SECURITY: public links still allow guest editing; §54 says public links are view only #981

New issue

Open

opened 2026-10-03 06:47:18 +00:00 by kayg · 24 comments

kayg commented 2026-10-03 06:47:18 +00:00

Owner

Copy link

Problem

DESIGN §54 (owner grill #479/#461, 2026-10-01) says: "Public links are view only. … Only the edit option is removed from public links (§22)." The code still has a live public guest edit path:

• crates/calternal-server/src/wire.rs:129 FilesPublicEditAccess → calternal_plugin_files::public_edit_guest_access;
• crates/calternal-collab/src/session.rs:530 PublicEditAccess / with_public_edits; guest edits are saved as attributed Versions.

So a public link with edit can still let an anonymous visitor change a Note. This is the older §22 behaviour that §54 replaced. Found by the Canvas security review (canvases must never get public edit).

Fix

• Remove the public edit option from link creation (UI, API, CLI, MCP, WebMCP) and stop honouring existing public edit links: they become view-only (keep the link working as view; no data loss).
• Remove or hard-deny the guest edit path in the collaboration hub (DenyPublicEdits everywhere), and delete dead code with its tests, keeping tests that prove a public visitor cannot send a document update.
• Migration: existing public links with edit permission are downgraded to view; record it in the change log for the owner.
• Update §22 text to point at §54.

Tests

Adversarial: with an old public edit link, open the collab socket as a guest and send an update → disconnected, document unchanged. e2e: a public link page shows no edit affordance.
Authorization hole class → blocks merge of anything that widens it; model Sol medium.

## Problem DESIGN §54 (owner grill #479/#461, 2026-10-01) says: "Public links are view only. … Only the edit option is removed from public links (§22)." The code still has a live public guest edit path: - `crates/calternal-server/src/wire.rs:129` `FilesPublicEditAccess` → `calternal_plugin_files::public_edit_guest_access`; - `crates/calternal-collab/src/session.rs:530` `PublicEditAccess` / `with_public_edits`; guest edits are saved as attributed Versions. So a public link with edit can still let an anonymous visitor change a Note. This is the older §22 behaviour that §54 replaced. Found by the Canvas security review (canvases must never get public edit). ## Fix - Remove the public edit option from link creation (UI, API, CLI, MCP, WebMCP) and stop honouring existing public edit links: they become view-only (keep the link working as view; no data loss). - Remove or hard-deny the guest edit path in the collaboration hub (`DenyPublicEdits` everywhere), and delete dead code with its tests, keeping tests that prove a public visitor cannot send a document update. - Migration: existing public links with edit permission are downgraded to view; record it in the change log for the owner. - Update §22 text to point at §54. ## Tests Adversarial: with an old public edit link, open the collab socket as a guest and send an update → disconnected, document unchanged. e2e: a public link page shows no edit affordance. Authorization hole class → blocks merge of anything that widens it; model Sol medium.

authenticated-note-editor-1440-paper.png

455 KiB

authenticated-note-editor-1440-tokyo-night.png

395 KiB

authenticated-note-editor-390-paper.png

138 KiB

authenticated-note-editor-390-tokyo-night.png

142 KiB

authenticated-note-editor-820-paper.png

402 KiB

authenticated-note-editor-820-tokyo-night.png

445 KiB

public-view-only-note-1440-paper.png

37 KiB

public-view-only-note-1440-tokyo-night.png

39 KiB

public-view-only-note-390-paper.png

29 KiB

public-view-only-note-390-tokyo-night.png

30 KiB

public-view-only-note-820-paper.png

34 KiB

public-view-only-note-820-tokyo-night.png

36 KiB

view-only-file-dialog-1440-paper.png

162 KiB

view-only-file-dialog-1440-tokyo-night.png

175 KiB

view-only-file-dialog-390-paper.png

71 KiB

view-only-file-dialog-390-tokyo-night.png

92 KiB

view-only-file-dialog-820-paper.png

122 KiB

view-only-file-dialog-820-tokyo-night.png

147 KiB

view-only-folder-dialog-1440-paper.png

174 KiB

view-only-folder-dialog-1440-tokyo-night.png

181 KiB

view-only-folder-dialog-390-paper.png

76 KiB

view-only-folder-dialog-390-tokyo-night.png

99 KiB

view-only-folder-dialog-820-paper.png

125 KiB

view-only-folder-dialog-820-tokyo-night.png

148 KiB

authenticated-note-editor-1440-paper.png

453 KiB

authenticated-note-editor-1440-tokyo-night.png

395 KiB

authenticated-note-editor-390-paper.png

138 KiB

authenticated-note-editor-390-tokyo-night.png

142 KiB

authenticated-note-editor-820-paper.png

399 KiB

authenticated-note-editor-820-tokyo-night.png

445 KiB

public-view-only-folder-1440-paper.png

24 KiB

public-view-only-folder-1440-tokyo-night.png

24 KiB

public-view-only-folder-390-paper.png

19 KiB

public-view-only-folder-390-tokyo-night.png

19 KiB

public-view-only-folder-820-paper.png

21 KiB

public-view-only-folder-820-tokyo-night.png

21 KiB

public-view-only-note-1440-paper.png

36 KiB

public-view-only-note-1440-tokyo-night.png

38 KiB

public-view-only-note-390-paper.png

26 KiB

public-view-only-note-390-tokyo-night.png

27 KiB

public-view-only-note-820-paper.png

33 KiB

public-view-only-note-820-tokyo-night.png

34 KiB

view-only-file-dialog-1440-paper.png

162 KiB

view-only-file-dialog-1440-tokyo-night.png

175 KiB

view-only-file-dialog-390-paper.png

71 KiB

view-only-file-dialog-390-tokyo-night.png

92 KiB

view-only-file-dialog-820-paper.png

122 KiB

view-only-file-dialog-820-tokyo-night.png

147 KiB

view-only-folder-dialog-1440-paper.png

174 KiB

view-only-folder-dialog-1440-tokyo-night.png

181 KiB

view-only-folder-dialog-390-paper.png

76 KiB

view-only-folder-dialog-390-tokyo-night.png

99 KiB

view-only-folder-dialog-820-paper.png

125 KiB

view-only-folder-dialog-820-tokyo-night.png

148 KiB

kayg commented 2026-10-03 07:05:50 +00:00

Author

Owner

Copy link

Started on job/pubedit-981 at base 48c94c9776. I will remove anonymous write authority, preserve existing links and Version attribution, and add focused regression coverage. The merge round will run the full adversarial matrices and e2e suite under the verification policy.

Started on job/pubedit-981 at base 48c94c9776660cee105be86c5a6ace90dd425367. I will remove anonymous write authority, preserve existing links and Version attribution, and add focused regression coverage. The merge round will run the full adversarial matrices and e2e suite under the verification policy.

kayg commented 2026-10-03 07:26:45 +00:00

Author

Owner

Copy link

Resumed job/pubedit-981 after the reboot at 48c94c9776. Surviving edits were uncommitted; no gate had completed. The patch removes the guest authority adapter and persistence path, preserves historical Version attribution, rejects retired guest REST/socket routes before reading bodies or opening rooms, and downgrades old edit links without changing their URL. Browser expectations are updated because #981 explicitly removes public editing.

Infrastructure: the first clippy run hit unreadable cached rustix metadata after reboot; the job target was cleaned and the check restarted. Normal git fetch fails on damaged shared ref refs/heads/job/moneyfu-984. git fetch --refetch origin dev succeeded without changing that other job ref.

Decisions: retain retired routes as unconditional 403 tombstones; accept legacy edit:false input but omit edit from output and the public schema; clear retired guest credentials and rate buckets, retain historical attribution. The stronger socket invariant rejects upgrade, so no guest document update can be sent. Full adversarial matrices/e2e remain for the merge round under the current verification policy.

Resumed job/pubedit-981 after the reboot at 48c94c9776660cee105be86c5a6ace90dd425367. Surviving edits were uncommitted; no gate had completed. The patch removes the guest authority adapter and persistence path, preserves historical Version attribution, rejects retired guest REST/socket routes before reading bodies or opening rooms, and downgrades old edit links without changing their URL. Browser expectations are updated because #981 explicitly removes public editing. Infrastructure: the first clippy run hit unreadable cached rustix metadata after reboot; the job target was cleaned and the check restarted. Normal git fetch fails on damaged shared ref refs/heads/job/moneyfu-984. git fetch --refetch origin dev succeeded without changing that other job ref. Decisions: retain retired routes as unconditional 403 tombstones; accept legacy edit:false input but omit edit from output and the public schema; clear retired guest credentials and rate buckets, retain historical attribution. The stronger socket invariant rejects upgrade, so no guest document update can be sent. Full adversarial matrices/e2e remain for the merge round under the current verification policy.

kayg commented 2026-10-03 07:38:22 +00:00

Author

Owner

Copy link

Progress commits: 5de942e9c (sharing contract and isolation classification), 356dcde3f (public UI and dead guest editor removal), 8281e9d68 (legacy security-state probe).

Evidence: production web build succeeded; bun run check reports svelte-check found 0 errors and 0 warnings; focused Vitest reports Test Files 2 passed (2) / Tests 10 passed (10); 11 action-registry tests pass. Offline classification reports Cross-User classification gate: 335 operations classified and Generated entry point classification: 945 tools classified.

Rust checks found remaining fields/imports from the removed guest code and one regression-test shutdown call assuming a Result instead of (). Fixed these. Rust test codegen is progressing after reboot cache recovery. A server build needs the production SPA directory, which is now available. origin/dev 4a871b383 is included; migration 19 remains free.

Progress commits: 5de942e9c (sharing contract and isolation classification), 356dcde3f (public UI and dead guest editor removal), 8281e9d68 (legacy security-state probe). Evidence: production web build succeeded; bun run check reports `svelte-check found 0 errors and 0 warnings`; focused Vitest reports `Test Files 2 passed (2)` / `Tests 10 passed (10)`; 11 action-registry tests pass. Offline classification reports `Cross-User classification gate: 335 operations classified` and `Generated entry point classification: 945 tools classified`. Rust checks found remaining fields/imports from the removed guest code and one regression-test shutdown call assuming a Result instead of (). Fixed these. Rust test codegen is progressing after reboot cache recovery. A server build needs the production SPA directory, which is now available. origin/dev 4a871b383 is included; migration 19 remains free.

kayg commented 2026-10-03 08:32:27 +00:00

Author

Owner

Copy link

Backend checkpoint 91d670acd preserves the completed security slice while Rust gates run after cold-cache recovery.

First Files gate: test result: FAILED. 144 passed; 2 failed; 1 ignored; 0 measured; 0 filtered out; finished in 344.00s. Both #981 tests passed: public_edit_is_denied_and_legacy_links_keep_view and version_reads_preserve_historical_guest_attribution.

Finding 1: the existing schema-upgrade test asserted MAX(version)=18, but #981 requires migration 19. Updating this expectation is required by the issue, not a relaxed behavior assertion. The upgrade fixture now also contains an edit-only public link before migration and checks its preserved URL/identity and new view/download grant.

Finding 2: the unchanged reconcile-storm test hit its existing 300-second deadline. It aborts the writer/scanner/watcher before failing; a write at index 600 then reported entry-not-found during fixture teardown. This is a timeout with a teardown consequence, not evidence of a production server crash. The focused retry will keep its original assertions and deadline.

Additional finding: the parity exemption still described guest editing as available. The generator now shares the reviewed retirement list and refuses success responses on those four operations. 13 registry tests and 4 parity tests passed. Generated outputs will come from the new server contract.

Backend checkpoint 91d670acd preserves the completed security slice while Rust gates run after cold-cache recovery. First Files gate: `test result: FAILED. 144 passed; 2 failed; 1 ignored; 0 measured; 0 filtered out; finished in 344.00s`. Both #981 tests passed: `public_edit_is_denied_and_legacy_links_keep_view` and `version_reads_preserve_historical_guest_attribution`. Finding 1: the existing schema-upgrade test asserted MAX(version)=18, but #981 requires migration 19. Updating this expectation is required by the issue, not a relaxed behavior assertion. The upgrade fixture now also contains an edit-only public link before migration and checks its preserved URL/identity and new view/download grant. Finding 2: the unchanged reconcile-storm test hit its existing 300-second deadline. It aborts the writer/scanner/watcher before failing; a write at index 600 then reported entry-not-found during fixture teardown. This is a timeout with a teardown consequence, not evidence of a production server crash. The focused retry will keep its original assertions and deadline. Additional finding: the parity exemption still described guest editing as available. The generator now shares the reviewed retirement list and refuses success responses on those four operations. 13 registry tests and 4 parity tests passed. Generated outputs will come from the new server contract.

kayg commented 2026-10-03 10:00:50 +00:00

Author

Owner

Copy link

Checkpoints: 5568fe302 adds the complete Files upgrade regression; 131c95b32 removes edit grants and retired write adapters from the generated API/action surfaces. Source-emitted OpenAPI fragments drive generation; the final server OpenAPI will be compared before completion.

Generator gates: Ran 17 tests in 0.211s / OK; Action registry: 333 operations, 312 generated tools; Parity matrix: 333 API actions, 126 shortcuts, 2 static commands, 145 menu actions, 35 settings groups, 0 actions with adapter gaps. Offline classifications: Cross-User classification gate: 335 operations classified; Generated entry point classification: 936 tools classified; Admin coverage: 39 reviewed operations; contract and Rust guards agree. Web: svelte-check found 0 errors and 0 warnings.

