovery request `PROPFIND /dav/calendars/<user>/` with `Depth: 1` returned no response (`timed out`). The preceding VTODO discovery returned 207 after 22.1 seconds. The runner continued after the timeout.

kayg commented

2026-09-27 21:35:43 +00:00

Author

Owner

Adversarial round evidence: the real local server did not answer REPORT /dav/calendars/<user>/... for an empty-token sync-collection DAV initial sync before the client timeout. The dependent assertion also found no sync token because the request timed out. This is an availability finding under the concurrent probe load; related Reminders discovery timeout is also recorded on this issue. No Files Index contention mismatch was observed in this round.

Adversarial round evidence: the real local server did not answer `REPORT /dav/calendars/<user>/...` for an empty-token `sync-collection` DAV initial sync before the client timeout. The dependent assertion also found no sync token because the request timed out. This is an availability finding under the concurrent probe load; related Reminders discovery timeout is also recorded on this issue. No Files Index contention mismatch was observed in this round.

kayg referenced this issue

2026-09-27 21:57:37 +00:00

DATA: Files Index lags storage after concurrent upload + rename (repaired only by a later listing) #259

kayg commented

2026-09-27 23:09:32 +00:00

Author

Owner

Additional observation from Forgejo #191's adversarial round on 2026-09-28: the media probe did not observe a generated thumbnail within its 10-second wait, so it skipped the thumbnail header check. The host had multiple simultaneous builds and adversarial rounds; this run does not distinguish worker delay under load from a reproducible thumbnail failure. The API process remained alive. Please include this probe in the isolated follow-up if it reproduces on an idle host.

kayg referenced this issue

2026-09-27 23:12:19 +00:00

Block actions: hover controls, make-note (→), block reminders with quiet hours, phone capsule bar (DESIGN §42) #191

kayg referenced this issue

2026-10-02 17:35:52 +00:00

Investigate Calendar Event from Log timeout under shared load #250

kayg commented

2026-10-02 17:35:56 +00:00

Author

Owner

Partial duplicate symptom with #250: both report Calendar Event-from-Log creation timing out at the 30-second client deadline during a shared-host adversarial run. This issue also has distinct template, Reminders, bookmark and DAV observations, and it used a server binary not built from the target branch. Recommend linking only the Event-from-Log observation to #250 and keeping the other findings separate.

kayg referenced this issue

2026-10-02 17:42:29 +00:00

Audit: open issue hygiene (duplicates, already fixed, stale) #866

kayg referenced this issue

2026-10-03 12:56:40 +00:00

Issue hygiene sweep 2026-10-03 #1008

Rows
Columns

[adversarial] API probes timed out during shared-host load #264

Context

Evidence

Follow-up