kayg/calternal
Watch
1
0
Fork
You've already forked calternal
 0
Code Issues 803 Pull requests Projects Releases Packages Wiki Activity Actions 472

Adversarial matrix reports missing policy for GET /api/v1/mail/accounts #383

New issue
Open
opened 2026-09-29 02:47:38 +00:00 by kayg · 16 comments
kayg commented 2026-09-29 02:47:38 +00:00
Owner
Copy link

The adversarial authorization matrix stopped on a missing OpenAPI authorization policy:

GET /api/v1/mail/accounts (mail_accounts)

This is the exact matrix finding. It does not by itself prove that the handler permits unauthorized access; please check the handler and add the policy metadata or fix the authorization behavior as needed. The finding was observed during the #373 adversarial round.

The adversarial authorization matrix stopped on a missing OpenAPI authorization policy: `GET /api/v1/mail/accounts` (`mail_accounts`) This is the exact matrix finding. It does not by itself prove that the handler permits unauthorized access; please check the handler and add the policy metadata or fix the authorization behavior as needed. The finding was observed during the #373 adversarial round.
kayg commented 2026-09-29 04:36:22 +00:00
Author
Owner
Copy link

Started sec-batch on branch job/sec-batch at base 00015e652a. Read CLAUDE.md, CONTEXT.md, DESIGN.md and issues #383, #386, #390, #379, #392. I am tracing the authorization matrix, DAV status boundary and Journal alarm handling before changes.

Started sec-batch on branch job/sec-batch at base 00015e652a153485d9e7adda1c5ee61bc17300db. Read CLAUDE.md, CONTEXT.md, DESIGN.md and issues #383, #386, #390, #379, #392. I am tracing the authorization matrix, DAV status boundary and Journal alarm handling before changes.
kayg commented 2026-09-29 04:39:20 +00:00
Author
Owner
Copy link

Findings: GET /api/v1/mail/accounts already derives the owner from PluginRequestContext and list_accounts filters mail_accounts.owner_id; authz_matrix.py omitted the /api/v1/mail/ route family, so it stopped before requests. WebDAV traversal was normalized by tests/adversarial/editor-proxy.mjs new URL(request.url), yielding 404 before the server; the proxy now forwards the raw request path. Journal parser accepted and discarded VALARM; I changed it to reject alarms that a Log line cannot retain. The DAV Files adapter also collapsed Precondition into dav-server FsError::Exists (405), so I am preserving the provider result at the HTTP boundary.

Findings: GET /api/v1/mail/accounts already derives the owner from PluginRequestContext and list_accounts filters mail_accounts.owner_id; authz_matrix.py omitted the /api/v1/mail/ route family, so it stopped before requests. WebDAV traversal was normalized by tests/adversarial/editor-proxy.mjs new URL(request.url), yielding 404 before the server; the proxy now forwards the raw request path. Journal parser accepted and discarded VALARM; I changed it to reject alarms that a Log line cannot retain. The DAV Files adapter also collapsed Precondition into dav-server FsError::Exists (405), so I am preserving the provider result at the HTTP boundary.
kayg commented 2026-09-29 04:51:23 +00:00
Author
Owner
Copy link

The cross-User matrix static classification also failed after fixture setup: five newer generic {id} operations (jobs and quota) and Mail before_id lacked resource classes. I added explicit classes. With inert local token files, operation_rows() now classifies all 280 OpenAPI operations; no server request is involved in this static check. The real folder fixture failure still needs replay against the built server.

The cross-User matrix static classification also failed after fixture setup: five newer generic {id} operations (jobs and quota) and Mail before_id lacked resource classes. I added explicit classes. With inert local token files, operation_rows() now classifies all 280 OpenAPI operations; no server request is involved in this static check. The real folder fixture failure still needs replay against the built server.
kayg commented 2026-09-29 05:49:28 +00:00
Author
Owner
Copy link

WebDAV real-loopback regression passed on HEAD 0549c25c: CALTERNAL_WEBDAV_PROBE_ONLY=1 cargo test -p calternal-plugin-files local_server_scripted_probe_and_rclone_ten_thousand_small_files -- --ignored --nocapture produced WebDAV scripted probes passed and test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 129 filtered out. This covers encoded traversal (400) and competing If-Match PUTs (204, 412). The server build for the cross-User fixture replay is in progress.

WebDAV real-loopback regression passed on HEAD 0549c25c: `CALTERNAL_WEBDAV_PROBE_ONLY=1 cargo test -p calternal-plugin-files local_server_scripted_probe_and_rclone_ten_thousand_small_files -- --ignored --nocapture` produced `WebDAV scripted probes passed` and `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 129 filtered out`. This covers encoded traversal (400) and competing If-Match PUTs (204, 412). The server build for the cross-User fixture replay is in progress.
kayg commented 2026-09-29 06:07:19 +00:00
Author
Owner
Copy link

Progress at HEAD 0549c25c (clean worktree): real-loopback WebDAV regression passed; cargo fmt --check passed; web bun run check reported 0 errors and 0 warnings; web bun run test reported 123 files and 787 tests passed. Production server compilation is active for the cross-User Folder fixture replay. No source changes are pending, so no partial commit is being held.

Progress at HEAD 0549c25c (clean worktree): real-loopback WebDAV regression passed; `cargo fmt --check` passed; web `bun run check` reported 0 errors and 0 warnings; web `bun run test` reported 123 files and 787 tests passed. Production server compilation is active for the cross-User Folder fixture replay. No source changes are pending, so no partial commit is being held.
kayg commented 2026-09-29 07:04:24 +00:00
Author
Owner
Copy link

Real-server replay on current branch passed Folder fixture setup and Mail owner isolation. The matrix reported: Two-User OpenAPI matrix: 280 operations classified; 129 operations replayed; 455 A-ID vs missing-ID comparisons across B, C, D and anonymous; 20 identifier routes classified with no local fixture factory; median absolute timing delta 6.2 ms. Thus #386's HTTP -1 Folder setup failure did not recur in this isolated round. The full API adversarial probe is still running on the same throwaway server.

Real-server replay on current branch passed Folder fixture setup and Mail owner isolation. The matrix reported: `Two-User OpenAPI matrix: 280 operations classified; 129 operations replayed; 455 A-ID vs missing-ID comparisons across B, C, D and anonymous; 20 identifier routes classified with no local fixture factory; median absolute timing delta 6.2 ms`. Thus #386's HTTP -1 Folder setup failure did not recur in this isolated round. The full API adversarial probe is still running on the same throwaway server.
kayg commented 2026-09-29 07:08:03 +00:00
Author
Owner
Copy link

Adversarial finding during this round: Appearance PUT with a 200 KB font ID returned a proxy-generated 502 while the server remained healthy. The Appearance route caps request bodies at 64 KiB, but the adversarial proxy waited for 100 Continue only above 1 MiB, so an early server 413 could race an upstream write error. Commit edce1e84 lowers the proxy coordination threshold to 64 KiB. The targeted regression returned 502 with the previous proxy code and 413 with the fix (node --test tests/adversarial/proxy-early-response.test.mjs: 1 pass). The ongoing full round started before this proxy change, so its original 502 remains in that run's log.

Adversarial finding during this round: Appearance PUT with a 200 KB font ID returned a proxy-generated 502 while the server remained healthy. The Appearance route caps request bodies at 64 KiB, but the adversarial proxy waited for `100 Continue` only above 1 MiB, so an early server 413 could race an upstream write error. Commit edce1e84 lowers the proxy coordination threshold to 64 KiB. The targeted regression returned 502 with the previous proxy code and 413 with the fix (`node --test tests/adversarial/proxy-early-response.test.mjs`: 1 pass). The ongoing full round started before this proxy change, so its original 502 remains in that run's log.
kayg commented 2026-09-29 08:22:20 +00:00
Author
Owner
Copy link

sec-batch final report
Branch: job/sec-batch
Head: edce1e84d6
Base: dev; merged dev once in 0549c25c. Branch pushed. No deploy or merge into dev.

