Status is a concurrency token, so the second SaveChanges of two simultaneous
CloseMotionAsync calls throws DbUpdateConcurrencyException. Reload and return,
with no second motion.closed audit event; the same pattern as the sealed closer.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Fails at this commit with DbUpdateConcurrencyException from CloseMotionAsync:
Motion.Status became a concurrency token in BifrostDbContext.cs:288.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Targets 55b74275 (#11 and #17 in main; #15 docs only). #11 signs everyone out
once. Lists the validator's required keys by name, NetworkTagSecret (32+
chars) as a hard startup failure, put into step 3. Rehearsal through
sudo -u postgres and one start on a separate env file, scratch connection
string, throwaway KeysPath and a port other than 5080; no dotnet ef. Backs up
the data-protection key ring. Uses the real log files with a baseline count.
Notes bifrost-watchdog-notice.timer.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Bifrost ships as a release directory switched by Idunn; nothing here pulls an
image, and the job would fail on every push to main.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A __Host- cookie is only removed by a Set-Cookie that is itself Secure. The
hardening test now checks Secure on every header, deletion included, and the
completion tests pin that success and refusal both clear the attempt cookie
with Secure, Path=/ and no Domain.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Preconditions, ordered steps, live check and rollback for moving live
67072b2 to main (141 commits, two additive EF migrations, new
Heimdall:AppSecret). Plan only; nothing deployed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A signed-in retract on a full account table must say busy with no sign-in offer (the
retract door passes its voter to Throttled), and a spent cast budget must say only
"too fast", for anonymous and signed-in voters alike. Both mutants survived Soul s4.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- answerInvites takes a fresh brake read after the long-poll
- readUpTo reads the brake when each receipt would post; held brake drops it, one log line
- the brake read and offline presence PUT precede the full-backlog early return
- a throwing logger cannot reject the unawaited receipt call
- tests: fake keeps the raw path and honours abort signals; the braked-round carve-out is offline presence PUTs only
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
An ack posts her public m.read per room at the newest covered event, fire and
forget (never awaited, failure logged once, no retry). syncOnce reads the brake
once per round, passes it to answerInvites, sends set_presence on /sync and one
presence PUT on a released-to-braked transition (first braked round included).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The room directory's gid must equal the Persona directory's, else store-failed (a setgid
directory in the wrong group would still give files the wrong group). A missing Persona
directory is refused rather than created; only the room directory is made. The stat is
injectable so the group case is testable where the sandbox cannot chown.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A chmod by bifrost, which is not in the Persona's group, clears the setgid bit, so files
would take bifrost's group and the Persona's reader could not open them. Directories and
files are now created with exact modes (fixed umask around mkdir and open), the room
directory must have inherited setgid from the installer's Persona directory or the image
is refused (store-failed), and the Persona directory is never chmodded. Adds behavioural
redirect-refused and fetch-timeout tests.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
m.image events in delivered messages are fetched as the receiving Persona,
classified by magic bytes, bounded by size and header pixel count, and stored
under IMAGE_STORE_ROOT/<persona>/<room hash>/<bytes hash>[.ext] (0640, dirs
2750). The delivery tuple gains index 11, nil or [path, mime, size, sha256];
the pending kind becomes gamecult.persona.chat_pending.v2 with Huginn's v3
golden bytes. Refusals keep the typed text line plus a fixed-word reason.
The mouth test homeserver is answered in-process so the suite runs under a
capped address space.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Session, OAuth correlation, antiforgery, voter and Heimdall attempt cookies all take the
__Host- prefix. The prefix forbids a narrower Path, so the voter (was /mill) and attempt
(was /auth/heimdall) cookies move to Path=/.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
REPORT.md E6 and results.md still held pre-fix numbers (half-cap 0.044/0.222, s max 0.953).
Regenerated with the current sim: s max 0.777; half-cap binding all four 0.000,
Patrons+Minds 0.008, Patrons alone 0.165. Weight is 0 only at amount <= unit/b (run.py,
REPORT.md, SPEC.md); the splitting table no longer prints a cliff "0 (below unit)". Test count 54.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
