Audit Blob store dedup timing and quota isolation #454

Open
opened 2026-09-29 13:03:34 +00:00 by kayg · 1 comment
Owner

Follow-up from #435 and docs/audits/cross-user-inventory.md. DESIGN §48 requires physical separation of User Derived data; DESIGN §5 permits the Instance Blob store only without a cross-User oracle.

Current state: calternal-fs/src/blob.rs and .cas/ are Instance-wide by DESIGN §5. Verify full uploads, equal User-visible responses, logical quota and no existence endpoint; test timing and simultaneous uploads across Users.

Acceptance: document the exact current boundary, migrate affected durable User state restartably where required, verify cross-User isolation with a negative control and extend tests/adversarial/xuser_matrix.py. Keep the server as the only writer and use calternal-fs for all filesystem access.

Follow-up from #435 and docs/audits/cross-user-inventory.md. DESIGN §48 requires physical separation of User Derived data; DESIGN §5 permits the Instance Blob store only without a cross-User oracle. Current state: calternal-fs/src/blob.rs and .cas/ are Instance-wide by DESIGN §5. Verify full uploads, equal User-visible responses, logical quota and no existence endpoint; test timing and simultaneous uploads across Users. Acceptance: document the exact current boundary, migrate affected durable User state restartably where required, verify cross-User isolation with a negative control and extend tests/adversarial/xuser_matrix.py. Keep the server as the only writer and use calternal-fs for all filesystem access.
Author
Owner

Merge-round 7a dedup timing evidence: the same-size known-content upload had median latency 0.968 s and a new-content upload had median latency 3.931 s; the probe measured a 2.96 s median difference (4.06x). The harness flagged the timing comparison. This run was under high shared-host load, so it is evidence for the requested follow-up audit, not a claim that the signal is exploitable. Full output is in #427's target/tmp/verify-7a-adversarial.log.

Merge-round 7a dedup timing evidence: the same-size known-content upload had median latency 0.968 s and a new-content upload had median latency 3.931 s; the probe measured a 2.96 s median difference (4.06x). The harness flagged the timing comparison. This run was under high shared-host load, so it is evidence for the requested follow-up audit, not a claim that the signal is exploitable. Full output is in #427's `target/tmp/verify-7a-adversarial.log`.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#454
No description provided.