docs: record the Proton Drive live verification results

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-12 13:53:13 +01:00
1 parent b440df2e1f
commit 29ad269444
@@ -6,15 +6,11 @@ Small, specific, independently actionable. Remove only when actually done.

 ## Now

- [ ] protondrive: the backend rewrite (plan 001) has Tasks 1-20 of 21
-  done. Start from `docs/plans/001-protondrive-tier1-HANDOFF.md`.
-  Remaining: Task 21 (live verification, paid account never signed in
-  to), then the whole-branch review.
- [ ] protondrive: Task 21 golden fixtures - the capture
-  (`TestGoldenCapture`) and `TestGoldenFixtures` are in; the live capture
-  of the web app and CLI folders into `testdata/golden/` is the owner's to
-  run, inspect and commit (command in
-  `.superpowers/sdd/001-protondrive-tier1/task-21g-report.md`).
+- [ ] protondrive: the backend rewrite (plan 001) has Tasks 1-21 done
+  as far as the test accounts allow (live results 2026-11-12 in the
+  handoff, section 6). Start from
+  `docs/plans/001-protondrive-tier1-HANDOFF.md`. Remaining: the
+  whole-branch review and its fix wave.

 ## Next

@@ -30,14 +26,19 @@ Small, specific, independently actionable. Remove only when actually done.
 - [ ] protondrive M7: the upstream path (spec 13), deferred by the owner;
  also the new crypto model once Proton publishes it in the SDK.
 - [ ] protondrive live checks not yet run (plan Task 21), each of which
-  the user docs avoid claiming: the paid account (never signed in to);
-  browser (session-fork) sign-in against the real service; 2FA, by code
-  and by `otp_secret_key`; CAPTCHA handling; Proton's desktop, mobile or
-  CLI clients reading files rclone wrote (only the web app has been
-  checked); `TestIntegration` (`fstests`) and `test_all` against the real
-  service; whether the real server lists drafts or trashed items as
+  the user docs avoid claiming: 2FA, by code and by `otp_secret_key`;
+  CAPTCHA handling; Proton's desktop and mobile clients reading files
+  rclone wrote (the web app and the official CLI 0.9.0 have been
+  checked); whether the real server lists drafts or trashed items as
  children (affects `Rmdir`); whether any real address differs from
-  another of the account only by non-ASCII case (counted as foreign).
+  another of the account only by non-ASCII case (counted as foreign);
+  how long the server's read-after-write lag after a commit really is
+  (the client retries for about 7 s).
+- [ ] protondrive: `test_all` against the real service (2026-11-12,
+  free account) fails only the five cross-`Fs` cache tests listed
+  below; `fstest/test_all/config.yaml`'s `TestProtonDrive:` entry has no
+  `ignore` for them, so plan Task 21's "clean with no ignore entries" is
+  not met until that is decided.
 - [ ] protondrive: `docs/content/protondrive.md`'s generated options
  section still shows the old options and help texts; regenerate it with
  `make backenddocs` when the work goes upstream (generated doc changes
@@ -49,8 +50,9 @@ Small, specific, independently actionable. Remove only when actually done.
  holds but not the bytes (about 250-350 MiB at the cap with realistic
  values, unbounded against a hostile server). Consider a limit on API
  response bodies and on those fields.
- [ ] protondrive: in live verification (plan Task 21), confirm on an
-  account whose drive was made by Proton's own apps that the
+- [ ] protondrive: confirm on an account whose drive was made by
+  Proton's own apps (both test accounts' drives were most likely created
+  by rclone itself) that the
  root-of-trust rule passes (the My Files share created, and its root
  signed, by one of the account's addresses), and count how many folders
  fail key verification.
@@ -101,8 +103,9 @@ Small, specific, independently actionable. Remove only when actually done.
  other in-flight blocks, which finish or fail soon) before it notices.
  Consider a context-aware `Get`.

- [ ] protondrive: confirm on a real account that the official web, desktop
-  and mobile clients read a file written by Task 5's `crypto.go` (v4 node key
+- [ ] protondrive: confirm that Proton's desktop and mobile clients read
+  a file written by Task 5's `crypto.go` (the web app and the official CLI
+  0.9.0 do, with signatures verified, as of 2026-11-12) (v4 node key
  advertising SEIPDv2, v6 PKESK content key, SEIPDv2 GCM blocks, block
  signatures encrypted with the content session key). This is what the SDK
  (js/v0.23.0) writes, but go-proton-api v1.0.4 `link_file_types.go`
@@ -53,7 +53,7 @@ pause. Last code commit: `9c90998f7`. Plan base (for a whole-branch diff):
 | Tasks | State |
 |---|---|
 | 1-20 | Implemented, each independently reviewed, all findings of Critical or Important severity fixed and re-reviewed |
-| 21 | Not started (resumed 2026-11-12; see the ledger for current state) |
+| 21 | Done as far as the test accounts allow (2026-11-12); whole-branch review next |
 | Final whole-branch review | Not run |

 What exists now:
@@ -305,7 +305,7 @@ Machine-local, not in the repository. A new machine needs them recreated.
  `hello.txt` with two revisions, and `my-little-folder/Readme.txt` made by
  the owner in Proton's web app). Leave it: it is the interop evidence.

