[adversarial] Review API probe timeouts under mixed load

kayg commented

2026-09-29 02:51:29 +00:00

Owner

Evidence

One real-server adversarial API round on 2026-09-29, after merging dev into job/app-pw-ui at de4531ce:

ADVERSARIAL_SERVER_BIN=/mnt/hdd/targets/jobs/app-pw-ui/debug/calternal-server \
ADVERSARIAL_SKIP_WEB_BUILD=1 ADVERSARIAL_API_ONLY=1 \
tests/adversarial/run.sh

The round finished with exit code 1. The server reported alive at the end. The runner removed its temporary fixture directory. It printed no credentials.

tests/adversarial/attack.py:894: a 3 MiB PUT /api/v1/appearance was expected to return 413. The local proxy returned 502 with local adversarial server is unavailable.
tests/adversarial/attack.py:3307-3320: two POST /api/v1/calendar/events/{id}/log-this requests timed out during the mixed-load run, after the 120-photo upload burst.
The Journal PATCH concurrency storm returned 200 once and 412 for 17 requests, but 6 of 24 requests timed out. A later Journal read returned 200.
tests/adversarial/attack.py:2552-2555: DAV discovery returned 207, but the probe did not find calendar-home-set in the response.

The round also reports that a DAV Event containing VALARM returned 201. The merged dev branch includes the Apple Reminders work in #358, which intentionally accepts and persists alarms. Review that existing adversarial expectation before changing behavior; this UI job did not change the API or its assertions.

Latency-only findings are omitted. These results came from the mixed hostile-input and concurrency run on a shared build host, so please check the response and logs before deciding whether they show a product issue or a load-sensitive probe result.

## Evidence One real-server adversarial API round on 2026-09-29, after merging `dev` into `job/app-pw-ui` at `de4531ce`: ```sh ADVERSARIAL_SERVER_BIN=/mnt/hdd/targets/jobs/app-pw-ui/debug/calternal-server \ ADVERSARIAL_SKIP_WEB_BUILD=1 ADVERSARIAL_API_ONLY=1 \ tests/adversarial/run.sh ``` The round finished with exit code 1. The server reported alive at the end. The runner removed its temporary fixture directory. It printed no credentials. - `tests/adversarial/attack.py:894`: a 3 MiB `PUT /api/v1/appearance` was expected to return 413. The local proxy returned 502 with `local adversarial server is unavailable`. - `tests/adversarial/attack.py:3307-3320`: two `POST /api/v1/calendar/events/{id}/log-this` requests timed out during the mixed-load run, after the 120-photo upload burst. - The Journal PATCH concurrency storm returned 200 once and 412 for 17 requests, but 6 of 24 requests timed out. A later Journal read returned 200. - `tests/adversarial/attack.py:2552-2555`: DAV discovery returned 207, but the probe did not find `calendar-home-set` in the response. The round also reports that a DAV Event containing `VALARM` returned 201. The merged `dev` branch includes the Apple Reminders work in #358, which intentionally accepts and persists alarms. Review that existing adversarial expectation before changing behavior; this UI job did not change the API or its assertions. Latency-only findings are omitted. These results came from the mixed hostile-input and concurrency run on a shared build host, so please check the response and logs before deciding whether they show a product issue or a load-sensitive probe result.

kayg referenced this issue

2026-09-29 04:01:09 +00:00

App Passwords UI: shared select and date picker, input surface token, one sheet title #377

kayg referenced this issue

2026-09-29 04:36:28 +00:00

[tests] Investigate calternal-cli loopback request failures #389

kayg commented

2026-09-29 04:38:37 +00:00

Author

Owner

Initial harness finding: the API probe in tests/adversarial/attack.py sends requests through editor-proxy.mjs. The proxy maps any backend connection error to a synthetic 502 body (local adversarial server is unavailable), so the reported 3 MiB PUT result does not show whether the API sent 413 or the proxy lost its upstream connection. I will route the API-only round directly to the real backend to separate API behavior from this proxy failure mode. The Journal and Calendar timeouts remain unclassified until that round completes.