Built:

  • #383: classified Mail account routes as User data in the authorization matrix. Added a real Mail account fixture and asserted owner visibility plus B/anonymous isolation. Current OpenAPI IDs are classified. The two-User matrix completed: 280 operations classified, 129 replayed, 455 A-ID versus missing-ID comparisons.
  • #386: fresh folder fixture setup and two-User matrix passed against a real local server. The reported HTTP -1 setup failure did not recur; no server behavior was changed for this issue.
  • #390: WebDAV rejects malformed traversal at its boundary and preserves a stale If-Match as HTTP 412. Scripted real-loopback WebDAV probes passed.
  • #379/#392: Journal writes reject VALARM, including valid alarms, because the Log write model cannot retain them. Parser and adversarial regressions cover missing TRIGGER and valid VALARM. reminders.rs was untouched.
  • The adversarial proxy now relays early HTTP 413 responses for moderate payloads. A regression demonstrated old 502 and current 413.

Changed files: tests/adversarial/authz_matrix.py, xuser_matrix.py, attack.py, webdav.py, editor-proxy.mjs, proxy-early-response.test.mjs, run.sh; crates/calternal-dav/src/lib.rs, crates/calternal-dav/src/files.rs, crates/plugins/files/src/dav.rs.

Gate output (verbatim excerpts):
cargo fmt --check: exit 0, no output.
cargo test -p calternal-dav:
test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
cargo test -p calternal-plugin-files:
test result: ok. 129 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 143.15s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
bun run check:
Text sizes use shared role tokens.
svelte-check found 0 errors and 0 warnings
bun run test:
Test Files 123 passed (123)
Tests 787 passed (787)
cargo clippy --all-targets -- -D warnings: stopped after dependency compilation under the job time limit (exit 143); no diagnostics before stop. Last output:
Checking want v0.3.1
cargo test: stopped after dependency compilation under the job time limit (exit 143); no test results before stop. Last output:
Compiling calternal-cli v0.0.1 (/home/kayg/Developer/calternal-wt/sec-batch/crates/calternal-cli)

Adversarial round: real-server two-User matrix and Journal DAV probes completed. One broader attack.py round was timeboxed after mixed-load timeouts; server stayed alive. The proxy's 502 on a 200 KiB Appearance payload was fixed and verified by a targeted old/new regression. Mixed-load timeouts were filed with evidence on #387. SLOW-only findings were treated as shared-host load.

Known gaps: full workspace Clippy and cargo test did not finish within the job limit. The broader adversarial round did not complete after timeboxing. No UI was changed, so visual screenshots are not applicable.

Decisions: reject all Journal VALARM until Log stores alarms; no speculative fix for #386 after a successful fresh real-server repro; use a 64 KiB Expect threshold in the local adversarial proxy to preserve upstream early rejections.

Cleanup: cargo clean output: Removed 12572 files, 9.9GiB total
Generated apps/web/build and apps/web/.svelte-kit/output were removed. Working tree clean.

sec-batch final report Branch: job/sec-batch Head: edce1e84d61d38b119120f298dd5c6fc112951ec Base: dev; merged dev once in 0549c25c. Branch pushed. No deploy or merge into dev. Built: - #383: classified Mail account routes as User data in the authorization matrix. Added a real Mail account fixture and asserted owner visibility plus B/anonymous isolation. Current OpenAPI IDs are classified. The two-User matrix completed: 280 operations classified, 129 replayed, 455 A-ID versus missing-ID comparisons. - #386: fresh folder fixture setup and two-User matrix passed against a real local server. The reported HTTP -1 setup failure did not recur; no server behavior was changed for this issue. - #390: WebDAV rejects malformed traversal at its boundary and preserves a stale If-Match as HTTP 412. Scripted real-loopback WebDAV probes passed. - #379/#392: Journal writes reject VALARM, including valid alarms, because the Log write model cannot retain them. Parser and adversarial regressions cover missing TRIGGER and valid VALARM. reminders.rs was untouched. - The adversarial proxy now relays early HTTP 413 responses for moderate payloads. A regression demonstrated old 502 and current 413. Changed files: tests/adversarial/authz_matrix.py, xuser_matrix.py, attack.py, webdav.py, editor-proxy.mjs, proxy-early-response.test.mjs, run.sh; crates/calternal-dav/src/lib.rs, crates/calternal-dav/src/files.rs, crates/plugins/files/src/dav.rs. Gate output (verbatim excerpts): `cargo fmt --check`: exit 0, no output. `cargo test -p calternal-dav`: test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s `cargo test -p calternal-plugin-files`: test result: ok. 129 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 143.15s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s `bun run check`: Text sizes use shared role tokens. svelte-check found 0 errors and 0 warnings `bun run test`: Test Files 123 passed (123) Tests 787 passed (787) `cargo clippy --all-targets -- -D warnings`: stopped after dependency compilation under the job time limit (exit 143); no diagnostics before stop. Last output: Checking want v0.3.1 `cargo test`: stopped after dependency compilation under the job time limit (exit 143); no test results before stop. Last output: Compiling calternal-cli v0.0.1 (/home/kayg/Developer/calternal-wt/sec-batch/crates/calternal-cli) Adversarial round: real-server two-User matrix and Journal DAV probes completed. One broader attack.py round was timeboxed after mixed-load timeouts; server stayed alive. The proxy's 502 on a 200 KiB Appearance payload was fixed and verified by a targeted old/new regression. Mixed-load timeouts were filed with evidence on #387. SLOW-only findings were treated as shared-host load. Known gaps: full workspace Clippy and cargo test did not finish within the job limit. The broader adversarial round did not complete after timeboxing. No UI was changed, so visual screenshots are not applicable. Decisions: reject all Journal VALARM until Log stores alarms; no speculative fix for #386 after a successful fresh real-server repro; use a 64 KiB Expect threshold in the local adversarial proxy to preserve upstream early rejections. Cleanup: `cargo clean` output: Removed 12572 files, 9.9GiB total Generated apps/web/build and apps/web/.svelte-kit/output were removed. Working tree clean.
kayg commented 2026-09-29 08:26:18 +00:00
Author
Owner
Copy link

Starting the Journal VALARM follow-up on job/sec-batch. Current head: edce1e84d61d38b119120f298dd5c6fc112951ec; merge base with dev: 9de38b46ee134dbc3a919325a320bc0c6a3ab371. I will merge dev once, reuse the reminders preservation helper if available, keep this change in the Journal path, and add a replay test for an Apple event PUT with a default alert.

Starting the Journal VALARM follow-up on `job/sec-batch`. Current head: `edce1e84d61d38b119120f298dd5c6fc112951ec`; merge base with `dev`: `9de38b46ee134dbc3a919325a320bc0c6a3ab371`. I will merge `dev` once, reuse the reminders preservation helper if available, keep this change in the Journal path, and add a replay test for an Apple event PUT with a default alert.
kayg commented 2026-09-29 08:31:16 +00:00
Author
Owner
Copy link

Finding: parse_journal_icalendar_detailed currently rejects every VEVENT subcomponent, and its regression treats a valid alert and a missing-TRIGGER alert identically. The reminders path already extracts raw VALARM lines. I will reuse that extractor, store Journal alarms in the Daily note calternal-dav frontmatter map under the block ID, and preserve unrelated map metadata. DESIGN does not specify this storage shape; the latest #392 review explicitly allows the frontmatter map.

