== A. secret handling == PASS the test secret is usable PASS the minimum secret length is at least 32 bytes PASS a MISSING secret reports missing PASS an EMPTY secret reports missing PASS a 31-byte secret reports too_short PASS a 32-byte secret is accepted PASS minting with NO secret fails closed (unavailable) PASS minting with a TOO-SHORT secret fails closed (unavailable) PASS verifying with NO secret fails closed (unavailable, never "valid") PASS the secret never appears in a minted reference or URL PASS the secret never appears in a failure message PASS no Event Link file ever logs or echoes the secret PASS the secret is read from CALEE_EVENT_LINK_SECRET and nowhere else PASS Event Links never read CALEE_CALENDAR_INTENT_SECRET PASS the Event Link machinery never calls calendar_intent_create()/secret()/verify() PASS the /e/ page mints no calendar intent token at all PASS the /e/ page does not even load the calendar-intent library PASS the /e/ page offers no /follow handoff of its own PASS the /e/ page's calendar CTA carries only the verified reference PASS an intent secret alone does NOT enable Event Links PASS the existing calendar intent token still mints and verifies independently == B. canonical serialization == PASS a NON-recurring payload is exactly {"b","t","u"} in that order PASS a RECURRING payload is exactly {"b","t","u","o"} in that order PASS a non-recurring payload OMITS "o" entirely PASS a non-recurring payload never emits "o":null PASS key order is fixed by construction, not by argument order PASS a re-ordered input array still serialises b,t,u,o PASS JSON_UNESCAPED_SLASHES keeps "/" literal in the payload PASS JSON_UNESCAPED_UNICODE keeps non-ASCII literal in the payload PASS the payload carries no "exp" field PASS the payload carries no "iat" field PASS the payload carries no "nbf" field PASS the payload carries no "ttl" field PASS the payload carries no "nonce" field PASS the payload carries no "kind" field PASS the payload carries no "source" field PASS the payload carries no "v" field PASS the payload has EXACTLY the four permitted keys and nothing else PASS the Event Link library never calls time()/date()/random/uniqid PASS the mint endpoint never calls time()/date()/random/uniqid == C. deterministic signing == PASS the same identity mints a byte-identical URL 100 times PASS a separate process (different clock instant, different TZ) mints the same URL PASS a different BASE yields a different URL PASS a different TOKEN yields a different URL PASS a different UID yields a different URL PASS a recurring URL differs from the non-recurring URL for the same UID PASS a different OCCURRENCE yields a different URL PASS boundary/inner whitespace and case keep UIDs distinct PASS a leading-space UID survives into the payload untouched PASS the literal UID "0" is accepted (never treated as falsy or numeric) PASS a numeric-looking UID is not reinterpreted PASS the canonical public ICS URL resolves back to the same base + token PASS base+token input and the equivalent ICS URL mint the SAME Event Link URL PASS an absent occurrenceId and an explicit null normalise to the same URL PASS an EMPTY-STRING occurrence id is refused, not treated as absent PASS the reference format is 1.. PASS the canonical URL is built from the configured public origin PASS no Event Link file reads a host-bearing request header PASS the only $_SERVER keys the Event Link entrypoints read are method/content-type/content-length PASS the signature is HMAC-SHA256 over "1." . payloadBase64url PASS signing the payload WITHOUT the version prefix would not match PASS the signature is 32 raw bytes (256-bit) PASS base64url output is unpadded == D. verification / tamper handling == PASS a genuine reference verifies to its exact identity PASS a genuine NON-recurring reference verifies with a null occurrence id PASS an empty reference is rejected PASS a null reference is rejected PASS a one-segment reference is rejected PASS a two-segment reference is rejected PASS a four-segment reference is rejected PASS a trailing dot is rejected PASS a leading dot is rejected PASS version '0' is rejected PASS version '2' is rejected PASS version '01' is rejected PASS version '1a' is rejected PASS version '' is rejected PASS version ' 1' is rejected PASS a non-base64url payload segment is rejected PASS a non-base64url signature segment is rejected PASS a PADDED payload segment is rejected PASS a 4n+1-length base64url segment is rejected PASS an oversized reference is rejected before any decoding PASS every single-character payload/signature mutation over the full base64url alphabet is rejected (9702 mutations, 0 survivors) PASS a reference signed with a DIFFERENT secret is rejected PASS a foreign-secret reference fails verification PASS a correctly signed but INVALID-JSON payload is rejected PASS a correctly signed JSON scalar payload is rejected PASS a correctly signed JSON list payload is rejected PASS a correctly signed empty-object payload is rejected PASS a payload with an UNKNOWN field is rejected PASS a payload missing "b" is rejected PASS a payload missing "t" is rejected PASS a payload missing "u" is rejected PASS a payload with a non-string "u" is rejected PASS a payload with "o":null is rejected PASS a payload with an empty "o" is rejected PASS a payload with an UNREGISTERED base is rejected PASS a payload with a malformed token is rejected PASS a payload with a token containing "/" is rejected PASS a payload with an empty UID is rejected PASS a payload with a whitespace-only UID is rejected PASS a payload with an oversized UID is rejected PASS an oversized signed payload is rejected PASS a RE-ORDERED payload is rejected as non-canonical PASS a payload with added JSON whitespace is rejected as non-canonical PASS a payload with \/-escaped slashes is rejected as non-canonical PASS occurrence id a local timestamp with no Z is refused PASS occurrence id a numeric offset is refused PASS occurrence id milliseconds is refused PASS occurrence id a hyphenated date is refused PASS occurrence id an impossible date is refused PASS occurrence id an impossible time is refused PASS occurrence id a leap second is refused PASS occurrence id a 4-digit time is refused PASS occurrence id arbitrary text is refused PASS occurrence id a 9-digit value is refused PASS an all-day occurrence id (Ymd) is accepted PASS a timed occurrence id (YmdTHisZ) is accepted PASS a leap-day occurrence id is accepted PASS 29 February in a non-leap year is refused PASS the signature comparison uses hash_equals() PASS verification signs before it decodes: hash_hmac precedes json_decode == D2. canonical signature spelling == PASS a 43-character HMAC signature yields exactly 3 derived aliases per identity (15 total) PASS CONTROL: every alias decodes to the SAME raw HMAC bytes as the canonical signature PASS every non-canonical signature spelling is REJECTED PASS the canonical signature still verifies for every identity PASS the production encoder always emits zero padding bits PASS verification compares the CANONICAL ENCODED signature, never decoded bytes PASS a padded signature segment is rejected PASS a truncated signature segment is rejected PASS a signature segment with an extra character is rejected PASS the payload aliases cover more than one padding-bit width (24 aliases) PASS CONTROL: every payload alias decodes to the same JSON bytes PASS a validly-signed NON-CANONICAL payload spelling is still rejected by the canonical re-serialisation check == E. strict source validation == PASS the library duplicates no host list of its own PASS the mint endpoint duplicates no host list of its own PASS the /e/ page duplicates no host list of its own PASS the mint endpoint validates a URL with calee_calendar_validate_legacy_ics_url() PASS the mint endpoint does NOT use calendar_intent_validate_subscription_url() PASS the ICS URL boundary rejects an arbitrary external domain PASS the ICS URL boundary rejects a suffix subdomain trick PASS the ICS URL boundary rejects a prefix host trick PASS the ICS URL boundary rejects a userinfo URL PASS the ICS URL boundary rejects userinfo with a password PASS the ICS URL boundary rejects an explicit port PASS the ICS URL boundary rejects a fragment PASS the ICS URL boundary rejects a wrong DAV path PASS the ICS URL boundary rejects a traversal in the DAV path PASS the ICS URL boundary rejects a private Nextcloud path PASS the ICS URL boundary rejects a wrong query PASS