The focused Files schema-upgrade regression passes. The unchanged reconciliation storm retry still hits its 300-second deadline; its writer reports entry-not-found after fixture teardown. Its deadline and assertions remain unchanged. This is a SLOW verification gap; no public-link denial/migration failure was found.

Remaining work: per-crate Rust gates, focused real-server UI regression and 24 macOS-emulated screenshots (four affected surfaces, three widths, two themes). Shared prebuilt CURRENT is absent, so a local debug server is required. Full matrices/e2e, release builds, staging and Mac interop are reserved for the merge round per the latest verification policy.

Checkpoints: 5568fe302 adds the complete Files upgrade regression; 131c95b32 removes edit grants and retired write adapters from the generated API/action surfaces. Source-emitted OpenAPI fragments drive generation; the final server OpenAPI will be compared before completion. Generator gates: `Ran 17 tests in 0.211s` / `OK`; `Action registry: 333 operations, 312 generated tools`; `Parity matrix: 333 API actions, 126 shortcuts, 2 static commands, 145 menu actions, 35 settings groups, 0 actions with adapter gaps`. Offline classifications: `Cross-User classification gate: 335 operations classified`; `Generated entry point classification: 936 tools classified`; `Admin coverage: 39 reviewed operations; contract and Rust guards agree`. Web: `svelte-check found 0 errors and 0 warnings`. The focused Files schema-upgrade regression passes. The unchanged reconciliation storm retry still hits its 300-second deadline; its writer reports entry-not-found after fixture teardown. Its deadline and assertions remain unchanged. This is a SLOW verification gap; no public-link denial/migration failure was found. Remaining work: per-crate Rust gates, focused real-server UI regression and 24 macOS-emulated screenshots (four affected surfaces, three widths, two themes). Shared prebuilt CURRENT is absent, so a local debug server is required. Full matrices/e2e, release builds, staging and Mac interop are reserved for the merge round per the latest verification policy.

kayg commented 2026-10-03 10:08:49 +00:00

Author

Owner

Copy link

#981 owner change note: migration 0019 keeps each existing public edit URL, item identity, password, expiry, counters and historical Versions. It converts those links to view/download, which is the view grant in DESIGN §54. New public links cannot give edit access. Anonymous REST write routes and the public collaboration socket now return 403. Authenticated Collaborate remains the way to edit together.

This note is also recorded in DESIGN §22 and the commit history used by scripts/changelog.sh. No content files are rewritten by the migration.

#981 owner change note: migration 0019 keeps each existing public edit URL, item identity, password, expiry, counters and historical Versions. It converts those links to view/download, which is the view grant in DESIGN §54. New public links cannot give edit access. Anonymous REST write routes and the public collaboration socket now return 403. Authenticated Collaborate remains the way to edit together. This note is also recorded in DESIGN §22 and the commit history used by `scripts/changelog.sh`. No content files are rewritten by the migration.

kayg commented 2026-10-03 10:28:07 +00:00

Author

Owner

Copy link

Head checkpoint: 24d2c00959. All source changes are committed; no push or deploy.

Passing gate output, verbatim:

Files Clippy: Finished \dev` profile [unoptimized + debuginfo] target(s) in 8m 31sNotes Clippy:Finished `dev` profile [unoptimized + debuginfo] target(s) in 15m 15sWeb check:svelte-check found 0 errors and 0 warningsEditor tests:Test Files 2 passed (2)/Tests 10 passed (10)WebMCP tests (including #981 callback/schema regression):Test Files 1 passed (1)/Tests 10 passed (10)Generator tests:Ran 17 tests in 0.211s/OK`

The new WebMCP test checks published schema and callback registration; body validation belongs to the server. The Files test proves edit:true fails creation and update, migration preserves the old link and history, retired REST routes deny, and viewing leaves bytes unchanged. The full schema-upgrade regression passes. The unchanged Files reconciliation storm still hits its original 300-second deadline; no deadline or assertion was relaxed.

The existing bench/files-listing-427.py now accepts usual/largest public folder slugs and records public average/burst p50/p95, CPU and RSS. CLI and Python syntax checks pass. No measurement was run: the latest policy limits measurements to performance issues on the locked perf VM. There is no existing public-listing baseline.

Pending: collaboration tests, Notes tests, server gates/build, authoritative full-contract comparison, focused real-server browser regression and screenshots. Full adversarial matrices and full e2e remain for the merge round.

Head checkpoint: 24d2c00959e948ce69b4d765e18483507531085a. All source changes are committed; no push or deploy. Passing gate output, verbatim: Files Clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 8m 31s` Notes Clippy: `Finished \`dev\` profile [unoptimized + debuginfo] target(s) in 15m 15s` Web check: `svelte-check found 0 errors and 0 warnings` Editor tests: `Test Files 2 passed (2)` / `Tests 10 passed (10)` WebMCP tests (including #981 callback/schema regression): `Test Files 1 passed (1)` / `Tests 10 passed (10)` Generator tests: `Ran 17 tests in 0.211s` / `OK` The new WebMCP test checks published schema and callback registration; body validation belongs to the server. The Files test proves edit:true fails creation and update, migration preserves the old link and history, retired REST routes deny, and viewing leaves bytes unchanged. The full schema-upgrade regression passes. The unchanged Files reconciliation storm still hits its original 300-second deadline; no deadline or assertion was relaxed. The existing `bench/files-listing-427.py` now accepts usual/largest public folder slugs and records public average/burst p50/p95, CPU and RSS. CLI and Python syntax checks pass. No measurement was run: the latest policy limits measurements to performance issues on the locked perf VM. There is no existing public-listing baseline. Pending: collaboration tests, Notes tests, server gates/build, authoritative full-contract comparison, focused real-server browser regression and screenshots. Full adversarial matrices and full e2e remain for the merge round.

kayg referenced this issue 2026-10-03 10:40:13 +00:00

E2E theme unit fixtures lack the current User storage seam #1006

kayg referenced this issue 2026-10-03 10:40:42 +00:00

E2E theme unit fixtures lack the current User storage seam #1006

kayg commented 2026-10-03 10:46:07 +00:00

Author

Owner

Copy link

Checkpoint a79564495 adds the screenshot harness correction discovered before browser review: the theme helper used retired #app, but the production layout mounts .app-frame. Fresh public contexts now reuse the tagged storage test seam with no User cache, and public theme captures check rendered CSS without asking for account preferences. The focused mounted-frame regression reports # pass 1 / # fail 0.

The full helper test file reports seven pre-existing window is not defined failures from its old VM fixtures. This is already tracked in #958. I created #1006 before applying the search result and cross-linked that duplicate; no issue was closed and no existing fixture/assertion was relaxed.

Files, Notes and collaboration Clippy have all passed with -D warnings. Collaboration test binaries are linking on this shared host. The new guest denial test has not run yet; Notes/server tests and browser screenshots remain pending. The build has not produced a new server binary, and shared-server/CURRENT is absent. No full-suite, e2e or screenshot pass is claimed.

Checkpoint a79564495 adds the screenshot harness correction discovered before browser review: the theme helper used retired `#app`, but the production layout mounts `.app-frame`. Fresh public contexts now reuse the tagged storage test seam with no User cache, and public theme captures check rendered CSS without asking for account preferences. The focused mounted-frame regression reports `# pass 1` / `# fail 0`. The full helper test file reports seven pre-existing `window is not defined` failures from its old VM fixtures. This is already tracked in #958. I created #1006 before applying the search result and cross-linked that duplicate; no issue was closed and no existing fixture/assertion was relaxed. Files, Notes and collaboration Clippy have all passed with `-D warnings`. Collaboration test binaries are linking on this shared host. The new guest denial test has not run yet; Notes/server tests and browser screenshots remain pending. The build has not produced a new server binary, and shared-server/CURRENT is absent. No full-suite, e2e or screenshot pass is claimed.

kayg commented 2026-10-03 10:50:01 +00:00

Author

Owner

Copy link

Focused #981 collaboration denial passes using the newly built hostile_clients test binary while the full crate command finishes linking its other binaries. The request has no User session and supplies a retired guest subprotocol token. The hub returns 403 before upgrade; shutdown and a disk read prove the Note is unchanged.

running 1 test
test retired_public_guest_socket_cannot_open_or_change_a_note ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 3.87s

No full collaboration suite pass or browser screenshot pass is claimed yet. Head: a79564495.

Focused #981 collaboration denial passes using the newly built hostile_clients test binary while the full crate command finishes linking its other binaries. The request has no User session and supplies a retired guest subprotocol token. The hub returns 403 before upgrade; shutdown and a disk read prove the Note is unchanged. ```text running 1 test test retired_public_guest_socket_cannot_open_or_change_a_note ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 3.87s ``` No full collaboration suite pass or browser screenshot pass is claimed yet. Head: a79564495.

kayg commented 2026-10-03 11:04:20 +00:00

Author

Owner

Copy link

Head 83700697bd. The focused #981 socket-denial regression passes, and the full hostile_clients target also passes that new test.

The full collaboration crate command passed its 23 unit tests and the agent-turn, block-apply and cross-language targets, then stopped at two existing post-rejection save deadlines:

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.46s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.40s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 81.22s
test result: FAILED. 10 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.15s

The unchanged focused retry passes primitive_value_in_fragment_cannot_truncate_the_note. unrepresentable_update_is_rejected_and_room_keeps_saving still misses its four-second save deadline. The same failure family is already tracked in #81 (intermittent post-rejection save failures on multiple branches). This is not claimed to be a harmless load-only failure. No truncation or accepted malformed update was observed in this run; rejection checks pass. Existing assertions and deadlines remain unchanged. Logs are in artifacts/collab-test.log, primitive-retry.log and unrepresentable-retry.log.

Server Clippy is now checking plugin code after a package-cache lock wait. Notes/server tests, server build, full-contract comparison and screenshots remain pending. The job is approaching its four-hour limit, so any unfinished checks will be named in the final report instead of being claimed as passes.

Head 83700697bda9e8b70cc84a7fbb263f0a7dca284f. The focused #981 socket-denial regression passes, and the full hostile_clients target also passes that new test. The full collaboration crate command passed its 23 unit tests and the agent-turn, block-apply and cross-language targets, then stopped at two existing post-rejection save deadlines: ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.46s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.40s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 81.22s test result: FAILED. 10 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.15s ``` The unchanged focused retry passes primitive_value_in_fragment_cannot_truncate_the_note. unrepresentable_update_is_rejected_and_room_keeps_saving still misses its four-second save deadline. The same failure family is already tracked in #81 (intermittent post-rejection save failures on multiple branches). This is not claimed to be a harmless load-only failure. No truncation or accepted malformed update was observed in this run; rejection checks pass. Existing assertions and deadlines remain unchanged. Logs are in artifacts/collab-test.log, primitive-retry.log and unrepresentable-retry.log. Server Clippy is now checking plugin code after a package-cache lock wait. Notes/server tests, server build, full-contract comparison and screenshots remain pending. The job is approaching its four-hour limit, so any unfinished checks will be named in the final report instead of being claimed as passes.

kayg commented 2026-10-03 11:16:24 +00:00

Author

Owner

Copy link

#981 implementation checkpoint — verification incomplete

Head: 83700697bda9e8b70cc84a7fbb263f0a7dca284f on job/pubedit-981. Required origin/dev integration completed once at 4a871b383864dad0d6c87bcd22b7f0d589e3506e. No push, deploy or issue closure. The four-hour job limit stopped the unfinished Notes build. This branch is not reported as merge-ready.

Built

• Migration 0019 converts old public edit links to view/download. It retains URLs, item IDs, passwords, expiry, counters, content and historical Versions/guest attribution. Retired guest credentials and rate buckets are cleared. The owner change note is in §22, issue comments and the commit history used by the generated changelog.
• Link creation/update reject edit:true. Legacy edit:false input remains compatible; edit is absent from responses, OpenAPI and generated CLI/MCP/WebMCP input schemas. Retired REST routes and the public collaboration route return 403 before link/body/room lookup. The guest grant/session/editor/write machinery is removed. Authenticated Collaborate remains supported.
• Updated DESIGN §22, isolation classifications, authorization policies, adapter/parity generation, adversarial share-options checks and e2e sharing expectations. Preserved linked-Note read coverage and old Version attribution coverage.
• Added the focused real-server browser flow and 24 macOS-emulated screenshot variants: file/folder link dialogs, anonymous Note view and authenticated Note editor, at 390/820/1440 px in light/dark. These captures have NOT run.
• Extended the existing Files listing benchmark with public average/large-folder burst workloads for p50/p95, CPU and RSS. CLI/Python syntax checks pass. Measurements were not run under the latest policy (performance issues and the locked perf VM only); public listing has no existing baseline.

Gate output (verbatim excerpts)

cargo fmt --check: exit 0, no output.

