Host facts for the machine popover (embedded and remote infraternal agent)

kayg commented

2026-10-09 15:02:13 +00:00

Owner

The window details popover (#127) shows only what the server already knows (name, login, address, route). D120/D126/D156 call for a Machine tab with cheap host facts collected by the infraternal agent, embedded and remote:

default, cheap, on by default (opt-out): OS name and version, kernel, architecture, model, CPU and cores, memory (used/total), disk (used/total for /), uptime, load, infraternal agent mode, engines present.
behind "more": init, virtualization, shell, locale; IPs hidden by default.
expensive or sensitive facts (listeners, workloads, mesh topology, SSH/firewall posture, updates, disk health, discovery sources) behind the "Gather extended information" switch (D156) — not in this slice.

Static facts are read at start and on reconnect; live numbers (memory, disk, load, uptime) refresh only while the popover is open (D120).

The window details popover (#127) shows only what the server already knows (name, login, address, route). D120/D126/D156 call for a Machine tab with cheap host facts collected by the infraternal agent, embedded and remote: - default, cheap, on by default (opt-out): OS name and version, kernel, architecture, model, CPU and cores, memory (used/total), disk (used/total for /), uptime, load, infraternal agent mode, engines present. - behind "more": init, virtualization, shell, locale; IPs hidden by default. - expensive or sensitive facts (listeners, workloads, mesh topology, SSH/firewall posture, updates, disk health, discovery sources) behind the "Gather extended information" switch (D156) — not in this slice. Static facts are read at start and on reconnect; live numbers (memory, disk, load, uptime) refresh only while the popover is open (D120).

kayg commented

2026-10-09 15:03:41 +00:00

Author

Owner

Starting #144 on branch host-facts, based on dev at 42e50d42c5e43dabc3da89de4b01dd92329bf030.

Starting #144 on branch `host-facts`, based on `dev` at `42e50d42c5e43dabc3da89de4b01dd92329bf030`.

kayg commented

2026-10-09 15:04:20 +00:00

Author

Owner

Finding: this checkout's DECISIONS.md ends at decision 112 (last numbered entry at line 485); D120, D126, D156, D198 and D205 are absent. The #144 body records the facts and on-demand boundary, and the job brief supplies D198/D205. I’m proceeding to that stated scope without changing decision text.

Finding: this checkout's `DECISIONS.md` ends at decision 112 (last numbered entry at line 485); D120, D126, D156, D198 and D205 are absent. The #144 body records the facts and on-demand boundary, and the job brief supplies D198/D205. I’m proceeding to that stated scope without changing decision text.

kayg commented

2026-10-09 15:08:35 +00:00

Author

Owner

Finding: this checkout has only the inherited-fd embedded daemon (crates/infraternal-agent/src/daemon.rs::run and crates/infraternal/src/main.rs::run_embedded); there is no remote-agent transport entry point to wire here. I’ll put collection in a shared plugin crate with embedded mode passed by the existing daemon, leaving its public collector API usable by the remote runner when that lane lands.

Finding: this checkout has only the inherited-fd embedded daemon (`crates/infraternal-agent/src/daemon.rs::run` and `crates/infraternal/src/main.rs::run_embedded`); there is no remote-agent transport entry point to wire here. I’ll put collection in a shared plugin crate with embedded mode passed by the existing daemon, leaving its public collector API usable by the remote runner when that lane lands.

kayg commented

2026-10-09 15:12:30 +00:00

Author

Owner

Contract proposal for #144: add a minimal, additive plugin API descriptor for declared actions (including bounds, effect, target and permission), settings/defaults and role dependencies, plus a generic agent-plugin registry. The host-facts plugin will declare host.facts.read and host.facts.configure (enabled by default; configure can disable it at runtime). The server will authorize/route declared agent actions generically. Wire stays on existing bounded Call/Result; no new frame or decoder.

Contract proposal for #144: add a minimal, additive plugin API descriptor for declared actions (including bounds, effect, target and permission), settings/defaults and role dependencies, plus a generic agent-plugin registry. The host-facts plugin will declare `host.facts.read` and `host.facts.configure` (enabled by default; configure can disable it at runtime). The server will authorize/route declared agent actions generically. Wire stays on existing bounded `Call`/`Result`; no new frame or decoder.

kayg commented

2026-10-09 15:29:18 +00:00

Author

Owner

Finding: the first scripts/verify fast exited non-green. fmt found one diff at crates/plugins/host-facts/src/facts.rs:54; clippy rejected the new test's expect at src/tests.rs:6; all Rust tests passed and cargo-deny passed. Static build then failed because .cargo/musl-cc.sh tried /home/kayg/Developer/infraternal/.worktrees/host-facts/target/auth-tools/zig/zig (missing) while CARGO_TARGET_DIR was /home/kayg/.cache/codex-scratch/host-facts/target. I’ll fix formatting/lint and stage the pinned Zig tool under job scratch before rerunning.

Finding: the first `scripts/verify fast` exited non-green. `fmt` found one diff at `crates/plugins/host-facts/src/facts.rs:54`; clippy rejected the new test's `expect` at `src/tests.rs:6`; all Rust tests passed and cargo-deny passed. Static build then failed because `.cargo/musl-cc.sh` tried `/home/kayg/Developer/infraternal/.worktrees/host-facts/target/auth-tools/zig/zig` (missing) while `CARGO_TARGET_DIR` was `/home/kayg/.cache/codex-scratch/host-facts/target`. I’ll fix formatting/lint and stage the pinned Zig tool under job scratch before rerunning.

kayg commented

2026-10-09 15:35:02 +00:00

Author

Owner

Finding: the updated scripts/verify fast run passes formatting and clippy, but its Rust test row failed real_binary_preserves_input_and_output_across_24_abrupt_stops: 21/24 checks passed, then iteration 22 stalled with terminal command queue full. The gate is still compiling the static targets; I will report its final status and investigate this failure before claiming completion.

Finding: the updated `scripts/verify fast` run passes formatting and clippy, but its Rust test row failed `real_binary_preserves_input_and_output_across_24_abrupt_stops`: 21/24 checks passed, then iteration 22 stalled with `terminal command queue full`. The gate is still compiling the static targets; I will report its final status and investigate this failure before claiming completion.

kayg commented

2026-10-09 15:47:13 +00:00

Author

Owner

Gate finding: the completed scripts/verify fast run reports fmt PASS, VT native fmt PASS, clippy PASS, test FAIL (101), cargo-deny PASS, and static builds PASS. The failed row is real_binary_preserves_input_and_output_across_24_abrupt_stops (21/24; iteration 22 hit terminal command queue full). Host load average at completion was 24.33, 21.57, 20.27. Both static size checks passed: x86_64 15,965,392 bytes (baseline 16,142,672); aarch64 13,426,064 (baseline 13,555,672). I will rerun after the feature changes and preserve the complete output.

Gate finding: the completed `scripts/verify fast` run reports fmt PASS, VT native fmt PASS, clippy PASS, test FAIL (101), cargo-deny PASS, and static builds PASS. The failed row is `real_binary_preserves_input_and_output_across_24_abrupt_stops` (21/24; iteration 22 hit `terminal command queue full`). Host load average at completion was 24.33, 21.57, 20.27. Both static size checks passed: x86_64 15,965,392 bytes (baseline 16,142,672); aarch64 13,426,064 (baseline 13,555,672). I will rerun after the feature changes and preserve the complete output.

kayg commented

2026-10-09 16:05:31 +00:00

Author

Owner

UI finding: the new Host row formatting check passes, and the four existing interaction cases in details.spec.ts timed out or missed the copy tick in this run. The test process was running at host load average 51.30, 33.71, 23.76 (uptime at 18:05 UTC); I will rerun this gate after the concurrent host work subsides. The only code defect exposed by the new check was the missing MB display unit; the formatter now includes MB.

UI finding: the new Host row formatting check passes, and the four existing interaction cases in `details.spec.ts` timed out or missed the copy tick in this run. The test process was running at host load average 51.30, 33.71, 23.76 (`uptime` at 18:05 UTC); I will rerun this gate after the concurrent host work subsides. The only code defect exposed by the new check was the missing MB display unit; the formatter now includes MB.

kayg commented

2026-10-09 16:09:38 +00:00

Author

Owner

Step complete: added the D198 plugin descriptor/action/settings metadata and an 8 KiB bounded generic action registry. cargo test -p infraternal-plugin-api: 2 passed, 0 failed. This API-only commit does not link into the CLI binary yet, so binary size change is 0 bytes. Commit f348b219.

Step complete: added the D198 plugin descriptor/action/settings metadata and an 8 KiB bounded generic action registry. `cargo test -p infraternal-plugin-api`: 2 passed, 0 failed. This API-only commit does not link into the CLI binary yet, so binary size change is 0 bytes. Commit f348b219.

kayg commented

2026-10-09 16:15:11 +00:00

Author

Owner

Finding: the first cargo check --target aarch64-apple-darwin -p infraternal-plugin-host-facts --lib exposed a missing Sysctl trait import for kern.boottime plus Linux-only helper warnings. Added the import and target-gated Linux parsers; the same Mac target check now passes without warnings. This is compile evidence only; runtime collection was measured on Linux.

Finding: the first `cargo check --target aarch64-apple-darwin -p infraternal-plugin-host-facts --lib` exposed a missing `Sysctl` trait import for `kern.boottime` plus Linux-only helper warnings. Added the import and target-gated Linux parsers; the same Mac target check now passes without warnings. This is compile evidence only; runtime collection was measured on Linux.

kayg commented

2026-10-09 16:18:07 +00:00

Author

Owner

Finding: macOS vm.loadavg is an opaque struct; reading it as a string loses the counters. The shared collector now decodes the bounded 64-bit layout (three fixed-point values and scale) and rejects an unexpected size or scale. Added a malformed-layout regression test. Evidence: cargo test --locked --all-targets -p infraternal-plugin-host-facts -p infraternal-plugin-api passed (8 host-facts, 2 plugin API tests); implementation in crates/plugins/host-facts/src/facts.rs.

Finding: macOS `vm.loadavg` is an opaque struct; reading it as a string loses the counters. The shared collector now decodes the bounded 64-bit layout (three fixed-point values and scale) and rejects an unexpected size or scale. Added a malformed-layout regression test. Evidence: `cargo test --locked --all-targets -p infraternal-plugin-host-facts -p infraternal-plugin-api` passed (8 host-facts, 2 plugin API tests); implementation in `crates/plugins/host-facts/src/facts.rs`.

kayg commented

2026-10-09 16:30:31 +00:00

Author

Owner

Step complete: .cargo/musl-ar.sh and .cargo/musl-cc.sh now follow CARGO_TARGET_DIR for Zig and its cache, so gates can build under the required job scratch directory. Commit 950bb421; bash -n and git diff --check passed. The full gate will exercise both static targets.

Step complete: `.cargo/musl-ar.sh` and `.cargo/musl-cc.sh` now follow `CARGO_TARGET_DIR` for Zig and its cache, so gates can build under the required job scratch directory. Commit `950bb421`; `bash -n` and `git diff --check` passed. The full gate will exercise both static targets.

kayg commented

2026-10-09 16:32:52 +00:00

Author

Owner

Step complete: 7935ba9a adds the shared bounded host-facts plugin, parser tests, a fuzz target and measurement example. Checks: 9 host-facts tests and 2 plugin API tests passed; fuzz target, agent --no-default-features, and aarch64 macOS cross-check compile cleanly. HostFacts preserves SSH bootstrap Rust fields os/arch/uid/version/cpus; the shared crate can replace the private collector, with HostFactsPlugin::new(AgentMode::Remote) for a remote runner. Its browser JSON keeps architecture/executionUid/logicalCpus via serde names, so keep an adapter if the existing remote wire shape differs. Measured on infraternal-dev (8 cores, load 27.24/37.37/37.15): static 136.28/199.65 us p50/p95; live 23.09/37.27 us; two-leg call+result 782/1,180 bytes.

History correction: the earlier scratch-helper comment named 950bb421; its corrected local commit hash is 9e434f8f, with the same code change.

Step complete: `7935ba9a` adds the shared bounded host-facts plugin, parser tests, a fuzz target and measurement example. Checks: 9 host-facts tests and 2 plugin API tests passed; fuzz target, agent `--no-default-features`, and aarch64 macOS cross-check compile cleanly. `HostFacts` preserves SSH bootstrap Rust fields `os/arch/uid/version/cpus`; the shared crate can replace the private collector, with `HostFactsPlugin::new(AgentMode::Remote)` for a remote runner. Its browser JSON keeps `architecture/executionUid/logicalCpus` via serde names, so keep an adapter if the existing remote wire shape differs. Measured on infraternal-dev (8 cores, load 27.24/37.37/37.15): static 136.28/199.65 us p50/p95; live 23.09/37.27 us; two-leg call+result 782/1,180 bytes. History correction: the earlier scratch-helper comment named `950bb421`; its corrected local commit hash is `9e434f8f`, with the same code change.

kayg commented

2026-10-09 16:33:29 +00:00

Author

Owner

Step complete: 592bf087 routes bounded generic plugin calls over the existing browser/server/embedded-agent Call/Result path and builds the registry for embedded or remote mode. The multi-package Rust run passed: agent 14 tests plus 2 transport tests, server 100 passed/9 ignored, API 2, and host facts 8; after aligning bootstrap field names the latest host-facts/API run passed 9/2. The real-server browser spec remains the end-to-end check.

Step complete: `592bf087` routes bounded generic plugin calls over the existing browser/server/embedded-agent `Call`/`Result` path and builds the registry for embedded or remote mode. The multi-package Rust run passed: agent 14 tests plus 2 transport tests, server 100 passed/9 ignored, API 2, and host facts 8; after aligning bootstrap field names the latest host-facts/API run passed 9/2. The real-server browser spec remains the end-to-end check.

kayg commented

2026-10-09 16:35:30 +00:00

Author

Owner

Step complete: 7d4f0590 maps the snapshot into the existing Host rows and polls only while the popover is open (max 1 request/s/window). No row component or data budget was added. Checks: bun run check passed; tracer unit suite passed 56 tests / 0 failures, including GB formatting and optional-row behavior. D188 transfer-budget gate remains to be recorded in the final gate.

Step complete: `7d4f0590` maps the snapshot into the existing Host rows and polls only while the popover is open (max 1 request/s/window). No row component or data budget was added. Checks: `bun run check` passed; tracer unit suite passed 56 tests / 0 failures, including GB formatting and optional-row behavior. D188 transfer-budget gate remains to be recorded in the final gate.

kayg commented

2026-10-09 16:35:56 +00:00

Author

Owner

Step complete: 1d0ab6af adds Host-row formatting tests and a real-server spec that checks /etc/os-release, uname -r, read cadence, and stop-on-close, with optional popover screenshot capture. bun run check and the 56-test tracer unit suite pass; browser specs and screenshot capture remain pending the production build.