the ICS URL boundary rejects an extra query parameter PASS the ICS URL boundary rejects an empty query PASS the ICS URL boundary rejects a plain http URL PASS the ICS URL boundary rejects a webcal URL PASS the ICS URL boundary rejects a file URL PASS the ICS URL boundary rejects a loopback URL PASS the ICS URL boundary rejects a link-local metadata URL PASS the ICS URL boundary rejects a malformed (too short) token PASS the ICS URL boundary rejects a token with illegal characters PASS the ICS URL boundary rejects a trailing-slash path PASS the EXACT public export URL is accepted PASS calendar_intent_validate_subscription_url() is demonstrably broader (so it is not reused) PASS minting with base 'evil' is refused PASS minting with base '' is refused PASS minting with base 'PORTAL' is refused PASS minting with base 'portal ' is refused PASS minting with base '../portal' is refused PASS minting with a malformed token is refused PASS minting with a malformed token is refused PASS minting with a malformed token is refused PASS minting with a malformed token is refused PASS minting with a malformed token is refused PASS minting with an unusable UID is refused PASS minting with an unusable UID is refused PASS minting with an unusable UID is refused PASS minting with an unusable UID is refused PASS minting with an unusable UID is refused PASS a UID of exactly the byte cap is accepted == G. one-off resolution == PASS a one-off event resolves as active PASS the active result carries the current title PASS the active result carries the current time PASS the active result carries the calendar name PASS the SAME reference still resolves after a one-off DTSTART moves PASS the moved one-off shows its NEW time PASS the Event Link URL is unchanged by the DTSTART move PASS a one-off 13 years away resolves (no current-month window) PASS a one-off 15 years in the past resolves PASS a UID absent from the source is unavailable PASS a UID differing only by a leading space does NOT resolve PASS a UID differing only by case does NOT resolve PASS a NON-recurring reference never resolves a recurring occurrence of the same UID == H. recurring resolution == PASS the first occurrence resolves by its canonical UTC identity PASS a later occurrence resolves PASS a later occurrence shows the right date PASS an occurrence that is not on the rule is unavailable PASS an occurrence BEFORE DTSTART is unavailable PASS a recurring reference never resolves against a different UID PASS the same instant written in UTC resolves under the same identity PASS an occurrence 6 years in the PAST resolves PASS an occurrence 15 years in the FUTURE resolves PASS the far-future occurrence shows its own date, not today's PASS an in-COUNT occurrence resolves PASS an EXDATE-removed occurrence is unavailable PASS the last in-COUNT occurrence resolves PASS an occurrence past COUNT is unavailable == I. detached moved override == PASS a moved detached override still resolves under its ORIGINAL identity PASS the moved override shows its NEW display time PASS the moved override shows its NEW title PASS the MOVED display start does NOT become a second identity PASS the stale generated twin is gone (no duplicate at the original time) PASS the reference for the moved occurrence is unchanged by the move PASS an override moved EIGHT MONTHS away still resolves under its original identity PASS the far-moved override shows its new date PASS a sibling occurrence still resolves normally PASS the sibling keeps the master title PASS series A resolves to A PASS series B resolves to B == J. cancelled / unavailable / ambiguous == PASS a detached cancellation resolves as CANCELLED, not unavailable PASS a cancelled occurrence never resolves to a DIFFERENT event PASS sibling occurrences of a cancelled one stay active PASS a cancelled NON-recurring event resolves as cancelled PASS a deleted event becomes unavailable, never another event PASS a deleted one-off becomes unavailable PASS an empty calendar resolves to unavailable PASS #573: a v3 Paraguay identity resolves to the occurrence it names PASS #573: the stale-DST 14:00Z identity (what tzdb 2024a minted) resolves to NOTHING, never to a neighbour PASS #573: the wall-time-as-UTC identity