Files Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 31s

Notes Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 15m 15s

Collaboration Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5m 58s

Server Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 59s

Web check:

svelte-check found 0 errors and 0 warnings

Focused editor Vitest:

 Test Files  2 passed (2)
      Tests  10 passed (10)

Focused WebMCP Vitest:

 Test Files  1 passed (1)
      Tests  10 passed (10)

Generator tests:

Ran 17 tests in 0.211s
OK

Registry/parity checks:

Action registry: 333 operations, 312 generated tools

Parity check:

Parity matrix: 333 API actions, 126 shortcuts, 2 static commands, 145 menu actions, 35 settings groups, 0 actions with adapter gaps

Cross-User classification:

Cross-User classification gate: 335 operations classified
Generated entry point classification: 936 tools classified

Authorization classification:

Admin coverage: 39 reviewed operations; contract and Rust guards agree

Full Files tests (initial schema expectation fixed afterward):

test result: FAILED. 144 passed; 2 failed; 1 ignored; 0 measured; 0 filtered out; finished in 344.00s

Focused Files schema upgrade after its fix:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 146 filtered out; finished in 4.72s

Focused public socket denial:

test retired_public_guest_socket_cannot_open_or_change_a_note ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 3.87s

Collaboration crate tests (stopped on existing integration failures):

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.46s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.40s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 81.22s
test result: FAILED. 10 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.15s

Primitive-value focused retry:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 4.94s

Post-rejection save focused retry:

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 11 filtered out; finished in 5.92s

New mounted-frame theme regression:

# tests 1
# pass 1
# fail 0

Full theme helper tests (existing #958 fixture defect):

# tests 9
# pass 2
# fail 7

Known gaps

• Files reconciliation storm missed its unchanged 300-second deadline twice, with a writer error during fixture teardown. The schema-upgrade expectation was changed from 18 to 19 because this issue adds migration 19; its unchanged identity assertions and new public-link checks pass on the focused run. Public link denial/migration and historical guest attribution tests passed in the full Files run.
• Collaboration post-rejection save deadlines fail in the full hostile_clients target. The unchanged primitive-value retry passes; the unchanged unrepresentable-update retry still fails its four-second save deadline. This is tracked by existing #81 and is not classified as harmless without evidence. No truncated document or accepted malformed update was observed here.
• Notes tests were interrupted during compilation at the job limit. Server tests/build and full server OpenAPI comparison have not run. The checked-in contract uses source-emitted Files/collaboration fragments; generator/type checks pass, but full-server regeneration is still required.
• Focused browser regression and all 24 screenshots remain unrun because no new server binary was built. No screenshots are attached and no visual review pass is claimed.
• Seven old theme VM tests lack window.__userStorageTest (#958). Their fixtures/expectations remain unchanged. Duplicate #1006 was created before applying the search result and cross-linked to #958; both remain open.

UX gaps closed

Removed the public Edit switch and visitor editor, including misleading guest-edit actions and code. The focused browser flow now covers real download and authenticated saving, but these actions still need the browser run. The screenshot helper now targets the actual mounted app frame and supports anonymous rendered-theme checks without an invented User.

UX gaps left

The real browser walk, pointer/touch/keyboard review, macOS-emulated width/theme screenshots and icon alignment inspection are pending. The orchestrator remains the visual reviewer.

Decisions

• Keep old write URLs as uniform 403 tombstones, with no client adapters, instead of removing them and changing old callers to 404.
• Accept legacy edit:false input while rejecting true and hiding the field from published schemas/responses.
• Clear retired credentials/buckets but retain guest history needed by existing Versions. Old edit-only links receive view and download as required by §54.

For the merge round / follow-up

Use the combined branch and normal migration-number audit. Preserve #81 and #958 assertions until their behavior is resolved.

export CARGO_PROFILE_DEV_DEBUG=line-tables-only CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=3 TMPDIR=$PWD/target/tmp
cargo test -p calternal-plugin-notes
cargo test -p calternal-server
# Resolve/verify the tracked failures without relaxing their deadlines:
cargo test -p calternal-collab
cargo test -p calternal-plugin-files
(cd apps/web && bun run build)
cargo build -p calternal-server
"$CARGO_TARGET_DIR/debug/calternal-server" openapi
python3 scripts/action_registry.py --check
python3 scripts/parity_matrix.py --check
(cd packages/api-client && bun run generate)
# Inspect full-server contract differences against the source-emitted checkpoint.
(cd apps/web && CALTERNAL_SERVER_BIN="$CARGO_TARGET_DIR/debug/calternal-server" PUBEDIT_ONLY=1 SHARE_SHOTS="$PWD/../../artifacts/public-view-only" bun e2e/share.mjs)
# Attach and inspect all 24 PNGs, including icon cap-height alignment.
(cd apps/web && bun run test --maxWorkers=2)
(cd apps/web && bun e2e/share.mjs)
ADVERSARIAL_ROUND2_ONLY=1 ROUND2_SECTIONS=share-options tests/adversarial/run.sh
# Full authorization / Cross-User / robustness matrices, once on the combined branch:
tests/adversarial/run.sh
node --test apps/web/e2e/harness.test.mjs

The focused browser run must prove no Edit affordance, successful public viewing/download with unchanged content, and authenticated Note saving. The adversarial sharing probe must prove all retired REST/socket routes deny even when a disposable fixture still has old edit permissions. Full matrices verify every identity and entry point. Full server generation must confirm no public edit field or supported edit adapter reappears. Release/staging/Mac interop remain merge-round work under the latest policy.

Files

• apps/web/e2e/harness.mjs
• apps/web/e2e/harness.test.mjs
• apps/web/e2e/share.mjs
• apps/web/src/lib/files/PublicLinkPage.svelte
• apps/web/src/lib/files/ShareDialog.svelte
• apps/web/src/lib/notes/NoteEditorSurface.svelte
• apps/web/src/lib/notes/collab.ts
• apps/web/src/lib/notes/editorHost.ts
• apps/web/src/lib/webmcp/generated.test.ts
• bench/files-listing-427.py
• contracts/actions.json
• contracts/openapi.json
• crates/calternal-collab/src/session.rs
• crates/calternal-collab/tests/hostile_clients.rs
• crates/calternal-server/src/wire.rs
• crates/plugins/files/migrations/0019_public_links_view_only.sql
• crates/plugins/files/src/lib.rs
• crates/plugins/files/src/public.rs
• crates/plugins/notes/src/lib.rs
• docs/DESIGN.md
• docs/audits/xuser-472.md
• docs/parity-exceptions.json
• docs/parity-matrix.md
• packages/api-client/src/generated.ts
• scripts/action_registry.py
• scripts/parity_matrix.py
• scripts/test_action_registry.py
• tests/adversarial/attack2.py
• tests/adversarial/authz_matrix.py
• tests/adversarial/xuser_matrix.py

Cleanup: cargo clean and deletion of web build output are running; exact output is in artifacts/clean.log. Logs and source-emitted contract fragments remain in ignored artifacts/. Automatic approval review rejected the first cleanup command because rm -f style commands were not permitted; path-specific filesystem operations replace it.

#981 implementation checkpoint — verification incomplete Head: `83700697bda9e8b70cc84a7fbb263f0a7dca284f` on `job/pubedit-981`. Required origin/dev integration completed once at `4a871b383864dad0d6c87bcd22b7f0d589e3506e`. No push, deploy or issue closure. The four-hour job limit stopped the unfinished Notes build. This branch is not reported as merge-ready. ## Built - Migration 0019 converts old public edit links to view/download. It retains URLs, item IDs, passwords, expiry, counters, content and historical Versions/guest attribution. Retired guest credentials and rate buckets are cleared. The owner change note is in §22, issue comments and the commit history used by the generated changelog. - Link creation/update reject edit:true. Legacy edit:false input remains compatible; edit is absent from responses, OpenAPI and generated CLI/MCP/WebMCP input schemas. Retired REST routes and the public collaboration route return 403 before link/body/room lookup. The guest grant/session/editor/write machinery is removed. Authenticated Collaborate remains supported. - Updated DESIGN §22, isolation classifications, authorization policies, adapter/parity generation, adversarial share-options checks and e2e sharing expectations. Preserved linked-Note read coverage and old Version attribution coverage. - Added the focused real-server browser flow and 24 macOS-emulated screenshot variants: file/folder link dialogs, anonymous Note view and authenticated Note editor, at 390/820/1440 px in light/dark. These captures have NOT run. - Extended the existing Files listing benchmark with public average/large-folder burst workloads for p50/p95, CPU and RSS. CLI/Python syntax checks pass. Measurements were not run under the latest policy (performance issues and the locked perf VM only); public listing has no existing baseline. ## Gate output (verbatim excerpts) `cargo fmt --check`: exit 0, no output. Files Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 31s ``` Notes Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 15m 15s ``` Collaboration Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 5m 58s ``` Server Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 59s ``` Web check: ```text svelte-check found 0 errors and 0 warnings ``` Focused editor Vitest: ```text Test Files 2 passed (2) Tests 10 passed (10) ``` Focused WebMCP Vitest: ```text Test Files 1 passed (1) Tests 10 passed (10) ``` Generator tests: ```text Ran 17 tests in 0.211s OK ``` Registry/parity checks: ```text Action registry: 333 operations, 312 generated tools ``` Parity check: ```text Parity matrix: 333 API actions, 126 shortcuts, 2 static commands, 145 menu actions, 35 settings groups, 0 actions with adapter gaps ``` Cross-User classification: ```text Cross-User classification gate: 335 operations classified Generated entry point classification: 936 tools classified ``` Authorization classification: ```text Admin coverage: 39 reviewed operations; contract and Rust guards agree ``` Full Files tests (initial schema expectation fixed afterward): ```text test result: FAILED. 144 passed; 2 failed; 1 ignored; 0 measured; 0 filtered out; finished in 344.00s ``` Focused Files schema upgrade after its fix: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 146 filtered out; finished in 4.72s ``` Focused public socket denial: ```text test retired_public_guest_socket_cannot_open_or_change_a_note ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 3.87s ``` Collaboration crate tests (stopped on existing integration failures): ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.46s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.40s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 81.22s test result: FAILED. 10 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 43.15s ``` Primitive-value focused retry: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 4.94s ``` Post-rejection save focused retry: ```text test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 11 filtered out; finished in 5.92s ``` New mounted-frame theme regression: ```text # tests 1 # pass 1 # fail 0 ``` Full theme helper tests (existing #958 fixture defect): ```text # tests 9 # pass 2 # fail 7 ``` ## Known gaps - Files reconciliation storm missed its unchanged 300-second deadline twice, with a writer error during fixture teardown. The schema-upgrade expectation was changed from 18 to 19 because this issue adds migration 19; its unchanged identity assertions and new public-link checks pass on the focused run. Public link denial/migration and historical guest attribution tests passed in the full Files run. - Collaboration post-rejection save deadlines fail in the full hostile_clients target. The unchanged primitive-value retry passes; the unchanged unrepresentable-update retry still fails its four-second save deadline. This is tracked by existing #81 and is not classified as harmless without evidence. No truncated document or accepted malformed update was observed here. - Notes tests were interrupted during compilation at the job limit. Server tests/build and full server OpenAPI comparison have not run. The checked-in contract uses source-emitted Files/collaboration fragments; generator/type checks pass, but full-server regeneration is still required. - Focused browser regression and all 24 screenshots remain unrun because no new server binary was built. No screenshots are attached and no visual review pass is claimed. - Seven old theme VM tests lack window.__userStorageTest (#958). Their fixtures/expectations remain unchanged. Duplicate #1006 was created before applying the search result and cross-linked to #958; both remain open. ## UX gaps closed Removed the public Edit switch and visitor editor, including misleading guest-edit actions and code. The focused browser flow now covers real download and authenticated saving, but these actions still need the browser run. The screenshot helper now targets the actual mounted app frame and supports anonymous rendered-theme checks without an invented User. ## UX gaps left The real browser walk, pointer/touch/keyboard review, macOS-emulated width/theme screenshots and icon alignment inspection are pending. The orchestrator remains the visual reviewer. ## Decisions - Keep old write URLs as uniform 403 tombstones, with no client adapters, instead of removing them and changing old callers to 404. - Accept legacy edit:false input while rejecting true and hiding the field from published schemas/responses. - Clear retired credentials/buckets but retain guest history needed by existing Versions. Old edit-only links receive view and download as required by §54. ## For the merge round / follow-up Use the combined branch and normal migration-number audit. Preserve #81 and #958 assertions until their behavior is resolved. ```sh export CARGO_PROFILE_DEV_DEBUG=line-tables-only CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=3 TMPDIR=$PWD/target/tmp cargo test -p calternal-plugin-notes cargo test -p calternal-server # Resolve/verify the tracked failures without relaxing their deadlines: cargo test -p calternal-collab cargo test -p calternal-plugin-files (cd apps/web && bun run build) cargo build -p calternal-server "$CARGO_TARGET_DIR/debug/calternal-server" openapi python3 scripts/action_registry.py --check python3 scripts/parity_matrix.py --check (cd packages/api-client && bun run generate) # Inspect full-server contract differences against the source-emitted checkpoint. (cd apps/web && CALTERNAL_SERVER_BIN="$CARGO_TARGET_DIR/debug/calternal-server" PUBEDIT_ONLY=1 SHARE_SHOTS="$PWD/../../artifacts/public-view-only" bun e2e/share.mjs) # Attach and inspect all 24 PNGs, including icon cap-height alignment. (cd apps/web && bun run test --maxWorkers=2) (cd apps/web && bun e2e/share.mjs) ADVERSARIAL_ROUND2_ONLY=1 ROUND2_SECTIONS=share-options tests/adversarial/run.sh # Full authorization / Cross-User / robustness matrices, once on the combined branch: tests/adversarial/run.sh node --test apps/web/e2e/harness.test.mjs ``` The focused browser run must prove no Edit affordance, successful public viewing/download with unchanged content, and authenticated Note saving. The adversarial sharing probe must prove all retired REST/socket routes deny even when a disposable fixture still has old edit permissions. Full matrices verify every identity and entry point. Full server generation must confirm no public edit field or supported edit adapter reappears. Release/staging/Mac interop remain merge-round work under the latest policy. ## Files - `apps/web/e2e/harness.mjs` - `apps/web/e2e/harness.test.mjs` - `apps/web/e2e/share.mjs` - `apps/web/src/lib/files/PublicLinkPage.svelte` - `apps/web/src/lib/files/ShareDialog.svelte` - `apps/web/src/lib/notes/NoteEditorSurface.svelte` - `apps/web/src/lib/notes/collab.ts` - `apps/web/src/lib/notes/editorHost.ts` - `apps/web/src/lib/webmcp/generated.test.ts` - `bench/files-listing-427.py` - `contracts/actions.json` - `contracts/openapi.json` - `crates/calternal-collab/src/session.rs` - `crates/calternal-collab/tests/hostile_clients.rs` - `crates/calternal-server/src/wire.rs` - `crates/plugins/files/migrations/0019_public_links_view_only.sql` - `crates/plugins/files/src/lib.rs` - `crates/plugins/files/src/public.rs` - `crates/plugins/notes/src/lib.rs` - `docs/DESIGN.md` - `docs/audits/xuser-472.md` - `docs/parity-exceptions.json` - `docs/parity-matrix.md` - `packages/api-client/src/generated.ts` - `scripts/action_registry.py` - `scripts/parity_matrix.py` - `scripts/test_action_registry.py` - `tests/adversarial/attack2.py` - `tests/adversarial/authz_matrix.py` - `tests/adversarial/xuser_matrix.py` Cleanup: cargo clean and deletion of web build output are running; exact output is in artifacts/clean.log. Logs and source-emitted contract fragments remain in ignored artifacts/. Automatic approval review rejected the first cleanup command because rm -f style commands were not permitted; path-specific filesystem operations replace it.

kayg commented 2026-10-03 11:20:08 +00:00

Author

Owner

Copy link

Final cleanup completed. Head remains 83700697bd; git status is clean. Web build output, Python caches and temporary contract executables are removed. Ignored report/log artifacts remain.