Initial harness finding: the API probe in `tests/adversarial/attack.py` sends requests through `editor-proxy.mjs`. The proxy maps any backend connection error to a synthetic 502 body (`local adversarial server is unavailable`), so the reported 3 MiB PUT result does not show whether the API sent 413 or the proxy lost its upstream connection. I will route the API-only round directly to the real backend to separate API behavior from this proxy failure mode. The Journal and Calendar timeouts remain unclassified until that round completes.

kayg commented

2026-09-29 07:20:33 +00:00

Author

Owner

Additional mixed-load evidence from job/sec-batch at HEAD edce1e84: the real-server API campaign completed the xuser matrix and DAV Journal probes while the server stayed alive, then the 120-photo upload burst reported NO RESPONSE (b'timed out') for upload requests around burst-062 through burst-064. Other uploads returned 201/204 but took 5–19 s. This happened while the shared host ran multiple builds; the server remained running. The same round saw a proxy-generated 502 on a 200 KB Appearance body, which I fixed in edce1e84 with a focused old-code 502/new-code 413 regression. This does not resolve the separate 3 MiB Appearance case or classify the photo timeouts; #387 remains the follow-up for mixed-load transport behavior.

Additional mixed-load evidence from job/sec-batch at HEAD edce1e84: the real-server API campaign completed the xuser matrix and DAV Journal probes while the server stayed alive, then the 120-photo upload burst reported `NO RESPONSE (b'timed out')` for upload requests around burst-062 through burst-064. Other uploads returned 201/204 but took 5–19 s. This happened while the shared host ran multiple builds; the server remained running. The same round saw a proxy-generated 502 on a 200 KB Appearance body, which I fixed in edce1e84 with a focused old-code 502/new-code 413 regression. This does not resolve the separate 3 MiB Appearance case or classify the photo timeouts; #387 remains the follow-up for mixed-load transport behavior.

kayg commented

2026-09-29 07:24:45 +00:00

Author

Owner

Final note from the 20-minute sec-batch round: the server remained alive through the xuser matrix (280 operations classified, 455 comparisons) and the DAV Journal alarm checks. After the 120-photo upload burst, attack.py also logged timeouts for Calendar Event-from-Log, the second Log this first write, Journal patch target creation, and Journal DELETE with stale condition. I ended the broad probe at its time box while those unrelated mixed-load requests were still running; the runner exited 1 from that termination and cleaned up the server. These observations extend #387 and are not classified as a product crash or a successful hostile write.

Final note from the 20-minute sec-batch round: the server remained alive through the xuser matrix (280 operations classified, 455 comparisons) and the DAV Journal alarm checks. After the 120-photo upload burst, `attack.py` also logged timeouts for Calendar Event-from-Log, the second `Log this` first write, Journal patch target creation, and Journal DELETE with stale condition. I ended the broad probe at its time box while those unrelated mixed-load requests were still running; the runner exited 1 from that termination and cleaned up the server. These observations extend #387 and are not classified as a product crash or a successful hostile write.

kayg referenced this issue

2026-09-29 07:34:02 +00:00

Investigate xuser adversarial folder fixture setup failure #386

kayg referenced this issue

2026-09-29 08:22:20 +00:00

Adversarial matrix reports missing policy for GET /api/v1/mail/accounts #383

kayg commented

2026-09-29 09:10:20 +00:00

Author

Owner

Update for #387 from the one API-only adversarial round on head 0eaa6ab4e4d18f2e0dcc60e7ed0245a9cdcd2dd5:

The API-only runner now targets the real backend directly (127.0.0.1:16223 in this run). It bypasses the Node frontend proxy, which converted any upstream connection error into a synthetic 502. The oversized Appearance PUT had no finding; its expected 413 check passed.
The two Calendar Log this retry paths and the Journal PATCH race completed without no-response findings. The Log this retry storm returned 200, with several 6–19s responses.
Other direct backend timeouts did occur: the Task create baseline and 8 Task storm requests timed out at 30s; POST /api/v1/calendar/events/from-log timed out at 30s after the 120-photo burst. I reported these mixed-load results to #367 with the shared-host load evidence.
The server reported alive at the end. The API round exited 1 with 163 findings, mostly SLOW results under active host load.