resolves to nothing either PASS #573: a Paraguay-qualified detached override resolves under the ORIGINAL identity PASS #573: the moved DTSTART zone identity (08:00Z Perth) resolves to nothing -- it never identifies the original PASS #573: the neighbours of a moved Paraguay occurrence still resolve to themselves PASS #573: a Paraguay-qualified cancellation resolves as CANCELLED, and only that occurrence PASS #573 adversarial: the override whose DTSTART lands on the 12 July clock resolves under 11 July, and 12 July stays itself PASS #573 rollout: under contract v2 this source yields NO identity a v3 link could match PASS two one-off events sharing a UID fail closed PASS the ambiguous result exposes NO event data at all PASS the ambiguous result is reported as ambiguous PASS two detached overrides naming ONE occurrence fail closed PASS the ambiguous override result exposes no title PASS a UID that is both a one-off and a series fails closed for the one-off link == J2. adversarial identity cases == PASS an occurrence of a cancelled master resolves as cancelled PASS the RRULE occurrence of an RDATE-bearing series resolves PASS an RDATE occurrence mints no identity and resolves to nothing PASS a move AND a cancellation of one occurrence fail closed PASS the contradiction exposes neither title PASS a sibling of the contradictory occurrence still resolves PASS an unportably-zoned override never resolves anything PASS its untouched siblings still resolve PASS the occurrence on the DST transition day resolves PASS the occurrence the week after (one hour further in UTC) resolves PASS the two DST-adjacent identities are different URLs PASS the pre-transition UTC spelling of the later occurrence resolves nothing PASS a UID-less component resolves nothing PASS a blank UID is not a UID PASS minting from a blank UID is refused outright PASS no two distinct identities collide on one URL (42 identities) PASS every minted reference is URL-safe with no escaping needed == H3. D1a: unsupported recurrence never resolves == PASS fabricated old-Mobile clamped identity (28 Feb) is unavailable PASS the locally skipped-to identity (31 Mar) is unavailable too PASS a Hub-style rolled-forward identity (3 Mar) is unavailable PASS the degraded DTSTART itself (31 Jan) carries no identity and is unavailable PASS the non-recurring form of the UID is unavailable (the UID names a series) PASS RDATE-only DTSTART: the UID-only link resolves the DTSTART deterministically PASS explicit cross-zone RDATE: its true own-clock instant (03:30Z) has no mintable identity and is unavailable PASS explicit cross-zone RDATE: the instant DTSTART's Perth clock would have produced (01:00Z) is unavailable too PASS degraded (unsupported RDATE TZID): the alleged RDATE instant on DTSTART's clock is unavailable PASS degraded (unsupported RDATE TZID): no recurrence identity of the DTSTART resolves PASS TZID on a UTC RDATE: a guessed identity at 20260312T090000Z is unavailable PASS TZID on a UTC RDATE: a guessed identity at 20260312T033000Z is unavailable PASS TZID on a UTC RDATE: a guessed identity at 20260312T010000Z is unavailable PASS TZID on a UTC RDATE: the DTSTART's own instant identity is unavailable (degraded series mints no recurrence identity) PASS duplicate TZID: a guessed identity at 20260312T033000Z is unavailable PASS duplicate TZID: a guessed identity at 20260312T010000Z is unavailable PASS duplicate TZID: a guessed identity at 20260312T090000Z is unavailable PASS duplicate TZID: the DTSTART's own instant identity is unavailable (degraded series mints no recurrence identity) PASS duplicate VALUE: a guessed identity at 20260312T090000Z is unavailable PASS duplicate VALUE: the DTSTART's own instant identity is unavailable (degraded series mints no recurrence identity) PASS bare DATE under DATE-TIME: a guessed identity at 20260312T000000Z is unavailable PASS bare DATE under DATE-TIME: a guessed identity at 20260312T010000Z is unavailable PASS bare DATE under DATE-TIME: a guessed identity at 20260312T090000Z is unavailable PASS bare DATE under DATE-TIME: the DTSTART's own instant identity is unavailable (degraded series mints no recurrence identity) PASS TZID on a DATE RDATE: a guessed all-day identity 20260312 