Removed 15481 files, 8.0GiB total

The verification gaps in the final report remain: #81 save failure, Notes/server tests and server build/contract/browser/screenshots. No issue was closed, no push or deploy was performed.

Final cleanup completed. Head remains 83700697bda9e8b70cc84a7fbb263f0a7dca284f; git status is clean. Web build output, Python caches and temporary contract executables are removed. Ignored report/log artifacts remain. ```text Removed 15481 files, 8.0GiB total ``` The verification gaps in the final report remain: #81 save failure, Notes/server tests and server build/contract/browser/screenshots. No issue was closed, no push or deploy was performed.

kayg commented 2026-10-03 11:26:27 +00:00

Author

Owner

Copy link

Resuming verification on job/pubedit-981. Prior head: 83700697bd. Fetched and merged origin/dev once; current head: b50ed94f55. The integration changes DESIGN documentation only. Remaining checks: per-crate Notes/server/Files/collaboration tests, server build and contract comparison, focused live-server regression, public-sharing probe and macOS width/theme screenshots. Cargo uses three build jobs; existing assertions stay unchanged. No push or deploy.

Resuming verification on job/pubedit-981. Prior head: 83700697bda9e8b70cc84a7fbb263f0a7dca284f. Fetched and merged origin/dev once; current head: b50ed94f55bf602a7dae3dc2e35dbcaacca96418. The integration changes DESIGN documentation only. Remaining checks: per-crate Notes/server/Files/collaboration tests, server build and contract comparison, focused live-server regression, public-sharing probe and macOS width/theme screenshots. Cargo uses three build jobs; existing assertions stay unchanged. No push or deploy.

kayg commented 2026-10-03 11:35:08 +00:00

Author

Owner

Copy link

Verification progress at b50ed94f55: production web build passed. Fresh focused web gates:

svelte-check found 0 errors and 0 warnings
 Test Files  2 passed (2)
      Tests  19 passed (19)
 Test Files  1 passed (1)
      Tests  1 passed (1)

Action/parity checks pass (333 operations, 312 tools, no adapter gaps). Files migration audit: origin/dev ends at 0018; our 0019 remains unique. Notes/server/Files/collaboration Rust tests and the one server build are still running with CARGO_BUILD_JOBS=3. No existing assertion changed.

Verification progress at b50ed94f55bf602a7dae3dc2e35dbcaacca96418: production web build passed. Fresh focused web gates: ```text svelte-check found 0 errors and 0 warnings Test Files 2 passed (2) Tests 19 passed (19) Test Files 1 passed (1) Tests 1 passed (1) ``` Action/parity checks pass (333 operations, 312 tools, no adapter gaps). Files migration audit: origin/dev ends at 0018; our 0019 remains unique. Notes/server/Files/collaboration Rust tests and the one server build are still running with CARGO_BUILD_JOBS=3. No existing assertion changed.

kayg commented 2026-10-03 11:44:12 +00:00

Author

Owner

Copy link

Notes verification reproduced the unchanged daily_and_composer_preserve_unrelated_bytes failure in the parallel per-crate run. The unchanged test passes in isolation:

test tests::daily_and_composer_preserve_unrelated_bytes ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 166 filtered out; finished in 3.38s

This matches existing #954. Evidence: setup() uses fixed User ID 27b870bd-86ec-47b4-ae93-a019668170fd for separate temporary Homes; USER_LOCKS is process-global and journal_snapshot() uses try_lock_owned() before repairing a missing legacy snapshot, otherwise returning 404. The #981 Notes diff only deletes two unused public-edit path helpers, outside that code. No assertion, fixture or deadline changed. The full Notes run is still finishing its Unicode property test.

Notes verification reproduced the unchanged daily_and_composer_preserve_unrelated_bytes failure in the parallel per-crate run. The unchanged test passes in isolation: ```text test tests::daily_and_composer_preserve_unrelated_bytes ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 166 filtered out; finished in 3.38s ``` This matches existing #954. Evidence: setup() uses fixed User ID 27b870bd-86ec-47b4-ae93-a019668170fd for separate temporary Homes; USER_LOCKS is process-global and journal_snapshot() uses try_lock_owned() before repairing a missing legacy snapshot, otherwise returning 404. The #981 Notes diff only deletes two unused public-edit path helpers, outside that code. No assertion, fixture or deadline changed. The full Notes run is still finishing its Unicode property test.

kayg commented 2026-10-03 12:21:34 +00:00

Author

Owner

Copy link

Head: 673be10dab. Added the focused #981 verification commands and evidence requirements to the existing Cross-User audit in atomic documentation commit 673be10da. Classification checks pass unchanged. Notes completed with one existing #954 failure:

test result: FAILED. 166 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 312.41s

The unchanged failing test passes alone (1 passed in 3.38s); its full-run failure is 404 versus expected 200, matching #954. Server compilation has reached calternal-server and its plugins with no compile error. Files/collaboration tests, server binary, authoritative contract and live evidence remain pending. Current target uses about 4.4 GiB. No application source changed during this verification continuation.

Head: 673be10dab57b2e5cd79316f54cab6d65ec871ef. Added the focused #981 verification commands and evidence requirements to the existing Cross-User audit in atomic documentation commit 673be10da. Classification checks pass unchanged. Notes completed with one existing #954 failure: ```text test result: FAILED. 166 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 312.41s ``` The unchanged failing test passes alone (1 passed in 3.38s); its full-run failure is 404 versus expected 200, matching #954. Server compilation has reached calternal-server and its plugins with no compile error. Files/collaboration tests, server binary, authoritative contract and live evidence remain pending. Current target uses about 4.4 GiB. No application source changed during this verification continuation.

kayg commented 2026-10-03 12:46:36 +00:00

Author

Owner

Copy link

The fresh server gate found missing 429 response for get /api/v1/public/{slug}/edit. This is caused by #981: the route is now an unconditional 403 tombstone and no longer calls the public authorization/rate-limit helper. The shared public middleware only resolves client IP; it does not impose a rate limit. Adding 429 to its schema would describe a response this route cannot produce. Updated the server contract test only for the two retired public REST paths: require exactly one response, 403; retain the existing 429 assertions for every active public/auth operation. This expectation change is specifically required by the behavior removed in #981/§54. No production behavior changed.

The separate live-app failure is full_app_setup_session_config_and_backup at wire.rs:7629: its unchanged five-second wait for a background User archive returns Elapsed(()). Investigation/retry is pending; it is not yet attributed to #965 or reported as passing.

The fresh server gate found missing 429 response for get /api/v1/public/{slug}/edit. This is caused by #981: the route is now an unconditional 403 tombstone and no longer calls the public authorization/rate-limit helper. The shared public middleware only resolves client IP; it does not impose a rate limit. Adding 429 to its schema would describe a response this route cannot produce. Updated the server contract test only for the two retired public REST paths: require exactly one response, 403; retain the existing 429 assertions for every active public/auth operation. This expectation change is specifically required by the behavior removed in #981/§54. No production behavior changed. The separate live-app failure is full_app_setup_session_config_and_backup at wire.rs:7629: its unchanged five-second wait for a background User archive returns Elapsed(()). Investigation/retry is pending; it is not yet attributed to #965 or reported as passing.

kayg commented 2026-10-03 13:15:48 +00:00

Author

Owner

Copy link

Checkpoint 7e26f5a26 records the contract test correction for retired public writes; server Clippy and tests are still queued/running, not claimed passing. Fresh Files public_edit_is_denied_and_legacy_links_keep_view, schema-upgrade and historical guest-attribution cases pass. A diagnostic comparison found that the prior source-fragment export still retains a 429 response for retired REST routes, whereas the real server test reports only 403. This stale generated contract must be replaced by the authoritative server export after the one binary build, followed by adapter generation/checks. The production retired handlers remain unconditional denials. The isolated unchanged server archive test passes (1 passed in 16.80s); its full-run timeout is retained as a failed result, not attributed to #965 without more evidence.

Checkpoint 7e26f5a26 records the contract test correction for retired public writes; server Clippy and tests are still queued/running, not claimed passing. Fresh Files public_edit_is_denied_and_legacy_links_keep_view, schema-upgrade and historical guest-attribution cases pass. A diagnostic comparison found that the prior source-fragment export still retains a 429 response for retired REST routes, whereas the real server test reports only 403. This stale generated contract must be replaced by the authoritative server export after the one binary build, followed by adapter generation/checks. The production retired handlers remain unconditional denials. The isolated unchanged server archive test passes (1 passed in 16.80s); its full-run timeout is retained as a failed result, not attributed to #965 without more evidence.

kayg commented 2026-10-03 13:17:30 +00:00

Author

Owner

Copy link

Fresh Files run at current branch source: all #981 cases pass (public denial/legacy migration, schema upgrade, historical attribution). The only full-suite failure matches existing #942; no expectation or deadline changed. Verbatim evidence:

---- tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm stdout ----

thread 'tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm' (2383253) panicked at crates/plugins/files/src/lib.rs:5080:14:
writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(())
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

thread 'tokio-rt-worker' (2383255) panicked at crates/plugins/files/src/lib.rs:5054:45:
atomic write 946 failed: entry not found


failures:
    tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm

test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 380.16s

The entry-not-found panic follows the timeout in the log. Teardown as its cause remains an inference, as #942 states; this run is not reported as passing. Collaboration tests are queued behind server Clippy.

Fresh Files run at current branch source: all #981 cases pass (public denial/legacy migration, schema upgrade, historical attribution). The only full-suite failure matches existing #942; no expectation or deadline changed. Verbatim evidence: ```text ---- tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm stdout ---- thread 'tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm' (2383253) panicked at crates/plugins/files/src/lib.rs:5080:14: writes, reconcile scans, and watcher adoption complete within five minutes: Elapsed(()) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace thread 'tokio-rt-worker' (2383255) panicked at crates/plugins/files/src/lib.rs:5054:45: atomic write 946 failed: entry not found failures: tests::internal_temp_paths_never_enter_index_during_atomic_write_reconcile_storm test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 380.16s ``` The entry-not-found panic follows the timeout in the log. Teardown as its cause remains an inference, as #942 states; this run is not reported as passing. Collaboration tests are queued behind server Clippy.

kayg commented 2026-10-03 13:41:05 +00:00

Author

Owner

Copy link

Server Clippy passed for checkpoint 7e26f5a26, including the #981 denial-only contract test correction. Verbatim final output:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 52m 57s

Collaboration crate tests are now compiling; the final server test rerun waits for Cargo’s build-directory lock. The stale fragment contract is still pending authoritative regeneration from the one server binary build.

Server Clippy passed for checkpoint 7e26f5a26, including the #981 denial-only contract test correction. Verbatim final output: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 52m 57s ``` Collaboration crate tests are now compiling; the final server test rerun waits for Cargo’s build-directory lock. The stale fragment contract is still pending authoritative regeneration from the one server binary build.

kayg commented 2026-10-03 13:47:24 +00:00

Author

Owner

Copy link

Fresh collaboration hostile_clients target passes all 12 cases, including the retired public guest socket regression and the two previously failing #81 save cases. Verbatim:

test retired_public_guest_socket_cannot_open_or_change_a_note ... ok
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.92s

No existing expectation or deadline changed. Other collaboration targets pass so far; final doc tests are still finishing. The corrected server test target is compiling and the single server binary build remains queued.

