Summary
Between 6 August and 8 September 2026, every adapter upload from the Ailoos mobile app to the coordinator failed with HTTP 422. The production database confirmed it: the most recent mobile artefact was dated 4 August. The training network's phones did their work and could not hand it in.
Background
The August production-readiness audit (item SIM-55) found that anyone who guessed a training session's job_id could upload an artefact and be credited for another node's work. The fix added an upload secret, issued when a session is created and required on upload. Correct, and necessary.
What happened
The mobile app was updated to request the secret when creating a session — and then dropped it. The value was parsed from the response and never stored. At upload time the app sent no secret; the coordinator, now correctly strict, rejected the request.
The secret is required at three endpoints and in two different places: in the body for artifacts, in the query string for validate and implement. The app's session model had no field for it, so no code path could have carried it.
Why it was not caught
- The coordinator's tests covered the new requirement with test clients that sent the secret.
- The app's tests mocked the coordinator and did not assert the secret was forwarded.
- No end-to-end test ran a real phone against the real coordinator after the fix.
- The 422s were logged server-side as client errors — expected noise after tightening validation — and nobody correlated them with the sudden absence of new artefacts.
Detection
The 8 September mobile verification, on a physical device against production. First upload attempt: 422. The response body named the missing field.
Fix
Session model extended with the secret; forwarded in the body or query per endpoint. Verified the same day: download → train → sign → upload (200) → validate → implement.
Lessons
- A security fix is a protocol change. Every client is affected; every client needs a test that exercises the new requirement against the real server, not a mock.
- Watch the absence, not only the errors. "No new artefacts for a month" is a louder alarm than any 4xx count, and it was not on a dashboard. It is now.
- Server-side, log which field failed. The 422 body did; the aggregate log did not. Correlating the two would have shortened 33 days to one.
- Test on the device. This finding, the random-weights finding and the tokenizer finding were all made in the same session on a phone — none by the test suite.
Based on the Ailoos mobile-training verification (2026-09-08) and the SIM-55 audit item.