Finding: `parse_journal_icalendar_detailed` currently rejects every VEVENT subcomponent, and its regression treats a valid alert and a missing-TRIGGER alert identically. The reminders path already extracts raw VALARM lines. I will reuse that extractor, store Journal alarms in the Daily note `calternal-dav` frontmatter map under the block ID, and preserve unrelated map metadata. DESIGN does not specify this storage shape; the latest #392 review explicitly allows the frontmatter map.
kayg commented 2026-09-29 12:18:55 +00:00
Author
Owner
Copy link

Continued job/sec-batch after merging dev. The branch is pushed; no merge into dev was performed.

Commits:

  • f2274fc2 — merge dev once before final gates.
  • 5762c4592b — preserve Journal VALARMs across CalDAV writes.

Head: 5762c4592b

Built: Journal PUT now accepts and preserves well-formed VALARM components, including Apple Calendar's default alert. It rejects malformed VALARMs without TRIGGER. Raw folded alarm lines survive GET and REPORT. Journal alert state is stored in the existing calternal-dav frontmatter map under journal:<block-id>, preserving Task Reminder metadata. Added an Apple default-alert fixture and DAV replay coverage, plus Notes provider persistence and ETag coverage.

Files:

  • crates/calternal-dav/src/lib.rs
  • crates/calternal-dav/src/protocol.rs
  • crates/calternal-dav/src/reminders.rs
  • crates/calternal-dav/tests/apple_replay.rs
  • crates/calternal-dav/tests/fixtures/macos27/put-new-event-default-alert.ics
  • crates/plugins/notes/src/calendar_links.rs
  • crates/plugins/notes/src/lib.rs
  • crates/plugins/notes/src/store.rs

Gate output, verbatim excerpts:

cargo fmt --all -- --check: exit 0, no output.

cargo test -p calternal-dav -p calternal-plugin-notes:

test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 113 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 75.62s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

cargo clippy --all-targets -- -D warnings (passed after bun run --cwd apps/web build generated the server's embedded Frontend assets):

    Checking calternal-api v0.0.1 (/home/kayg/Developer/calternal-wt/sec-batch/crates/calternal-api)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 10s

bun run --cwd apps/web build completed successfully:

✓ built in 38.99s
  Wrote site to "build"
  ✔ done

Adversarial round: I started ADVERSARIAL_API_ONLY=1 ADVERSARIAL_SKIP_WEB_BUILD=1 tests/adversarial/run.sh against its real local server harness. Server, CLI and Sync binary compilation spent ten minutes on shared-host dependency builds and did not reach the server or DAV probes. I stopped it before the four-hour job limit. No HTTP probes ran, so this round produced no findings and remains a coverage gap.

Known gaps: the full workspace cargo test and the real-server adversarial API round did not complete within the job time limit. Web bun run check and bun run test were not run; this change has no web source edits.

Decisions: DESIGN does not specify Journal VALARM storage. I reused the existing calternal-dav frontmatter map, keyed by stable Journal block ID, and the Reminders VALARM preservation helpers. The shared helper visibility is now pub(crate) for the Journal parser.

Cleanup: cargo clean output: Removed 11503 files, 4.2GiB total. Removed apps/web/build and apps/web/.svelte-kit/output. The adversarial runner removed its temporary server fixture directory.

Continued job/sec-batch after merging dev. The branch is pushed; no merge into dev was performed. Commits: - f2274fc2 — merge dev once before final gates. - 5762c4592bd829357ff8ce40fec84b0bd1c14d2b — preserve Journal VALARMs across CalDAV writes. Head: 5762c4592bd829357ff8ce40fec84b0bd1c14d2b Built: Journal PUT now accepts and preserves well-formed VALARM components, including Apple Calendar's default alert. It rejects malformed VALARMs without TRIGGER. Raw folded alarm lines survive GET and REPORT. Journal alert state is stored in the existing calternal-dav frontmatter map under `journal:<block-id>`, preserving Task Reminder metadata. Added an Apple default-alert fixture and DAV replay coverage, plus Notes provider persistence and ETag coverage. Files: - crates/calternal-dav/src/lib.rs - crates/calternal-dav/src/protocol.rs - crates/calternal-dav/src/reminders.rs - crates/calternal-dav/tests/apple_replay.rs - crates/calternal-dav/tests/fixtures/macos27/put-new-event-default-alert.ics - crates/plugins/notes/src/calendar_links.rs - crates/plugins/notes/src/lib.rs - crates/plugins/notes/src/store.rs Gate output, verbatim excerpts: `cargo fmt --all -- --check`: exit 0, no output. `cargo test -p calternal-dav -p calternal-plugin-notes`: ```text test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 113 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 75.62s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` `cargo clippy --all-targets -- -D warnings` (passed after `bun run --cwd apps/web build` generated the server's embedded Frontend assets): ```text Checking calternal-api v0.0.1 (/home/kayg/Developer/calternal-wt/sec-batch/crates/calternal-api) Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 10s ``` `bun run --cwd apps/web build` completed successfully: ```text ✓ built in 38.99s Wrote site to "build" ✔ done ``` Adversarial round: I started `ADVERSARIAL_API_ONLY=1 ADVERSARIAL_SKIP_WEB_BUILD=1 tests/adversarial/run.sh` against its real local server harness. Server, CLI and Sync binary compilation spent ten minutes on shared-host dependency builds and did not reach the server or DAV probes. I stopped it before the four-hour job limit. No HTTP probes ran, so this round produced no findings and remains a coverage gap. Known gaps: the full workspace `cargo test` and the real-server adversarial API round did not complete within the job time limit. Web `bun run check` and `bun run test` were not run; this change has no web source edits. Decisions: DESIGN does not specify Journal VALARM storage. I reused the existing `calternal-dav` frontmatter map, keyed by stable Journal block ID, and the Reminders VALARM preservation helpers. The shared helper visibility is now `pub(crate)` for the Journal parser. Cleanup: `cargo clean` output: `Removed 11503 files, 4.2GiB total`. Removed `apps/web/build` and `apps/web/.svelte-kit/output`. The adversarial runner removed its temporary server fixture directory.
kayg commented 2026-09-30 03:46:13 +00:00
Author
Owner
Copy link

Starting verification of #383 on job/small-bugs-3, based on dev at dfb5964a2fcf13dc8b9a50a319eee09bc386f322. I will check the Mail handler and current authorization-matrix coverage.

Starting verification of #383 on `job/small-bugs-3`, based on `dev` at `dfb5964a2fcf13dc8b9a50a319eee09bc386f322`. I will check the Mail handler and current authorization-matrix coverage.
kayg commented 2026-09-30 09:11:43 +00:00
Author
Owner
Copy link

Finding for #383: the current branch classifies GET /api/v1/mail/accounts under the signed-in data policy (/api/v1/mail/ in DATA_PREFIXES), and the real cross-User matrix includes an owner/read and non-owner leakage check for that collection. The attempted one-time real-server matrix round stopped during readiness: /readyz returned HTTP 502 before the probes ran. I am adding a focused offline regression assertion for this operation's policy; the live authorization result remains unverified in this run.

Finding for #383: the current branch classifies `GET /api/v1/mail/accounts` under the signed-in data policy (`/api/v1/mail/` in `DATA_PREFIXES`), and the real cross-User matrix includes an owner/read and non-owner leakage check for that collection. The attempted one-time real-server matrix round stopped during readiness: `/readyz` returned HTTP 502 before the probes ran. I am adding a focused offline regression assertion for this operation's policy; the live authorization result remains unverified in this run.
kayg commented 2026-09-30 09:20:35 +00:00
Author
Owner
Copy link

Finished #383. HEAD: 4720cac4d2.

Added a regression assertion that GET /api/v1/mail/accounts is classified for signed-in Users and Admins. The focused Python test passed: 4 tests. The current real cross-User matrix also contains an owner-read and non-owner leakage check for the collection.

Live verification gap: the one-time adversarial run stopped during server readiness, before its matrix started: curl: (22) The requested URL returned error: 502 (exit 22). The live authorization result remains unverified.