Fresh collaboration hostile_clients target passes all 12 cases, including the retired public guest socket regression and the two previously failing #81 save cases. Verbatim: ```text test retired_public_guest_socket_cannot_open_or_change_a_note ... ok test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.92s ``` No existing expectation or deadline changed. Other collaboration targets pass so far; final doc tests are still finishing. The corrected server test target is compiling and the single server binary build remains queued.

kayg commented 2026-10-03 13:56:03 +00:00

Author

Owner

Copy link

Final server tests pass at 7e26f5a26, including the corrected denial-only OpenAPI assertion and live_apps_run_in_separate_processes. The prior archive timeout does not recur in this fresh full run. Verbatim:

test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 16.00s

The complete collaboration command also passed, with 72 tests across its targets and no failed cases; the old #81 cases pass without assertion/deadline changes. The one server binary build is now running. Pending: authoritative export/adapter comparison, focused live-server browser/probe and 24 macOS width/theme screenshots.

Final server tests pass at 7e26f5a26, including the corrected denial-only OpenAPI assertion and live_apps_run_in_separate_processes. The prior archive timeout does not recur in this fresh full run. Verbatim: ```text test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 16.00s ``` The complete collaboration command also passed, with 72 tests across its targets and no failed cases; the old #81 cases pass without assertion/deadline changes. The one server binary build is now running. Pending: authoritative export/adapter comparison, focused live-server browser/probe and 24 macOS width/theme screenshots.

kayg commented 2026-10-03 14:20:48 +00:00

Author

Owner

Copy link

Production screenshots exposed a #981 regression: guest-editor removal also deleted the file/folder {:else} in PublicLinkPage.svelte. Public files incorrectly render This folder is empty, and public folders lose their listing. Restored the existing branch (no new UI unit) and extended the focused real-server flow to create a folder link, open its child with keyboard and touch, download the child, and assert that files have no folder empty state. Added six public-folder width/theme captures; the final evidence set will contain 30 images and supersede the first set. A new production web build/check and focused run are underway. The prior REST sharing probe passed with zero findings and zero SLOW findings; no Rust or API behavior changed in this UI correction.

Production screenshots exposed a #981 regression: guest-editor removal also deleted the file/folder {:else} in PublicLinkPage.svelte. Public files incorrectly render This folder is empty, and public folders lose their listing. Restored the existing branch (no new UI unit) and extended the focused real-server flow to create a folder link, open its child with keyboard and touch, download the child, and assert that files have no folder empty state. Added six public-folder width/theme captures; the final evidence set will contain 30 images and supersede the first set. A new production web build/check and focused run are underway. The prior REST sharing probe passed with zero findings and zero SLOW findings; no Rust or API behavior changed in this UI correction.

kayg referenced this issue 2026-10-03 14:28:32 +00:00

Share sheet on phone shows its title twice #1012

kayg commented 2026-10-03 14:36:12 +00:00

Author

Owner

Copy link

#981 verification complete

Head: dd1c8f1cc638374f890a9b0b7b340359d85e1b5e on job/pubedit-981. Fetched and merged origin/dev once. Files migration 0019 was free: the fetched branch ended at 0018. No push, deploy or issue closure.

What was built

Public links cannot grant edit through the API, CLI, MCP, WebMCP or browser. Existing edit links become view/download links. Their URLs, passwords, expiry, counters, item identities and historical Version attribution stay intact. Retired REST/socket entry points deny before body/link/room lookup. Authenticated Collaborate remains available.

This continuation completed the remaining verification and made four corrections:

• The server contract test now requires exactly 403 for the two retired REST paths. Active public/auth routes retain their original 429 assertions. This expectation change follows the behavior explicitly removed by #981; no other existing expectation or deadline changed.
• The authoritative server export replaces the fragment export. It removes stale retired-route 429 responses and refreshes four existing handler descriptions. Generated actions and client types match it.
• The screenshot helper seeds its review theme after media callbacks and the Appearance save settle. It keeps the existing rendering assertions.
• Restored the file/folder branch accidentally removed with the guest editor. Public folders show their children again; files no longer show a folder empty state. The focused regression now checks keyboard/touch Quick Look and child download.

Atomic continuation commits: 673be10da (audit commands), 7e26f5a26 (retired contract assertion), 6a470751e (capture ordering), 33eef7657 (authoritative generated files), dd1c8f1cc (public folder regression fix). Source comments were read again before this report.

Gates — verbatim output

cargo fmt --check: exit 0, no output. The prior Files, Notes and collaboration Clippy passes cover unchanged Rust source in this continuation:

Files Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 31s

Notes Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 15m 15s

Collaboration Clippy:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 5m 58s

Fresh server Clippy after the test correction:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 52m 57s

Fresh server tests:

test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 16.00s

Fresh collaboration tests (every target passed):

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.99s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.78s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.60s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 75.81s
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.92s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.77s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.34s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.09s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.14s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 33.69s
test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.74s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.65s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

Fresh Notes full run:

test result: FAILED. 166 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 312.41s

Unchanged Notes #954 test in isolation:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 166 filtered out; finished in 3.38s

Fresh Files full run:

test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 380.16s

The Files public denial/migration, schema upgrade and historical attribution cases pass in that full run:

test tests::dev_files_schema_upgrades_through_share_log_and_sidecar_migrations ... ok
test tests::public_edit_is_denied_and_legacy_links_keep_view ... ok
test tests::version_reads_preserve_historical_guest_attribution ... ok

One server binary build:

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 20m 08s

Production web build completed with adapter-static. Final web check:

svelte-check found 0 errors and 0 warnings

Focused provider/WebMCP Vitest:

 Test Files  2 passed (2)
      Tests  19 passed (19)
 Test Files  1 passed (1)
      Tests  1 passed (1)
 Test Files  1 passed (1)
      Tests  10 passed (10)

API-client tests:

 18 pass
 0 fail
Ran 18 tests across 1 file. [949.00ms]

Focused mounted-frame theme regression:

# tests 1
# pass 1
# fail 0

Generator/classification checks:

Ran 13 tests in 0.498s
OK
Action registry: 333 operations, 312 generated tools
Parity matrix: 333 API actions, 126 shortcuts, 2 static commands, 145 menu actions, 35 settings groups, 0 actions with adapter gaps
Cross-User classification gate: 335 operations classified
Generated entry point classification: 936 tools classified
Admin coverage: 39 reviewed operations; contract and Rust guards agree

Final focused real-server browser run:

PASS #981 public link creation and visitor page are view only; content unchanged
CSP REPORTS share: 0 across 3 pages

The existing public sharing probe ran once with a 900-second bound, the built server and production web build. It exited 0:

server alive at end: True
==== ROUND 2 FINDINGS 0
==== ROUND 2 SLOW 0

Known gaps and failure evidence

• Notes #954: the full run reports 404 versus the unchanged expected 200 in daily_and_composer_preserve_unrelated_bytes. Separate test Homes use the same User ID and process-global writer lock. journal_snapshot uses try_lock_owned before legacy ID repair, then returns 404 without a snapshot. The unchanged isolated test passes in 3.38 s. This matches #954; the #981 Notes diff only removes unused guest helpers. The full Notes command remains a failed gate.
• Files #942: the unchanged reconciliation storm exceeds its five-minute wait, then a background writer reports atomic write 946 failed: entry not found. The full Files command remains a failed gate. Fixture teardown as the writer error's cause is an inference, not a confirmed harmless result. The same timeout/error family is already recorded in #942; no assertion or deadline was relaxed.
• The initial server run found the retired-route contract mismatch and a five-second User archive timeout. The contract mismatch is fixed. The unchanged archive test passed alone (1 passed in 16.80 s), and all live-app subprocess tests pass in the final full server run. No evidence here establishes #965 as that timeout's cause.
• The previous #81 collaboration failures do not recur: all 12 hostile-client cases and the complete collaboration command pass without changed expectations.
• Standalone theme VM fixtures remain tracked by #958. This job ran its focused mounted-frame regression and the real browser flow; the full helper suite remains merge-round work.
• The inherited repeated phone Share title is filed as #1012. It is cosmetic and was present before #981.
• No performance measurement ran: the latest verification policy limits measurements to performance issues on the locked perf VM. The existing public-folder profile extension remains in bench/files-listing-427.py; no public-listing baseline exists.

UX gaps closed

Removed public Edit controls and editable content. Restored public folder rows and removed the wrong folder empty state from files. Verified real public view/download, keyboard and touch Quick Look, Escape, child download, unchanged file bytes, and authenticated Note saving. The public row download target is 44 px; primary buttons and rows meet the touch floor. Capture themes no longer race media callbacks. Inspected icons next to text in zoomed production captures; no new alignment defect was found. Visual quality review stays with the orchestrator.

UX gaps left

The inherited phone Share title duplication (#1012). Full sharing-option/gallery/file-drop and platform matrices remain for the merge round. No public edit affordance or writable guest path remains in the focused flow.

Decisions

No new product policy. Retain uniform 403 tombstones for old write URLs; accept legacy edit:false but reject true and omit edit from published schemas/responses; clear retired credentials/rate buckets while preserving historical attribution. Existing edit-only links receive view/download as §54 requires. The server contract assertion checks the new denial-only behavior rather than documenting a nonexistent REST rate-limit response. Restoring the folder branch keeps the original rendering behavior.

Screenshots

The final set below supersedes the first 24-image set. Thirty production captures cover file/folder link dialogs, public folder/Note and authenticated editor: 390, 820 and 1440 px, light/dark, macOS platform emulation. All images are attached to #981 and stay out of Git.

authenticated-note-editor-1440-paper.png
authenticated-note-editor-1440-tokyo-night.png
authenticated-note-editor-390-paper.png
authenticated-note-editor-390-tokyo-night.png
authenticated-note-editor-820-paper.png
authenticated-note-editor-820-tokyo-night.png
public-view-only-folder-1440-paper.png
public-view-only-folder-1440-tokyo-night.png
public-view-only-folder-390-paper.png
public-view-only-folder-390-tokyo-night.png
public-view-only-folder-820-paper.png
public-view-only-folder-820-tokyo-night.png
public-view-only-note-1440-paper.png
public-view-only-note-1440-tokyo-night.png
public-view-only-note-390-paper.png
public-view-only-note-390-tokyo-night.png
public-view-only-note-820-paper.png
public-view-only-note-820-tokyo-night.png
view-only-file-dialog-1440-paper.png
view-only-file-dialog-1440-tokyo-night.png
view-only-file-dialog-390-paper.png
view-only-file-dialog-390-tokyo-night.png
view-only-file-dialog-820-paper.png
view-only-file-dialog-820-tokyo-night.png
view-only-folder-dialog-1440-paper.png
view-only-folder-dialog-1440-tokyo-night.png
view-only-folder-dialog-390-paper.png
view-only-folder-dialog-390-tokyo-night.png
view-only-folder-dialog-820-paper.png
view-only-folder-dialog-820-tokyo-night.png

For the merge round

Run these once on the combined branch under the current owner policy:

(cd apps/web && bun run test --maxWorkers=2)
(cd apps/web && bun e2e/share.mjs)
node --test apps/web/e2e/harness.test.mjs
tests/adversarial/run.sh

The full sharing flow must prove all option combinations, gallery/file-drop and child actions. The full adversarial runner must prove the Cross-User, authorization and robustness matrices. Diagnose the documented #954/#942 baseline failures without weakening assertions. The orchestrator performs visual review, release/staging checks and real Mac interop. No Calendar source changed, so a separate Calendar crate gate is not applicable to this branch.

Files

• apps/web/e2e/harness.mjs
• apps/web/e2e/harness.test.mjs
• apps/web/e2e/share.mjs
• apps/web/src/lib/files/PublicLinkPage.svelte
• apps/web/src/lib/files/ShareDialog.svelte
• apps/web/src/lib/notes/NoteEditorSurface.svelte
• apps/web/src/lib/notes/collab.ts
• apps/web/src/lib/notes/editorHost.ts
• apps/web/src/lib/webmcp/generated.test.ts
• bench/files-listing-427.py
• contracts/actions.json
• contracts/openapi.json
• crates/calternal-collab/src/session.rs
• crates/calternal-collab/tests/hostile_clients.rs
• crates/calternal-server/src/main.rs
• crates/calternal-server/src/wire.rs
• crates/plugins/files/migrations/0019_public_links_view_only.sql
• crates/plugins/files/src/lib.rs
• crates/plugins/files/src/public.rs
• crates/plugins/notes/src/lib.rs
• docs/DESIGN.md
• docs/audits/xuser-472.md
• docs/parity-exceptions.json
• docs/parity-matrix.md
• packages/api-client/src/generated.ts
• scripts/action_registry.py
• scripts/parity_matrix.py
• scripts/test_action_registry.py
• tests/adversarial/attack2.py
• tests/adversarial/authz_matrix.py
• tests/adversarial/xuser_matrix.py

Cleanup

Cargo cleanup and removal of the web build output completed. The worktree is clean; ignored logs and review artifacts remain.