Step complete: `1d0ab6af` adds Host-row formatting tests and a real-server spec that checks `/etc/os-release`, `uname -r`, read cadence, and stop-on-close, with optional popover screenshot capture. `bun run check` and the 56-test tracer unit suite pass; browser specs and screenshot capture remain pending the production build.

kayg commented

2026-10-09 16:35:57 +00:00

Author

Owner

Step complete: c380049f documents the bounded facts and host-file decoder target. cargo check --locked --offline --manifest-path fuzz/Cargo.toml --bin host_facts_decode passed.

Step complete: `c380049f` documents the bounded facts and host-file decoder target. `cargo check --locked --offline --manifest-path fuzz/Cargo.toml --bin host_facts_decode` passed.

kayg commented

2026-10-09 16:42:36 +00:00

Author

Owner

Finding: scripts/verify fast reached cargo-deny and reported error[wildcard]: found 1 wildcard dependency for crate 'infraternal-fuzz' at fuzz/Cargo.toml:17, the new path-only host-facts dependency. The package is version 0.1.0; I will add the matching version constraint after the in-progress static build finishes, then rerun the gate.

Finding: `scripts/verify fast` reached `cargo-deny` and reported `error[wildcard]: found 1 wildcard dependency for crate 'infraternal-fuzz'` at `fuzz/Cargo.toml:17`, the new path-only host-facts dependency. The package is version `0.1.0`; I will add the matching version constraint after the in-progress static build finishes, then rerun the gate.

kayg commented

2026-10-09 16:46:53 +00:00

Author

Owner

Fast-gate findings (captured at load average 15.80/22.41/29.34): fmt, VT native fmt, workspace tests and both static builds passed. Clippy failed because AgentPlugin::call lacks a # Errors doc section (crates/infraternal-plugin-api/src/lib.rs:77). cargo-deny failed on the wildcard path dependency at fuzz/Cargo.toml:17. Workspace tests also reported a non-failing example filename collision (measure with infraternal-mesh). Static sizes: x86_64 16,031,568 bytes (+66,176 over 15,965,392 pre-plugin); aarch64 13,482,320 bytes (+56,256 over 13,426,064 pre-plugin); both below their limits. I will correct the lint/policy findings, give the example a unique target name, then rerun the complete gate including TypeScript.

Fast-gate findings (captured at load average 15.80/22.41/29.34): fmt, VT native fmt, workspace tests and both static builds passed. Clippy failed because `AgentPlugin::call` lacks a `# Errors` doc section (`crates/infraternal-plugin-api/src/lib.rs:77`). `cargo-deny` failed on the wildcard path dependency at `fuzz/Cargo.toml:17`. Workspace tests also reported a non-failing example filename collision (`measure` with infraternal-mesh). Static sizes: x86_64 16,031,568 bytes (+66,176 over 15,965,392 pre-plugin); aarch64 13,482,320 bytes (+56,256 over 13,426,064 pre-plugin); both below their limits. I will correct the lint/policy findings, give the example a unique target name, then rerun the complete gate including TypeScript.

kayg commented

2026-10-09 16:50:21 +00:00

Author

Owner

Clippy follow-up committed as 0551ea32: the plugin API now documents its bounded call errors. Focused warning-denied Clippy passes for infraternal-plugin-api and infraternal-plugin-host-facts after the collector lint fixes; the remaining manifest and benchmark target fixes are being checked separately.

Clippy follow-up committed as 0551ea32: the plugin API now documents its bounded call errors. Focused warning-denied Clippy passes for `infraternal-plugin-api` and `infraternal-plugin-host-facts` after the collector lint fixes; the remaining manifest and benchmark target fixes are being checked separately.

kayg commented

2026-10-09 16:50:29 +00:00

Author

Owner

Collector lint fixes committed as a69819a5. Focused cargo clippy -p infraternal-plugin-api -p infraternal-plugin-host-facts --all-targets --locked --offline -- -D warnings passes; the macOS load parser now checks the sysctl scale range instead of relying on lossy casts.

Collector lint fixes committed as a69819a5. Focused `cargo clippy -p infraternal-plugin-api -p infraternal-plugin-host-facts --all-targets --locked --offline -- -D warnings` passes; the macOS load parser now checks the sysctl scale range instead of relying on lossy casts.

kayg commented

2026-10-09 16:50:55 +00:00

Author

Owner

The fuzz dependency policy fix is committed as fe87f840. cargo deny check now exits successfully (advisories ok, bans ok, licenses ok, sources ok); existing duplicate-version warnings remain unrelated to this dependency.

The fuzz dependency policy fix is committed as fe87f840. `cargo deny check` now exits successfully (`advisories ok, bans ok, licenses ok, sources ok`); existing duplicate-version warnings remain unrelated to this dependency.

kayg commented

2026-10-09 16:51:10 +00:00

Author

Owner

The measurement target fix is committed as 67e702ed. Focused tests pass: plugin API 2/2, host-facts 9/9, benchmark example 0 tests; focused warning-denied Clippy also passes. Cargo now names the measurement example host_facts_measure, avoiding the workspace output collision.

The measurement target fix is committed as 67e702ed. Focused tests pass: plugin API 2/2, host-facts 9/9, benchmark example 0 tests; focused warning-denied Clippy also passes. Cargo now names the measurement example `host_facts_measure`, avoiding the workspace output collision.

kayg commented

2026-10-09 17:05:36 +00:00

Author

Owner

Real-server harness finding: the first browser launch used the misspelled INFRATERAL_BIN; real/server.ts:60 reads INFRATERNAL_BIN. The helper therefore fell back to the missing worktree target/x86_64-unknown-linux-musl/release/infraternal (ENOENT). This is an invocation typo, not a runtime failure; rerunning with the declared variable and the scratch-built binary.

Real-server harness finding: the first browser launch used the misspelled `INFRATERAL_BIN`; `real/server.ts:60` reads `INFRATERNAL_BIN`. The helper therefore fell back to the missing worktree `target/x86_64-unknown-linux-musl/release/infraternal` (ENOENT). This is an invocation typo, not a runtime failure; rerunning with the declared variable and the scratch-built binary.

kayg commented

2026-10-09 17:06:17 +00:00

Author

Owner

The production real-server run now reaches the popover. Its OS row is Debian GNU/Linux 13, but the spec's hasText: "System" row locator matched both that row and the Init value systemd, returning two .ui-kv-value elements. I’m tightening the assertion to use the existing .ui-kv-key cell.

The production real-server run now reaches the popover. Its OS row is `Debian GNU/Linux 13`, but the spec's `hasText: "System"` row locator matched both that row and the Init value `systemd`, returning two `.ui-kv-value` elements. I’m tightening the assertion to use the existing `.ui-kv-key` cell.

kayg commented

2026-10-09 17:07:27 +00:00

Author

Owner

Selector follow-up: Playwright's filter({ has }) treated the key locator rooted at .canvas-popover as outside each row, so the second run found zero matching rows. The existing ui-kv-key button is the right anchor; I’ll read the value from its parent row directly.

Selector follow-up: Playwright's `filter({ has })` treated the key locator rooted at `.canvas-popover` as outside each row, so the second run found zero matching rows. The existing `ui-kv-key` button is the right anchor; I’ll read the value from its parent row directly.

kayg commented

2026-10-09 17:08:11 +00:00

Author

Owner

Real production run passes: real/host-facts.spec.ts reports 1/1 pass (15.2s), matching this machine's /etc/os-release row Debian GNU/Linux 13 and uname -r row 6.12.111+deb13-amd64. The spec also verifies no read before open, at most one read per second while open, and no further reads after close. Screenshot: apps/tracer/real/host-facts-popover.png.

Real production run passes: `real/host-facts.spec.ts` reports 1/1 pass (15.2s), matching this machine's `/etc/os-release` row `Debian GNU/Linux 13` and `uname -r` row `6.12.111+deb13-amd64`. The spec also verifies no read before open, at most one read per second while open, and no further reads after close. Screenshot: `apps/tracer/real/host-facts-popover.png`.

kayg commented

2026-10-09 17:11:07 +00:00

Author

Owner

D205 measurement on infraternal-dev (x86_64, 8 cores), run under systemd-run --user --scope -p CPUWeight=10000, load average 19.92→19.19:

Static facts: p50 132.71 µs, p95 207.82 µs; live refresh: p50 24.23 µs, p95 38.50 µs.
Static JSON 357 B; request+response 782 B across two muxed legs. Live JSON 538 B; request+response 1,180 B across two legs.
Final stripped static binary: x86_64 16,031,568 B (+66,176 B vs pre-plugin 15,965,392); aarch64 13,482,320 B (+56,256 B vs 13,426,064). The added runtime code is the shared plugin registry/action route and host-facts collector; UI/docs/spec commits add no server code. cargo tree -d -p infraternal-plugin-host-facts -p infraternal-agent printed no duplicate entries. Transfer-budget gate passes with no limits raised; largest on-demand chunk is gzip 8,488/20,480 B and Brotli 7,636/18,432 B.

D205 measurement on infraternal-dev (x86_64, 8 cores), run under `systemd-run --user --scope -p CPUWeight=10000`, load average 19.92→19.19: - Static facts: p50 132.71 µs, p95 207.82 µs; live refresh: p50 24.23 µs, p95 38.50 µs. - Static JSON 357 B; request+response 782 B across two muxed legs. Live JSON 538 B; request+response 1,180 B across two legs. - Final stripped static binary: x86_64 16,031,568 B (+66,176 B vs pre-plugin 15,965,392); aarch64 13,482,320 B (+56,256 B vs 13,426,064). The added runtime code is the shared plugin registry/action route and host-facts collector; UI/docs/spec commits add no server code. `cargo tree -d -p infraternal-plugin-host-facts -p infraternal-agent` printed no duplicate entries. Transfer-budget gate passes with no limits raised; largest on-demand chunk is gzip 8,488/20,480 B and Brotli 7,636/18,432 B.

kayg commented

2026-10-09 17:12:59 +00:00

Author

Owner

Finished on head 38b53f456d.

scripts/verify fast completed with Result=success. Verbatim gate summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Tracer unit output: 56 pass, 0 fail, 9946 expect() calls; stream differential: 134 streams, 11439 schedules, zero divergences; protocol output: 7 pass, 0 fail, 34390 expect() calls. bun run check exits 0; details.spec.ts passes 4/4; real production host-facts spec passes 1/1. Screenshot: apps/tracer/real/host-facts-popover.png.

The existing on-demand chunk limit remains unchanged and passes: largest on-demand chunk is gzip 8488/20480 B, Brotli 7636/18432 B. No IP fact was added. To switch the ssh-bootstrap branch, replace its private collector with infraternal-plugin-host-facts and instantiate HostFactsPlugin::new(AgentMode::Remote); the Rust fields keep os, arch, uid, version, and cpus, while serde keeps the browser keys architecture, executionUid, and logicalCpus on the wire. This branch has no remote transport route to wire yet.

Finished on head 38b53f456dcb0d7c2abb02e35a32a66bca88c101. `scripts/verify fast` completed with Result=success. Verbatim gate summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Tracer unit output: `56 pass`, `0 fail`, `9946 expect() calls`; stream differential: `134 streams, 11439 schedules, zero divergences`; protocol output: `7 pass`, `0 fail`, `34390 expect() calls`. `bun run check` exits 0; `details.spec.ts` passes 4/4; real production host-facts spec passes 1/1. Screenshot: `apps/tracer/real/host-facts-popover.png`. The existing on-demand chunk limit remains unchanged and passes: largest on-demand chunk is gzip 8488/20480 B, Brotli 7636/18432 B. No IP fact was added. To switch the ssh-bootstrap branch, replace its private collector with `infraternal-plugin-host-facts` and instantiate `HostFactsPlugin::new(AgentMode::Remote)`; the Rust fields keep `os`, `arch`, `uid`, `version`, and `cpus`, while serde keeps the browser keys `architecture`, `executionUid`, and `logicalCpus` on the wire. This branch has no remote transport route to wire yet.

kayg commented

2026-10-09 17:15:48 +00:00

Author

Owner

Independent review started on review-host-facts, detached target now branched at 38b53f456dcb0d7c2abb02e35a32a66bca88c101; merge base with dev 42e50d42c5e43dabc3da89de4b01dd92329bf030. Read all #144 and related #127 comments, project contracts/process and author report. Verifying behavior and recording failing tests without implementation changes.

Independent review started on `review-host-facts`, detached target now branched at `38b53f456dcb0d7c2abb02e35a32a66bca88c101`; merge base with dev `42e50d42c5e43dabc3da89de4b01dd92329bf030`. Read all #144 and related #127 comments, project contracts/process and author report. Verifying behavior and recording failing tests without implementation changes.

kayg commented

2026-10-09 17:20:06 +00:00

Author

Owner

Review step: committed HF-R1 (P2) as a19cb139: default Host rows keep secondary facts behind more fails (2 existing tests pass, 1 new test fails). apps/tracer/src/canvas/windows/details-facts.ts:79 puts Init/Virtualization/Shell/Locale directly in default Host rows, contrary to #144 and D126. Evidence log: /home/kayg/.cache/codex-scratch/host-facts-review/more-test.log. Pristine head fast gate initially lacked make; rerunning with the documented Nix make/perl/Zig environment.

Review step: committed HF-R1 (P2) as a19cb139: `default Host rows keep secondary facts behind more` fails (2 existing tests pass, 1 new test fails). `apps/tracer/src/canvas/windows/details-facts.ts:79` puts Init/Virtualization/Shell/Locale directly in default Host rows, contrary to #144 and D126. Evidence log: `/home/kayg/.cache/codex-scratch/host-facts-review/more-test.log`. Pristine head fast gate initially lacked make; rerunning with the documented Nix make/perl/Zig environment.

kayg commented

2026-10-09 17:22:48 +00:00

Author

Owner

Review step: HF-R2 (P2), commit 687c9750af: a refused host facts action stops its recurring timer fails (0 pass / 1 fail; expected 0 timers, received 1). At apps/tracer/src/canvas/sessions/details-live.on-demand.ts:79, Result(ok=false) for a disabled/build-removed plugin schedules another read indefinitely while open. D198 requires no timer/background work when off. Deterministic test observes the real details source after ActionRefused(action unavailable); no implementation changes.

Review step: HF-R2 (P2), commit 687c9750af54ad024c0fe37ad399d669dee7fb3b: `a refused host facts action stops its recurring timer` fails (0 pass / 1 fail; expected 0 timers, received 1). At `apps/tracer/src/canvas/sessions/details-live.on-demand.ts:79`, Result(ok=false) for a disabled/build-removed plugin schedules another read indefinitely while open. D198 requires no timer/background work when off. Deterministic test observes the real details source after ActionRefused(action unavailable); no implementation changes.

kayg commented

2026-10-09 17:27:13 +00:00

Author

Owner

Review scale evidence committed as 859ecdb7ef: cargo run --release -p infraternal-plugin-host-facts --example review_scale under CPUWeight=10000 on infraternal-dev (x86_64, 8 cores), load 27.84→27.45. Worst-case 500 distinct hosts × 5 viewers: 500 collector initialization 120.32 ms; 2500 sequential live reads 132.12 ms; retained collector RSS delta 581632 B (1163 B/host); JSON 1340000 B/round. This measures real local collection/serialization, not concurrent end-to-end remote latency. Original example independently reproduces 357/538 B JSON and 782/1180 B two-leg frames; static p50/p95 137.94/297.97 µs, live 24.50/38.58 µs.