Web gate output (verbatim result lines):

bun run --cwd apps/web check

$ node scripts/check-type-tokens.mjs && svelte-kit sync && svelte-check --tsconfig ./tsconfig.json
Text sizes and UI shape values use shared role tokens.
Loading svelte-check in workspace: /home/kayg/Developer/calternal-wt/small-bugs-3/apps/web
Getting Svelte diagnostics...

svelte-check found 0 errors and 0 warnings

bun run --cwd apps/web test

FAIL  |component| src/lib/components/analytics/widgets/StatRow.svelte.test.ts > StatRow summary cards > toggles all four cards together and remembers the mode
Error: Test timed out in 5000ms.

Test Files  1 failed | 136 passed (137)
     Tests  1 failed | 888 passed (889)
error: script "test" exited with code 1

The sole Web test failure was the 5-second timeout above in merged Analytics StatRow coverage. I did not change its expectation. No Rust source changed, so no Rust crate gates ran. cargo clean output: Removed 7066 files, 4.0GiB total.

Finished #383. HEAD: 4720cac4d20747c4ccf514d94117d03ec5d95067. Added a regression assertion that GET /api/v1/mail/accounts is classified for signed-in Users and Admins. The focused Python test passed: 4 tests. The current real cross-User matrix also contains an owner-read and non-owner leakage check for the collection. Live verification gap: the one-time adversarial run stopped during server readiness, before its matrix started: curl: (22) The requested URL returned error: 502 (exit 22). The live authorization result remains unverified. Web gate output (verbatim result lines): bun run --cwd apps/web check ``` $ node scripts/check-type-tokens.mjs && svelte-kit sync && svelte-check --tsconfig ./tsconfig.json Text sizes and UI shape values use shared role tokens. Loading svelte-check in workspace: /home/kayg/Developer/calternal-wt/small-bugs-3/apps/web Getting Svelte diagnostics... svelte-check found 0 errors and 0 warnings ``` bun run --cwd apps/web test ``` FAIL |component| src/lib/components/analytics/widgets/StatRow.svelte.test.ts > StatRow summary cards > toggles all four cards together and remembers the mode Error: Test timed out in 5000ms. Test Files 1 failed | 136 passed (137) Tests 1 failed | 888 passed (889) error: script "test" exited with code 1 ``` The sole Web test failure was the 5-second timeout above in merged Analytics StatRow coverage. I did not change its expectation. No Rust source changed, so no Rust crate gates ran. cargo clean output: Removed 7066 files, 4.0GiB total.
kayg commented 2026-09-30 16:09:01 +00:00
Author
Owner
Copy link

Merge round 3 integration report

State: incomplete; do not fast-forward this snapshot to dev yet. The four-hour job limit ended while CLI Clippy was compiling. No completed final-tree gate failed. No source branch was dropped because the completed gates showed no failing branch.

  • Branch: job/merge-round-3
  • Head: 3e5056d485e9021d2d1f708613e783b0b901b447
  • Included in order: job/multiget-500, job/dav-delete-471, job/iso-435, job/admin-deny-483, job/attach-427, job/hidden-420, job/files-sel-keys, job/small-bugs-3, job/sweep-478.
  • Additional commits: 92f5803f3, 3ea69e317, 26b986bc4, 0948cffa1, 99c088193, df6b07a5a, 3e5056d48.

Completed gate output (verbatim excerpts)

cargo fmt --check exited 0 with no output.

  • DAV clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 56.92s`
  • DAV tests:
    test result: ok. 40 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s
    test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s
    test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.31s
  • Notes Core clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 14.97s`
  • Notes Core tests:
    test result: ok. 512 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s
    test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.21s
    test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s
    test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.35s
    test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
  • Notes plugin clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 2m 55s`
  • Notes plugin tests: test result: ok. 127 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 151.26s
  • Files clippy (after comment fix): Finished \dev` profile [unoptimized + debuginfo] target(s) in 48.77s`
  • Files tests: test result: ok. 144 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 178.62s
    The dev-version migration test passed: test tests::dev_files_schema_upgrades_through_share_log_and_sidecar_migrations ... ok
  • Calendar clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 1m 53s`
  • Calendar tests:
    test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.01s
    test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s
    test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.22s
  • Photos clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 1m 13s`
  • Photos tests: test result: ok. 45 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 11.10s
  • Search clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 55.79s`
  • Search tests:
    test result: ok. 36 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 46.71s
    test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.38s
    test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s
    test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.44s
    test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
    test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
    test result: ok. 1 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 5.66s
    test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s
  • Embed clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 27.32s`
  • Embed tests: test result: ok. 31 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 1.93s
  • Filesystem clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 10.78s`
  • Filesystem tests:
    test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.04s
    test result: ok. 42 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.56s
  • Server clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 1m 48s`
  • Server tests: test result: ok. 85 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 19.67s

Other completed checks:

  • Parity matrix: 190 web API actions, 122 shortcuts, 2 static commands, 136 menu actions, 31 settings groups, 172 actions with adapter gaps
  • Cross-User classification gate: 311 operations classified; its test suite printed Ran 5 tests in 0.246s and OK.
  • Admin coverage: 39 reviewed operations; contract and Rust guards agree; its test suite printed Ran 14 tests in 2.404s and OK.
  • Migration audit: ai: 4 migrations, no duplicate numbers; analytics: 2 migrations, no duplicate numbers; calendar: 3 migrations, no duplicate numbers; files: 18 migrations, no duplicate numbers; mail: 8 migrations, no duplicate numbers; notes: 19 migrations, no duplicate numbers; notifications: 4 migrations, no duplicate numbers; photos: 6 migrations, no duplicate numbers; video: 1 migrations, no duplicate numbers.

Remaining work

  • CLI Clippy was interrupted at the four-hour limit while checking dependencies; CLI tests and both Auth gates did not run.
  • The generated contract check, web bun run check, bun run test, and bun run build are pending.
  • The live two-User matrix, authz matrix, DAV round (including Apple’s 100-href and DELETE re-parent replays), sidecar probe, and attachment e2e are pending.
  • Production-browser screenshots for each affected screen at 390/820/1440 px in light/dark mode are pending. No visual review artifacts were produced.
  • The new benchmark profile was added, but its local run and comparison with docs/perf/baseline.json are pending.
  • cargo clean is running but has not returned yet; apps/web/build was removed.

Decisions

  • Files migration IDs follow merge order after dev’s 0015: 0016 share_search_invalidations, 0017 log_attachment_trash, 0018 sidecar_pairs. The populated dev-schema upgrade test passed.
  • Hidden-file Settings copy leads with the User-visible result and uses “Photo edit files (.xmp, .aae)”.
  • The parity exception snapshot was regenerated and reviewed for the newly merged API and Files UI actions.

The branch contains the merged code and commits, but the listed pending gates mean this is not a green merge candidate yet.