     Removed 16835 files, 11.7GiB total

READY FOR MERGE: yes

# #981 verification complete Head: `dd1c8f1cc638374f890a9b0b7b340359d85e1b5e` on `job/pubedit-981`. Fetched and merged `origin/dev` once. Files migration 0019 was free: the fetched branch ended at 0018. No push, deploy or issue closure. ## What was built Public links cannot grant edit through the API, CLI, MCP, WebMCP or browser. Existing edit links become view/download links. Their URLs, passwords, expiry, counters, item identities and historical Version attribution stay intact. Retired REST/socket entry points deny before body/link/room lookup. Authenticated Collaborate remains available. This continuation completed the remaining verification and made four corrections: - The server contract test now requires exactly 403 for the two retired REST paths. Active public/auth routes retain their original 429 assertions. This expectation change follows the behavior explicitly removed by #981; no other existing expectation or deadline changed. - The authoritative server export replaces the fragment export. It removes stale retired-route 429 responses and refreshes four existing handler descriptions. Generated actions and client types match it. - The screenshot helper seeds its review theme after media callbacks and the Appearance save settle. It keeps the existing rendering assertions. - Restored the file/folder branch accidentally removed with the guest editor. Public folders show their children again; files no longer show a folder empty state. The focused regression now checks keyboard/touch Quick Look and child download. Atomic continuation commits: `673be10da` (audit commands), `7e26f5a26` (retired contract assertion), `6a470751e` (capture ordering), `33eef7657` (authoritative generated files), `dd1c8f1cc` (public folder regression fix). Source comments were read again before this report. ## Gates — verbatim output `cargo fmt --check`: exit 0, no output. The prior Files, Notes and collaboration Clippy passes cover unchanged Rust source in this continuation: Files Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 8m 31s ``` Notes Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 15m 15s ``` Collaboration Clippy: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 5m 58s ``` Fresh server Clippy after the test correction: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 52m 57s ``` Fresh server tests: ```text test result: ok. 107 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 16.00s ``` Fresh collaboration tests (every target passed): ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 4.99s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.78s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.60s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 75.81s test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.92s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.77s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.34s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.09s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.14s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 33.69s test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.74s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 22.65s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` Fresh Notes full run: ```text test result: FAILED. 166 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 312.41s ``` Unchanged Notes #954 test in isolation: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 166 filtered out; finished in 3.38s ``` Fresh Files full run: ```text test result: FAILED. 145 passed; 1 failed; 1 ignored; 0 measured; 0 filtered out; finished in 380.16s ``` The Files public denial/migration, schema upgrade and historical attribution cases pass in that full run: ```text test tests::dev_files_schema_upgrades_through_share_log_and_sidecar_migrations ... ok test tests::public_edit_is_denied_and_legacy_links_keep_view ... ok test tests::version_reads_preserve_historical_guest_attribution ... ok ``` One server binary build: ```text Finished `dev` profile [unoptimized + debuginfo] target(s) in 20m 08s ``` Production web build completed with adapter-static. Final web check: ```text svelte-check found 0 errors and 0 warnings ``` Focused provider/WebMCP Vitest: ```text Test Files 2 passed (2) Tests 19 passed (19) Test Files 1 passed (1) Tests 1 passed (1) Test Files 1 passed (1) Tests 10 passed (10) ``` API-client tests: ```text 18 pass 0 fail Ran 18 tests across 1 file. [949.00ms] ``` Focused mounted-frame theme regression: ```text # tests 1 # pass 1 # fail 0 ``` Generator/classification checks: ```text Ran 13 tests in 0.498s OK Action registry: 333 operations, 312 generated tools Parity matrix: 333 API actions, 126 shortcuts, 2 static commands, 145 menu actions, 35 settings groups, 0 actions with adapter gaps Cross-User classification gate: 335 operations classified Generated entry point classification: 936 tools classified Admin coverage: 39 reviewed operations; contract and Rust guards agree ``` Final focused real-server browser run: ```text PASS #981 public link creation and visitor page are view only; content unchanged CSP REPORTS share: 0 across 3 pages ``` The existing public sharing probe ran once with a 900-second bound, the built server and production web build. It exited 0: ```text server alive at end: True ==== ROUND 2 FINDINGS 0 ==== ROUND 2 SLOW 0 ``` ## Known gaps and failure evidence - Notes #954: the full run reports 404 versus the unchanged expected 200 in daily_and_composer_preserve_unrelated_bytes. Separate test Homes use the same User ID and process-global writer lock. journal_snapshot uses try_lock_owned before legacy ID repair, then returns 404 without a snapshot. The unchanged isolated test passes in 3.38 s. This matches #954; the #981 Notes diff only removes unused guest helpers. The full Notes command remains a failed gate. - Files #942: the unchanged reconciliation storm exceeds its five-minute wait, then a background writer reports atomic write 946 failed: entry not found. The full Files command remains a failed gate. Fixture teardown as the writer error's cause is an inference, not a confirmed harmless result. The same timeout/error family is already recorded in #942; no assertion or deadline was relaxed. - The initial server run found the retired-route contract mismatch and a five-second User archive timeout. The contract mismatch is fixed. The unchanged archive test passed alone (1 passed in 16.80 s), and all live-app subprocess tests pass in the final full server run. No evidence here establishes #965 as that timeout's cause. - The previous #81 collaboration failures do not recur: all 12 hostile-client cases and the complete collaboration command pass without changed expectations. - Standalone theme VM fixtures remain tracked by #958. This job ran its focused mounted-frame regression and the real browser flow; the full helper suite remains merge-round work. - The inherited repeated phone Share title is filed as #1012. It is cosmetic and was present before #981. - No performance measurement ran: the latest verification policy limits measurements to performance issues on the locked perf VM. The existing public-folder profile extension remains in bench/files-listing-427.py; no public-listing baseline exists. ## UX gaps closed Removed public Edit controls and editable content. Restored public folder rows and removed the wrong folder empty state from files. Verified real public view/download, keyboard and touch Quick Look, Escape, child download, unchanged file bytes, and authenticated Note saving. The public row download target is 44 px; primary buttons and rows meet the touch floor. Capture themes no longer race media callbacks. Inspected icons next to text in zoomed production captures; no new alignment defect was found. Visual quality review stays with the orchestrator. ## UX gaps left The inherited phone Share title duplication (#1012). Full sharing-option/gallery/file-drop and platform matrices remain for the merge round. No public edit affordance or writable guest path remains in the focused flow. ## Decisions No new product policy. Retain uniform 403 tombstones for old write URLs; accept legacy edit:false but reject true and omit edit from published schemas/responses; clear retired credentials/rate buckets while preserving historical attribution. Existing edit-only links receive view/download as §54 requires. The server contract assertion checks the new denial-only behavior rather than documenting a nonexistent REST rate-limit response. Restoring the folder branch keeps the original rendering behavior. ## Screenshots The final set below supersedes the first 24-image set. Thirty production captures cover file/folder link dialogs, public folder/Note and authenticated editor: 390, 820 and 1440 px, light/dark, macOS platform emulation. All images are attached to #981 and stay out of Git. [authenticated-note-editor-1440-paper.png](https://git.kayg.org/attachments/72e5ebc5-cb6a-49dd-aafd-392de303f91b) [authenticated-note-editor-1440-tokyo-night.png](https://git.kayg.org/attachments/beea7855-aab8-4c8d-8503-7bc0f443026e) [authenticated-note-editor-390-paper.png](https://git.kayg.org/attachments/940338ce-b9e0-47a9-805d-a4b553536cdf) [authenticated-note-editor-390-tokyo-night.png](https://git.kayg.org/attachments/81c79a07-1143-4a2b-954d-ae49d5480043) [authenticated-note-editor-820-paper.png](https://git.kayg.org/attachments/e984c374-ffbc-4f14-a976-98245b0235d2) [authenticated-note-editor-820-tokyo-night.png](https://git.kayg.org/attachments/a6acd4f9-4e2d-496a-a03a-44bab2b91e32) [public-view-only-folder-1440-paper.png](https://git.kayg.org/attachments/96dda9db-d2dd-4955-a7a3-de8276589d09) [public-view-only-folder-1440-tokyo-night.png](https://git.kayg.org/attachments/0dafea7a-3026-4aef-acef-bdcb37ded93f) [public-view-only-folder-390-paper.png](https://git.kayg.org/attachments/4d524a9d-ed20-4094-accc-36ee9105c312) [public-view-only-folder-390-tokyo-night.png](https://git.kayg.org/attachments/1214431b-44c4-4501-b798-50735cc40bd9) [public-view-only-folder-820-paper.png](https://git.kayg.org/attachments/c00d77d5-1265-4439-9be5-2b67340513ef) [public-view-only-folder-820-tokyo-night.png](https://git.kayg.org/attachments/08ef43c6-0b5c-4b5a-bde4-8962dbc692c0) [public-view-only-note-1440-paper.png](https://git.kayg.org/attachments/ebe2c3a2-7394-47ac-9137-5d4bc1075a6a) [public-view-only-note-1440-tokyo-night.png](https://git.kayg.org/attachments/bb5ef389-9d92-4079-8829-b3ca829f1efb) [public-view-only-note-390-paper.png](https://git.kayg.org/attachments/bd3322a1-22ec-49cc-9b86-b21e05afb1ba) [public-view-only-note-390-tokyo-night.png](https://git.kayg.org/attachments/723fafdd-bc14-4fa5-9c62-75fdd18ed055) [public-view-only-note-820-paper.png](https://git.kayg.org/attachments/3474f898-8a92-46a9-bd48-cf6f374bd434) [public-view-only-note-820-tokyo-night.png](https://git.kayg.org/attachments/087d0dd8-9f4a-4ff4-90f5-8d5361e0127c) [view-only-file-dialog-1440-paper.png](https://git.kayg.org/attachments/6bfa143f-970b-4ea0-a600-0c1840a13dd0) [view-only-file-dialog-1440-tokyo-night.png](https://git.kayg.org/attachments/71eb64b3-913a-48ca-baa3-cae59c1f9603) [view-only-file-dialog-390-paper.png](https://git.kayg.org/attachments/9745391c-9b48-4640-a387-dad3f86f1846) [view-only-file-dialog-390-tokyo-night.png](https://git.kayg.org/attachments/6b6c57ac-a0a5-4072-af19-f0e5ae0db7cd) [view-only-file-dialog-820-paper.png](https://git.kayg.org/attachments/e1a12bb8-20b0-42e6-9aaa-0aed1bae8030) [view-only-file-dialog-820-tokyo-night.png](https://git.kayg.org/attachments/4d8f74a9-0bb2-47f4-aa41-792750505c32) [view-only-folder-dialog-1440-paper.png](https://git.kayg.org/attachments/76644475-b163-4821-977f-d3871ea1896d) [view-only-folder-dialog-1440-tokyo-night.png](https://git.kayg.org/attachments/68bd1491-856c-46f9-9d27-9f5874d9f422) [view-only-folder-dialog-390-paper.png](https://git.kayg.org/attachments/88e03555-bddd-4403-a7b5-4511ac0b2d2f) [view-only-folder-dialog-390-tokyo-night.png](https://git.kayg.org/attachments/0ea43451-080d-4846-8f09-53b760e2d329) [view-only-folder-dialog-820-paper.png](https://git.kayg.org/attachments/6f821681-4cf8-4c88-9311-7a5d98223115) [view-only-folder-dialog-820-tokyo-night.png](https://git.kayg.org/attachments/241705af-3c6f-48eb-a7d3-a4cbddc0c7d9) ## For the merge round Run these once on the combined branch under the current owner policy: ```sh (cd apps/web && bun run test --maxWorkers=2) (cd apps/web && bun e2e/share.mjs) node --test apps/web/e2e/harness.test.mjs tests/adversarial/run.sh ``` The full sharing flow must prove all option combinations, gallery/file-drop and child actions. The full adversarial runner must prove the Cross-User, authorization and robustness matrices. Diagnose the documented #954/#942 baseline failures without weakening assertions. The orchestrator performs visual review, release/staging checks and real Mac interop. No Calendar source changed, so a separate Calendar crate gate is not applicable to this branch. ## Files - `apps/web/e2e/harness.mjs` - `apps/web/e2e/harness.test.mjs` - `apps/web/e2e/share.mjs` - `apps/web/src/lib/files/PublicLinkPage.svelte` - `apps/web/src/lib/files/ShareDialog.svelte` - `apps/web/src/lib/notes/NoteEditorSurface.svelte` - `apps/web/src/lib/notes/collab.ts` - `apps/web/src/lib/notes/editorHost.ts` - `apps/web/src/lib/webmcp/generated.test.ts` - `bench/files-listing-427.py` - `contracts/actions.json` - `contracts/openapi.json` - `crates/calternal-collab/src/session.rs` - `crates/calternal-collab/tests/hostile_clients.rs` - `crates/calternal-server/src/main.rs` - `crates/calternal-server/src/wire.rs` - `crates/plugins/files/migrations/0019_public_links_view_only.sql` - `crates/plugins/files/src/lib.rs` - `crates/plugins/files/src/public.rs` - `crates/plugins/notes/src/lib.rs` - `docs/DESIGN.md` - `docs/audits/xuser-472.md` - `docs/parity-exceptions.json` - `docs/parity-matrix.md` - `packages/api-client/src/generated.ts` - `scripts/action_registry.py` - `scripts/parity_matrix.py` - `scripts/test_action_registry.py` - `tests/adversarial/attack2.py` - `tests/adversarial/authz_matrix.py` - `tests/adversarial/xuser_matrix.py` ## Cleanup Cargo cleanup and removal of the web build output completed. The worktree is clean; ignored logs and review artifacts remain. ```text Removed 16835 files, 11.7GiB total ``` READY FOR MERGE: yes

