claude
c0f4074a5d
Nineteen of the twenty findings were open, and they lived in an untracked audit.md at the repo root that no next session would have read. The one that is closed, the unauthenticated mavgpud proxy, went out as V-673. The report is now a frozen measurement under docs/evals/, dated and never edited again — including when a finding it names gets fixed. The live state moved to docs/caveats/, one entry per limit, each carrying its Vikunja id and the condition that makes it worth fixing. A caveat with no revisit trigger is a complaint, so every entry has one. Closing a limit deletes its entry rather than editing the measurement that found it. Two directory indexes come with it. docs/CLAUDE.md states the tier rule the repo already followed by convention: living docs corrected in place, evals frozen by date, caveats deleted when fixed. docs/caveats/CLAUDE.md indexes the nineteen by claim and severity, because an index of filenames adds nothing a directory listing does not. Tasks V-675 through V-693 carry the plans. The doc line and the tracker now join in both directions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz
1.5 KiB
Transport
The HTTP and socket seams. What a client can do to them, and what a shutdown can do to us.
Closing a TCP listener can strand Accept [#679]
Costs: during close, both errc and done are ready in acceptLoop's select.
Go picks uniformly. So roughly one close in two leaves a waiting Accept
blocked forever on a TCP seam. Unix sockets are unaffected.
Revisit when: a daemon is seen hanging on shutdown, or before any new TCP
listener is added.
Workaround: the process usually exits anyway, which hides it.
PTT reads an unbounded body [#688]
Costs: handlePTT does an unlimited io.ReadAll, and mavweb sets no header or
idle timeouts. A client can force unbounded allocation or hold a connection
open. mavgpud's half of this was fixed in V-673.
Revisit when: mavweb is reachable from anything but the tunnel.
Workaround: mavweb is not LAN-exposed today.
/ws rides along with this entry. It never calls SetReadLimit, so the
dependency default of 32,768 bytes applies, about a second of audio. Nothing
reaches it: the browser posts PCM to /api/ptt, and only handlers_test.go
opens /ws. It gets a caller and a real limit, or it gets deleted.
mavweb errors cannot be traced [#689]
Costs: some handlers return the raw internal error, which discloses internals. Others return a generic one with no identifier, which cannot be joined to its log line. There is no request-id middleware to join them. Revisit when: a reported UI failure cannot be found in the log. Workaround: read the log by timestamp.