## Merge round 3 integration report **State: incomplete; do not fast-forward this snapshot to `dev` yet.** The four-hour job limit ended while CLI Clippy was compiling. No completed final-tree gate failed. No source branch was dropped because the completed gates showed no failing branch. - Branch: `job/merge-round-3` - Head: `3e5056d485e9021d2d1f708613e783b0b901b447` - Included in order: `job/multiget-500`, `job/dav-delete-471`, `job/iso-435`, `job/admin-deny-483`, `job/attach-427`, `job/hidden-420`, `job/files-sel-keys`, `job/small-bugs-3`, `job/sweep-478`. - Additional commits: `92f5803f3`, `3ea69e317`, `26b986bc4`, `0948cffa1`, `99c088193`, `df6b07a5a`, `3e5056d48`. ### Completed gate output (verbatim excerpts) `cargo fmt --check` exited 0 with no output. - DAV clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 56.92s` - DAV tests: `test result: ok. 40 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s` `test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s` `test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.31s` - Notes Core clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 14.97s` - Notes Core tests: `test result: ok. 512 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.21s` `test result: ok. 19 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.21s` `test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s` `test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.35s` `test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s` - Notes plugin clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 2m 55s` - Notes plugin tests: `test result: ok. 127 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 151.26s` - Files clippy (after comment fix): `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 48.77s` - Files tests: `test result: ok. 144 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 178.62s` The dev-version migration test passed: `test tests::dev_files_schema_upgrades_through_share_log_and_sidecar_migrations ... ok` - Calendar clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 1m 53s` - Calendar tests: `test result: ok. 52 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.01s` `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s` `test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.22s` - Photos clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 1m 13s` - Photos tests: `test result: ok. 45 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 11.10s` - Search clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 55.79s` - Search tests: `test result: ok. 36 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 46.71s` `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.38s` `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s` `test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 10.44s` `test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s` `test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s` `test result: ok. 1 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 5.66s` `test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s` - Embed clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 27.32s` - Embed tests: `test result: ok. 31 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 1.93s` - Filesystem clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 10.78s` - Filesystem tests: `test result: ok. 50 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 9.04s` `test result: ok. 42 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.56s` - Server clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 1m 48s` - Server tests: `test result: ok. 85 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 19.67s` Other completed checks: - `Parity matrix: 190 web API actions, 122 shortcuts, 2 static commands, 136 menu actions, 31 settings groups, 172 actions with adapter gaps` - `Cross-User classification gate: 311 operations classified`; its test suite printed `Ran 5 tests in 0.246s` and `OK`. - `Admin coverage: 39 reviewed operations; contract and Rust guards agree`; its test suite printed `Ran 14 tests in 2.404s` and `OK`. - Migration audit: `ai: 4 migrations, no duplicate numbers`; `analytics: 2 migrations, no duplicate numbers`; `calendar: 3 migrations, no duplicate numbers`; `files: 18 migrations, no duplicate numbers`; `mail: 8 migrations, no duplicate numbers`; `notes: 19 migrations, no duplicate numbers`; `notifications: 4 migrations, no duplicate numbers`; `photos: 6 migrations, no duplicate numbers`; `video: 1 migrations, no duplicate numbers`. ### Remaining work - CLI Clippy was interrupted at the four-hour limit while checking dependencies; CLI tests and both Auth gates did not run. - The generated contract check, web `bun run check`, `bun run test`, and `bun run build` are pending. - The live two-User matrix, authz matrix, DAV round (including Apple’s 100-href and DELETE re-parent replays), sidecar probe, and attachment e2e are pending. - Production-browser screenshots for each affected screen at 390/820/1440 px in light/dark mode are pending. No visual review artifacts were produced. - The new benchmark profile was added, but its local run and comparison with `docs/perf/baseline.json` are pending. - `cargo clean` is running but has not returned yet; `apps/web/build` was removed. ### Decisions - Files migration IDs follow merge order after dev’s 0015: 0016 `share_search_invalidations`, 0017 `log_attachment_trash`, 0018 `sidecar_pairs`. The populated dev-schema upgrade test passed. - Hidden-file Settings copy leads with the User-visible result and uses “Photo edit files (.xmp, .aae)”. - The parity exception snapshot was regenerated and reviewed for the newly merged API and Files UI actions. The branch contains the merged code and commits, but the listed pending gates mean this is not a green merge candidate yet.
kayg commented 2026-09-30 16:11:00 +00:00
Author
Owner
Copy link

Merge round 3 report addendum

Branch job/merge-round-3, HEAD 3e5056d485e9021d2d1f708613e783b0b901b447.

  • Cleanup completed after the main report: Removed 25367 files, 17.5GiB total.
  • apps/web/build removal check: web build output removed: True.
  • git diff --check exited 0 with no output; the worktree has no modified or untracked files.
  • The 4-hour cutoff also prevented a full re-read of documentation comments across all 234 changed files. This remains an audit gap alongside the pending gates listed in the main report.

The branch is still not a green merge candidate.