kayg referenced this issue 2026-10-04 05:14:33 +00:00

Groups: admin-managed user groups for Share and Collaborate #1028

kayg referenced this issue 2026-10-04 07:13:22 +00:00

SHARING: one Share dialog everywhere + share Notes, Canvases and folders #1034

kayg referenced this issue 2026-10-04 18:55:26 +00:00

Plan: merge order and conflicts for merge round 7b #867

kayg referenced this issue 2026-10-04 18:55:27 +00:00

SHARING: one Share dialog everywhere + share Notes, Canvases and folders #1034

kayg referenced this issue 2026-10-04 18:55:28 +00:00

SHARING: invite links for people without an account #1035

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

dev

wip/restyle-mailmoney

wip/restyle-files

wip/previewcard-1098

wip/palette2-1123

wip/palette-1093

wip/onboard2-1141

wip/onboard-1141.aborted-early

wip/onboard-1141

wip/nlpchip-1127

wip/morph-1104

wip/merge-round-7c5

wip/merge-round-7c4

wip/merge-round-7c3

wip/merge-round-7c2

wip/merge-round-7c

wip/mchrome-1084

wip/mailghost2-1094

wip/mailghost-1094

wip/kbpreview2-1118

wip/kbpreview-1118

wip/kanban-1092

wip/importhang-1121

wip/hiderev-1153

wip/hide4-1153

wip/hide3-1153

wip/hide2-1153

wip/hide-1153

wip/editreg-1132

wip/editorrail3-1113

wip/editorrail2-1113

wip/editorrail-1113

wip/e2e-b2-1071

wip/e2e-b-1071

wip/draw4-1101

wip/draw3-1101

wip/draw2-1101

wip/draw-1101

wip/directory-1199-r

wip/directory-1199

wip/delete-1119

job/merge30

wip/collabrev-1197

wip/collabloss2-1197

wip/collabloss-1197

wip/cards2-1083

wip/cards-1083

wip/canvas-visual

wip/canvasvis2-976

wip/calhdr-1112

wip/calcards-1115

wip/browserfix

wip/blocks-1125

wip/allday-1107

wip/agenda-decks

wip/agenda-1086

wip/adv7c-1105

wip/txentry-1198

wip/trayicons2-1095

wip/trayicons-1095

wip/tagperf-1186

wip/sidebar3-1094

wip/rev2-webperf

wip/rev2-money-ident

job/restyle-notes

job/tagperf-1186

job/adv-1202

job/notifloop-1194

job/restyle-mailmoney

job/onboard-1141

wip/restyle-notes

job/segmented-1200

job/hide-1153

wip/notifloop-1194

job/txentry-1198

job/collabloss-1197

job/perf-1124

job/perf2-1124

job/tocrail-1191

job/restyle-settings

wip/restyle-settings

wip/segmented-1200

job/restyle-files

job/tagdnd-1187

job/cards-1179

wip/cards2-1179

wip/cards-1179

wip/tocrail-1191

wip/tagdnd-1187

wip/perf-1124

wip/merge30j

job/wizchoices-1140

wip/wizchoices-1140

wip/restyle-1190

job/moneyfmt-1180

wip/moneyfmt2-1180

wip/moneyfmt-1180-r

wip/moneyfmt-1180

job/pillglass-1189

job/flags-1181

wip/flags-1181

job/restyle-1190

job/restyle-search

job/settingsreg-1195

job/wizard-1140

site/website

wip/wizardrev2-1140

wip/wizardrev-1140

wip/wizard5-1140

wip/wizard4-1140

wip/wizard3-1140

wip/wizard2-1140

wip/wizard-1140

wip/pillglass-1189

wip/settingsreg-1195

job/merge29

job/fu-1171

wip/merge29j

wip/fu-1171

job/fu-1166

job/directory-1199

job/proflog-1204

job/txresearch-1188

wip/fu-1166

job/merge28

job/search-1066

wip/search-1066

wip/merge28j

job/gateslot-1182

job/bulkimport-1157

job/mailnet-1160

wip/mailnetrev-1160

wip/mailnet-1160

wip/bulkrev-1157

wip/bulkimport-1157

job/startup-1161

wip/startup-1161

job/merge27

job/linkcards-1151

wip/linkcards3-1151

wip/linkcards2-1151

wip/linkcards-1151

job/traydate-1144

wip/traydate3-1144

wip/traydate2-1144

wip/traydate-1144

job/draw-1101

wip/merge27j

job/blockpill-1152

wip/blockpill3-1152

wip/blockpill2-1152

wip/blockpill-1152

job/minihover-1149

wip/minihover2-1149

wip/minihover-1149

job/merge25

wip/merge25-r

wip/merge25b

wip/merge25

job/inspector-1129

job/tags-1110

wip/inspector3-1129

wip/inspector2-1129

wip/inspector-1129

wip/tagsrev-1110

wip/tags2-1110

wip/tags-1110

job/dates-1148

wip/datesrev-1148

wip/dates2-1148

wip/dates-1148

job/licence-1145

wip/licence2-1145

wip/licence-1145

job/selfhost-1156

job/merge23

wip/merge23

job/tagfilter-1109

wip/tagfilter2-1109

wip/tagfilter-1109

job/kbd-1134

wip/kbd2-1134

wip/kbd-1134

job/palfoot-1137

wip/selfhost-1156

wip/palfoot2-1137

wip/palfoot-1137

job/toggle-1158

wip/toggle-1158

job/kbpreview-1118

job/docratchet-1155

job/perflint-1133

job/devtests-1159

wip/docratchet-1155

wip/devtests-1159

job/segv-1136

wip/toast-1142

wip/segv-1136

job/toast-1142

job/blockreload-1147

wip/blockreload-1147

job/font-1150

wip/font-1150

job/importui-1120

job/minimonth-1149

wip/importui-1120

wip/minimonth-1149

job/depcheck-1146

wip/perflint-1133

wip/depcheck-1146

job/calcards-1115

job/blocks-1125

job/plus-1128

job/shift-1138

wip/plus2-1128

wip/plus-1128

wip/shift-1138

job/moneyfid-1130

job/editorrail-1113

wip/moneyrev-1130

wip/moneyfid-1130

job/noext-851

wip/noext-851

wip/noext3-851

wip/noext2-851

job/week-1135

wip/week-1135

job/editreg-1132

job/smoke-1122

wip/smoke-1122

job/docs-1143

job/palette2-1123

job/calhdr-1112

job/nlpchip-1127

job/mailghost-1094

job/reconnect-1131

wip/reconnect-1131

job/trayicons-1095

job/delete-1119

job/importhang-1121

job/cards-1083

job/palette-1093

job/mchrome-1084

job/e2e-a-1071

job/canvas-visual

job/previewcard-1098

job/allday-1107

wip/e2e-a2-1071

wip/e2e-a-1071

job/e2e-b-1071

job/adv7c-1105

job/kanban-1092

job/agenda-1086

job/merge-round-7c

job/morph-1104

wip/surfaces-p2

job/merge-round-9

wip/merge-round-9

job/7cfix-small

wip/7cfix-small

job/mailui-1078

job/merge-round-8

wip/merge-round-8

wip/mailui-1078

job/mailround-1038

job/applemail-accept

wip/settitle-1068

wip/mailround2-1038

wip/mailround-1038

wip/e2e-7b

job/crash-1069

wip/crash-1069

job/searchlost-1066

wip/searchlost-1066

job/7b-reconcile

job/flake-1065

wip/flake-1065

wip/merge-round-7b7

wip/merge-round-7b6

wip/merge-round-7b5

wip/merge-round-7b4

wip/7b-reconcile

job/appupdate-1059

job/nfd-1044

wip/appupdate-1059

job/e2e-7b

job/loop-1062

wip/loop-1062

job/pdfprev-1045

job/invtoggle-1053

wip/pdfprev-1045

wip/nfd-1044

wip/invtoggle-1053

job/7bfix-e2e

job/mailstress-b

wip/7bfix-e2e

wip/mailstress-b

job/7bfix-adv

wip/7bfix-adv

job/mailstress-a

job/stack-1054

wip/stack-1054

wip/mailstress-a

job/mailstress-1038

wip/mailstress-1038

job/upload500-1051

wip/upload500-1051

job/share-1034

wip/share-1034

job/syncerr-1037

job/7bfix-photos

wip/7bfix-photos

job/paste-1036

job/setside-1039

wip/setside-1039

wip/paste-1036

job/lease-1042

wip/syncerr-1037

wip/lease-1042

job/7bfix-data

job/passkeybind-1043

wip/apprevoke-1041

job/invite-1035

wip/invite-1035

job/merge-round-7b2

wip/merge-round-7b2

job/mailproxy-486

job/apprevoke-1041

job/rebuild-1033

job/pillborder-1029

wip/pillborder-1029

wip/mailproxy-486

wip/applemail-486

job/headless-998

wip/headless-998

job/groups-1028

wip/groups-1028

job/rebuildwarn-1016

wip/rebuildwarn-1016

job/startup-1011

wip/startup-1011

job/monthpill-1009

job/bgthumb-1025

job/sharetitle-1012

wip/monthpill-1009

wip/bgthumb-1025

wip/sharetitle-1012

job/canvas-cards-977

wip/canvas-cards-977

job/canvas-pencil-978

job/canvas-sketch-990

wip/canvas-sketch-990

wip/canvas-pencil-978

job/canvas-files-989

wip/canvas-files-989

job/canvas-collab-991

wip/canvas-collab-991

job/weekscroll-1018

wip/weekscroll-1018

wip/canvas-core-976

job/canvas-core-976

job/round-drag

wip/round-drag

job/round-settings

job/browserfix

wip/oapi-974

job/oapi-974

job/hist2-integrate

job/mailhtml-726

wip/mailhtml-726

wip/hist2-integrate

job/moneyfu-984

job/drag-1015

wip/drag-1015

job/rename-1017

wip/rename-1017

job/hist2-api

wip/hist2-api

job/oneacct-1014

wip/oneacct-1014

wip/moneyfu-984

job/hist2-bench

job/hist2-restore

wip/hist2-bench

job/hist2-write

job/hotfix-724

wip/hotfix-724

wip/hist2-write

wip/hist2-restore

job/hist2-store

job/hist2-ui

wip/hist2-ui

wip/hist2-store

job/searchstarve-965

job/shutdown-963

wip/shutdown-963

wip/pubedit-981

job/pubedit-981

job/analytics-973

wip/searchstarve-965

job/authflash-850

job/weeklane-969

job/pvtitle-1004

job/hist-975

wip/authflash-850

job/voicepill-617

wip/pvtitle-1004

job/headring-1003

wip/weeklane-969

wip/voicepill-617

wip/headring-1003

wip/analytics-973

job/agentscope-980

wip/thumbsandbox-988

job/thumbsandbox-988

wip/hist-975

job/links-856

wip/links-856

job/davetag-966

wip/davetag-966

job/filesstorm-1000

job/hoverpad-725

wip/filesstorm-1000

job/ffmpegblas-993

job/merge-round-7a

wip/hoverpad-725

wip/ffmpegblas-993

job/nowdot-1002

wip/verify-7a

job/noteid-857

wip/nowdot-1002

wip/noteid-857

wip/merge-round-7a

wip/agentscope-980

job/imapedge

job/a11yfix2

wip/imapedge-941

wip/imapedge

wip/a11yfix2

job/notetask-986

job/logheading

wip/logheading-998

job/textthumb-652

job/photolive-987

wip/photolive-987

job/davactive-983

job/savefix-985

job/tabicons-607

wip/davactive-983

wip/tabicons-607

wip/notetask-986

wip/savefix-985

job/dirid-627

job/buildspeed-1007

wip/dirid-627

job/agenda-decks

job/perfguards-impl

job/undo-a11y

wip/undo-a11y

job/mailperf

job/wal-824

wip/settings-50

job/settings-50

job/notesfilter-606

wip/notesfilter-606

job/surfaces-p2

wip/wal-824

job/maillayouts

wip/mailperf

wip/maillayouts

job/taskmeta-659

job/money-ident

wip/money-ident

wip/taskmeta-659

job/errstates

wip/perfguards-impl

job/headings-881

wip/headings-881

wip/errstates

job/voice-619

job/gaps-827

job/notesperf

wip/notesperf

wip/voice-619

job/hddsql-549

job/perf-stream-668

wip/perf-stream-668

wip/deeplinks-fix

job/deeplinks-fix

job/authfix

job/docsfix-rust

wip/docsfix-rust

job/webperf

job/docsfix-web

job/datafix2

job/webdav-lock-476

job/copyfix

wip/copyfix

wip/webperf

job/focus-658

wip/protofix

job/mediafix

job/protofix

wip/mediafix

job/agentfix

job/hhmm-724

wip/agentfix

job/undo-722

job/reuse

wip/webdav-lock-476

wip/reuse

job/scopefix

job/datafix

wip/hhmm-724

wip/undo-722

job/surfaces-p1

wip/hddsql-549

job/voicememos-618

wip/datafix2

wip/surfaces-p1

job/fix-940

wip/fix-940

job/blaze-surfaces

wip/datafix

wip/blaze-surfaces

job/taskday-655

job/linknav-639

wip/linknav-639

wip/gaps-827

job/isolation-707

job/audiophotos-720

wip/audiophotos-720

job/advfind-664

wip/voicememos-618

wip/taskday-655

wip/isolation-707

wip/advfind-664

wip/scopefix

wip/focus-658

job/testgaps

wip/testgaps

job/overscroll-718

wip/authfix

job/deps

wip/overscroll-718

job/rev2-agentfix

job/rev2-money-ident

job/rev2-mailperf

wip/deps

job/hardening-728

wip/hardening-728

job/searchgen-832

wip/searchgen-832

job/photopw-849

job/mailsql-825

wip/photopw-849

job/sharefix

wip/sharefix

job/rev2-mailhtml-726

job/rev2-perfguards

job/copyval-723

job/lightglass-r2