Review scale evidence committed as 859ecdb7effbfe5e8fe441b91dd3e1cbefd9bb2e: `cargo run --release -p infraternal-plugin-host-facts --example review_scale` under CPUWeight=10000 on infraternal-dev (x86_64, 8 cores), load 27.84→27.45. Worst-case 500 distinct hosts × 5 viewers: 500 collector initialization 120.32 ms; 2500 sequential live reads 132.12 ms; retained collector RSS delta 581632 B (1163 B/host); JSON 1340000 B/round. This measures real local collection/serialization, not concurrent end-to-end remote latency. Original example independently reproduces 357/538 B JSON and 782/1180 B two-leg frames; static p50/p95 137.94/297.97 µs, live 24.50/38.58 µs.

kayg commented

2026-10-09 17:29:45 +00:00

Author

Owner

Confirmed HF-R3 (P1), committed failing test 2046c247f8: non_owner_without_host_configure_permission_is_refused_before_leg_b fails (0 passed / 1 failed). A real unlocked non-owner session, with no role grant, sends host.facts.configure / {"enabled":false}; the real WebSocket router forwards it over the embedded infraternal agent socket. crates/infraternal-server/src/websocket.rs:970 checks body lengths and session liveness but never the declared action permission/host scope. This permits a non-owner to change host-wide settings affecting other users (D29; contracts/plugin.md §4; wire.md §7). Evidence log: /home/kayg/.cache/codex-scratch/host-facts-review/permission-test.log. No implementation fix.

Confirmed HF-R3 (P1), committed failing test 2046c247f88c98c6a76a30d64202c324ce711c22: `non_owner_without_host_configure_permission_is_refused_before_leg_b` fails (0 passed / 1 failed). A real unlocked non-owner session, with no role grant, sends `host.facts.configure` / `{"enabled":false}`; the real WebSocket router forwards it over the embedded infraternal agent socket. `crates/infraternal-server/src/websocket.rs:970` checks body lengths and session liveness but never the declared action permission/host scope. This permits a non-owner to change host-wide settings affecting other users (D29; contracts/plugin.md §4; wire.md §7). Evidence log: `/home/kayg/.cache/codex-scratch/host-facts-review/permission-test.log`. No implementation fix.

kayg commented

2026-10-09 17:33:36 +00:00

Author

Owner

Review HF-R4 (P2), committed 53a37ca42d: pending_host_facts_read_keeps_control_ping_responsive fails (0 passed / 1 failed, 1.66s). Hold the facts Result on a real leg-B socket after confirming host.facts.read was forwarded; the same real browser socket cannot receive Pong for an independent Ping within one second. websocket.rs:973 awaits plugin completion inside the main receive/output loop, blocking unrelated terminal/control traffic. Separate checks: pristine target fast gate first run failed initial_attach_requires_explicit_credit_before_replay (existing test); native latency profile under load missed same-session flood p99 (416.76 ms vs 334 ms; growth 88.53 ms vs 16.67 ms). Investigating/replaying these gate failures, not treating the run as green.

Review HF-R4 (P2), committed 53a37ca42d8ebf5f4594c051e93a563045bd5eed: `pending_host_facts_read_keeps_control_ping_responsive` fails (0 passed / 1 failed, 1.66s). Hold the facts Result on a real leg-B socket after confirming host.facts.read was forwarded; the same real browser socket cannot receive Pong for an independent Ping within one second. `websocket.rs:973` awaits plugin completion inside the main receive/output loop, blocking unrelated terminal/control traffic. Separate checks: pristine target fast gate first run failed `initial_attach_requires_explicit_credit_before_replay` (existing test); native latency profile under load missed same-session flood p99 (416.76 ms vs 334 ms; growth 88.53 ms vs 16.67 ms). Investigating/replaying these gate failures, not treating the run as green.

kayg commented

2026-10-09 17:34:44 +00:00

Author

Owner

Gate clarification: the initial fast test failure was fixture setup, not a measured timeout: verify-agent-attach-credit.py attempted target/ac3411167 with no target/ parent in the pristine scratch checkout and raised FileNotFoundError. Build output remains under job scratch; an ignored target symlink now supplies the existing fixture path. The standalone latency run used the native debug binary (supplemental, not the prescribed optimized gate); release-profile latency remains pending static build. Production UI + real native server host-facts spec independently passes 1/1 in 15.0s; screenshot docs/reviews/host-facts-popover.png.

Gate clarification: the initial fast test failure was fixture setup, not a measured timeout: `verify-agent-attach-credit.py` attempted `target/ac3411167` with no `target/` parent in the pristine scratch checkout and raised FileNotFoundError. Build output remains under job scratch; an ignored target symlink now supplies the existing fixture path. The standalone latency run used the native debug binary (supplemental, not the prescribed optimized gate); release-profile latency remains pending static build. Production UI + real native server host-facts spec independently passes 1/1 in 15.0s; screenshot `docs/reviews/host-facts-popover.png`.

kayg commented

2026-10-09 17:41:08 +00:00

Author

Owner

Review checks: committed the test-only clock naming correction as e362fc8cf6; warning-denied all-target Clippy passes for infraternal-server and infraternal-plugin-host-facts. cargo check --locked -p infraternal --no-default-features passes on the pristine target, verifying backend build-time removal. Seeded host-facts fuzz run completed 1740295 executions in 31s, max input 20000 B, RSS 261 MiB, no crash (valid and oversized request/file seeds included). Findings remain 1 P1 + 3 P2.

Review checks: committed the test-only clock naming correction as e362fc8cf6902af500f8348eca4c0c429dc0e17b; warning-denied all-target Clippy passes for `infraternal-server` and `infraternal-plugin-host-facts`. `cargo check --locked -p infraternal --no-default-features` passes on the pristine target, verifying backend build-time removal. Seeded host-facts fuzz run completed 1740295 executions in 31s, max input 20000 B, RSS 261 MiB, no crash (valid and oversized request/file seeds included). Findings remain 1 P1 + 3 P2.

kayg commented

2026-10-09 17:46:30 +00:00

Author

Owner

Optimized gate evidence: x86_64 stripped static binary independently matches author report at 16031568 B, PT_INTERP absent. Native real-agent latency profile (20 samples, 300 ms RTT; CPUWeight=10000, load 17.46→18.15) passes baseline echo and other-session flood, but same-session flood fails: echo p99 427.10 ms vs 334 ms, growth 101.61 ms vs 16.67 ms. The full scripts/verify latency profile is running with unique TRACER_TEST_PORT=4295. These budget failures are recorded without claiming a branch-induced regression; the confirmed mux-dispatch isolation gap has its own deterministic failing test HF-R4.

Optimized gate evidence: x86_64 stripped static binary independently matches author report at 16031568 B, PT_INTERP absent. Native real-agent latency profile (20 samples, 300 ms RTT; CPUWeight=10000, load 17.46→18.15) passes baseline echo and other-session flood, but same-session flood fails: echo p99 427.10 ms vs 334 ms, growth 101.61 ms vs 16.67 ms. The full `scripts/verify latency` profile is running with unique TRACER_TEST_PORT=4295. These budget failures are recorded without claiming a branch-induced regression; the confirmed mux-dispatch isolation gap has its own deterministic failing test HF-R4.

kayg commented

2026-10-09 17:50:42 +00:00

Author

Owner

D170 scale evidence committed as e1dc889742. Optimized direct runs under CPUWeight=10000 on infraternal-dev (8 cores), load 5.41/14.22/18.91 recorded immediately around both runs: 1000 collectors initialization 151.22 ms, retained RSS delta 1028096 B (1028 B/node ×1000); 10000 initialization 1401.62 ms, RSS delta 7864320 B (786 B/node ×10000). For 200 active hosts ×5 viewers, 1000 live calls took 28.01/24.12 ms and produced 535000 B JSON each round. Example accepts only 1000/10000 nodes. Both static head binary sizes independently match the author: x86 16031568 B, ARM 13482320 B; static checks pass. Clean fast rerun and full latency profile continue.

D170 scale evidence committed as e1dc88974287100338cba20bcf45603666b995eb. Optimized direct runs under CPUWeight=10000 on infraternal-dev (8 cores), load 5.41/14.22/18.91 recorded immediately around both runs: 1000 collectors initialization 151.22 ms, retained RSS delta 1028096 B (1028 B/node ×1000); 10000 initialization 1401.62 ms, RSS delta 7864320 B (786 B/node ×10000). For 200 active hosts ×5 viewers, 1000 live calls took 28.01/24.12 ms and produced 535000 B JSON each round. Example accepts only 1000/10000 nodes. Both static head binary sizes independently match the author: x86 16031568 B, ARM 13482320 B; static checks pass. Clean fast rerun and full latency profile continue.

kayg commented

2026-10-09 17:55:59 +00:00

Author

Owner

Pristine target 38b53f456dcb0d7c2abb02e35a32a66bca88c101: clean scripts/verify fast exits 0. Full output committed verbatim as d762c7c0 at docs/reviews/host-facts-fast.md on review-host-facts (including load, Rust tests and TypeScript/transfer outputs). Tracer 56 pass/0 fail; protocol 7 pass/0 fail; differential 134 streams/11439 schedules/zero divergences. Gate summary, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Review tests remain intentionally failing; no implementation fixes. Full latency run already fails native same-session flood and has reached an unrelated canvas scrolling browser failure; baseline comparison and final counts remain pending.

Pristine target `38b53f456dcb0d7c2abb02e35a32a66bca88c101`: clean `scripts/verify fast` exits 0. Full output committed verbatim as d762c7c0 at `docs/reviews/host-facts-fast.md` on review-host-facts (including load, Rust tests and TypeScript/transfer outputs). Tracer 56 pass/0 fail; protocol 7 pass/0 fail; differential 134 streams/11439 schedules/zero divergences. Gate summary, verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Review tests remain intentionally failing; no implementation fixes. Full latency run already fails native same-session flood and has reached an unrelated canvas scrolling browser failure; baseline comparison and final counts remain pending.

kayg commented

2026-10-09 18:00:51 +00:00

Author

Owner

Verification setup correction: later canvas browser failures in the first full latency attempt are invalid. The concurrently finishing fast gate ran bun run build without INFRATERNAL_CLUSTERS_PREVIEW, replacing the preview assets served by Playwright from the same scratch checkout. build.ts:18-36 removes mock canvas modules in that mode. Stopped that attempt and restarted full scripts/verify latency after the fast gate completed, with unique TRACER_TEST_PORT=4297 and no concurrent UI rebuild. Earlier native latency metrics remain valid; no browser failures from the collided build are counted as findings. The separate optimized merge-base baseline build continues for latency attribution.

Verification setup correction: later canvas browser failures in the first full latency attempt are invalid. The concurrently finishing fast gate ran `bun run build` without INFRATERNAL_CLUSTERS_PREVIEW, replacing the preview assets served by Playwright from the same scratch checkout. `build.ts:18-36` removes mock canvas modules in that mode. Stopped that attempt and restarted full `scripts/verify latency` after the fast gate completed, with unique TRACER_TEST_PORT=4297 and no concurrent UI rebuild. Earlier native latency metrics remain valid; no browser failures from the collided build are counted as findings. The separate optimized merge-base baseline build continues for latency attribution.

kayg commented

2026-10-09 18:09:44 +00:00

Author

Owner

Independent merge-base comparison: optimized x86_64 musl baseline at 42e50d42 (same machine/toolchain, separate build target, CPUWeight=10000) is 15965392 B; head is 16031568 B, independently confirming +66176 B. Native latency default 100-sample baseline under load 4.67→3.51 also fails same-session flood: echo p99 523.79 ms vs 334 ms, growth 197.44 ms vs 16.67 ms; baseline echo and other-session flood pass. Head clean rerun native same-session echo p99 486.84 ms, growth 160.22 ms. The existing budget failure remains FAIL; it is not counted as a branch-induced finding. Preview browser cases invalidated by the first run’s asset collision now pass with no concurrent UI rebuild. Review findings remain 1 P1 + 3 P2.

Independent merge-base comparison: optimized x86_64 musl baseline at 42e50d42 (same machine/toolchain, separate build target, CPUWeight=10000) is 15965392 B; head is 16031568 B, independently confirming +66176 B. Native latency default 100-sample baseline under load 4.67→3.51 also fails same-session flood: echo p99 523.79 ms vs 334 ms, growth 197.44 ms vs 16.67 ms; baseline echo and other-session flood pass. Head clean rerun native same-session echo p99 486.84 ms, growth 160.22 ms. The existing budget failure remains FAIL; it is not counted as a branch-induced finding. Preview browser cases invalidated by the first run’s asset collision now pass with no concurrent UI rebuild. Review findings remain 1 P1 + 3 P2.

kayg commented

2026-10-09 18:26:33 +00:00

Author

Owner

HF-R5 (P3): detected OS reaches the System row but not the existing popover OS mark (D126/D158). Live-source test confirms Debian GNU/Linux 13 then expects debian and receives undefined: 0 pass / 1 fail. Committed on review-host-facts at 81fd3d58; no implementation change. Findings now 1 P1, 3 P2, 1 P3.

HF-R5 (P3): detected OS reaches the System row but not the existing popover OS mark (D126/D158). Live-source test confirms Debian GNU/Linux 13 then expects debian and receives undefined: 0 pass / 1 fail. Committed on review-host-facts at 81fd3d58; no implementation change. Findings now 1 P1, 3 P2, 1 P3.

kayg commented

2026-10-09 18:28:25 +00:00

Author

Owner

Completed independent baseline evidence, commit c56ca190: docs/reviews/host-facts-baseline.md contains stripped size comparison and verbatim 100-sample native baseline output. Rebuilt x86_64: 15965392 → 16031568 B (+66176); aarch64: 13426064 → 13482320 B (+56256). Merge-base same-session echo p99 523.79 ms and growth 197.44 ms fail the same budgets as head (486.84 / 160.22 ms). This is an existing gate failure, not evidence of a branch-induced regression. Final review TypeScript check passes (exit 0).

