Joseph Spiker spikerj
  • Joined on 2025-11-03
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 04:38:09 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

PR #118 up — starts failure mode #2 (in-place element mutation) with a verified slice: a new JsonListValueComparer<T> (JSON deep-clone snapshot + structural JSON equality) applied to…

spikerj commented on issue spikerj/spikersoft-issues#401 2026-07-06 04:12:26 +00:00
[Security][CRITICAL] SignalR hubs missing class-level [Authorize] — CodeExecutionHub / DashboardHub / ClusterHub open to anonymous connections

PRs #116 and #117 merged to master. CodeExecutionHub, ChatHub now class-level [Authorize]; PreRegistrationHub explicitly [AllowAnonymous]. Combined with DashboardHub/ClusterHub (item 1),…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 04:12:22 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

PR #115 merged to master — all 19 count-only List<T> comparers now use SequenceEqual, closing the element-replacement data loss (failure mode #1), verified against the real built…

spikerj commented on issue spikerj/spikersoft-issues#408 2026-07-06 04:10:29 +00:00
[Safety][Compliance][Go-live] Make fail-open safety gates fail closed (SMS/TCPA, ClamAV, passport PII)

Triage — located each gate; one is a ready config flip, the others need pointers

1. ClamAV malware scan — CONFIRMED fail-open in prod, and it's a config decision (not a code bug). The…

spikerj commented on issue spikerj/spikersoft-issues#401 2026-07-06 04:01:03 +00:00
[Security][CRITICAL] SignalR hubs missing class-level [Authorize] — CodeExecutionHub / DashboardHub / ClusterHub open to anonymous connections

Status — critical hubs now covered by two PRs

  • PR #116CodeExecutionHub → class-level [Authorize] (plain; students reach their own sessions).
  • PR #117ChatHub →…
spikerj closed issue spikerj/spikersoft-issues#424 2026-07-06 03:51:44 +00:00
[i18n tooling] i18n:scan always exits 1 on a honeypot false-positive → tool can't surface new hardcoded strings
spikerj commented on issue spikerj/spikersoft-issues#424 2026-07-06 03:51:43 +00:00
[i18n tooling] i18n:scan always exits 1 on a honeypot false-positive → tool can't surface new hardcoded strings

Already resolved on master (verified off origin/master @ 365320c) — no PR needed.

The recommended "best" option (3, inline ignore marker) is fully in place:

  • The scanner supports it —…
spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 03:39:26 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

PR #115 up — implements the primary fix from the spec above: all 19 count-only List<T> comparers → SequenceEqual (turns out there were 19, not 13 — the earlier count was head-truncat…

spikerj commented on issue spikerj/spikersoft-issues#432 2026-07-06 03:30:23 +00:00
art_pipe: repo-vendoring model venvs miss cloned-repo requirements + need Python 3.10

Update — getting TripoSG (modeling) actually running end-to-end on a cu128 host surfaced two more venv_setup bugs beyond the missing cloned-repo requirements.txt. Fixed in **spikersoft-artpi…

spikerj closed issue spikerj/spikersoft-issues#435 2026-07-06 03:27:34 +00:00
[Reliability] KeycloakAdminService.GetRoleMembersAsync news a per-call HttpClient (leak + inconsistent with the rest of the class)
spikerj commented on issue spikerj/spikersoft-issues#435 2026-07-06 03:27:33 +00:00
[Reliability] KeycloakAdminService.GetRoleMembersAsync news a per-call HttpClient (leak + inconsistent with the rest of the class)

Resolved in spikersoft-backend PR #114 (merged to master). GetRoleMembersAsync now uses the injected HttpClient with a per-request Authorization header, matching every sibling method — no…

spikerj closed issue spikerj/spikersoft-issues#434 2026-07-06 03:27:30 +00:00
[Reliability] Scheduler TaskRunners create a new HttpClient per execution (socket exhaustion — use IHttpClientFactory)
spikerj commented on issue spikerj/spikersoft-issues#434 2026-07-06 03:27:29 +00:00
[Reliability] Scheduler TaskRunners create a new HttpClient per execution (socket exhaustion — use IHttpClientFactory)

Resolved in spikersoft-backend PR #113 (merged to master). Registered IHttpClientFactory in the Scheduler host and switched HttpCallbackTaskRunner + GeoIpUpdateTaskRunner to `CreateClient()…

spikerj commented on issue spikerj/spikersoft-issues#410 2026-07-06 03:23:37 +00:00
[Reliability][Go-live] Fix silent data loss — count-only ValueComparer & missing publisher confirms

Precise diagnosis + implementation spec (after reading every comparer)

Exact inventory in SpikerSoft.Data/Contexts/SpikerDbContext.cs:

  • Count-only Equals (the bug) — 13 sites:
spikerj opened issue spikerj/spikersoft-issues#435 2026-07-06 03:18:28 +00:00
[Reliability] KeycloakAdminService.GetRoleMembersAsync news a per-call HttpClient (leak + inconsistent with the rest of the class)
spikerj commented on issue spikerj/spikersoft-issues#433 2026-07-06 03:15:31 +00:00
[Reliability] MongoDB_HealthCheck constructs a new MongoClient on every invocation (connection-pool leak)

Resolved in spikersoft-backend PR #112 (merged to master). MongoDB_HealthCheck now takes the DI-registered singleton IMongoClient and uses it for the ping/settings instead of `new MongoClient…

spikerj opened issue spikerj/spikersoft-issues#434 2026-07-06 03:11:07 +00:00
[Reliability] Scheduler TaskRunners create a new HttpClient per execution (socket exhaustion — use IHttpClientFactory)
spikerj commented on issue spikerj/spikersoft-issues#411 2026-07-06 03:08:41 +00:00
[Reliability][Go-live] Eliminate availability bombs — Redis scans/flush, MongoClient-per-message, GPU ledger, poison requeue

Progress: the MongoClient-per-message bomb is now merged (PR #111 → master, GamePersistenceService reuses the singleton IMongoClient). A related per-invocation MongoClient leak in…

spikerj opened issue spikerj/spikersoft-issues#433 2026-07-06 03:05:46 +00:00
[Reliability] MongoDB_HealthCheck constructs a new MongoClient on every invocation (connection-pool leak)
spikerj closed issue spikerj/spikersoft-issues#416 2026-07-06 03:04:22 +00:00
[Security] Remove anonymous access to Trails mutating endpoints (DELETE /{id}, DELETE /purge)