wip/lightglass-r2

wip/docsfix-web

job/copy-audit

job/macinterop-staging-r2

job/design-sync

job/rev2-taskmeta-659

job/rev2-webperf

job/docs-audit

job/rev2-advfind-664

job/rev2-mailproxy-486

job/states-audit

job/rev2-datafix

job/design-drift

job/test-gaps

job/rev2-voicememos-618

job/rev2-mediafix

job/rev2-deps

job/rev2-datafix2

job/licence-audit

job/issue-hygiene

job/rev2-protofix

job/rev2-voice-619

job/rev2-isolation-707

job/rev2-surfaces-p1

job/deeplink-audit2

job/rev2-audiophotos-720

wip/test-gaps

job/rev2-overscroll-718

job/rev2-undo-722

wip/states-audit

job/rev2-dropmd-719

job/rev2-linknav-639

job/merge-7b-plan

wip/merge-7b-plan

job/rev2-taskday-655

wip/mailsql-825

job/rev2-webdav-lock-476

job/rev2-browserfix

wip/design-drift

job/rev2-hddsql-549

wip/deeplink-audit2

job/rev2-scopefix

job/rev2-authfix

job/rev2-hardening-728

job/rev2-wal-824

job/rev2-sharefix

job/calsidebar-638

job/chrome-audit

job/ioperf

wip/ioperf

wip/chrome-audit

wip/calsidebar-638

job/dropmd-719

wip/dropmd-719

job/ocr-build

wip/ocr-build

job/blaze-settings

wip/copyval-723

job/toastring-721

wip/toastring-721

job/deployfix-732

wip/deployfix-732

wip/blaze-settings

job/money-import-recheck

job/rev-a11y

job/perf-arch-db

job/rev-7b-data

wip/textthumb-652

wip/perf-arch-db

job/sec-protocols

job/sidehdr-660

job/rev-7b-security

job/research-surfaces

job/rev-design-gaps

job/rev-mcp-api

wip/sidehdr-660

job/perf-arch-memory

wip/sec-protocols

job/perf-arch-bundle

job/snapedge-714

wip/rev-mcp-api

job/sec-supplychain

wip/research-surfaces

job/perf-arch-sync

job/rev-consistency

job/perf-arch-server

wip/perf-arch-server

wip/perf-arch-memory

job/perf-arch-io

job/perf-arch-client

job/sec-fs

job/sec-mcp-scopes

job/sec-sharing

job/perf-guards

job/sec-browser

job/sec-admin-deploy

job/sec-auth

wip/snapedge-714

job/bgpicker-717

wip/perf-arch-bundle

wip/money-import-recheck

job/advsetup-654

wip/bgpicker-717

wip/advsetup-654

job/burst-709

job/kbdcaps-710

job/app-pw-chooser

wip/burst-709

wip/app-pw-chooser

job/imaptest-625

wip/kbdcaps-710

job/fix-499

wip/fix-499

job/perf-mut-667

job/calimg-589

job/perf-snap-666

wip/calimg-589

wip/perf-snap-666

wip/perf-mut-667

job/perf-cache-665

wip/perf-cache-665

job/voicefiles-620

wip/voicefiles-620

job/admin-burst-705

wip/admin-burst-705

job/voicememos-review

wip/voicememos-review

wip/ryw-653

job/ryw-653

job/writeonopen-661

job/instant-663

wip/writeonopen-661

job/money-import-review

wip/money-import-review

wip/importjs-610

review/integrations-407-round6

wip/integrations-review

job/dragghost-612

wip/dragghost-612

job/integrations

wip/integrations

job/decider-656

job/merge-round-6

job/perf-rerun

wip/merge-round-6

job/integrations-review-round5

job/selalign-576

wip/selalign-576

job/mcp-events-491

job/files-631

job/cal-e2e-569

wip/cal-e2e-569

job/reload-423

wip/reload-423

wip/mcp-events-491

wip/files-631

job/notesbridge-644

wip/notesbridge-644

job/editor-series

job/calcard-series

wip/calcard-series

job/mcp-events-review-491

wip/mcp-events-review

wip/editor-series

job/quirks-546

job/integrations-recheck

job/tocrail-636

wip/tocrail-636

wip/quirks-546

wip/reminders-643

job/reminders-643

wip/davscale-573

job/davscale-573

job/integrations-review

wip/ocr-eval-584

job/ocr-eval-584

job/esc-537

wip/esc-537

job/toastname-586

wip/toastname-586

job/submenu-579

wip/submenu-579

job/tasks-mode

wip/tasks-mode

job/agentdocs-630

job/dupwrite-634

wip/agentdocs-630

wip/dupwrite-634

job/lightglass-588

wip/lightglass-588

job/tabswitch-549

job/ghosttask-623

wip/ghosttask-623

job/toaststack-616

job/weekstate-609

job/mailsync-613

wip/mailsync-613

wip/weekstate-609

job/maildup-626

wip/tabswitch-549

wip/maildup-626

wip/toaststack-616

job/motion-611

wip/motion-611

job/tlstest-601

wip/tlstest-601

job/perf-495

job/floating-sheet

wip/floating-sheet

job/remdup-585

wip/remdup-585

job/fix-502

wip/fix-502

job/attachplay-622

job/perf-batch

wip/perf-batch-563

wip/perf-495

hotfix/mail-sync-diag

job/mail-m3

wip/mail-m3

job/attach-poof-603

job/calhover-608

job/editorbar-604

job/mentions-605

job/merge-round-4

job/allday-514

wip/merge-round-4

wip/allday-514

job/merge-round-4a

wip/merge-round-4a

job/sharestack-580

job/fix-501

wip/sharestack-580

wip/fix-501

job/perf-batch-563

job/apw-cache-review

wip/apw-cache-review

job/probe-520

wip/probe-520

job/mac-393

wip/mac-393

job/header-571

job/flake-513

wip/flake-513

job/docs-thumb-547

wip/header-571

job/webcal-572

wip/webcal-572

wip/shortcuts-542

job/shortcuts-542

wip/docs-thumb-547

job/caldav-stress

wip/caldav-stress

wip/sweep-478

job/apw-cache-512

wip/apw-cache-512

job/money-empty-540

wip/restart-505

wip/money-empty-540

wip/fix-510

job/restart-505

job/fix-503

job/perf-496

wip/perf-496

job/fix-498

wip/fix-498

job/info-inspector-465

wip/info-inspector-465

job/fix-510

job/fix-507

wip/fix-507

wip/fix-503

job/fix-493

job/money-kinds

wip/money-kinds

job/hygiene-548

job/merge-round-3

wip/fix-493

job/drag-snap-536

wip/merge-round-3

wip/merge-round-0930

wip/drag-snap-536

job/align-538

wip/align-538

job/bg-flash

wip/bg-flash

job/money-import

job/search-count-544

wip/search-count-544

wip/money-import

job/settings-key-541

wip/settings-key-541

job/toast-539

job/preview-421

wip/preview-421

wip/toast-539

job/tasks-500-531

job/title-plain-526

wip/title-plain-526

wip/tasks-500-531

job/notes-bridge

wip/parity-484

job/parity-484

job/files-slow

job/crash-525

wip/notes-bridge

wip/files-slow

wip/crash-525

job/kbd-motion-527

wip/bg-422

job/analytics-504

wip/analytics-504

wip/kbd-motion-527

job/upload-pill-523

wip/upload-pill-523

wip/tray-order

job/tray-order

wip/overflow-mid

wip/merge-round-2

job/perf-494

wip/perf-494

wip/mcp-fast-492

wip/motion-477

wip/asr-ab-489

wip/theme-variants-506

wip/overflow-511

wip/week-header-508

wip/attach-427

job/dav-delete-471

job/iso-435

wip/iso-435

wip/files-sel-keys

wip/dav-delete-471

job/align-253

job/siwc-490

wip/siwc-490

job/money-kinds-review

wip/align-253

wip/money-kinds-review

job/small-bugs-3

wip/overlay-title-487

wip/multiget-500

wip/hidden-420

wip/webcal-ui

wip/webcal-431

job/perf-367

job/location

wip/small-bugs-3

wip/location

wip/perf-367

wip/admin-deny-483

job/tag-unicode-473

wip/tag-unicode-473

job/blur-436

wip/photos-470

wip/blur-436

wip/small-bugs-4

wip/hunt-20260930

wip/settings-hdr-482

wip/chips-416

job/dedup-375

wip/dedup-375

job/doc-stack

wip/doc-stack

job/tokens-literals

wip/tokens-literals

job/jobs-leftovers

wip/send-fast

wip/paste-467

wip/money-numbers

job/money-plugin

wip/money-plugin

job/break-dav

wip/merge-batch

wip/crossday-469

wip/mac-verify

wip/mail-m2

wip/break-dav

wip/money-review2

job/money-md

job/modes-424

wip/money-md

wip/jobs-leftovers

job/agenda-413

wip/agenda-413

wip/modes-424

job/recog-417

wip/recog-417

wip/bounce-425

wip/ab-384-luna

job/webdav-perf

wip/webdav-perf

job/toast-ring

wip/toast-ring

job/money-review

wip/money-review

wip/micro-motion

wip/settings-card

wip/minical

job/notes-imap-428

job/least-priv

wip/ui-small-2

wip/flaky-426

wip/drag-end-418

job/jank

wip/jank

wip/least-priv

wip/docs-site

job/agenda

job/sec-batch

wip/sec-batch

wip/per-user-index

job/area-calendars

wip/area-calendars

job/parity

wip/parity

job/documents-research

wip/documents-research

job/test-infra

job/reminders-sync

wip/small-bugs-2

wip/reminders-sync

wip/gestures

job/google-oauth

wip/tags-merge

wip/tags

job/e2e-theme

wip/e2e-theme

job/icon-align

wip/test-infra

wip/select-align

wip/editor-385

job/voice

wip/webdav

job/webdav

job/app-pw-ui

job/editor-integrity

wip/editor-integrity

wip/voice

wip/quota

wip/cal-followups

wip/icon-align

job/composer-scale

wip/composer-scale

job/jobs-page

wip/jobs-page

job/hig-type

wip/hig-type

wip/app-pw-ui

job/motion-spring

job/mcp

wip/motion-spring

wip/mcp

job/small-bugs

wip/push-hosts

job/profile-sign

wip/touch-369

wip/profile-sign

job/mobile-focus

wip/mobile-focus

wip/ui-polish-354

wip/small-bugs

wip/dup-task

job/toast-polish

job/app-pw-scopes

wip/toast-polish

wip/app-pw-scopes

wip/cli-agent

wip/selection-pills

job/preview-attach

wip/preview-attach

job/dav-proppatch

wip/dav-proppatch

wip/cal-switcher

job/atomic-race

wip/atomic-race

job/photos-shared

wip/photos-shared

wip/cal-grid

wip/note-rewrite

wip/search-rebuild

job/mail-m1

job/paperless-import

wip/paperless-import

wip/mail-m1

wip/hidden-activity

wip/search-d

wip/pricing-research

wip/cursors

wip/auto-scheme

job/single-pills

wip/single-pills

wip/xuser-matrix

wip/money-format

wip/app-pw-setup

wip/purge-dos

wip/vault-health

wip/caldav-apple

wip/xuser-audit

wip/e2e-green

wip/tabbar

wip/adv-harness

wip/maple-mono

job/search-fix

wip/search-fix

wip/search-perf-c

job/adv-harness

wip/sidebar-headers

job/glass

wip/temp-index

job/polish

wip/polish

wip/file-protocols

wip/money-research

wip/glass

wip/voice-models

wip/collab-redo

job/voice-research

wip/hunt-20260928

wip/notes-actions-research

wip/search-pad

wip/search-perf

wip/search-sticky

wip/editor-undo

wip/chrome-rules

wip/motion

wip/appearance-research

wip/appearance

wip/audit-bugs

wip/cal-glass

wip/block-actions

wip/authz-order

wip/event-stripes

wip/chrome-sidebar

wip/auth-flaky

wip/robust-2

wip/gate-fix

wip/menu-blur

wip/import-calternaljs

wip/tray-fix

job/import-calternaljs

wip/index-order

wip/audit-fixes

wip/search-chevrons

research/mail

wip/phone-chrome

wip/dedup-break

wip/csp

wip/ui-audit

wip/select-toast

wip/perf

wip/flat-layout

wip/fonts

wip/event-tint

wip/sync-converge

wip/data-split

wip/glass-audit

wip/robustness

wip/sync-chaos

wip/search-thumbs

wip/fuzz

wip/menu-icons

wip/search-pill

wip/sync-changing

wip/heading-links

wip/date-formats

wip/a11y

wip/break-editor

wip/e2e-fix

wip/settings-sections

wip/sync-root-guard

wip/search-palette

wip/share-edit

job/toasts

wip/toasts

wip/cont-analytics

wip/authz-review

wip/popovers

wip/overlay-glass

wip/change-feed

wip/editor-modes

wip/composer-align

wip/cont-agenda

wip/agenda-merge

job/agent-conventions

wip/agent-conventions

wip/backend-misc

job/route-audit

wip/route-audit

wip/ui-batch

wip/heif-hardening

wip/grid-resize

wip/ask-page

wip/webmcp

job/deeplink-audit

wip/deeplinks

wip/shortcuts

wip/cont-tz-days

main

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/calternal#981

No description provided.