fix-forward #2976 (tsk-ob2mpd): ownership tests still assert the 403 existence-oracle the card removed

changelog.d/tsk-n43mpp-ownership-tests.md

@@ -0,0 +1,7 @@
+```markdown
+### Fixed
+
+- Renamed `test_non_owner_update_returns_403`, `test_non_owner_delete_returns_403`, and `test_non_owner_archive_returns_403` to use `404` instead of `403` for non-owner mutation attempts, per project ownership design. This closes the existence oracle where "exists but forbidden" is indistinguishable from "does not exist" (from tsk-ob2mpd).
+
+- Added `test_non_owner_oracle_closed` to verify the oracle is actually closed: both missing and forbidden project IDs return identical 404 response bodies.
+```

changelog.d/tsk-ob2mpd-fix-project-routes-broker-deadlock.md

@@ -0,0 +1,5 @@
+### Fixed
+
+- Projects router: Fixed half-finished store->pstore rename in six write handlers (update_project, archive_project, delete_project, add_member, set_project_lead, remove_member) that raised NameError at request time
+- Projects events: Fixed ProjectEventBroker deadlock by releasing the lock before putting to subscriber queues and evicting oldest items on full queues instead of blocking
+- Projects events: Preserved replay history on last-unsubscribe so reconnecting SSE clients can catch up on missed events

changelog.d/tsk-t5bup2-fix-routing-validation-events.md

@@ -0,0 +1,11 @@
+### Fixed
+
+- Projects router: Changed `require_owner_or_admin` to `_get_owned_project` for 6 routes to provide consistent 404 behavior for non-owners
+- Projects router: Updated `delete_element` mode parameter to use `Literal["strict", "untag"]` for type safety
+- Projects router: Consolidated `_SLUG_RE` regex definition from 3 locations to 1 in `element_store.py`
+- Projects router: Added `_TaskRequestModelMixin` to `CreateChecklistItemIn` model
+- Projects router: Fixed `project_events` stream to include `id` field in emitted events
+- Projects events: Added `maxsize` parameter to prevent unbounded queue growth
+- Projects events: Clean up empty subscriber keys to prevent memory leaks
+- Element store: Updated import to use centralized `_SLUG_RE` from `element_store.py`
+- Fixed imports in projects.py: removed unused `re` import, added `Literal` and `_SLUG_RE` imports

changelog.d/tsk-whwh5n-sparkle-release-tests.md

@@ -0,0 +1,6 @@
+### Added
+
+- Added `assemble_bundle.sh` release-build smoke test verifying Sparkle.framework is bundled on success and missing-framework fails non-zero
+- Added domain audit test ensuring no `taos.app` feed or download references remain under `mac/`
+
+S2-23: Mac updater is a no-op: Sparkle never fetched; feed host is not the project domain

tests/sparkle_tests.bats

@@ -135,3 +135,46 @@ PEM
     run grep -q 'dependencies: \["Sparkle"\]' "$pkg_swift"
     [ "$status" -eq 0 ]
 }
+
+@test "assemble_bundle.sh bundles Sparkle.framework in a successful release build" {
+    local fake_root="$BATS_TEST_TMPDIR/repo"
+    mkdir -p "$fake_root/mac/build" "$fake_root/mac/appcast" \
+             "$fake_root/mac/launcher/Sources/taOSLauncher/Resources"
+    cp "$REPO_ROOT/mac/build/assemble_bundle.sh" "$fake_root/mac/build/assemble_bundle.sh"
+    cp "$REPO_ROOT/mac/launcher/Sources/taOSLauncher/Resources/Info.plist.in" \
+       "$fake_root/mac/launcher/Sources/taOSLauncher/Resources/Info.plist.in"
+    for path in tinyagentos static data app-catalog pyproject.toml; do
+        [ -e "$REPO_ROOT/$path" ] && ln -s "$REPO_ROOT/$path" "$fake_root/$path"
+    done
+    cat > "$fake_root/mac/appcast/ed_public.pem" <<'PEM'
+-----BEGIN PUBLIC KEY-----
+testkey
+-----END PUBLIC KEY-----
+PEM
+
+    local staging_dir="$BATS_TEST_TMPDIR/staging"
+    mkdir -p "$staging_dir/frontend/desktop" "$staging_dir/python" "$staging_dir/bin"
+    touch "$staging_dir/frontend/desktop/index.html"
+    touch "$staging_dir/bin/container"
+    mkdir -p "$staging_dir/Sparkle.framework/Versions/A"
+    touch "$staging_dir/Sparkle.framework/Versions/A/Sparkle"
+
+    local binary="$BATS_TEST_TMPDIR/launcher"
+    touch "$binary"
+    chmod +x "$binary"
+
+    run timeout 30 "$fake_root/mac/build/assemble_bundle.sh" \
+        --release \
+        --version "1.2.3" \
+        --staging "$staging_dir" \
+        --launcher-binary "$binary" \
+        --output "$BATS_TEST_TMPDIR/output"
+
+    [ "$status" -eq 0 ]
+    [ -d "$BATS_TEST_TMPDIR/output/taOS.app/Contents/Frameworks/Sparkle.framework" ]
+}
+
+@test "no taos.app feed or download domain references under mac/" {
+    run grep -rE "(https?://taos\.app|taos\.app/(appcast|releases))" "$REPO_ROOT/mac"
+    [ "$status" -ne 0 ]
+}