Completed independent baseline evidence, commit c56ca190: docs/reviews/host-facts-baseline.md contains stripped size comparison and verbatim 100-sample native baseline output. Rebuilt x86_64: 15965392 → 16031568 B (+66176); aarch64: 13426064 → 13482320 B (+56256). Merge-base same-session echo p99 523.79 ms and growth 197.44 ms fail the same budgets as head (486.84 / 160.22 ms). This is an existing gate failure, not evidence of a branch-induced regression. Final review TypeScript check passes (exit 0).

kayg commented

2026-10-09 18:32:22 +00:00

Author

Owner

Clean canonical latency run (port 4297) has three browser failures so far: add-host wizard material, view-flight timing, toolbar gesture row. Final failure details and counts are pending. Running those identical tests on the independently built merge-base checkout to distinguish existing failures. Initial baseline port 4298 was already occupied; no process was touched, rerun uses free port 49217. No additional branch finding is inferred yet.

kayg commented

2026-10-09 18:35:12 +00:00

Author

Owner

Browser attribution evidence committed in docs/reviews/host-facts-browser-comparison.md: wizard assertion fails identically on merge base (expected blur16px, received blur8px saturate1.6). Flight and toolbar pass there (2 pass/1 fail subset, 45.5s) and on an isolated head retry (2 pass/0 fail, 38.7s). Head retry pointerBack 308ms vs initial574ms; no branch-induced regression established. Original canonical gate failures remain recorded. Ports 49217/49218; separate production assets; CPUWeight10000 and loads retained.

kayg commented

2026-10-09 18:39:54 +00:00

Author

Owner

Evidence archived: 89173fe9 adds docs/reviews/host-facts-findings.md with all five failing test outputs. bb8493c2 adds Source Code Pro fixture retries to browser-comparison evidence: baseline 1/1 pass (11.1s), head 1/1 pass (10.9s), ports49219/49220. The original canonical font failure was a mock text-output socket hang-up before the font assertion; it remains counted in that run. Full gate still running; no implementation changes.

Evidence archived: 89173fe9 adds docs/reviews/host-facts-findings.md with all five failing test outputs. bb8493c2 adds Source Code Pro fixture retries to browser-comparison evidence: baseline 1/1 pass (11.1s), head 1/1 pass (10.9s), ports49219/49220. The original canonical font failure was a mock text-output socket hang-up before the font assertion; it remains counted in that run. Full gate still running; no implementation changes.

kayg commented

2026-10-09 18:46:01 +00:00

Author

Owner

Comparison evidence in docs/reviews/host-facts-browser-comparison.md: 9d10458a reproduces all4 DPR3 toast visibility failures on merge base. 0199b600 records unresolved mesh frame budget: canonical head pan p95 100.1ms vs60ms at load/core1.05; baseline33.4ms passes at1.11; head retry raw116.6ms passes only with higher load-adjusted allowance at1.59. The retry does not clear the original failure or establish causation. Keep this performance result unresolved, separate from the five confirmed failing-test findings. Full canonical browser suite remains running.

Comparison evidence in docs/reviews/host-facts-browser-comparison.md: 9d10458a reproduces all4 DPR3 toast visibility failures on merge base. 0199b600 records unresolved mesh frame budget: canonical head pan p95 100.1ms vs60ms at load/core1.05; baseline33.4ms passes at1.11; head retry raw116.6ms passes only with higher load-adjusted allowance at1.59. The retry does not clear the original failure or establish causation. Keep this performance result unresolved, separate from the five confirmed failing-test findings. Full canonical browser suite remains running.

kayg commented

2026-10-09 18:48:57 +00:00

Author

Owner

Completed motion-audit comparison, ad931f73: canonical head and merge base both expect tooltip width190px and receive169px. Baseline case fails in12.7s on port49224; load and verbatim failure excerpt retained in docs/reviews/host-facts-browser-comparison.md. This is an existing unchanged-tooltip assertion failure. Canonical full run remains in progress; five confirmed host-facts findings unchanged.

Completed motion-audit comparison, ad931f73: canonical head and merge base both expect tooltip width190px and receive169px. Baseline case fails in12.7s on port49224; load and verbatim failure excerpt retained in docs/reviews/host-facts-browser-comparison.md. This is an existing unchanged-tooltip assertion failure. Canonical full run remains in progress; five confirmed host-facts findings unchanged.

kayg commented

2026-10-09 18:56:24 +00:00

Author

Owner

Completed late browser comparisons, 52e2b6ed: baseline8/8 fail. Seven match head assertions (onboarding connection, palette filter budget, predictive-backspace per-key budget, four sign-in screenshots). Predictive capture fails at different stages: head visibility remains hidden on retry, baseline fixture GET or connection precondition fails. This case remains unresolved, alongside mesh frame budget; no new production-cause finding inferred. Loads, separate ports49225–49227 and redacted error logs retained in docs/reviews/host-facts-browser-comparison.md. Full gate still running.

Completed late browser comparisons, 52e2b6ed: baseline8/8 fail. Seven match head assertions (onboarding connection, palette filter budget, predictive-backspace per-key budget, four sign-in screenshots). Predictive capture fails at different stages: head visibility remains hidden on retry, baseline fixture GET or connection precondition fails. This case remains unresolved, alongside mesh frame budget; no new production-cause finding inferred. Loads, separate ports49225–49227 and redacted error logs retained in docs/reviews/host-facts-browser-comparison.md. Full gate still running.

kayg commented

2026-10-09 19:07:47 +00:00

Author

Owner

Canonical pristine-head scripts/verify latency completed: exit1; tracer293 passed/22 failed/26 skipped in1.0h. Full output (test-session headers redacted) archived at3ed32a66 in docs/reviews/host-facts-latency.md. Native same-session failure reproduces on merge base; auth browser4scenarios and native recovery2scenarios pass. Bulk-output prediction delta −1.31% passes −5% budget. Scene crash comparison/retry evidence was committed at8102a667 (baseline24.2s pass, head23.8s pass). Final access/mobile comparisons are still running; resume comparison stopped at an earlier baseline connection assertion. Five confirmed host-facts findings remain1P1/3P2/1P3.

kayg commented

2026-10-09 19:13:40 +00:00

Author

Owner

Verdict: merge after fixes. Findings: 0 P0, 1 P1, 3 P2, 1 P3.

Reviewed target38b53f456dcb0d7c2abb02e35a32a66bca88c101 against merge base42e50d42c5e43dabc3da89de4b01dd92329bf030. Final local review-host-facts head: 19e1891915. No implementation fixes, pushes or issue closure.

Confirmed tests: HF-R3(P1) non-owner configuration permission bypass; HF-R4(P2) pending facts read blocks socket control; HF-R2(P2) refused plugin keeps polling; HF-R1(P2) secondary fields exposed before more; HF-R5(P3) detected OS mark unset. Each has a committed failing test. Full test outputs: docs/reviews/host-facts-findings.md. Review and measurements: docs/reviews/host-facts.md. Production screenshot: docs/reviews/host-facts-popover.png. Findings index: /home/kayg/.local/state/codex-jobs/infraternal/review-host-facts/findings.md.

Pristine-target scripts/verify fast: PASS, exit0, entire output below verbatim, also committed in docs/reviews/host-facts-fast.md. Review TypeScript and warning-denied focused all-target Clippy pass; feature-removal check passes.

Canonical scripts/verify latency: FAIL, exit1. Native same-session budget failure reproduces on merge base; auth4scenarios and recovery2scenarios pass. Browser293pass/22fail/26skip in1.0h. Fifteen cases have matching baseline assertions or measured budget failures; five pass isolated head retries. Mesh frame budget and predictive-capture visibility remain unresolved. Full gate and comparisons are archived in docs/reviews/host-facts-latency.md and host-facts-browser-comparison.md. Retries do not clear the original gate. Final comparisons066c7afc; final report/screenshot19e18919.

D170: 1000/10000 retained collectors, RSS deltas1028096/7864320B; 200active hosts×5viewers, 1000sequential live reads28.01/24.12ms. Collector-only, not fleet/network/UI memory. Rebuilt stripped growth +66176B x86_64 / +56256B aarch64. Seeded fuzz1740295executions/31s, no crash. Machine/load and scope limits are in the report. Temporary builds/checkouts are being removed after evidence archival.

scripts/verify fast — complete pristine-head output, verbatim

METRIC name=network_rtt_selftest configured_rtt_ms=300 jitter_ms=30 loss=unsupported transport=tcp-stream n=3 p50_ms=305.25 p99_ms=319.85 result=PASS

==> fmt

==> VT native fmt

==> clippy
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.56s

==> test
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.40s
     Running unittests src/main.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal-c1f8694317415770)

running 2 tests
test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok
test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/agent_daemon.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_daemon-e37040ed9293cb16)

running 1 test
test real_binary_preserves_input_and_output_across_24_abrupt_stops ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.14s

     Running tests/agent_queues.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_queues-2f329ae7b2cad15f)

running 1 test
test saturated_terminal_queues_preserve_every_byte_and_daemon_liveness ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 35.20s

     Running tests/agent_review.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_review-48a255937cca9ce1)

running 6 tests
test stalled_terminal_never_delays_control_or_sibling_dispatch ... ok
test last_typist_selects_its_own_real_pty_dimensions ... ok
test initial_attach_requires_explicit_credit_before_replay ... ok
test retained_unwritten_input_survives_interleaved_ack_restart ... ok
test two_writers_keep_independent_ack_and_exact_input_after_restart ... ok
test repeated_tiny_credit_pauses_preserve_shell_progress ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 15.79s

     Running tests/agent_sessions.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_sessions-b3b39d2e45ad0eb5)

running 1 test
test detached_shim_is_discovered_and_replays_from_the_last_observed_offset ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

     Running tests/idle_canary.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/idle_canary-d2fff69fba46d0f3)

running 1 test
test one_hertz_wakeup_is_detected_past_the_legacy_half_second_window ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.13s

     Running tests/shim.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/shim-cf4b4029b039ff5d)

running 7 tests
test double_fork_survives_parent_death ... ok
test replacement_connection_and_malformed_limit ... ok
test disallowed_signal_only_disconnects_peer ... ok
active
test real_shell_reconnect_resize_and_retained_exit ... ok
test user_scope_survives_parent_unit_stop ... ok
test attached_backpressure_and_detached_progress ... ok
test ring_wrap_snapshot_repaints_real_vim ... ok

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.23s

     Running tests/vt_credit.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/vt_credit-78d4da44c9250f83)

running 1 test
test unaffordable_repaints_park_until_sufficient_credit ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 20.74s

     Running tests/vt_reconnect.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/vt_reconnect-4c65cf46be9cbc1e)

running 1 test
test snapshot_limits_never_close_live_reconnect ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.15s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_agent-e1bd03594facf472)

running 16 tests
test relay::tests::output_payload_move_measurement ... ignored, release ownership versus payload-copy measurement
test relay::tests::input_overlap_gap_and_restart_from_confirmed_offset ... ok
test relay::tests::attachment_has_no_implicit_output_or_snapshot_credit ... ok
test relay::tests::expired_credit_resumes_retained_bytes_at_the_same_cursor ... ok
test relay::tests::overflowing_ranges_never_mutate_cursors ... ok
test relay::tests::positive_insufficient_credit_arms_a_one_shot_deadline ... ok
test relay::tests::output_partial_credit_and_dedup ... ok
test relay::tests::returned_credit_cancels_starvation_and_state_has_no_payload_buffer ... ok
test relay::tests::starvation_is_one_shot_and_snapshot_length_does_not_advance_sequence ... ok
test sessions::tests::reader_borrow_measurement ... ignored, release borrowed versus owned asynchronous receive measurement
test sessions::tests::symlink_state_cannot_redirect_private_runtime_storage ... ok
test sessions::tests::refused_socket_is_removed_but_insecure_directory_is_rejected ... ok
test sessions::tests::sequenced_attach_intersects_caps_and_legacy_attach_stays_zero ... ok
test sessions::tests::post_listen_chmod_wakes_a_connection_refused_at_bind ... ok
test sessions::tests::borrowed_reader_payload_uses_reusable_cancel_safe_storage ... ok
test sessions::tests::cancelled_fragmented_shim_read_retains_header_and_body_progress ... ok

test result: ok. 14 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.03s

     Running tests/transport.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/transport-8f3460b3ccba6a28)

running 2 tests
test oversized_header_and_truncated_frame_are_rejected ... ok
test fragmented_headers_coalesced_frames_and_reusable_transmit ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_mesh-3f967587718407e9)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/default_arrow.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/default_arrow-312553ba19630584)

running 1 test
test omitted_arrow_ports_default_to_all_services ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/properties.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/properties-78f35bbe1b57dcd5)

running 14 tests
test overlaps_are_reported_without_silent_range_changes ... ok
test directional_grants_union_and_minimal_updates ... ok
test exhausted_versions_reject_mutations_without_changing_state ... ok
test names_versions_and_backend_status ... ok
test arrow_replacement_is_atomic_and_unrelated_nodes_keep_their_versions ... ok
test checkpoint_after_suffix_change_restores_without_reallocating_addresses ... ok
test private_material_never_enters_debug_or_coordination_serialization ... ok
test join_to_same_tag_grants_both_initiation_directions ... ok
test server_rotation_has_continuous_keys_for_every_node_during_delivery ... ok
test rotation_waits_for_overlap_and_delivery_and_removal_drops_every_key ... ok
test public_checkpoint_preserves_addresses_rules_versions_and_overlap ... ok
test protocol_port_unions_never_grant_an_unlisted_service ... ok
test addresses_are_unique_stable_and_not_recycled ... ok
test seeded_random_sequences_equal_full_compile_and_deny_without_grants ... ok

test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.21s

     Running tests/rotation_time.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/rotation_time-a58dd287253d611d)

running 1 test
test unrepresentable_rotation_overlap_rejects_before_mutation ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2)

running 2 tests
test tests::registry_rejects_oversized_json_before_plugin_dispatch ... ok
test tests::registry_routes_only_declared_actions ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_plugin_host_facts-0cb65db9fbee717c)

running 9 tests
test tests::descriptor_declares_default_settings_actions_and_no_hidden_role_dependency ... ok
test tests::linux_load_average_text_ignores_proc_metadata_and_rejects_invalid_values ... ok
test tests::os_release_parser_rejects_unbounded_input_and_ignores_untrusted_lines ... ok
test tests::action_decoders_reject_unknown_and_oversized_fields ... ok
test tests::compatibility_fields_are_kept_in_the_rust_shape_and_architecture_on_wire ... ok
test tests::static_facts_are_cached_and_live_counters_are_collected_only_when_requested ... ok
test tests::os_release_uses_distribution_name_and_version_without_shell_evaluation ... ok
test tests::macos_load_average_decodes_the_bounded_64_bit_sysctl_shape ... ok
test tests::runtime_disable_drops_cached_facts_and_reenable_collects_them_again ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_protocol-67b9a310ef49abf9)

running 7 tests
test tests::rejects_oversized_noncanonical_and_malformed_frames_before_buffering_body ... ok
test tests::mux_round_trip_and_incremental_decoders_preserve_frame_order ... ok
test stream_tests::split_mux_header_preserves_trailing_close ... ok
test tests::oversized_encode_keeps_the_reusable_output_unchanged ... ok
test tests::golden_vectors_encode_and_decode_every_contract_frame ... ok
test stream_tests::all_short_frame_splits_match_direct_decoding ... ok
test stream_tests::maximum_sized_fragmented_frame_is_not_rejected ... ok