## Merge round 3 report addendum Branch `job/merge-round-3`, HEAD `3e5056d485e9021d2d1f708613e783b0b901b447`. - Cleanup completed after the main report: `Removed 25367 files, 17.5GiB total`. - `apps/web/build` removal check: `web build output removed: True`. - `git diff --check` exited 0 with no output; the worktree has no modified or untracked files. - The 4-hour cutoff also prevented a full re-read of documentation comments across all 234 changed files. This remains an audit gap alongside the pending gates listed in the main report. The branch is still not a green merge candidate.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
dev
wip/rev2-webperf
wip/rev2-money-ident
wip/restyle-notes
wip/previewcard-1098
wip/palette2-1123
wip/palette-1093
wip/onboard2-1141
wip/onboard-1141.aborted-early
wip/onboard-1141
wip/nlpchip-1127
wip/morph-1104
wip/merge-round-7c5
wip/merge-round-7c4
job/notifloop-1194
wip/merge-round-7c3
wip/merge-round-7c2
wip/merge-round-7c
wip/mchrome-1084
wip/mailghost2-1094
wip/mailghost-1094
wip/kbpreview2-1118
wip/kbpreview-1118
wip/kanban-1092
wip/importhang-1121
wip/hiderev-1153
wip/hide4-1153
wip/hide3-1153
wip/hide2-1153
wip/hide-1153
wip/editreg-1132
wip/editorrail3-1113
wip/editorrail2-1113
wip/editorrail-1113
wip/e2e-b2-1071
wip/e2e-b-1071
wip/draw4-1101
wip/draw3-1101
wip/draw2-1101
wip/draw-1101
wip/directory-1199-r
wip/directory-1199
wip/delete-1119
wip/collabrev-1197
wip/collabloss-1197
wip/cards2-1083
wip/cards-1083
wip/canvas-visual
wip/canvasvis2-976
wip/calhdr-1112
wip/calcards-1115
wip/browserfix
wip/blocks-1125
wip/allday-1107
wip/agenda-decks
wip/agenda-1086
wip/adv7c-1105
wip/txentry-1198
wip/trayicons2-1095
wip/trayicons-1095
job/onboard-1141
wip/sidebar3-1094
job/collabloss-1197
job/hide-1153
job/perf-1124
job/perf2-1124
job/tocrail-1191
job/restyle-settings
wip/restyle-settings
job/segmented-1200
wip/notifloop-1194
job/tagperf-1186
wip/tagperf-1186
wip/segmented-1200
job/restyle-files
job/tagdnd-1187
job/merge30
job/cards-1179
wip/cards2-1179
wip/cards-1179
wip/tocrail-1191
wip/tagdnd-1187
wip/restyle-files
wip/perf-1124
wip/merge30j
job/restyle-notes
job/wizchoices-1140
job/adv-1202
wip/wizchoices-1140
wip/restyle-1190
job/moneyfmt-1180
job/txentry-1198
wip/moneyfmt2-1180
wip/moneyfmt-1180-r
wip/moneyfmt-1180
job/pillglass-1189
job/flags-1181
wip/flags-1181
job/restyle-1190
job/restyle-mailmoney
job/restyle-search
job/settingsreg-1195
job/wizard-1140
site/website
wip/wizardrev2-1140
wip/wizardrev-1140
wip/wizard5-1140
wip/wizard4-1140
wip/wizard3-1140
wip/wizard2-1140
wip/wizard-1140
wip/pillglass-1189
wip/settingsreg-1195
job/merge29
job/fu-1171
wip/merge29j
wip/fu-1171
job/fu-1166
job/directory-1199
job/proflog-1204
job/txresearch-1188
wip/fu-1166
job/merge28
job/search-1066
wip/search-1066
wip/merge28j
job/gateslot-1182
job/bulkimport-1157
job/mailnet-1160
wip/mailnetrev-1160
wip/mailnet-1160
wip/bulkrev-1157
wip/bulkimport-1157
job/startup-1161
wip/startup-1161
job/merge27
job/linkcards-1151
wip/linkcards3-1151
wip/linkcards2-1151
wip/linkcards-1151
job/traydate-1144
wip/traydate3-1144
wip/traydate2-1144
wip/traydate-1144
job/draw-1101
wip/merge27j
job/blockpill-1152
wip/blockpill3-1152
wip/blockpill2-1152
wip/blockpill-1152
job/minihover-1149
wip/minihover2-1149
wip/minihover-1149
job/merge25
wip/merge25-r
wip/merge25b
wip/merge25
job/inspector-1129
job/tags-1110
wip/inspector3-1129
wip/inspector2-1129
wip/inspector-1129
wip/tagsrev-1110
wip/tags2-1110
wip/tags-1110
job/dates-1148
wip/datesrev-1148
wip/dates2-1148
wip/dates-1148
job/licence-1145
wip/licence2-1145
wip/licence-1145
job/selfhost-1156
job/merge23
wip/merge23
job/tagfilter-1109
wip/tagfilter2-1109
wip/tagfilter-1109
job/kbd-1134
wip/kbd2-1134
wip/kbd-1134
job/palfoot-1137
wip/selfhost-1156
wip/palfoot2-1137
wip/palfoot-1137
job/toggle-1158
wip/toggle-1158
job/kbpreview-1118
job/docratchet-1155
job/perflint-1133
job/devtests-1159
wip/docratchet-1155
wip/devtests-1159
job/segv-1136
wip/toast-1142
wip/segv-1136
job/toast-1142
job/blockreload-1147
wip/blockreload-1147
job/font-1150
wip/font-1150
job/importui-1120
job/minimonth-1149
wip/importui-1120
wip/minimonth-1149
job/depcheck-1146
wip/perflint-1133
wip/depcheck-1146
job/calcards-1115
job/blocks-1125
job/plus-1128
job/shift-1138
wip/plus2-1128
wip/plus-1128
wip/shift-1138
job/moneyfid-1130
job/editorrail-1113
wip/moneyrev-1130
wip/moneyfid-1130
job/noext-851
wip/noext-851
wip/noext3-851
wip/noext2-851
job/week-1135
wip/week-1135
job/editreg-1132
job/smoke-1122
wip/smoke-1122
job/docs-1143
job/palette2-1123
job/calhdr-1112
job/nlpchip-1127
job/mailghost-1094
job/reconnect-1131
wip/reconnect-1131
job/trayicons-1095
job/delete-1119
job/importhang-1121
job/cards-1083
job/palette-1093
job/mchrome-1084
job/e2e-a-1071
job/canvas-visual
job/previewcard-1098
job/allday-1107
wip/e2e-a2-1071
wip/e2e-a-1071
job/e2e-b-1071
job/adv7c-1105
job/kanban-1092
job/agenda-1086
job/merge-round-7c
job/morph-1104
wip/surfaces-p2
job/merge-round-9
wip/merge-round-9
job/7cfix-small
wip/7cfix-small
job/mailui-1078
job/merge-round-8
wip/merge-round-8
wip/mailui-1078
job/mailround-1038
job/applemail-accept
wip/settitle-1068
wip/mailround2-1038
wip/mailround-1038
wip/e2e-7b
job/crash-1069
wip/crash-1069
job/searchlost-1066
wip/searchlost-1066
job/7b-reconcile
job/flake-1065
wip/flake-1065
wip/merge-round-7b7
wip/merge-round-7b6
wip/merge-round-7b5
wip/merge-round-7b4
wip/7b-reconcile
job/appupdate-1059
job/nfd-1044
wip/appupdate-1059
job/e2e-7b
job/loop-1062
wip/loop-1062
job/pdfprev-1045
job/invtoggle-1053
wip/pdfprev-1045
wip/nfd-1044
wip/invtoggle-1053
job/7bfix-e2e
job/mailstress-b
wip/7bfix-e2e
wip/mailstress-b
job/7bfix-adv
wip/7bfix-adv
job/mailstress-a
job/stack-1054
wip/stack-1054
wip/mailstress-a
job/mailstress-1038
wip/mailstress-1038
job/upload500-1051
wip/upload500-1051
job/share-1034
wip/share-1034
job/syncerr-1037
job/7bfix-photos
wip/7bfix-photos
job/paste-1036
job/setside-1039
wip/setside-1039
wip/paste-1036
job/lease-1042
wip/syncerr-1037
wip/lease-1042
job/7bfix-data
job/passkeybind-1043
wip/apprevoke-1041
job/invite-1035
wip/invite-1035
job/merge-round-7b2
wip/merge-round-7b2
job/mailproxy-486
job/apprevoke-1041
job/rebuild-1033
job/pillborder-1029
wip/pillborder-1029
wip/mailproxy-486
wip/applemail-486
job/headless-998
wip/headless-998
job/groups-1028
wip/groups-1028
job/rebuildwarn-1016
wip/rebuildwarn-1016
job/startup-1011
wip/startup-1011
job/monthpill-1009
job/bgthumb-1025
job/sharetitle-1012
wip/monthpill-1009
wip/bgthumb-1025
wip/sharetitle-1012
job/canvas-cards-977
wip/canvas-cards-977
job/canvas-pencil-978
job/canvas-sketch-990
wip/canvas-sketch-990
wip/canvas-pencil-978
job/canvas-files-989
wip/canvas-files-989
