mathias

mathias opened issue mathias/tapir#56

2026-10-03 19:13:11 +00:00

Slow-drip upload body holds a receive slot without a time bound

mathias pushed to sprint/audio-followups at mathias/tapir

2026-10-03 19:13:08 +00:00

4ef446548d docs(adr): spool arithmetic and the unbounded slow-drip limitation for the receive cap (#47)

145949875e fix(audio): keep a bounded head of ffmpeg's output instead of buffering all of it (#49)

82aeac7c19 fix(store): FailUpload only fails a queued or transcribing upload (review of #55)

1b4747ed03 test: FailUpload must not overwrite a finished upload; ffmpeg stderr is bounded, red (review of #55)

9939afb90c test: pin the production receive limits, split the vacuous drain test, harden the lint-gate test (review of #55)

Compare 5 commits »

mathias created pull request mathias/tapir#55

2026-10-03 19:01:07 +00:00

v0.31.1: cross-origin POST protection, ffprobe/ffmpeg limits, receive cap, SIGTERM, lint gate (#41 #47 #48 #49 #50)

mathias pushed to sprint/audio-followups at mathias/tapir

2026-10-03 19:01:00 +00:00

3e69c00a64 docs(adr): ADR-033 amended for SIGTERM handling and the recorded deploy limitation (#50, #47)

253aa567aa fix(serve): handle SIGTERM and wait for in-flight requests and the worker before exiting (#50)

5644dc3fc8 fix(uploads): record a job interrupted by shutdown at once, on its own short context (#50)

7df1de6628 test(serve): shutdown waits for in-flight requests and the worker, bounded (#50), red

7e920102f6 test: SIGTERM cancels the process context; a shutdown mid-job records the row interrupted at once (#50), red

Compare 10 commits »

mathias created branch sprint/audio-followups in mathias/tapir

2026-10-03 19:01:00 +00:00

mathias commented on issue mathias/tapir#47

2026-10-03 18:50:47 +00:00

Audio upload: cap concurrent uploads in flight, and give ffprobe its own deadline (found reviewing the production enablement, infra#520)

Sprint triage (phase 1). Item 2 (ffprobe deadline) moved to #49 (it also covers the memory finding). Item 3 (deploy kills a job) reduced to #50: the process handles SIGINT only, so SIGTERM on…

mathias commented on issue mathias/tapir#46

2026-10-03 18:50:46 +00:00

Audio upload hardening follow-ups the first adversarial review could not verify or did not fix

Sprint triage (phase 1). Split out: item 2 (ffprobe memory) -> #49; items 4+5 (tracker hung save, clock) -> #51; item 6 (LLM unbounded read) -> #53; cross-origin POST (found while checking item 3)…

mathias opened issue mathias/tapir#54

2026-10-03 18:50:39 +00:00

Sprint: audio upload follow-ups (v0.31.1 hotfix, then v0.32.0)

mathias pushed to main at mathias/tapir

2026-10-03 18:50:35 +00:00

24d65b2085 docs(sprint): audio upload follow-ups sweep sprint plan, oath and decision list

mathias opened issue mathias/tapir#53

2026-10-03 18:48:25 +00:00

LLM client reads an unbounded response body before checking the status

mathias opened issue mathias/tapir#52

2026-10-03 18:48:22 +00:00

Say when a recording's audio went to the cloud: label the serving endpoint, and document that an empty transcript also triggers the fallback

mathias opened issue mathias/tapir#51

2026-10-03 18:48:19 +00:00

Progress tracker: a hung database save blocks reporting, and the heartbeat uses a different clock from the page

mathias opened issue mathias/tapir#50

2026-10-03 18:48:14 +00:00

SIGTERM is not handled: every deploy kills the process without draining or failing the running row (interim fix; the full drain is recorded as a limitation)

mathias opened issue mathias/tapir#49

2026-10-03 18:48:06 +00:00

ffprobe/ffmpeg resource limits: a 900-stream file costs about 570 MB against the 512 Mi pod limit; no probe deadline; unbounded probe output

mathias opened issue mathias/tapir#48

2026-10-03 18:47:59 +00:00

Security: refuse cross-origin POSTs; POST /account/delete is forgeable from a sibling *.d-ma.be origin

mathias commented on pull request mathias/hyperguild#161

2026-10-03 16:39:32 +00:00

fix(search): walk and read the brain through an os.Root (#157, slice 1)

Gatekeeper verdict, round 3: PASS (head fd33e04)

Only search/brainroot_test.go changed since ffe46c7, so the round-2 probes of the production code stand: every symlink case returns 0,…

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:39:32 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

Gatekeeper round 3 on PR #161 (slice 1, head fd33e04): PASS. Evidence is on the PR. Not merged, verdict only.

The readOpened bypass is now caught 10/10. No flakiness (140 runs, plus -race).…

mathias commented on pull request mathias/hyperguild#160

2026-10-03 16:33:17 +00:00

feat(ingestion): runtime symlink tripwire removes what it finds, 30s scans (#157)

pr-gatekeeper verdict, round 3: PASS (PR #160 @ 4ba9d20). Not merged.

This is a verdict only. The PR is risk/high and CD deploys on merge, so the merge is Mathias's call.

Round-2…

mathias commented on issue mathias/hyperguild#157

2026-10-03 16:33:17 +00:00

SECURITY: symlinks anywhere in the Syncthing-shared brain dir are followed by search, vectorstore, context and graph readers

pr-gatekeeper verdict, round 3: PASS (PR #160 @ 4ba9d20). Not merged.

This is a verdict only. The PR is risk/high and CD deploys on merge, so the merge is Mathias's call.

Round-2…

mathias opened issue mathias/hyperguild#164

2026-10-03 16:33:02 +00:00

symlinkguard: a hung ntfy delays symlink removal (alert flush runs in the scan goroutine)