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_server-32c9e179fdf7b126)

running 109 tests
test auth::tests::aaguid_projection_rejects_malformed_cbor_corpus ... ok
test auth::tests::account_identity_migration_backfills_legacy_users ... ok
test auth::tests::aaguid_migration_preserves_legacy_credentials_and_sessions ... ok
test auth::tests::account_identity_schema_has_unique_usernames_and_display_names ... ok
test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok
test auth::http::hostname_tests::authenticated_session_response_includes_system_hostname ... ok
test auth::crypto::verifier_tests::browser_secret_hashing_is_canonical_and_bounded ... ok
test auth::crypto::verifier_tests::recovery_capacity_denial_is_not_a_legacy_credential_signal ... ok
test auth::tests::audit_ceremony_browser_binding ... ok
test auth::tests::audit_logout_survives_admission_exhaustion ... ok
test auth::tests::discoverable_latency_at_pending_capacity ... ignored, run --release --ignored --nocapture without concurrent builds
test auth::tests::audit_no_public_credential_listing ... ok
test auth::tests::audit_recovery_after_page_discard_can_resume_at_original_deadline ... ok
test auth::tests::audit_recovery_pending_is_visible_to_signed_in_device ... ok
test auth::tests::audit_recovery_session_expiring_during_verification_keeps_delay ... ok
test auth::tests::provider_labels_cover_the_cited_registry_without_guessing ... ok
test auth::tests::provider_session_latency_at_50_devices ... ignored, local auth session scale measurement; run without concurrent builds
test auth::tests::authenticated_prf_metadata_preserves_legacy_envelopes ... ok
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::discoverable_login_handle_credential_counter_and_replay ... ok
test auth::tests::enrollment_prf_input_matches_discoverable_login ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::pending_unlock_expires_without_terminal_authority ... ok
test auth::tests::public_status_and_discoverable_http_login ... ok
test auth::tests::recovery_session_delay_latency_at_capacity ... ignored, release-only recovery measurement at 50 live sessions; run without concurrent compilation
test auth::tests::recovery_audit_commits_once_with_start_cancel_and_complete ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::recovery_verifier_latency_at_capacity ... ignored, release-only v2 diagnostic at 50 live session rows; record host load separately
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::recovery_http_live_same_account_is_immediate ... ok
test auth::tests::recovery_http_other_expired_pending_and_missing_sessions_wait ... ok
test auth::tests::recovery_live_session_cannot_accelerate_an_active_delayed_request ... ok
test auth::tests::recovery_live_session_revoked_during_verification_cannot_waive_delay ... ok
test auth::tests::recovery_unknown_identity_pays_the_same_database_and_verifier_work ... ok
test auth::tests::recovery_username_identity_is_additive_and_ambiguous_forms_fail ... ok
test auth::tests::redacted_unknown_and_failed_registrations_do_not_claim_a_provider ... ok
test auth::tests::registration_aaguid_survives_none_attestation_and_binds_session_provider ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::review3_tests::review3_backend_reply_has_a_deadline ... ok
test auth::tests::review3_tests::review3_busy_expiry ... ok
test auth::tests::review3_tests::review3_busy_logout ... ok
test auth::tests::review3_tests::review3_busy_recovery ... ok
test auth::tests::review3_tests::review3_completion_and_cleanup_are_transaction_bound ... ok
test auth::tests::review3_tests::review3_expired_handshake_must_not_welcome ... ok
test auth::tests::review3_tests::review4_slow_open_at_user_capacity ... ignored, release-only connect scale measurement; run without concurrent builds
test auth::tests::review3_tests::review3_identified_privacy_timing_and_binding_replays ... ok
test auth::tests::review3_tests::review3_pending_routes_and_idle_expiry_recovery ... ok
test auth::tests::review3_tests::review3_revoked_handshake_must_not_welcome ... ok
test auth::tests::review3_tests::review3_revoked_resume_must_not_welcome ... ok
test auth::tests::review3_tests::review3_unwrap_cannot_be_skipped ... ok
test auth::tests::review3_tests::review3_waiting_handshake_loses_authority ... ok
test auth::tests::review3_tests::review4_open_reply_and_revocation_preserve_authority ... ok
test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok
test auth::tests::review_old_words_race_rotation ... ok
test auth::tests::reviewer_tests::reviewer_disk_cancel_complete_races ... ok
test auth::tests::reviewer_tests::reviewer_disk_restart_and_concurrent_resume ... ok
test auth::tests::reviewer_tests::reviewer_http_denials_and_recovery_admission ... ok
test auth::tests::reviewer_tests::reviewer_http_expired_capability_cannot_complete_after_writer_wait ... ok
test auth::tests::reviewer_tests::reviewer_http_expired_ceremony_cannot_complete_after_writer_wait ... ok
test auth::tests::reviewer_tests::reviewer_server_clock_rollback_retains_deadline_and_reports_more_than_day ... ok
test auth::tests::rotation_tests::recovery_phrase_routes_are_removed_and_words_fail_closed ... ok
test auth::tests::setup_check_is_non_consuming_and_closes_after_owner_creation ... ok
test auth::tests::setup_identity_validation_and_uniqueness ... ok
test auth::tests::rotation_tests::recovery_rotation_cannot_follow_a_cookie_account_switch ... ok
test auth::tests::setup_start_accepts_username_and_display_name ... ok
test auth::tests::rotation_tests::recovery_rotation_denies_pending_expired_and_stale_sessions ... ok
test auth::tests::rotation_tests::recovery_rotation_requires_session_and_replaces_legacy_envelope ... ok
test auth::tests::rotation_tests::reviewer_concurrent_signed_in_rotations_commit_once ... ok
test auth::tests::server_setup_terminal_echo_and_resume_preserve_offsets_once ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_restart_rotation_expiry_and_parallel_redemption ... ok
test auth::tests::socket_tests::authenticated_idle_socket_survives_the_former_read_timeout ... ok
test auth::tests::socket_tests::socket_authority_latency_at_user_capacity ... ignored, release-only measurement without concurrent compilation
test auth::tests::socket_tests::clean_control_close_is_not_an_internal_error ... ok
test embedded::regressions::credited_bulk_output_survives_forwarder_io_pause ... ok
test embedded::regressions::credited_output_queue_at_stream_capacity ... ignored, debug actor memory/scheduling measurement; run without concurrent builds
test embedded::regressions::full_output_queue_must_not_block_shared_actor ... ok
test embedded::regressions::healthy_receiver_survives_ready_native_output_burst ... ok
test embedded::regressions::healthy_streams_progress_at_user_attachment_capacity ... ok
test embedded::regressions::output_and_snapshot_spend_remaining_restart_credit ... ok
test embedded::regressions::real_agent_canonical_uuid_result_is_accepted ... ok
test embedded::regressions::real_agent_open_uses_uid_and_character_dimensions ... ok
test embedded::regressions::reattach_must_restore_output_credit ... ok
test embedded::regressions::recovery_event_then_snapshot_keeps_embedded_connection_live ... ok
test embedded::regressions::recovery_notices_preserve_order_credit_and_session_isolation ... ok
test embedded::regressions::stream_close_must_not_restart_all_sessions ... ok
test embedded::regressions::uncredited_output_or_repaint_is_rejected_before_queueing ... ok
test runtime::reviewer_admission::reviewer_recovery_source_limit_covers_all_routes_without_forwarding_bypass ... ok
test runtime::tests::proxy_mode_requires_an_explicit_peer_allowlist ... ok
test runtime::tests::proxy_networks_match_only_their_address_family_and_prefix ... ok
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok
test runtime::tests::router_migrates_private_storage_and_serves_health ... ok
test runtime::tests::setup_socket_cleanup_preserves_symlinks_and_regular_files ... ok
test runtime::tests::setup_token_socket_is_private_and_requires_explicit_request ... ok
test runtime::tests::startup_with_owner_unlinks_stale_setup_token_socket ... ok
test web_assets::tests::encodings_and_identity_have_correct_headers_and_sizes ... ok
test web_assets::tests::spa_and_mutable_assets_revalidate_and_missing_brotli_uses_gzip ... ok
test websocket::recovery_notification_bench::recovery_notification_state_at_socket_capacity ... ignored, notification state sizing diagnostic, not allocator-inclusive RSS certification
test websocket::writer_tests::second_device_does_not_inherit_first_device_input_ack ... ok
test websocket::writer_tests::writer_admission_at_user_capacity ... ignored, release-only scale measurement; run without concurrent builds
test websocket::writer_tests::writer_ownership_capacity_unsigned_offsets_and_identity_reuse ... ok
test runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment ... ok
test auth::tests::socket_tests::fragmented_wire_frame_has_a_completion_deadline ... ok
test auth::tests::socket_tests::half_open_sockets_obey_user_limit ... ok
test auth::tests::socket_tests::incomplete_rfc_message_still_loses_authority_on_revocation ... ok
test auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket ... ok
test auth::tests::socket_tests::revoked_idle_socket_loses_all_authority ... ok
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok

test result: ok. 100 passed; 0 failed; 9 ignored; 0 measured; 0 filtered out; finished in 102.43s

     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_shim-67ffc9c8d51fcf5c)

running 73 tests
test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement
test frame::checks::tests::golden_and_fragmented ... ok
test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok
test ring::checks::tests::wrap_and_exact_offsets ... ok
test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile
test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement
test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile
test frame::checks::golden::every_frozen_message ... ok
test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok
test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok
test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok
test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok
test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok
test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok
test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok
test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok
test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok
test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok
test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok
test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok
test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok
test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok
test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok
test terminal::checks::tests::fixtures_and_continuations_repaint ... ok
test terminal::checks::tests::partial_csi_and_utf8_continue ... ok
test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok
test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok
test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file
test terminal::checks::tests::saved_origin_survives_changed_margins ... ok
test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases
test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok
test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok
test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok
test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok
test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok
test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok
test terminal::fidelity::fidelity_iso_protection_erase ... ok
test terminal::fidelity::fidelity_cursor ... ok
test terminal::fidelity::fidelity_edge ... ok
test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok
test terminal::fidelity::fidelity_orphaned_spacer_head ... ok
test terminal::fidelity::fidelity_f1_rep ... ok
test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok
test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok
test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok
test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok
test terminal::fidelity::fidelity_saved_modes_future_restore ... ok
test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases
test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok
test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok
test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok
test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok
test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok
test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok
test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok
test terminal::fidelity::fidelity_spacer_head_attributes ... ok
test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture
test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host
test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process
test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement
test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup
test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok
test terminal::fidelity::fidelity_variation_tail_attributes ... ok
test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok
test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok
test terminal::fidelity::fidelity_variation_wrap_attributes ... ok
test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok
test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok
test terminal::fidelity::fidelity_recorded_corpus ... ok
test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok
test terminal::fidelity::fidelity_handwritten ... ok
test terminal::fidelity::fidelity_extended_smoke ... ok
test terminal::fidelity::fidelity_seeded_smoke ... ok

test result: ok. 61 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 38.82s

     Running tests/detach.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/detach-c502cd554fb112ce)

running 1 test
test closed_standard_descriptors_become_dev_null ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.76s

     Running tests/mouse.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/mouse-523bfdef43cc46cb)

running 1 test
test faithful_snapshot_preserves_public_mouse_encoder_reports ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s

   Doc-tests infraternal_agent

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_mesh

running 1 test
test crates/infraternal-mesh/src/model.rs - model::LocalPrivateKey (line 20) - compile fail ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s

   Doc-tests infraternal_plugin_api

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_host_facts

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_ssh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_protocol