is unavailable PASS mixed legal/illegal lines: the illegal 13 Mar instant is unavailable PASS mixed legal/illegal lines: the legal RDATEs still mint nothing (existing RDATE refusal), so 12 Mar 03:30Z and 14 Mar 09:00Z are unavailable too PASS supported RRULE + malformed RDATE: the would-be generated 11 Mar is unavailable (the rule is not stepped) PASS supported RRULE + malformed RDATE: the DTSTART instant identity is unavailable PASS control: supported RRULE + legal RDATE still resolves its generated 11 Mar PASS supported RRULE control: the second occurrence still resolves PASS fabricated BYDAY=2TU identity (14 Apr, the real second Tuesday) is unavailable PASS the substituted plain-monthly identity (10 Apr) is unavailable PASS the BYDAY=2TU DTSTART itself is unavailable (no identity is minted from a refused rule) PASS HOURLY DTSTART identity is unavailable PASS HOURLY alleged 03:00 identity is unavailable PASS HOURLY alleged 05:00 (the fourth instance) identity is unavailable PASS FREQ=WEEKLY;BYDAY=2MO: the substituted-schedule identity 20260316T090000Z is unavailable PASS FREQ=WEEKLY;BYDAY=2MO: the DTSTART identity is unavailable PASS FREQ=MONTHLY;BYDAY=TU: the substituted-schedule identity 20260410T090000Z is unavailable PASS FREQ=MONTHLY;BYDAY=TU: the DTSTART identity is unavailable PASS FREQ=YEARLY;BYDAY=TU: the substituted-schedule identity 20270310T090000Z is unavailable PASS FREQ=YEARLY;BYDAY=TU: the DTSTART identity is unavailable PASS FREQ=MONTHLY;BYSETPOS=-1: the substituted-schedule identity 20260410T090000Z is unavailable PASS FREQ=MONTHLY;BYSETPOS=-1: the DTSTART identity is unavailable PASS FREQ=YEARLY;BYMONTH=3,9: the substituted-schedule identity 20270310T090000Z is unavailable PASS FREQ=YEARLY;BYMONTH=3,9: the DTSTART identity is unavailable PASS FREQ=MONTHLY;BYMONTHDAY=1,15: the substituted-schedule identity 20260401T090000Z is unavailable PASS FREQ=MONTHLY;BYMONTHDAY=1,15: the DTSTART identity is unavailable PASS FREQ=WEEKLY;WKST=SU: the substituted-schedule identity 20260317T090000Z is unavailable PASS FREQ=WEEKLY;WKST=SU: the DTSTART identity is unavailable PASS FREQ=DAILY;BYHOUR=9: the substituted-schedule identity 20260311T090000Z is unavailable PASS FREQ=DAILY;BYHOUR=9: the DTSTART identity is unavailable PASS FREQ=DAILY;X-CALEE-FOO=1: the substituted-schedule identity 20260311T090000Z is unavailable PASS FREQ=DAILY;X-CALEE-FOO=1: the DTSTART identity is unavailable PASS FREQ=MINUTELY: the substituted-schedule identity 20260310T090100Z is unavailable PASS FREQ=MINUTELY: the DTSTART identity is unavailable PASS FREQ=DAILY;INTERVAL=0: the substituted-schedule identity 20260311T090000Z is unavailable PASS FREQ=DAILY;INTERVAL=0: the DTSTART identity is unavailable PASS FREQ=DAILY;COUNT=abc: the substituted-schedule identity 20260310T090000Z is unavailable PASS FREQ=DAILY;COUNT=abc: the DTSTART identity is unavailable PASS FREQ=DAILY;COUNT=3;UNTIL=20260420T090000Z: the substituted-schedule identity 20260311T090000Z is unavailable PASS FREQ=DAILY;COUNT=3;UNTIL=20260420T090000Z: the DTSTART identity is unavailable PASS FREQ=DAILY;UNTIL=20260420T090000: the substituted-schedule identity 20260311T090000Z is unavailable PASS FREQ=DAILY;UNTIL=20260420T090000: the DTSTART identity is unavailable PASS a fabricated identity never lands on an unrelated one-off at the same instant PASS ...nor on an unrelated series occurrence at the same instant PASS ...while the unrelated series still resolves under its own UID PASS ...and the unrelated one-off still resolves under its own UID PASS an explicit detached replacement naming the degraded DTSTART resolves active PASS ...to the replacement, on its moved date PASS an explicit detached cancellation naming the degraded DTSTART resolves cancelled PASS a detached override naming an alleged later instance resolves to the override itself PASS ...while the un-overridden alleged 04:00 stays unavailable PASS ...and the degraded DTSTART stays unavailable PASS control: a safe MONTHLY (day 28) still resolves its second occurrence PASS control: a safe MONTHLY still refuses an occurrence past COUNT PASS control: a safe WEEKLY;BYDAY still resolves PASS the HOURLY DTSTART is displayed (one occurrence) PASS ...but mints no Event