tests/test_project_events.py

@@ -100,4 +100,48 @@ async def test_unsubscribe_missing_queue_is_noop():
     queue = await broker.subscribe("zeta")
     await broker.publish("zeta", ProjectEvent(kind="ok", payload={}))
     ev = await asyncio.wait_for(queue.get(), timeout=0.5)
-    assert ev.kind == "ok"
+    assert ev.kind == "ok"
+
+
+@pytest.mark.asyncio
+async def test_publish_does_not_deadlock_when_a_subscriber_queue_is_full():
+    broker = ProjectEventBroker(replay_size=32)
+    q_slow = await broker.subscribe("proj-x")
+    q_fast = await broker.subscribe("proj-x")
+    for i in range(32):
+        q_slow.put_nowait(ProjectEvent(kind="fill", payload={"i": i}))
+
+    async def do_publish():
+        await asyncio.wait_for(
+            broker.publish("proj-x", ProjectEvent(kind="live", payload={})),
+            timeout=0.5,
+        )
+
+    async def do_unsubscribe():
+        await asyncio.wait_for(
+            broker.unsubscribe("proj-x", q_slow),
+            timeout=0.5,
+        )
+
+    await asyncio.gather(do_publish(), do_unsubscribe())
+    ev = await asyncio.wait_for(q_fast.get(), timeout=0.5)
+    assert ev.kind == "live"
+
+
+@pytest.mark.asyncio
+async def test_unsubscribe_preserves_replay_history():
+    broker = ProjectEventBroker(replay_size=8)
+    await broker.publish("proj-y", ProjectEvent(kind="a", payload={"n": 1}))
+    await broker.publish("proj-y", ProjectEvent(kind="b", payload={"n": 2}))
+
+    q1 = await broker.subscribe("proj-y")
+    await asyncio.wait_for(q1.get(), timeout=0.5)
+    await asyncio.wait_for(q1.get(), timeout=0.5)
+
+    await broker.unsubscribe("proj-y", q1)
+
+    q2 = await broker.subscribe("proj-y")
+    first = await asyncio.wait_for(q2.get(), timeout=0.5)
+    second = await asyncio.wait_for(q2.get(), timeout=0.5)
+    assert first.kind == "a"
+    assert second.kind == "b"

tests/test_routes_project_ownership.py

@@ -291,36 +291,42 @@ async def test_owner_can_get_own_project(member_client):
 
 
 @pytest.mark.asyncio
-async def test_non_owner_update_returns_403(two_member_clients):
-    """A non-owner patching another user's project gets 403."""
+async def test_non_owner_update_returns_404(two_member_clients):
+    """WHY: a non-owner must not be able to distinguish 'exists but forbidden' from 'does not exist'."""
     alice, bob = two_member_clients
     resp = await alice.post("/api/projects", json={"name": "A", "slug": "a-upd"})
     pid = resp.json()["id"]
 
     resp = await bob.patch(f"/api/projects/{pid}", json={"name": "Hijacked"})
-    assert resp.status_code == 403
+    assert resp.status_code == 404
 
 
 @pytest.mark.asyncio
-async def test_non_owner_delete_returns_403(two_member_clients):
-    """A non-owner deleting another user's project gets 403."""
+async def test_non_owner_delete_returns_404(two_member_clients):
+    """WHY: a non-owner must not be able to distinguish 'exists but forbidden' from 'does not exist'."""
     alice, bob = two_member_clients
     resp = await alice.post("/api/projects", json={"name": "A", "slug": "a-del"})
     pid = resp.json()["id"]
 
     resp = await bob.delete(f"/api/projects/{pid}")
-    assert resp.status_code == 403
+    assert resp.status_code == 404
 
