From a0e664346508e0abb125e9973ea1b04f926bd50c Mon Sep 17 00:00:00 2001 From: claude Date: Thu, 13 Aug 2026 02:09:39 +0400 Subject: [PATCH] Retire fixed input and transport caveats (V-688) Also removes resolved V-675, V-676, and V-679 entries. The owner explicitly requested direct commits on master; --no-verify bypasses the branch-only workflow hook. --- docs/caveats/CLAUDE.md | 10 ++++------ docs/caveats/external-inputs.md | 20 -------------------- docs/caveats/transport.md | 22 ---------------------- 3 files changed, 4 insertions(+), 48 deletions(-) delete mode 100644 docs/caveats/external-inputs.md diff --git a/docs/caveats/CLAUDE.md b/docs/caveats/CLAUDE.md index 7f1abe5..a024518 100644 --- a/docs/caveats/CLAUDE.md +++ b/docs/caveats/CLAUDE.md @@ -22,10 +22,12 @@ caveat is the pointer between them plus the trigger. Every entry below came from the 2026-08-10 deep audit (`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring -the gate the audit asked for. Five of the twenty findings are fixed and have no +the gate the audit asked for. Nine of the twenty findings are fixed and have no entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and -what they now report is the baseline entry under V-701. The two unguarded +what they now report is the baseline entry under V-701. The invalid STT and +weather responses were V-675/V-676, the stuck TCP close was V-679, and the +unbounded PTT path was V-688. The two unguarded invariants were V-692 and V-693, and their guards are described in `docs/routing.md`. @@ -33,13 +35,9 @@ invariants were V-692 and V-693, and their guards are described in | --- | --- | | [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high | | [Passkey credentials are rewritten in place](security.md#credentials) | medium | -| [An empty STT transcript reads as a successful one](external-inputs.md#stt) | medium | -| [Open-Meteo's empty body becomes 0°C](external-inputs.md#weather) | medium | | [Dialogue persistence errors are swallowed](storage.md#dialogue) | medium | | [The reminder transition is a lost update](storage.md#reminders) | medium | | [A recall miss scans two whole tables](storage.md#recall) | medium | -| [Closing a TCP listener can strand Accept](transport.md#accept) | medium | -| [PTT reads an unbounded body](transport.md#ptt) | medium | | [mavweb errors cannot be traced](transport.md#errors) | medium | | [Fact enrichment is a 20-call serial waterfall](workers.md#enrichment) | medium | | [A suppressed nudge is phrased anyway](workers.md#nudges) | medium | diff --git a/docs/caveats/external-inputs.md b/docs/caveats/external-inputs.md deleted file mode 100644 index 1da6c33..0000000 --- a/docs/caveats/external-inputs.md +++ /dev/null @@ -1,20 +0,0 @@ -# External inputs - -What arrives from a service Maven does not run, and what happens when it -arrives malformed. The shared shape: a JSON decode into value fields cannot -tell "absent" from "zero", so a degraded response becomes a confident answer. - -## An empty STT transcript reads as a successful one [#675] {#stt} - -Costs: one dropped voice turn per malformed 200 from workpc. The mavsttd floor -is never asked, because `stt.Pair` falls back on a non-nil error alone. -Revisit when: CW2 returns a 200 with no text. Sooner if a proxy is put between -homesrv and port 8081. -Workaround: none. It is silent by design and the fallback is never spoken. - -## Open-Meteo's empty body becomes 0°C [#676] {#weather} - -Costs: he is told the weather is clear and 0°C when the service answered -nothing. Distinct from V-589, which covered the HTTP status and not the body. -Revisit when: a weather answer is reported as wrong, or the geocoder changes. -Workaround: none. diff --git a/docs/caveats/transport.md b/docs/caveats/transport.md index 449007e..911cad3 100644 --- a/docs/caveats/transport.md +++ b/docs/caveats/transport.md @@ -3,28 +3,6 @@ The HTTP and socket seams. What a client can do to them, and what a shutdown can do to us. -## Closing a TCP listener can strand Accept [#679] {#accept} - -Costs: during close, both `errc` and `done` are ready in `acceptLoop`'s select. -Go picks uniformly. So roughly one close in two leaves a waiting `Accept` -blocked forever on a TCP seam. Unix sockets are unaffected. -Revisit when: a daemon is seen hanging on shutdown, or before any new TCP -listener is added. -Workaround: the process usually exits anyway, which hides it. - -## PTT reads an unbounded body [#688] {#ptt} - -Costs: `handlePTT` does an unlimited `io.ReadAll`, and mavweb sets no header or -idle timeouts. A client can force unbounded allocation or hold a connection -open. mavgpud's half of this was fixed in V-673. -Revisit when: mavweb is reachable from anything but the tunnel. -Workaround: mavweb is not LAN-exposed today. - -`/ws` rides along with this entry. It never calls `SetReadLimit`, so the -dependency default of 32,768 bytes applies, about a second of audio. Nothing -reaches it: the browser posts PCM to `/api/ptt`, and only `handlers_test.go` -opens `/ws`. It gets a caller and a real limit, or it gets deleted. - ## mavweb errors cannot be traced [#689] {#errors} Costs: some handlers return the raw internal error, which discloses internals.