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_server

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_shim

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s


==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
   ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:24:1
   │  
24 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
25 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ base64 v0.21.7
     ├── base64urlsafedata v0.5.5
     │   ├── webauthn-attestation-ca v0.5.5
     │   │   └── webauthn-rs-core v0.5.5
     │   │       └── webauthn-rs v0.5.5
     │   │           └── infraternal-server v0.1.0
     │   │               └── infraternal v0.1.0
     │   ├── webauthn-rs v0.5.5 (*)
     │   ├── webauthn-rs-core v0.5.5 (*)
     │   └── webauthn-rs-proto v0.5.5
     │       └── webauthn-rs-core v0.5.5 (*)
     ├── webauthn-rs-core v0.5.5 (*)
     └── webauthn-rs-proto v0.5.5 (*)
   ├ base64 v0.22.1
     ├── axum v0.8.9
     │   └── infraternal-server v0.1.0
     │       └── infraternal v0.1.0
     ├── infraternal-server v0.1.0 (*)
     └── sqlx-core v0.8.6
         ├── sqlx v0.8.6
         │   ├── infraternal v0.1.0 (*)
         │   └── infraternal-server v0.1.0 (*)
         ├── sqlx-macros v0.8.6
         │   └── sqlx v0.8.6 (*)
         ├── sqlx-macros-core v0.8.6
         │   └── sqlx-macros v0.8.6 (*)
         └── sqlx-sqlite v0.8.6
             ├── sqlx v0.8.6 (*)
             └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
   ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:90:1
   │  
90 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
91 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
92 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
   │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ getrandom v0.2.17
     └── rand_core v0.6.4
         ├── bip39 v2.2.2
         │   └── infraternal-server v0.1.0
         │       └── infraternal v0.1.0
         ├── crypto-common v0.1.7
         │   ├── aead v0.5.2
         │   │   └── aes-gcm v0.10.3
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   ├── cipher v0.4.4
         │   │   ├── aes v0.8.4
         │   │   │   └── aes-gcm v0.10.3 (*)
         │   │   ├── aes-gcm v0.10.3 (*)
         │   │   └── ctr v0.9.2
         │   │       └── aes-gcm v0.10.3 (*)
         │   ├── digest v0.10.7
         │   │   ├── blake2 v0.10.6
         │   │   │   └── argon2 v0.5.3
         │   │   │       └── infraternal-server v0.1.0 (*)
         │   │   ├── hmac v0.12.1
         │   │   │   └── hkdf v0.12.4
         │   │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   │   ├── sha1 v0.10.7
         │   │   │   ├── axum v0.8.9
         │   │   │   │   └── infraternal-server v0.1.0 (*)
         │   │   │   └── tungstenite v0.29.0
         │   │   │       └── tokio-tungstenite v0.29.0
         │   │   │           ├── axum v0.8.9 (*)
         │   │   │           └── (dev) infraternal-server v0.1.0 (*)
         │   │   └── sha2 v0.10.9
         │   │       ├── infraternal-server v0.1.0 (*)
         │   │       ├── sqlx-core v0.8.6
         │   │       │   ├── sqlx v0.8.6
         │   │       │   │   ├── infraternal v0.1.0 (*)
         │   │       │   │   └── infraternal-server v0.1.0 (*)
         │   │       │   ├── sqlx-macros v0.8.6
         │   │       │   │   └── sqlx v0.8.6 (*)
         │   │       │   ├── sqlx-macros-core v0.8.6
         │   │       │   │   └── sqlx-macros v0.8.6 (*)
         │   │       │   └── sqlx-sqlite v0.8.6
         │   │       │       ├── sqlx v0.8.6 (*)
         │   │       │       └── sqlx-macros-core v0.8.6 (*)
         │   │       └── sqlx-macros-core v0.8.6 (*)
         │   └── universal-hash v0.5.1
         │       └── polyval v0.6.2
         │           └── ghash v0.5.1
         │               └── aes-gcm v0.10.3 (*)
         ├── password-hash v0.5.0
         │   └── argon2 v0.5.3 (*)
         ├── rand v0.8.8
         │   └── bip39 v2.2.2 (*)
         └── rand_chacha v0.3.1
             └── rand v0.8.8 (*)
   ├ getrandom v0.3.4
     └── rand_core v0.9.5
         ├── rand v0.9.5
         │   ├── infraternal-server v0.1.0
         │   │   └── infraternal v0.1.0
         │   ├── tungstenite v0.29.0
         │   │   └── tokio-tungstenite v0.29.0
         │   │       ├── axum v0.8.9
         │   │       │   └── infraternal-server v0.1.0 (*)
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         └── rand_chacha v0.9.0
             ├── rand v0.9.5 (*)
             └── webauthn-rs-core v0.5.5 (*)
   ├ getrandom v0.4.3
     ├── jobserver v0.1.35
     │   └── cc v1.6.0
     │       ├── (build) libfuzzer-sys v0.4.13
     │       │   └── infraternal-fuzz v0.1.0
     │       ├── (build) libsqlite3-sys v0.30.1
     │       │   └── sqlx-sqlite v0.8.6
     │       │       ├── sqlx v0.8.6
     │       │       │   ├── infraternal v0.1.0
     │       │       │   └── infraternal-server v0.1.0
     │       │       │       └── infraternal v0.1.0 (*)
     │       │       └── sqlx-macros-core v0.8.6
     │       │           └── sqlx-macros v0.8.6
     │       │               └── sqlx v0.8.6 (*)
     │       ├── openssl-src v300.6.1+3.6.3
     │       │   └── (build) openssl-sys v0.9.117
     │       │       ├── axum-server v0.8.0
     │       │       │   └── infraternal-server v0.1.0 (*)
     │       │       ├── openssl v0.10.81
     │       │       │   ├── axum-server v0.8.0 (*)
     │       │       │   ├── infraternal-server v0.1.0 (*)
     │       │       │   ├── tokio-openssl v0.6.5
     │       │       │   │   └── axum-server v0.8.0 (*)
     │       │       │   ├── webauthn-attestation-ca v0.5.5
     │       │       │   │   └── webauthn-rs-core v0.5.5
     │       │       │   │       └── webauthn-rs v0.5.5
     │       │       │   │           └── infraternal-server v0.1.0 (*)
     │       │       │   └── webauthn-rs-core v0.5.5 (*)
     │       │       ├── tokio-openssl v0.6.5 (*)
     │       │       ├── webauthn-attestation-ca v0.5.5 (*)
     │       │       └── webauthn-rs-core v0.5.5 (*)
     │       └── (build) openssl-sys v0.9.117 (*)
     └── uuid v1.27.0
         ├── infraternal-agent v0.1.0
         │   └── infraternal v0.1.0 (*)
         ├── infraternal-server v0.1.0 (*)
         ├── webauthn-attestation-ca v0.5.5 (*)
         ├── webauthn-rs v0.5.5 (*)
         └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
   ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:96:1
   │  
96 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
97 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ hashbrown v0.15.5
     ├── hashlink v0.10.0
     │   └── sqlx-core v0.8.6
     │       ├── sqlx v0.8.6
     │       │   ├── infraternal v0.1.0
     │       │   └── infraternal-server v0.1.0
     │       │       └── infraternal v0.1.0 (*)
     │       ├── sqlx-macros v0.8.6
     │       │   └── sqlx v0.8.6 (*)
     │       ├── sqlx-macros-core v0.8.6
     │       │   └── sqlx-macros v0.8.6 (*)
     │       └── sqlx-sqlite v0.8.6
     │           ├── sqlx v0.8.6 (*)
     │           └── sqlx-macros-core v0.8.6 (*)
     └── sqlx-core v0.8.6 (*)
   ├ hashbrown v0.17.1
     └── indexmap v2.14.2
         ├── h2 v0.4.19
         │   └── hyper v1.11.1
         │       ├── axum v0.8.9
         │       │   └── infraternal-server v0.1.0
         │       │       └── infraternal v0.1.0
         │       ├── axum-server v0.8.0
         │       │   └── infraternal-server v0.1.0 (*)
         │       └── hyper-util v0.1.21
         │           ├── axum v0.8.9 (*)
         │           └── axum-server v0.8.0 (*)
         └── sqlx-core v0.8.6
             ├── sqlx v0.8.6
             │   ├── infraternal v0.1.0 (*)
             │   └── infraternal-server v0.1.0 (*)
             ├── sqlx-macros v0.8.6
             │   └── sqlx v0.8.6 (*)
             ├── sqlx-macros-core v0.8.6
             │   └── sqlx-macros v0.8.6 (*)
             └── sqlx-sqlite v0.8.6
                 ├── sqlx v0.8.6 (*)
                 └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:186:1
    │  
186 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
187 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ r-efi v5.3.0
      └── getrandom v0.3.4
          └── rand_core v0.9.5
              ├── rand v0.9.5
              │   ├── infraternal-server v0.1.0
              │   │   └── infraternal v0.1.0
              │   ├── tungstenite v0.29.0
              │   │   └── tokio-tungstenite v0.29.0
              │   │       ├── axum v0.8.9
              │   │       │   └── infraternal-server v0.1.0 (*)
              │   │       └── (dev) infraternal-server v0.1.0 (*)
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              └── rand_chacha v0.9.0
                  ├── rand v0.9.5 (*)
                  └── webauthn-rs-core v0.5.5 (*)
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          ├── jobserver v0.1.35
          │   └── cc v1.6.0
          │       ├── (build) libfuzzer-sys v0.4.13
          │       │   └── infraternal-fuzz v0.1.0
          │       ├── (build) libsqlite3-sys v0.30.1
          │       │   └── sqlx-sqlite v0.8.6
          │       │       ├── sqlx v0.8.6
          │       │       │   ├── infraternal v0.1.0
          │       │       │   └── infraternal-server v0.1.0
          │       │       │       └── infraternal v0.1.0 (*)
          │       │       └── sqlx-macros-core v0.8.6
          │       │           └── sqlx-macros v0.8.6
          │       │               └── sqlx v0.8.6 (*)
          │       ├── openssl-src v300.6.1+3.6.3
          │       │   └── (build) openssl-sys v0.9.117
          │       │       ├── axum-server v0.8.0
          │       │       │   └── infraternal-server v0.1.0 (*)
          │       │       ├── openssl v0.10.81
          │       │       │   ├── axum-server v0.8.0 (*)
          │       │       │   ├── infraternal-server v0.1.0 (*)
          │       │       │   ├── tokio-openssl v0.6.5
          │       │       │   │   └── axum-server v0.8.0 (*)
          │       │       │   ├── webauthn-attestation-ca v0.5.5
          │       │       │   │   └── webauthn-rs-core v0.5.5
          │       │       │   │       └── webauthn-rs v0.5.5
          │       │       │   │           └── infraternal-server v0.1.0 (*)
          │       │       │   └── webauthn-rs-core v0.5.5 (*)
          │       │       ├── tokio-openssl v0.6.5 (*)
          │       │       ├── webauthn-attestation-ca v0.5.5 (*)
          │       │       └── webauthn-rs-core v0.5.5 (*)
          │       └── (build) openssl-sys v0.9.117 (*)
          └── uuid v1.27.0
              ├── infraternal-agent v0.1.0
              │   └── infraternal v0.1.0 (*)
              ├── infraternal-server v0.1.0 (*)
              ├── webauthn-attestation-ca v0.5.5 (*)
              ├── webauthn-rs v0.5.5 (*)
              └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:188:1
    │  
188 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
189 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand v0.8.8
      └── bip39 v2.2.2
          └── infraternal-server v0.1.0
              └── infraternal v0.1.0
    ├ rand v0.9.5
      ├── infraternal-server v0.1.0
      │   └── infraternal v0.1.0
      ├── tungstenite v0.29.0
      │   └── tokio-tungstenite v0.29.0
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       └── (dev) infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5
          └── webauthn-rs v0.5.5
              └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:190:1
    │  
190 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
191 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_chacha v0.3.1
      └── rand v0.8.8
          └── bip39 v2.2.2
              └── infraternal-server v0.1.0
                  └── infraternal v0.1.0
    ├ rand_chacha v0.9.0
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   └── infraternal v0.1.0
      │   ├── tungstenite v0.29.0
      │   │   └── tokio-tungstenite v0.29.0
      │   │       ├── axum v0.8.9
      │   │       │   └── infraternal-server v0.1.0 (*)
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_core'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:192:1
    │  
192 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
193 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_core v0.6.4
      ├── bip39 v2.2.2
      │   └── infraternal-server v0.1.0
      │       └── infraternal v0.1.0
      ├── crypto-common v0.1.7
      │   ├── aead v0.5.2
      │   │   └── aes-gcm v0.10.3
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   ├── cipher v0.4.4
      │   │   ├── aes v0.8.4
      │   │   │   └── aes-gcm v0.10.3 (*)
      │   │   ├── aes-gcm v0.10.3 (*)
      │   │   └── ctr v0.9.2
      │   │       └── aes-gcm v0.10.3 (*)
      │   ├── digest v0.10.7
      │   │   ├── blake2 v0.10.6
      │   │   │   └── argon2 v0.5.3
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── hmac v0.12.1
      │   │   │   └── hkdf v0.12.4
      │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   │   ├── sha1 v0.10.7
      │   │   │   ├── axum v0.8.9
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   └── tungstenite v0.29.0
      │   │   │       └── tokio-tungstenite v0.29.0
      │   │   │           ├── axum v0.8.9 (*)
      │   │   │           └── (dev) infraternal-server v0.1.0 (*)
      │   │   └── sha2 v0.10.9
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── sqlx-core v0.8.6
      │   │       │   ├── sqlx v0.8.6
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── sqlx-macros v0.8.6
      │   │       │   │   └── sqlx v0.8.6 (*)
      │   │       │   ├── sqlx-macros-core v0.8.6
      │   │       │   │   └── sqlx-macros v0.8.6 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6 (*)
      │   │       │       └── sqlx-macros-core v0.8.6 (*)
      │   │       └── sqlx-macros-core v0.8.6 (*)
      │   └── universal-hash v0.5.1
      │       └── polyval v0.6.2
      │           └── ghash v0.5.1
      │               └── aes-gcm v0.10.3 (*)
      ├── password-hash v0.5.0
      │   └── argon2 v0.5.3 (*)
      ├── rand v0.8.8
      │   └── bip39 v2.2.2 (*)
      └── rand_chacha v0.3.1
          └── rand v0.8.8 (*)
    ├ rand_core v0.9.5
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   └── infraternal v0.1.0
      │   ├── tungstenite v0.29.0
      │   │   └── tokio-tungstenite v0.29.0
      │   │       ├── axum v0.8.9
      │   │       │   └── infraternal-server v0.1.0 (*)
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── rand_chacha v0.9.0
          ├── rand v0.9.5 (*)
          └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'syn'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:229:1
    │  
229 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
230 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ syn v2.0.119
      ├── asn1-rs-derive v0.5.1
      │   └── asn1-rs v0.6.2
      │       ├── der-parser v9.0.0
      │       │   ├── webauthn-rs-core v0.5.5
      │       │   │   └── webauthn-rs v0.5.5
      │       │   │       └── infraternal-server v0.1.0
      │       │   │           └── infraternal v0.1.0
      │       │   └── x509-parser v0.16.0
      │       │       └── webauthn-rs-core v0.5.5 (*)
      │       ├── oid-registry v0.7.1
      │       │   └── x509-parser v0.16.0 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── asn1-rs-impl v0.2.0
      │   └── asn1-rs v0.6.2 (*)
      ├── enum-as-inner v0.6.1
      │   └── sysctl v0.7.1
      │       └── infraternal-plugin-host-facts v0.1.0
      │           ├── infraternal-agent v0.1.0
      │           │   └── infraternal v0.1.0 (*)
      │           └── infraternal-fuzz v0.1.0
      ├── openssl-macros v0.1.1
      │   └── openssl v0.10.81
      │       ├── axum-server v0.8.0
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── tokio-openssl v0.6.5
      │       │   └── axum-server v0.8.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5
      │       │   └── webauthn-rs-core v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── sqlx-macros v0.8.6
      │   └── sqlx v0.8.6
      │       ├── infraternal v0.1.0 (*)
      │       └── infraternal-server v0.1.0 (*)
      ├── sqlx-macros-core v0.8.6
      │   └── sqlx-macros v0.8.6 (*)
      ├── synstructure v0.13.2
      │   └── asn1-rs-derive v0.5.1 (*)
      ├── thiserror-impl v1.0.69
      │   └── thiserror v1.0.69
      │       ├── asn1-rs v0.6.2 (*)
      │       ├── webauthn-rs-core v0.5.5 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── tracing-attributes v0.1.31
      │   └── tracing v0.1.44
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── axum-core v0.5.6
      │       │   └── axum v0.8.9 (*)
      │       ├── h2 v0.4.19
      │       │   └── hyper v1.11.1
      │       │       ├── axum v0.8.9 (*)
      │       │       ├── axum-server v0.8.0 (*)
      │       │       └── hyper-util v0.1.21
      │       │           ├── axum v0.8.9 (*)