-## 6. What has been proven live (free account)
+## 6. What has been proven live

 - Password (SRP) sign-in with the new code; a fresh account's Drive volume
  is created by the client.
@@ -321,11 +321,36 @@ Machine-local, not in the repository. A new machine needs them recreated.
  revision, server-side `moveto` and `copyto`, `sync` back byte-identical,
  `rmdir` of a non-empty folder refused, `purge`.

-Not yet proven: the paid account; browser (session-fork) sign-in against
-the real service; 2FA; the official CLI or desktop clients reading rclone's
-files; `fstests`/`test_all` against the real service; whether the real
-server lists drafts or trashed items as children (affects `Rmdir`); the
-items marked "confirm on a real account" in `docs/TODO.md`.
+Proven on 2026-11-12 (binaries at `502a32b5f` and `b440df2e1`):
+
+- `TestIntegration` (`fstests`) against `TestProtonDrive:`: 98 pass,
+  29 skipped by the suite's feature checks, 0 fail.
+- `test_all -n 1` against the real service: only the five cross-`Fs`
+  cache tests fail (owner question 5); `fs/operations`, `fs/sync` and
+  `vfs` otherwise pass. The first run found two real bugs (read-after-
+  write lag after a commit), fixed in `af6fdd789` and `be0053607`, and
+  the re-run confirmed the fix.
+- Browser (session-fork) sign-in with `rclone config create` against the
+  real service, then listing, a verified read and `config disconnect`.
+- The paid account: first password sign-in, `about` (64 GiB), mkdir and
+  rmdir. Its drive was most likely created by rclone at that moment.
+- Interop with Proton's official CLI 0.9.0 (run in Docker, signed in to
+  the free account): each reads, verifies and modifies what the other
+  wrote, both ways, including multi-block, empty and Unicode-named files.
+- Upgrade/downgrade with released rclone v1.76.0: each reads what the
+  other wrote, byte-identical.
+- Re-keyed fixtures of files written by the web app and the CLI are in
+  `backend/protondrive/testdata/golden/` (`TestGoldenFixtures`).
+
+Still not proven: 2FA; CAPTCHA; Proton's desktop and mobile clients; the
+root-of-trust rule on a drive made by Proton's own apps; the items marked
+"confirm" in `docs/TODO.md`.
+
+Folders on the free account to leave in place (interop evidence):
+`rclone-live-probe-20261111-130916`, `rclone-interop-20261112`,
+`rclone-golden-cli-20261112`. The official CLI's session lives in the
+Docker volume `pdcli-free` (image `proton-drive-cli:0.9.0`, built from the
+checksum-verified release binary).

 The security changes made after `c00162ed2` were re-checked live on the
 free account without `ignore_signature_errors`: at `e7e43095d` (root of
@@ -1359,7 +1359,7 @@ committed. If the remote is absent (`rclone listremotes` lacks
 `TestProtonDrive:`), **do not attempt this task**: leave every box
 unticked and report it as not run.

- [ ] `go test -v ./backend/protondrive/ -run '^TestIntegration$' -remote TestProtonDrive:`
+- [x] `go test -v ./backend/protondrive/ -run '^TestIntegration$' -remote TestProtonDrive:`
 - [ ] `go run ./fstest/test_all -backends protondrive -remotes TestProtonDrive: -n 1`
  clean with no `ignore:` entries.
 - [x] Capture golden fixtures from the account (nodes created by the web
@@ -1367,7 +1367,7 @@ unticked and report it as not run.
  `-capture` test flag, and add `TestGoldenFixtures`.
 - [x] Interop both ways with the official CLI and the web app (spec 9.7).
 - [x] Upgrade/downgrade check against released rclone v1.76.
- [ ] Record results in `docs/TODO.md`; only then is spec criterion 12
+- [x] Record results in `docs/TODO.md`; only then is spec criterion 12
  (items 3, 6, 7) met.

 ---