The round also repeated the missing calendar-home-set result and accepted a DAV alarm. #389 already notes the former; #358 intentionally accepts and stores VALARM. The Reminders unsupported-field probe returned 201 where its existing assertion expects 422, then the following delete returned 412. I left all existing API and test expectations unchanged for review.

Update for #387 from the one API-only adversarial round on head `0eaa6ab4e4d18f2e0dcc60e7ed0245a9cdcd2dd5`: - The API-only runner now targets the real backend directly (`127.0.0.1:16223` in this run). It bypasses the Node frontend proxy, which converted any upstream connection error into a synthetic 502. The oversized Appearance PUT had no finding; its expected 413 check passed. - The two Calendar `Log this` retry paths and the Journal PATCH race completed without no-response findings. The Log this retry storm returned 200, with several 6–19s responses. - Other direct backend timeouts did occur: the Task create baseline and 8 Task storm requests timed out at 30s; `POST /api/v1/calendar/events/from-log` timed out at 30s after the 120-photo burst. I reported these mixed-load results to #367 with the shared-host load evidence. - The server reported alive at the end. The API round exited 1 with 163 findings, mostly `SLOW` results under active host load. The round also repeated the missing `calendar-home-set` result and accepted a DAV alarm. #389 already notes the former; #358 intentionally accepts and stores `VALARM`. The Reminders unsupported-field probe returned 201 where its existing assertion expects 422, then the following delete returned 412. I left all existing API and test expectations unchanged for review.

kayg referenced this issue

2026-09-29 09:10:38 +00:00

[tests] Investigate calternal-cli loopback request failures #389

kayg commented

2026-09-29 13:43:22 +00:00

Author

Owner

Additional real-server reproduction on 2026-09-29 from job/toast-ring after merging dev at d8c62e42 (ADVERSARIAL_API_ONLY=1): the 3 MiB PUT /api/v1/appearance returned 502 local adversarial server is unavailable through the local Node editor proxy. The direct-backend oversized Appearance probe passed its expected 413, and the adversarial harness reported server alive at end: True. This reproduces the proxy transport finding without evidence of a Rust server crash. The complete run log is in the ignored worktree file target/tmp/toast-ring-adversarial.log.

Additional real-server reproduction on 2026-09-29 from `job/toast-ring` after merging `dev` at `d8c62e42` (`ADVERSARIAL_API_ONLY=1`): the 3 MiB `PUT /api/v1/appearance` returned `502 local adversarial server is unavailable` through the local Node editor proxy. The direct-backend oversized Appearance probe passed its expected `413`, and the adversarial harness reported `server alive at end: True`. This reproduces the proxy transport finding without evidence of a Rust server crash. The complete run log is in the ignored worktree file `target/tmp/toast-ring-adversarial.log`.

kayg referenced this issue

2026-09-29 13:50:34 +00:00

TOAST: accent hairline around the capsule that drains with the dismiss timer (pauses on hover) #405

kayg referenced this issue from a commit

2026-09-29 20:08:01 +00:00

Merge job/test-infra (#389 #387: cancellable CLI loopback listener, backend-direct API probes)

kayg commented

2026-10-03 11:55:35 +00:00

Author

Owner

Fixed in d06030b5ca (origin/dev); the API probe runner now uses cancellable loopback requests and load-aware timeouts.

Fixed in d06030b5ca (origin/dev); the API probe runner now uses cancellable loopback requests and load-aware timeouts.