      │       │           └── axum-server v0.8.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6
      │       │   ├── sqlx v0.8.6 (*)
      │       │   ├── sqlx-macros v0.8.6 (*)
      │       │   ├── sqlx-macros-core v0.8.6 (*)
      │       │   └── sqlx-sqlite v0.8.6
      │       │       ├── sqlx v0.8.6 (*)
      │       │       └── sqlx-macros-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── tracing-subscriber v0.3.23
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      └── zerocopy-derive v0.8.60
          └── zerocopy v0.8.60
              ├── half v2.7.1
              │   ├── ciborium-ll v0.2.2
              │   │   └── ciborium v0.2.2
              │   │       └── criterion v0.7.0
              │   │           └── (dev) infraternal-protocol v0.1.0
              │   │               ├── infraternal-agent v0.1.0 (*)
              │   │               ├── infraternal-fuzz v0.1.0 (*)
              │   │               ├── (dev) infraternal-plugin-host-facts v0.1.0 (*)
              │   │               └── infraternal-server v0.1.0 (*)
              │   └── serde_cbor_2 v0.13.0
              │       ├── infraternal-server v0.1.0 (*)
              │       └── webauthn-rs-core v0.5.5 (*)
              └── ppv-lite86 v0.2.21
                  ├── rand_chacha v0.3.1
                  │   └── rand v0.8.8
                  │       └── bip39 v2.2.2
                  │           └── infraternal-server v0.1.0 (*)
                  └── rand_chacha v0.9.0
                      ├── rand v0.9.5
                      │   ├── infraternal-server v0.1.0 (*)
                      │   ├── tungstenite v0.29.0
                      │   │   └── tokio-tungstenite v0.29.0
                      │   │       ├── axum v0.8.9 (*)
                      │   │       └── (dev) infraternal-server v0.1.0 (*)
                      │   └── webauthn-rs-core v0.5.5 (*)
                      └── webauthn-rs-core v0.5.5 (*)
    ├ syn v3.0.6
      ├── clap_derive v4.6.7
      │   └── clap v4.6.7
      │       ├── criterion v0.7.0
      │       │   └── (dev) infraternal-protocol v0.1.0
      │       │       ├── infraternal-agent v0.1.0
      │       │       │   └── infraternal v0.1.0
      │       │       ├── infraternal-fuzz v0.1.0
      │       │       ├── (dev) infraternal-plugin-host-facts v0.1.0
      │       │       │   ├── infraternal-agent v0.1.0 (*)
      │       │       │   └── infraternal-fuzz v0.1.0 (*)
      │       │       └── infraternal-server v0.1.0
      │       │           └── infraternal v0.1.0 (*)
      │       └── infraternal v0.1.0 (*)
      ├── displaydoc v0.2.7
      │   ├── asn1-rs v0.6.2
      │   │   ├── der-parser v9.0.0
      │   │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   │   └── webauthn-rs v0.5.5
      │   │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   │   └── x509-parser v0.16.0
      │   │   │       └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── oid-registry v0.7.1
      │   │   │   └── x509-parser v0.16.0 (*)
      │   │   └── x509-parser v0.16.0 (*)
      │   ├── der-parser v9.0.0 (*)
      │   ├── icu_collections v2.3.0
      │   │   ├── icu_normalizer v2.3.0
      │   │   │   └── idna_adapter v1.2.2
      │   │   │       └── idna v1.1.0
      │   │   │           └── url v2.5.8
      │   │   │               ├── infraternal-server v0.1.0 (*)
      │   │   │               ├── sqlx-core v0.8.6
      │   │   │               │   ├── sqlx v0.8.6
      │   │   │               │   │   ├── infraternal v0.1.0 (*)
      │   │   │               │   │   └── infraternal-server v0.1.0 (*)
      │   │   │               │   ├── sqlx-macros v0.8.6
      │   │   │               │   │   └── sqlx v0.8.6 (*)
      │   │   │               │   ├── sqlx-macros-core v0.8.6
      │   │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │   │   │               │   └── sqlx-sqlite v0.8.6
      │   │   │               │       ├── sqlx v0.8.6 (*)
      │   │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-sqlite v0.8.6 (*)
      │   │   │               ├── webauthn-rs v0.5.5 (*)
      │   │   │               ├── webauthn-rs-core v0.5.5 (*)
      │   │   │               └── webauthn-rs-proto v0.5.5
      │   │   │                   └── webauthn-rs-core v0.5.5 (*)
      │   │   └── icu_properties v2.3.0
      │   │       └── idna_adapter v1.2.2 (*)
      │   ├── icu_locale_core v2.3.0
      │   │   ├── icu_properties v2.3.0 (*)
      │   │   └── icu_provider v2.3.1
      │   │       ├── icu_normalizer v2.3.0 (*)
      │   │       └── icu_properties v2.3.0 (*)
      │   ├── icu_properties v2.3.0 (*)
      │   ├── icu_provider v2.3.1 (*)
      │   ├── tinystr v0.8.4
      │   │   └── icu_locale_core v2.3.0 (*)
      │   └── zerotrie v0.2.5
      │       ├── icu_properties v2.3.0 (*)
      │       └── icu_provider v2.3.1 (*)
      ├── futures-macro v0.3.34
      │   └── futures-util v0.3.34
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── futures-executor v0.3.34
      │       │   └── sqlx-sqlite v0.8.6 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── js-sys v0.3.106
      │       │   └── web-sys v0.3.106
      │       │       └── plotters v0.3.7
      │       │           └── criterion v0.7.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tokio-tungstenite v0.29.0
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       └── tower-http v0.6.11
      │           └── infraternal-server v0.1.0 (*)
      ├── serde_derive v1.0.229
      │   ├── serde v1.0.229
      │   │   ├── base64urlsafedata v0.5.5
      │   │   │   ├── webauthn-attestation-ca v0.5.5
      │   │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   │   ├── bip39 v2.2.2
      │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   ├── ciborium v0.2.2
      │   │   │   └── criterion v0.7.0 (*)
      │   │   ├── criterion v0.7.0 (*)
      │   │   ├── either v1.18.0
      │   │   │   ├── axum-server v0.8.0
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   ├── itertools v0.13.0
      │   │   │   │   ├── criterion v0.7.0 (*)
      │   │   │   │   └── criterion-plot v0.6.0
      │   │   │   │       └── criterion v0.7.0 (*)
      │   │   │   ├── rayon v1.12.0
      │   │   │   │   └── criterion v0.7.0 (*)
      │   │   │   ├── sqlx-core v0.8.6 (*)
      │   │   │   └── sqlx-macros-core v0.8.6 (*)
      │   │   ├── infraternal-agent v0.1.0 (*)
      │   │   ├── infraternal-mesh v0.1.0
      │   │   ├── infraternal-plugin-host-facts v0.1.0 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   ├── serde_cbor_2 v0.13.0
      │   │   │   ├── infraternal-server v0.1.0 (*)
      │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── serde_urlencoded v0.7.1
      │   │   │   ├── axum v0.8.9 (*)
      │   │   │   └── sqlx-sqlite v0.8.6 (*)
      │   │   ├── sqlx-core v0.8.6 (*)
      │   │   ├── sqlx-macros-core v0.8.6 (*)
      │   │   ├── sqlx-sqlite v0.8.6 (*)
      │   │   ├── tinytemplate v1.2.1
      │   │   │   └── criterion v0.7.0 (*)
      │   │   ├── tracing-serde v0.2.0
      │   │   │   └── tracing-subscriber v0.3.23
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── tracing-subscriber v0.3.23 (*)
      │   │   ├── url v2.5.8 (*)
      │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   └── url v2.5.8 (*)
      ├── synstructure v0.14.0
      │   ├── yoke-derive v0.8.4
      │   │   └── yoke v0.8.3
      │   │       ├── icu_collections v2.3.0 (*)
      │   │       ├── icu_provider v2.3.1 (*)
      │   │       ├── zerotrie v0.2.5 (*)
      │   │       └── zerovec v0.11.8
      │   │           ├── icu_collections v2.3.0 (*)
      │   │           ├── icu_locale_core v2.3.0 (*)
      │   │           ├── icu_normalizer v2.3.0 (*)
      │   │           ├── icu_properties v2.3.0 (*)
      │   │           ├── icu_provider v2.3.1 (*)
      │   │           ├── potential_utf v0.1.6
      │   │           │   └── icu_collections v2.3.0 (*)
      │   │           └── tinystr v0.8.4 (*)
      │   └── zerofrom-derive v0.1.8
      │       └── zerofrom v0.1.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── yoke v0.8.3 (*)
      │           ├── zerotrie v0.2.5 (*)
      │           └── zerovec v0.11.8 (*)
      ├── thiserror-impl v2.0.21
      │   └── thiserror v2.0.21
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-mesh v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── sysctl v0.7.1
      │       │   └── infraternal-plugin-host-facts v0.1.0 (*)
      │       └── tungstenite v0.29.0
      │           └── tokio-tungstenite v0.29.0 (*)
      ├── tokio-macros v2.7.2
      │   └── tokio v1.53.2
      │       ├── axum v0.8.9 (*)
      │       ├── axum-server v0.8.0 (*)
      │       ├── fs-err v3.3.2
      │       │   └── axum-server v0.8.0 (*)
      │       ├── h2 v0.4.19
      │       │   └── hyper v1.11.1
      │       │       ├── axum v0.8.9 (*)
      │       │       ├── axum-server v0.8.0 (*)
      │       │       └── hyper-util v0.1.21
      │       │           ├── axum v0.8.9 (*)
      │       │           └── axum-server v0.8.0 (*)
      │       ├── hyper v1.11.1 (*)
      │       ├── hyper-util v0.1.21 (*)
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-agent v0.1.0 (*)
      │       ├── (dev) infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-macros-core v0.8.6 (*)
      │       ├── tokio-openssl v0.6.5
      │       │   └── axum-server v0.8.0 (*)
      │       ├── tokio-stream v0.1.19
      │       │   └── sqlx-core v0.8.6 (*)
      │       ├── tokio-tungstenite v0.29.0 (*)
      │       ├── tokio-util v0.7.19
      │       │   ├── h2 v0.4.19 (*)
      │       │   └── tower-http v0.6.11 (*)
      │       ├── tower v0.5.3 (*)
      │       └── tower-http v0.6.11 (*)
      ├── wasm-bindgen-macro-support v0.2.129
      │   └── wasm-bindgen-macro v0.2.129
      │       └── wasm-bindgen v0.2.129
      │           ├── js-sys v0.3.106 (*)
      │           ├── plotters v0.3.7 (*)
      │           └── web-sys v0.3.106 (*)
      ├── yoke-derive v0.8.4 (*)
      ├── zerofrom-derive v0.1.8 (*)
      └── zerovec-derive v0.11.6
          └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:232:1
    │  
232 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
233 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ synstructure v0.13.2
      └── asn1-rs-derive v0.5.1
          └── asn1-rs v0.6.2
              ├── der-parser v9.0.0
              │   ├── webauthn-rs-core v0.5.5
              │   │   └── webauthn-rs v0.5.5
              │   │       └── infraternal-server v0.1.0
              │   │           └── infraternal v0.1.0
              │   └── x509-parser v0.16.0
              │       └── webauthn-rs-core v0.5.5 (*)
              ├── oid-registry v0.7.1
              │   └── x509-parser v0.16.0 (*)
              └── x509-parser v0.16.0 (*)
    ├ synstructure v0.14.0
      ├── yoke-derive v0.8.4
      │   └── yoke v0.8.3
      │       ├── icu_collections v2.3.0
      │       │   ├── icu_normalizer v2.3.0
      │       │   │   └── idna_adapter v1.2.2
      │       │   │       └── idna v1.1.0
      │       │   │           └── url v2.5.8
      │       │   │               ├── infraternal-server v0.1.0
      │       │   │               │   └── infraternal v0.1.0
      │       │   │               ├── sqlx-core v0.8.6
      │       │   │               │   ├── sqlx v0.8.6
      │       │   │               │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   ├── sqlx-macros v0.8.6
      │       │   │               │   │   └── sqlx v0.8.6 (*)
      │       │   │               │   ├── sqlx-macros-core v0.8.6
      │       │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │       │   │               │   └── sqlx-sqlite v0.8.6
      │       │   │               │       ├── sqlx v0.8.6 (*)
      │       │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-sqlite v0.8.6 (*)
      │       │   │               ├── webauthn-rs v0.5.5
      │       │   │               │   └── infraternal-server v0.1.0 (*)
      │       │   │               ├── webauthn-rs-core v0.5.5
      │       │   │               │   └── webauthn-rs v0.5.5 (*)
      │       │   │               └── webauthn-rs-proto v0.5.5
      │       │   │                   └── webauthn-rs-core v0.5.5 (*)
      │       │   └── icu_properties v2.3.0
      │       │       └── idna_adapter v1.2.2 (*)
      │       ├── icu_provider v2.3.1
      │       │   ├── icu_normalizer v2.3.0 (*)
      │       │   └── icu_properties v2.3.0 (*)
      │       ├── zerotrie v0.2.5
      │       │   ├── icu_properties v2.3.0 (*)
      │       │   └── icu_provider v2.3.1 (*)
      │       └── zerovec v0.11.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_locale_core v2.3.0
      │           │   ├── icu_properties v2.3.0 (*)
      │           │   └── icu_provider v2.3.1 (*)
      │           ├── icu_normalizer v2.3.0 (*)
      │           ├── icu_properties v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── potential_utf v0.1.6
      │           │   └── icu_collections v2.3.0 (*)
      │           └── tinystr v0.8.4
      │               └── icu_locale_core v2.3.0 (*)
      └── zerofrom-derive v0.1.8
          └── zerofrom v0.1.8
              ├── icu_collections v2.3.0 (*)
              ├── icu_provider v2.3.1 (*)
              ├── yoke v0.8.3 (*)
              ├── zerotrie v0.2.5 (*)
              └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:235:1
    │  
235 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
236 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror v1.0.69
      ├── asn1-rs v0.6.2
      │   ├── der-parser v9.0.0
      │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   └── webauthn-rs v0.5.5
      │   │   │       └── infraternal-server v0.1.0
      │   │   │           └── infraternal v0.1.0
      │   │   └── x509-parser v0.16.0
      │   │       └── webauthn-rs-core v0.5.5 (*)
      │   ├── oid-registry v0.7.1
      │   │   └── x509-parser v0.16.0 (*)
      │   └── x509-parser v0.16.0 (*)
      ├── webauthn-rs-core v0.5.5 (*)
      └── x509-parser v0.16.0 (*)
    ├ thiserror v2.0.21
      ├── infraternal v0.1.0
      ├── infraternal-mesh v0.1.0
      ├── infraternal-server v0.1.0
      │   └── infraternal v0.1.0 (*)
      ├── sqlx-core v0.8.6
      │   ├── sqlx v0.8.6
      │   │   ├── infraternal v0.1.0 (*)
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── sqlx-macros v0.8.6
      │   │   └── sqlx v0.8.6 (*)
      │   ├── sqlx-macros-core v0.8.6
      │   │   └── sqlx-macros v0.8.6 (*)
      │   └── sqlx-sqlite v0.8.6
      │       ├── sqlx v0.8.6 (*)
      │       └── sqlx-macros-core v0.8.6 (*)
      ├── sqlx-sqlite v0.8.6 (*)
      ├── sysctl v0.7.1
      │   └── infraternal-plugin-host-facts v0.1.0
      │       ├── infraternal-agent v0.1.0
      │       │   └── infraternal v0.1.0 (*)
      │       └── infraternal-fuzz v0.1.0
      └── tungstenite v0.29.0
          └── tokio-tungstenite v0.29.0
              ├── axum v0.8.9
              │   └── infraternal-server v0.1.0 (*)
              └── (dev) infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
    ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:237:1
    │  
237 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
238 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror-impl v1.0.69
      └── thiserror v1.0.69
          ├── asn1-rs v0.6.2
          │   ├── der-parser v9.0.0
          │   │   ├── webauthn-rs-core v0.5.5
          │   │   │   └── webauthn-rs v0.5.5
          │   │   │       └── infraternal-server v0.1.0
          │   │   │           └── infraternal v0.1.0
          │   │   └── x509-parser v0.16.0
          │   │       └── webauthn-rs-core v0.5.5 (*)
          │   ├── oid-registry v0.7.1
          │   │   └── x509-parser v0.16.0 (*)
          │   └── x509-parser v0.16.0 (*)
          ├── webauthn-rs-core v0.5.5 (*)
          └── x509-parser v0.16.0 (*)
    ├ thiserror-impl v2.0.21
      └── thiserror v2.0.21
          ├── infraternal v0.1.0
          ├── infraternal-mesh v0.1.0
          ├── infraternal-server v0.1.0
          │   └── infraternal v0.1.0 (*)
          ├── sqlx-core v0.8.6
          │   ├── sqlx v0.8.6
          │   │   ├── infraternal v0.1.0 (*)
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── sqlx-macros v0.8.6
          │   │   └── sqlx v0.8.6 (*)
          │   ├── sqlx-macros-core v0.8.6
          │   │   └── sqlx-macros v0.8.6 (*)
          │   └── sqlx-sqlite v0.8.6
          │       ├── sqlx v0.8.6 (*)
          │       └── sqlx-macros-core v0.8.6 (*)
          ├── sqlx-sqlite v0.8.6 (*)
          ├── sysctl v0.7.1
          │   └── infraternal-plugin-host-facts v0.1.0
          │       ├── infraternal-agent v0.1.0
          │       │   └── infraternal v0.1.0 (*)
          │       └── infraternal-fuzz v0.1.0
          └── tungstenite v0.29.0
              └── tokio-tungstenite v0.29.0
                  ├── axum v0.8.9
                  │   └── infraternal-server v0.1.0 (*)
                  └── (dev) infraternal-server v0.1.0 (*)