Link URL PASS ...while a supported control occurrence still mints one PASS resolving against a degraded series costs zero work units == K. all-day == PASS an all-day one-off resolves PASS an all-day event reports "All day", not a time PASS an all-day event reports its literal date PASS an all-day occurrence resolves by its literal Ymd identity PASS a later all-day occurrence resolves PASS the all-day identity is a literal date, never shifted by an offset PASS a timed identity does NOT resolve an all-day series PASS an all-day identity does NOT resolve a timed series PASS a multi-day all-day event reports its inclusive date range == L. current-source refresh == PASS ONE reference resolves against ICS version A PASS the SAME reference resolves against ICS version B PASS the URL is unchanged between versions PASS a title change appears PASS a time change appears PASS a date change appears PASS a calendar-name change appears PASS neither title, start, end nor calendar name is signed == P. resource bounds == PASS an ancient unbounded daily series resolves in the far future PASS resolving it costs a bounded handful of work units (6) PASS the work is independent of how far away the target is PASS a COUNT=100000 series costs a bounded handful of work units (5) PASS the hostile series still resolves correctly PASS a noisy feed still resolves the target PASS unrelated series in the same feed are never expanded for this link PASS the existing VEVENT cap still fails closed during resolution PASS the reference cap is bounded PASS the payload cap is bounded PASS the mint body cap is bounded PASS a 1 MB reference is refused without decoding it PASS the resolution window is a few days wide, not a whole month PASS the window is centred on the signed target, not on today PASS the resolver never reads the clock to build its window == H2. timezone context (identity vs display) == PASS a floating series WITH a portable calendar context mints an identity PASS the resolver resolves that exact canonical identity PASS and shows it on the calendar's own wall clock (09:00 Perth) PASS a floating series with NO context fails closed on UTC PASS a floating ONE-OFF resolves on UTC and shows its literal wall clock PASS a floating series with NO context fails closed on Australia/Perth PASS a floating ONE-OFF resolves on Australia/Perth and shows its literal wall clock PASS a floating series with NO context fails closed on America/New_York PASS a floating ONE-OFF resolves on America/New_York and shows its literal wall clock PASS a non-portable X-WR-TIMEZONE supplies no calendar context PASS a floating series under a non-portable zone fails closed PASS an event's own TZID mints an identity with no calendar context PASS the inferred display zone shows the source wall clock PASS a Z-suffixed series resolves identically on UTC PASS a Z-suffixed series resolves identically on Australia/Perth PASS two masters generating one occurrence fail closed PASS the double-master failure exposes no title == F. mint endpoint validation == PASS POST base+token+uid mints 200 PASS the minted URL is the canonical /e/ URL PASS the success body carries ONLY a url PASS the success body leaks no decoded payload internals PASS POST calendarUrl+uid mints the SAME URL as base+token PASS an AGREEING url + base/token pair mints the same URL PASS a DISAGREEING url + base pair is refused PASS a DISAGREEING url + token pair is refused PASS an occurrenceId mints the recurring URL PASS an explicit null occurrenceId mints the NON-recurring URL PASS GET is refused with 405 PASS the 405 response advertises Allow: POST PASS a non-JSON content type is refused with 415 PASS a JSON content type with a charset parameter is accepted PASS a request with no content type is refused PASS an oversized body is refused with 413 PASS a body of 'not json at all' is refused as invalid_request PASS a body of '[]' is refused as invalid_request PASS a body of '["business"]' is refused as invalid_request PASS a body of '"a string"' is refused as invalid_request PASS a body of 'null' is refused as invalid_request PASS a body of '{}' is refused as invalid_request PASS an unknown field is refused PASS an ARRAY where a string belongs is refused PASS an