job/canvas-collab-991
wip/canvas-collab-991
job/weekscroll-1018
wip/weekscroll-1018
wip/canvas-core-976
job/canvas-core-976
job/round-drag
wip/round-drag
job/round-settings
job/browserfix
wip/oapi-974
job/oapi-974
job/hist2-integrate
job/mailhtml-726
wip/mailhtml-726
wip/hist2-integrate
job/moneyfu-984
job/drag-1015
wip/drag-1015
job/rename-1017
wip/rename-1017
job/hist2-api
wip/hist2-api
job/oneacct-1014
wip/oneacct-1014
wip/moneyfu-984
job/hist2-bench
job/hist2-restore
wip/hist2-bench
job/hist2-write
job/hotfix-724
wip/hotfix-724
wip/hist2-write
wip/hist2-restore
job/hist2-store
job/hist2-ui
wip/hist2-ui
wip/hist2-store
job/searchstarve-965
job/shutdown-963
wip/shutdown-963
wip/pubedit-981
job/pubedit-981
job/analytics-973
wip/searchstarve-965
job/authflash-850
job/weeklane-969
job/pvtitle-1004
job/hist-975
wip/authflash-850
job/voicepill-617
wip/pvtitle-1004
job/headring-1003
wip/weeklane-969
wip/voicepill-617
wip/headring-1003
wip/analytics-973
job/agentscope-980
wip/thumbsandbox-988
job/thumbsandbox-988
wip/hist-975
job/links-856
wip/links-856
job/davetag-966
wip/davetag-966
job/filesstorm-1000
job/hoverpad-725
wip/filesstorm-1000
job/ffmpegblas-993
job/merge-round-7a
wip/hoverpad-725
wip/ffmpegblas-993
job/nowdot-1002
wip/verify-7a
job/noteid-857
wip/nowdot-1002
wip/noteid-857
wip/merge-round-7a
wip/agentscope-980
job/imapedge
job/a11yfix2
wip/imapedge-941
wip/imapedge
wip/a11yfix2
job/notetask-986
job/logheading
wip/logheading-998
job/textthumb-652
job/photolive-987
wip/photolive-987
job/davactive-983
job/savefix-985
job/tabicons-607
wip/davactive-983
wip/tabicons-607
wip/notetask-986
wip/savefix-985
job/dirid-627
job/buildspeed-1007
wip/dirid-627
job/agenda-decks
job/perfguards-impl
job/undo-a11y
wip/undo-a11y
job/mailperf
job/wal-824
wip/settings-50
job/settings-50
job/notesfilter-606
wip/notesfilter-606
job/surfaces-p2
wip/wal-824
job/maillayouts
wip/mailperf
wip/maillayouts
job/taskmeta-659
job/money-ident
wip/money-ident
wip/taskmeta-659
job/errstates
wip/perfguards-impl
job/headings-881
wip/headings-881
wip/errstates
job/voice-619
job/gaps-827
job/notesperf
wip/notesperf
wip/voice-619
job/hddsql-549
job/perf-stream-668
wip/perf-stream-668
wip/deeplinks-fix
job/deeplinks-fix
job/authfix
job/docsfix-rust
wip/docsfix-rust
job/webperf
job/docsfix-web
job/datafix2
job/webdav-lock-476
job/copyfix
wip/copyfix
wip/webperf
job/focus-658
wip/protofix
job/mediafix
job/protofix
wip/mediafix
job/agentfix
job/hhmm-724
wip/agentfix
job/undo-722
job/reuse
wip/webdav-lock-476
wip/reuse
job/scopefix
job/datafix
wip/hhmm-724
wip/undo-722
job/surfaces-p1
wip/hddsql-549
job/voicememos-618
wip/datafix2
wip/surfaces-p1
job/fix-940
wip/fix-940
job/blaze-surfaces
wip/datafix
wip/blaze-surfaces
job/taskday-655
job/linknav-639
wip/linknav-639
wip/gaps-827
job/isolation-707
job/audiophotos-720
wip/audiophotos-720
job/advfind-664
wip/voicememos-618
wip/taskday-655
wip/isolation-707
wip/advfind-664
wip/scopefix
wip/focus-658
job/testgaps
wip/testgaps
job/overscroll-718
wip/authfix
job/deps
wip/overscroll-718
job/rev2-agentfix
job/rev2-money-ident
job/rev2-mailperf
wip/deps
job/hardening-728
wip/hardening-728
job/searchgen-832
wip/searchgen-832
job/photopw-849
job/mailsql-825
wip/photopw-849
job/sharefix
wip/sharefix
job/rev2-mailhtml-726
job/rev2-perfguards
job/copyval-723
job/lightglass-r2
wip/lightglass-r2
wip/docsfix-web
job/copy-audit
job/macinterop-staging-r2
job/design-sync
job/rev2-taskmeta-659
job/rev2-webperf
job/docs-audit
job/rev2-advfind-664
job/rev2-mailproxy-486
job/states-audit
job/rev2-datafix
job/design-drift
job/test-gaps
job/rev2-voicememos-618
job/rev2-mediafix
job/rev2-deps
job/rev2-datafix2
job/licence-audit
job/issue-hygiene
job/rev2-protofix
job/rev2-voice-619
job/rev2-isolation-707
job/rev2-surfaces-p1
job/deeplink-audit2
job/rev2-audiophotos-720
wip/test-gaps
job/rev2-overscroll-718
job/rev2-undo-722
wip/states-audit
job/rev2-dropmd-719
job/rev2-linknav-639
job/merge-7b-plan
wip/merge-7b-plan
job/rev2-taskday-655
wip/mailsql-825
job/rev2-webdav-lock-476
job/rev2-browserfix
wip/design-drift
job/rev2-hddsql-549
wip/deeplink-audit2
job/rev2-scopefix
job/rev2-authfix
job/rev2-hardening-728
job/rev2-wal-824
job/rev2-sharefix
job/calsidebar-638
job/chrome-audit
job/ioperf
wip/ioperf
wip/chrome-audit
wip/calsidebar-638
job/dropmd-719
wip/dropmd-719
job/ocr-build
wip/ocr-build
job/blaze-settings
wip/copyval-723
job/toastring-721
wip/toastring-721
job/deployfix-732
wip/deployfix-732
wip/blaze-settings
job/money-import-recheck
job/rev-a11y
job/perf-arch-db
job/rev-7b-data
wip/textthumb-652
wip/perf-arch-db
job/sec-protocols
job/sidehdr-660
job/rev-7b-security
job/research-surfaces
job/rev-design-gaps
job/rev-mcp-api
wip/sidehdr-660
job/perf-arch-memory
wip/sec-protocols
job/perf-arch-bundle
job/snapedge-714
wip/rev-mcp-api
job/sec-supplychain
wip/research-surfaces
job/perf-arch-sync
job/rev-consistency
job/perf-arch-server
wip/perf-arch-server
wip/perf-arch-memory
job/perf-arch-io
job/perf-arch-client
job/sec-fs
job/sec-mcp-scopes
job/sec-sharing
job/perf-guards
job/sec-browser
job/sec-admin-deploy
job/sec-auth
wip/snapedge-714
job/bgpicker-717
wip/perf-arch-bundle
wip/money-import-recheck
job/advsetup-654
wip/bgpicker-717
wip/advsetup-654
job/burst-709
job/kbdcaps-710
job/app-pw-chooser
wip/burst-709
wip/app-pw-chooser
job/imaptest-625
wip/kbdcaps-710
job/fix-499
wip/fix-499
job/perf-mut-667
job/calimg-589
job/perf-snap-666
wip/calimg-589
wip/perf-snap-666
wip/perf-mut-667
job/perf-cache-665
wip/perf-cache-665
job/voicefiles-620
wip/voicefiles-620
job/admin-burst-705
wip/admin-burst-705
job/voicememos-review
wip/voicememos-review
wip/ryw-653
job/ryw-653
job/writeonopen-661
job/instant-663
wip/writeonopen-661
job/money-import-review
wip/money-import-review
wip/importjs-610
review/integrations-407-round6
wip/integrations-review
job/dragghost-612
wip/dragghost-612
job/integrations
wip/integrations
job/decider-656
job/merge-round-6
job/perf-rerun
wip/merge-round-6
job/integrations-review-round5
job/selalign-576
wip/selalign-576
job/mcp-events-491
job/files-631
job/cal-e2e-569
wip/cal-e2e-569
job/reload-423
wip/reload-423
wip/mcp-events-491
wip/files-631
job/notesbridge-644
wip/notesbridge-644
job/editor-series
job/calcard-series
wip/calcard-series
job/mcp-events-review-491
wip/mcp-events-review
wip/editor-series
job/quirks-546
job/integrations-recheck
job/tocrail-636
wip/tocrail-636
wip/quirks-546
wip/reminders-643
job/reminders-643
wip/davscale-573
job/davscale-573
job/integrations-review
wip/ocr-eval-584
job/ocr-eval-584
job/esc-537
wip/esc-537
job/toastname-586
wip/toastname-586
job/submenu-579
wip/submenu-579
job/tasks-mode
wip/tasks-mode
job/agentdocs-630