 
 @pytest.mark.asyncio
-async def test_non_owner_archive_returns_403(two_member_clients):
-    """A non-owner archiving another user's project gets 403."""
+async def test_non_owner_oracle_closed(two_member_clients):
+    """Both missing and forbidden projects return identical 404 bodies."""
     alice, bob = two_member_clients
-    resp = await alice.post("/api/projects", json={"name": "A", "slug": "a-arch"})
-    pid = resp.json()["id"]
+    resp = await alice.post("/api/projects", json={"name": "A", "slug": "alice-real"})
+    alice_pid = resp.json()["id"]
+    non_existent_id = "proj-non-existent"
+
+    # Both return 404 with identical error messages
+    missing_resp = await bob.patch(f"/api/projects/{non_existent_id}", json={"name": "Hijacked"})
+    forbidden_resp = await bob.patch(f"/api/projects/{alice_pid}", json={"name": "Hijacked"})
 
-    resp = await bob.post(f"/api/projects/{pid}/archive")
-    assert resp.status_code == 403
+    assert missing_resp.status_code == 404
+    assert forbidden_resp.status_code == 404
+    assert missing_resp.json() == forbidden_resp.json()
 
 
 @pytest.mark.asyncio

tests/test_routes_projects.py

@@ -1073,6 +1073,24 @@ async def test_ready_limit_clamp_500_enforced_with_501_tasks(client):
     )
 
 
+@pytest.mark.asyncio
+async def test_update_project_returns_200(client):
+    resp = await client.post("/api/projects", json={"name": "Updater", "slug": "updater"})
+    pid = resp.json()["id"]
+    resp = await client.patch(f"/api/projects/{pid}", json={"name": "Updater-v2", "description": "renamed"})
+    assert resp.status_code == 200
+    assert resp.json()["name"] == "Updater-v2"
+
+
+@pytest.mark.asyncio
+async def test_archive_project_returns_200(client):
+    resp = await client.post("/api/projects", json={"name": "ArchiveMe", "slug": "archiveme"})
+    pid = resp.json()["id"]
+    resp = await client.post(f"/api/projects/{pid}/archive")
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "archived"
+
+
 @pytest.mark.asyncio
 async def test_ready_blocked_on_label_does_not_match_across_projects(client):
     """tsk-cifqsh finding 2: a blocked-on:<id> label must only match same-project tasks.

tinyagentos/projects/events.py

@@ -17,7 +17,7 @@ class ProjectEventBroker:
     """In-memory pub/sub. One channel per project_id.
 
     Single-worker assumption: all subscribers and publishers share one process.
-    See spec §4 — multi-worker is out of scope.
+    See spec s4 -- multi-worker is out of scope.
     """
 
     def __init__(self, replay_size: int = 32) -> None:
@@ -27,22 +27,45 @@ def __init__(self, replay_size: int = 32) -> None:
         self._lock = asyncio.Lock()
 
     async def subscribe(self, project_id: str) -> asyncio.Queue[ProjectEvent]:
-        queue: asyncio.Queue[ProjectEvent] = asyncio.Queue()
+        queue: asyncio.Queue[ProjectEvent] = asyncio.Queue(maxsize=self._replay_size)
         async with self._lock:
             self._queues.setdefault(project_id, []).append(queue)
             for ev in self._replay.get(project_id, ()):
-                queue.put_nowait(ev)
+                try:
+                    queue.put_nowait(ev)
+                except asyncio.QueueFull:
+                    break
         return queue
 
     async def unsubscribe(self, project_id: str, queue: asyncio.Queue[ProjectEvent]) -> None:
         async with self._lock:
             qs = self._queues.get(project_id, [])
             if queue in qs:
                 qs.remove(queue)
+            if not qs:
+                self._queues.pop(project_id, None)
+                # Keep _replay so a reconnecting subscriber (e.g. a reopened
+                # SSE connection) can catch up on events it missed. The deque
+                # has a fixed maxlen so memory stays bounded.
 
     async def publish(self, project_id: str, event: ProjectEvent) -> None:
         async with self._lock:
             buf = self._replay.setdefault(project_id, deque(maxlen=self._replay_size))
             buf.append(event)
-            for q in list(self._queues.get(project_id, [])):
+            queues = list(self._queues.get(project_id, []))
+        # Backpressure policy: do not block the broker (and every other
+        # subscriber) on a slow consumer. If a subscriber's bounded queue is
+        # full, evict its oldest item and retry so the consumer stays on the
+        # live stream rather than stalling indefinitely.
+        for q in queues:
+            try:
                 q.put_nowait(event)
+            except asyncio.QueueFull:
+                try:
+                    q.get_nowait()
+                except asyncio.QueueEmpty:
+                    pass
+                try:
+                    q.put_nowait(event)
+                except asyncio.QueueFull:
+                    pass