Synology CalDAV integration has never been exercised against a real server #9

New Issue

2026-10-01T22:50:37Z

KofTwentyTwo commented

2026-10-01 22:50:37 +00:00

(Migrated from github.com)

Summary

calendar/CalDavClient.java is a real java.net.http CalDAV client (PROPFIND, REPORT, GET, PUT with If-None-Match/If-Match, DELETE, bounded bodies, HTTPS required off loopback) and CalendarPublicationService.apply really performs remote writes through the carlPublishCalendar process and the calendar-plan workflow. It is only ever tested against loopback HttpServer stubs (CalDavClientTest, CalendarPublicationServiceTest, CarlConversationHttpTest:1435). No Synology endpoint, collection or credential is configured anywhere; CARL_CALDAV_* is unset and requirement SYN-AT-08 is BLOCKED.

Also

Agenda sync reads VEVENT only (CalendarWorkflows.java:91-120); reminders (VTODO) can be published but are not read back.
V20__calendar_publication_outbox.sql is named as an outbox but is a synchronous operation log with manual reconcile; there is no drainer. The name implies asynchronous delivery that does not exist.

Suggested resolution

Run a bounded live check against the designated Synology collection with a throwaway event, record ETag/conflict behaviour, then decide on VTODO reads and rename or document the operation log.

Priority rationale

P1: this is the one write capability Carl is authorized to have, and it is unproven.

Filed from the 2026-10-01 real-versus-fake audit of Carl (branch feature/cicd-liquibase-gitops, HEAD 5414d7a, main 1b334d1). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

## Summary `calendar/CalDavClient.java` is a real `java.net.http` CalDAV client (PROPFIND, REPORT, GET, PUT with `If-None-Match`/`If-Match`, DELETE, bounded bodies, HTTPS required off loopback) and `CalendarPublicationService.apply` really performs remote writes through the `carlPublishCalendar` process and the `calendar-plan` workflow. It is only ever tested against loopback `HttpServer` stubs (`CalDavClientTest`, `CalendarPublicationServiceTest`, `CarlConversationHttpTest:1435`). No Synology endpoint, collection or credential is configured anywhere; `CARL_CALDAV_*` is unset and requirement SYN-AT-08 is BLOCKED. ## Also - Agenda sync reads VEVENT only (`CalendarWorkflows.java:91-120`); reminders (VTODO) can be published but are not read back. - `V20__calendar_publication_outbox.sql` is named as an outbox but is a synchronous operation log with manual `reconcile`; there is no drainer. The name implies asynchronous delivery that does not exist. ## Suggested resolution Run a bounded live check against the designated Synology collection with a throwaway event, record ETag/conflict behaviour, then decide on VTODO reads and rename or document the operation log. ## Priority rationale P1: this is the one write capability Carl is authorized to have, and it is unproven. --- Filed from the 2026-10-01 real-versus-fake audit of Carl (branch `feature/cicd-liquibase-gitops`, HEAD `5414d7a`, main `1b334d1`). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/carl#9