job/dupwrite-634
wip/agentdocs-630
wip/dupwrite-634
job/lightglass-588
wip/lightglass-588
job/tabswitch-549
job/ghosttask-623
wip/ghosttask-623
job/toaststack-616
job/weekstate-609
job/mailsync-613
wip/mailsync-613
wip/weekstate-609
job/maildup-626
wip/tabswitch-549
wip/maildup-626
wip/toaststack-616
job/motion-611
wip/motion-611
job/tlstest-601
wip/tlstest-601
job/perf-495
job/floating-sheet
wip/floating-sheet
job/remdup-585
wip/remdup-585
job/fix-502
wip/fix-502
job/attachplay-622
job/perf-batch
wip/perf-batch-563
wip/perf-495
hotfix/mail-sync-diag
job/mail-m3
wip/mail-m3
job/attach-poof-603
job/calhover-608
job/editorbar-604
job/mentions-605
job/merge-round-4
job/allday-514
wip/merge-round-4
wip/allday-514
job/merge-round-4a
wip/merge-round-4a
job/sharestack-580
job/fix-501
wip/sharestack-580
wip/fix-501
job/perf-batch-563
job/apw-cache-review
wip/apw-cache-review
job/probe-520
wip/probe-520
job/mac-393
wip/mac-393
job/header-571
job/flake-513
wip/flake-513
job/docs-thumb-547
wip/header-571
job/webcal-572
wip/webcal-572
wip/shortcuts-542
job/shortcuts-542
wip/docs-thumb-547
job/caldav-stress
wip/caldav-stress
wip/sweep-478
job/apw-cache-512
wip/apw-cache-512
job/money-empty-540
wip/restart-505
wip/money-empty-540
wip/fix-510
job/restart-505
job/fix-503
job/perf-496
wip/perf-496
job/fix-498
wip/fix-498
job/info-inspector-465
wip/info-inspector-465
job/fix-510
job/fix-507
wip/fix-507
wip/fix-503
job/fix-493
job/money-kinds
wip/money-kinds
job/hygiene-548
job/merge-round-3
wip/fix-493
job/drag-snap-536
wip/merge-round-3
wip/merge-round-0930
wip/drag-snap-536
job/align-538
wip/align-538
job/bg-flash
wip/bg-flash
job/money-import
job/search-count-544
wip/search-count-544
wip/money-import
job/settings-key-541
wip/settings-key-541
job/toast-539
job/preview-421
wip/preview-421
wip/toast-539
job/tasks-500-531
job/title-plain-526
wip/title-plain-526
wip/tasks-500-531
job/notes-bridge
wip/parity-484
job/parity-484
job/files-slow
job/crash-525
wip/notes-bridge
wip/files-slow
wip/crash-525
job/kbd-motion-527
wip/bg-422
job/analytics-504
wip/analytics-504
wip/kbd-motion-527
job/upload-pill-523
wip/upload-pill-523
wip/tray-order
job/tray-order
wip/overflow-mid
wip/merge-round-2
job/perf-494
wip/perf-494
wip/mcp-fast-492
wip/motion-477
wip/asr-ab-489
wip/theme-variants-506
wip/overflow-511
wip/week-header-508
wip/attach-427
job/dav-delete-471
job/iso-435
wip/iso-435
wip/files-sel-keys
wip/dav-delete-471
job/align-253
job/siwc-490
wip/siwc-490
job/money-kinds-review
wip/align-253
wip/money-kinds-review
job/small-bugs-3
wip/overlay-title-487
wip/multiget-500
wip/hidden-420
wip/webcal-ui
wip/webcal-431
job/perf-367
job/location
wip/small-bugs-3
wip/location
wip/perf-367
wip/admin-deny-483
job/tag-unicode-473
wip/tag-unicode-473
job/blur-436
wip/photos-470
wip/blur-436
wip/small-bugs-4
wip/hunt-20260930
wip/settings-hdr-482
wip/chips-416
job/dedup-375
wip/dedup-375
job/doc-stack
wip/doc-stack
job/tokens-literals
wip/tokens-literals
job/jobs-leftovers
wip/send-fast
wip/paste-467
wip/money-numbers
job/money-plugin
wip/money-plugin
job/break-dav
wip/merge-batch
wip/crossday-469
wip/mac-verify
wip/mail-m2
wip/break-dav
wip/money-review2
job/money-md
job/modes-424
wip/money-md
wip/jobs-leftovers
job/agenda-413
wip/agenda-413
wip/modes-424
job/recog-417
wip/recog-417
wip/bounce-425
wip/ab-384-luna
job/webdav-perf
wip/webdav-perf
job/toast-ring
wip/toast-ring
job/money-review
wip/money-review
wip/micro-motion
wip/settings-card
wip/minical
job/notes-imap-428
job/least-priv
wip/ui-small-2
wip/flaky-426
wip/drag-end-418
job/jank
wip/jank
wip/least-priv
wip/docs-site
job/agenda
job/sec-batch
wip/sec-batch
wip/per-user-index
job/area-calendars
wip/area-calendars
job/parity
wip/parity
job/documents-research
wip/documents-research
job/test-infra
job/reminders-sync
wip/small-bugs-2
wip/reminders-sync
wip/gestures
job/google-oauth
wip/tags-merge
wip/tags
job/e2e-theme
wip/e2e-theme
job/icon-align
wip/test-infra
wip/select-align
wip/editor-385
job/voice
wip/webdav
job/webdav
job/app-pw-ui
job/editor-integrity
wip/editor-integrity
wip/voice
wip/quota
wip/cal-followups
wip/icon-align
job/composer-scale
wip/composer-scale
job/jobs-page
wip/jobs-page
job/hig-type
wip/hig-type
wip/app-pw-ui
job/motion-spring
job/mcp
wip/motion-spring
wip/mcp
job/small-bugs
wip/push-hosts
job/profile-sign
wip/touch-369
wip/profile-sign
job/mobile-focus
wip/mobile-focus
wip/ui-polish-354
wip/small-bugs
wip/dup-task
job/toast-polish
job/app-pw-scopes
wip/toast-polish
wip/app-pw-scopes
wip/cli-agent
wip/selection-pills
job/preview-attach
wip/preview-attach
job/dav-proppatch
wip/dav-proppatch
wip/cal-switcher
job/atomic-race
wip/atomic-race
job/photos-shared
wip/photos-shared
wip/cal-grid
wip/note-rewrite
wip/search-rebuild
job/mail-m1
job/paperless-import
wip/paperless-import
wip/mail-m1
wip/hidden-activity
wip/search-d
wip/pricing-research
wip/cursors
wip/auto-scheme
job/single-pills
wip/single-pills
wip/xuser-matrix
wip/money-format
wip/app-pw-setup
wip/purge-dos
wip/vault-health
wip/caldav-apple
wip/xuser-audit
wip/e2e-green
wip/tabbar
wip/adv-harness
wip/maple-mono
job/search-fix
wip/search-fix
wip/search-perf-c
job/adv-harness
wip/sidebar-headers
job/glass
wip/temp-index
job/polish
wip/polish
wip/file-protocols
wip/money-research
wip/glass
wip/voice-models
wip/collab-redo
job/voice-research
wip/hunt-20260928
wip/notes-actions-research
wip/search-pad
wip/search-perf
wip/search-sticky
wip/editor-undo
wip/chrome-rules
wip/motion
wip/appearance-research
wip/appearance
wip/audit-bugs
wip/cal-glass
wip/block-actions
wip/authz-order
wip/event-stripes
wip/chrome-sidebar
wip/auth-flaky
wip/robust-2
wip/gate-fix
wip/menu-blur
wip/import-calternaljs
wip/tray-fix
job/import-calternaljs
wip/index-order
wip/audit-fixes
wip/search-chevrons
research/mail
wip/phone-chrome
wip/dedup-break
wip/csp
wip/ui-audit
wip/select-toast
wip/perf
wip/flat-layout
wip/fonts
wip/event-tint
wip/sync-converge
wip/data-split
wip/glass-audit
wip/robustness
wip/sync-chaos
wip/search-thumbs
wip/fuzz
wip/menu-icons
wip/search-pill
wip/sync-changing
wip/heading-links
wip/date-formats
wip/a11y
wip/break-editor
wip/e2e-fix
wip/settings-sections
wip/sync-root-guard
wip/search-palette
wip/share-edit
job/toasts
wip/toasts
wip/cont-analytics
wip/authz-review
wip/popovers
wip/overlay-glass
wip/change-feed
wip/editor-modes
wip/composer-align
wip/cont-agenda
wip/agenda-merge
job/agent-conventions
wip/agent-conventions
wip/backend-misc
job/route-audit
wip/route-audit
wip/ui-batch
wip/heif-hardening
wip/grid-resize
wip/ask-page
wip/webmcp
job/deeplink-audit
wip/deeplinks
wip/shortcuts
wip/cont-tz-days
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#383
No description provided.