array uid is refused PASS an array occurrenceId is refused PASS a numeric occurrenceId is refused PASS a missing uid is refused as invalid_uid PASS an empty uid is refused as invalid_uid PASS an oversized uid is refused as invalid_uid PASS a malformed occurrenceId is refused as invalid_occurrence PASS an empty-string occurrenceId is refused, not treated as absent PASS an unregistered base is refused as invalid_source PASS base with no token is refused as invalid_source PASS mint refuses an arbitrary external domain PASS mint refuses a suffix subdomain trick PASS mint refuses a prefix host trick PASS mint refuses a userinfo URL PASS mint refuses userinfo with a password PASS mint refuses an explicit port PASS mint refuses a fragment PASS mint refuses a wrong DAV path PASS mint refuses a traversal in the DAV path PASS mint refuses a private Nextcloud path PASS mint refuses a wrong query PASS mint refuses an extra query parameter PASS mint refuses an empty query PASS mint refuses a plain http URL PASS mint refuses a webcal URL PASS mint refuses a file URL PASS mint refuses a loopback URL PASS mint refuses a link-local metadata URL PASS mint refuses a malformed (too short) token PASS mint refuses a token with illegal characters PASS mint refuses a trailing-slash path PASS the mint response sends no access-control-allow-origin PASS the mint response sends no access-control-allow-credentials PASS the mint response sends no access-control-allow-methods PASS the mint response sends no set-cookie PASS the mint response is no-store PASS the mint response is nosniff PASS the mint response is JSON PASS a mint error leaks no filesystem path PASS a mint error leaks no upstream host PASS a mint error leaks no secret PASS a mint error uses a stable code PASS a mint error carries no stack trace or internal marker == Q. no-upstream-fetch mint proof == PASS the mint endpoint never calls calee_calendar_load()/calee_calendar_fetch_ics() PASS the mint endpoint makes no cURL/socket call PASS the mint endpoint does not even LOAD the fetcher PASS the mint endpoint does not even LOAD the calendar service PASS the mint endpoint does not even LOAD the cache PASS the mint endpoint loads exactly sources + data + exception + windows map + recurrence classifier + event link (calendar_data.php, calendar_event_link.php, calendar_exception.php, calendar_recurrence_qualification.php, calendar_sources.php, calendar_windows_timezones.php, event-link-mint.php) PASS the recurrence classifier performs no I/O at all (no file, socket, process, env, clock or global read) PASS the Windows map loader opens no socket and runs no process PASS the Windows map loader reads only the pinned local artifact PASS mint returns 200 on a server with curl/sockets DISABLED PASS ...and mints exactly the same URL PASS mint accepts a calendarUrl without fetching it (curl disabled) PASS minting succeeds for a calendar the resolver would call unavailable PASS ...and produces a well-formed reference PASS the mint endpoint created no cache entry for that calendar == M. escaping / privacy == PASS the privacy fixture renders as an active event (200) PASS the approved TITLE is present PASS the approved DATE is present PASS the approved TIME is present PASS the approved CALENDAR NAME is present PASS the active page never exposes LOCATION PASS the active page never exposes DESCRIPTION PASS the active page never exposes ATTENDEE PASS the active page never exposes ORGANIZER PASS the active page never exposes ATTACH PASS the active page never exposes VALARM description PASS the active page never exposes CATEGORIES PASS the active page never exposes the raw UID PASS the active page never exposes the public token PASS the active page never exposes the DAV export URL PASS the active page never exposes the upstream host PASS the active page never exposes the cache directory PASS the active page never exposes the Event Link secret PASS the active page never exposes a canonical recurrence identity PASS the active page never renders the decoded payload PASS the active page contains no RRULE internals PASS a recurring page never exposes its recurrence identity PASS a recurring page never exposes its own UID PASS a hostile title never produces a