advisories ok, bans ok, licenses ok, sources ok

==> static builds
    Finished `release` profile [optimized] target(s) in 0.38s
/home/kayg/.cache/codex-scratch/host-facts-review/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 16031568 bytes (baseline 16142672 + allowance 262144 = max 16404816)
    Finished `release` profile [optimized] target(s) in 0.45s
/home/kayg/.cache/codex-scratch/host-facts-review/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 13482320 bytes (baseline 13555672 + allowance 262144 = max 13817816)
server subcommand: exit 2, not implemented
agent subcommand: exit 2, not implemented

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

==> Vendored Ghostty artifact checksums
dist/ghostty-web.js: OK
dist/ghostty-vt.wasm: OK
dist/index.d.ts: OK

==> TypeScript protocol compiler

==> Tracer compiler, precompression and bundle transfer budget
bun install v1.4.2 (744846f84)

Checked 38 installs across 69 packages (no changes) [21.00ms]
$ bun x tsc --project tsconfig.json
bun test v1.4.2 (744846f84)

browser-build.test.ts:
(pass) the browser renderer has no unresolved Vite Node-file shim request [31.49ms]

chunk-classes.test.ts:
(pass) the first screen is critical, the canvas product module and what only it uses are deferred [2.23ms]
(pass) a chunk that both sides use stays critical [0.27ms]
(pass) code only an action loads is on demand, even when the lazy canvas is what loads it [0.53ms]

precompress.test.ts:
(pass) text sidecars round-trip deterministically; compressed formats remain identity [34.78ms]

test/recovery-ui.test.ts:
(pass) compiled recovery UI mode off obeys its URL boundary [5.60ms]
(pass) compiled recovery UI mode preview obeys its URL boundary [2.46ms]
(pass) compiled recovery UI mode 1 obeys its URL boundary [1.84ms]

test/recovery-crypto.test.ts:
(pass) HKDF siblings match independent implementation and bind unwrap to domain, account, kind and version [14.90ms]
(pass) 100 repeated wrapping operations generate independent salts and nonces [11.05ms]

test/recovery-wait.test.ts:
(pass) server remaining wait 0s is accepted through the capability policy maximum [4.28ms]
(pass) server remaining wait 86400s is accepted through the capability policy maximum [0.83ms]
(pass) server remaining wait 90000s is accepted through the capability policy maximum [0.59ms]
(pass) server remaining wait 172800s is accepted through the capability policy maximum [0.61ms]
(pass) malformed or excessive remaining wait -1 is denied [0.99ms]
(pass) malformed or excessive remaining wait 0.5 is denied [0.65ms]
(pass) malformed or excessive remaining wait 172801 is denied [0.71ms]
(pass) malformed or excessive remaining wait 9007199254740992 is denied [0.88ms]
(pass) malformed or excessive remaining wait 90000 is denied [0.59ms]

test/recovery-rotation.test.ts:
(pass) signed-in rotation sends only a local envelope and verifier after acknowledgement [6.52ms]
(pass) abandoned word acknowledgement uploads nothing [2.53ms]
(pass) settled acknowledgement cannot upload later (dismissed) [1.71ms]
(pass) settled acknowledgement cannot upload later (no acknowledgement) [1.58ms]

src/canvas/windows/details-facts.test.ts:
(pass) host facts become the existing Host key/value rows [0.51ms]
(pass) unknown optional host facts stay absent instead of appearing as placeholders [0.11ms]

src/canvas/mesh/protocol.test.ts:
(pass) the server's own list becomes nodes, tags and grants, by name [0.64ms]
(pass) without `access` (today's server) the person may view and may not edit [0.21ms]
(pass) fields the server does not send are absent, never invented [0.15ms]
(pass) anything that is not a list is refused, whole [4.69ms]
(pass) a node's own tag list and the tag table agree even when a server sends only one [0.15ms]
(pass) the subscription's events: a pushed list, a revision that invalidates, and the end of the subscription [0.18ms]
(pass) answers carry the new revision, and a create the new arrow's id [0.05ms]
(pass) endpoints go out as the server writes them: a node by id, a tag by name [0.06ms]

src/canvas/mesh/layout.test.ts:
(pass) a small mesh keeps the approved arrangement: tags down the left, hosts two to a row [10.94ms]
(pass) the layout is deterministic and does not depend on input order [7.17ms]
(pass) no two cards overlap, and every card lies inside the graph [4.67ms]
(pass) the sheet is wider than tall, roughly 16:10 [1.34ms]
(pass) a pinned node stays where it was put and the others do not move [1.44ms]
(pass) a pin beyond the sheet grows the graph [0.52ms]
(pass) a host's other tags do not move it; a tag nobody carries still has its node [0.20ms]
(pass) 1,000 nodes lay out in a few milliseconds [11.23ms]

src/canvas/layout/stops.test.ts:
(pass) a view that fits the viewport has one stop, centred [0.30ms]
(pass) a wide view has one stop per column and the last stop ends at the right edge [0.11ms]
(pass) a view taller than the viewport is scaled down so it fits [0.02ms]
(pass) nearestStop picks the stop whose centre is closest [0.09ms]
(pass) a big graph opens fitted whole, in one stop, and its canvas is free [0.13ms]
(pass) a small graph keeps one stop per node column [0.11ms]
(pass) on a narrow screen a big graph does not shrink past where its names can be read: it starts at the top left [0.09ms]

src/canvas/layout/geometry.test.ts:
(pass) a dropped view pushes the one it lands on along the axis of least overlap, never itself [0.33ms]
(pass) a chain of neighbours is pushed in turn [0.06ms]
(pass) snapping rounds to whole cells [0.03ms]
(pass) reach follows grants through tags and keeps the relay [0.15ms]

src/canvas/model/document.test.ts:
(pass) a document holds references and layout, never content [0.22ms]
(pass) a document survives JSON and rebuilds the same columns [0.42ms]
(pass) a target that no longer exists is dropped, and an emptied column with it [0.10ms]
(pass) parseDocument rejects anything that is not a document of this format [0.22ms]

 56 pass
 0 fail
 9946 expect() calls
Ran 56 tests across 13 files. [241.00ms]
$ bun run build.ts
built chunk-k3789ryh.js, chunk-r3mgv63s.js, chunk-cy892tb7.js, main.js, chunk-pw0rta48.js, chunk-xrb0zjcp.js, chunk-z5p786p6.js, chunk-sxk8w2p8.js, chunk-5753zf8s.js, chunk-aqpxqt98.js, chunk-ww2m8ee0.js, chunk-axbkkqp1.js, chunk-b1x17cec.js, chunk-xyvqg7t7.js, chunk-93r1e5ch.js, chunk-1hfqw9kz.js, chunk-v52cv3b9.js, chunk-k93v5q4e.js, chunk-5b5vfws5.js, chunk-84k2mb1x.js, chunk-s78fgkex.js, chunk-tvpjb29t.js, chunk-nrhjdsd2.js, backdrop.worker.js, faulty-terminal.worker.js, chunk-1gmd77gh.js, chunk-sajgyt5b.js, chunk-krag9pdw.js, chunk-y667rdh9.js, chunk-cmc3x3e5.js
critical chunk-cmc3x3e5.js: identity=39 gzip=39 brotli=39 bytes
onDemand chunk-aqpxqt98.js: identity=14856 gzip=5465 brotli=4890 bytes
onDemand chunk-84k2mb1x.js: identity=538 gzip=352 brotli=314 bytes
critical chunk-b1x17cec.js: identity=702015 gzip=203602 brotli=164847 bytes
critical faulty-terminal.worker.js: identity=1086 gzip=558 brotli=481 bytes
critical backdrop.worker.js: identity=243 gzip=212 brotli=164 bytes
onDemand chunk-5b5vfws5.js: identity=4351 gzip=1722 brotli=1496 bytes
deferred chunk-r3mgv63s.js: identity=37378 gzip=14585 brotli=12770 bytes
critical chunk-axbkkqp1.js: identity=90 gzip=90 brotli=78 bytes
critical chunk-sxk8w2p8.js: identity=1916 gzip=845 brotli=734 bytes
critical chunk-z5p786p6.js: identity=8172 gzip=3514 brotli=3108 bytes
onDemand chunk-v52cv3b9.js: identity=5749 gzip=2762 brotli=2497 bytes
critical chunk-xrb0zjcp.js: identity=6483 gzip=3110 brotli=2814 bytes
critical chunk-k3789ryh.js: identity=20074 gzip=6378 brotli=5694 bytes
onDemand chunk-xyvqg7t7.js: identity=5787 gzip=2584 brotli=2348 bytes
critical chunk-pw0rta48.js: identity=8377 gzip=3574 brotli=3186 bytes
onDemand chunk-tvpjb29t.js: identity=4112 gzip=1734 brotli=1522 bytes
deferred chunk-93r1e5ch.js: identity=93321 gzip=32397 brotli=28652 bytes
critical chunk-1gmd77gh.js: identity=9810 gzip=4020 brotli=3461 bytes
critical chunk-1hfqw9kz.js: identity=49 gzip=49 brotli=49 bytes
critical chunk-sajgyt5b.js: identity=199 gzip=160 brotli=134 bytes
onDemand chunk-nrhjdsd2.js: identity=11538 gzip=4877 brotli=4302 bytes
critical chunk-5753zf8s.js: identity=386 gzip=237 brotli=195 bytes
onDemand chunk-s78fgkex.js: identity=5327 gzip=2569 brotli=2286 bytes
critical chunk-y667rdh9.js: identity=39 gzip=39 brotli=39 bytes
onDemand chunk-cy892tb7.js: identity=2108 gzip=1037 brotli=870 bytes
critical main.js: identity=105479 gzip=38352 brotli=33200 bytes
critical chunk-krag9pdw.js: identity=57474 gzip=18833 brotli=16884 bytes
onDemand chunk-k93v5q4e.js: identity=20875 gzip=8490 brotli=7640 bytes
onDemand chunk-ww2m8ee0.js: identity=1026 gzip=623 brotli=498 bytes
JavaScript transfer, critical: identity=921931 gzip=283612/307200 brotli=235107/256000 bytes
JavaScript transfer, deferred: identity=130699 gzip=46982/51200 brotli=41422/45056 bytes
JavaScript transfer, onDemand: identity=76267 gzip=32215/20480 brotli=28663/18432 bytes
JavaScript transfer, onDemand largest chunk chunk-k93v5q4e.js: gzip=8490/20480 brotli=7640/18432 bytes (class total gzip=32215 brotli=28663, not limited)
fonts/monaspace-neon/italic.latin.woff2: identity=44324 gzip=44324 brotli=44324 bytes
fonts/monaspace-neon/roman.latin.woff2: identity=40016 gzip=40016 brotli=40016 bytes
fonts/jetbrains-mono/italic.latin.woff2: identity=36316 gzip=36316 brotli=36316 bytes
fonts/jetbrains-mono/roman.latin.woff2: identity=34068 gzip=34068 brotli=34068 bytes
fonts/source-code-pro/italic.latin.woff2: identity=23612 gzip=23612 brotli=23612 bytes
fonts/source-code-pro/roman.latin.woff2: identity=22872 gzip=22872 brotli=22872 bytes
fonts/geist-mono/italic.latin.woff2: identity=21380 gzip=21380 brotli=21380 bytes
fonts/geist-mono/roman.latin.woff2: identity=19984 gzip=19984 brotli=19981 bytes
fonts/ibm-plex-mono/italic.latin.woff2: identity=22296 gzip=22296 brotli=22296 bytes
fonts/ibm-plex-mono/roman.latin.woff2: identity=19048 gzip=19048 brotli=19047 bytes
fonts/cascadia-code/italic.latin.woff2: identity=44404 gzip=44404 brotli=44404 bytes
fonts/cascadia-code/roman.latin.woff2: identity=40604 gzip=40604 brotli=40604 bytes
fonts/maple-mono-nf/italic.latin.woff2: identity=53444 gzip=53444 brotli=53444 bytes
fonts/maple-mono-nf/roman.latin.woff2: identity=46432 gzip=46432 brotli=46432 bytes
fonts/nerd-symbols.woff2: identity=223748 gzip=223748 brotli=223748 bytes
fonts/fira-code/roman.latin.woff2: identity=36756 gzip=36756 brotli=36756 bytes
fonts/commit-mono/italic-400.latin.woff2: identity=18716 gzip=18716 brotli=18716 bytes
fonts/commit-mono/italic-700.latin.woff2: identity=18352 gzip=18352 brotli=18352 bytes
fonts/commit-mono/roman-400.latin.woff2: identity=17484 gzip=17484 brotli=17484 bytes
fonts/commit-mono/roman-700.latin.woff2: identity=17260 gzip=17260 brotli=17260 bytes
Font transfer: monaspace-neon=84340/88064 jetbrains-mono=70384/75776 source-code-pro=46484/49152 geist-mono=41364/45056 ibm-plex-mono=41344/45056 cascadia-code=85008/88064 maple-mono-nf=99876/106496 (critical 46432/51200) symbols=223748/235520 fira-code=36756/40960 commit-mono=71812/75776 bytes

==> Rust stream oracle (for the differential test)

==> TypeScript protocol tests
bun test v1.4.2 (744846f84)

src/codec.test.ts:
(pass) wire protocol golden vectors > encodes and decodes each frame exactly as the shared manifest describes [6.28ms]
(pass) wire protocol golden vectors > returns borrowed payload views and writes into reusable buffers [0.13ms]
(pass) wire protocol golden vectors > decodes muxed messages split across WebSocket messages [0.73ms]
(pass) wire protocol golden vectors > rejects oversized, non-canonical, unknown, and malformed frame bytes [0.14ms]
(pass) split mux header preserves trailing Close [0.20ms]

src/stream.test.ts:
stream differential: 134 streams, 11439 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3416.79ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.75ms]

 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [3.44s]

Verdict: **merge after fixes**. Findings: **0 P0, 1 P1, 3 P2, 1 P3**. Reviewed target38b53f456dcb0d7c2abb02e35a32a66bca88c101 against merge base42e50d42c5e43dabc3da89de4b01dd92329bf030. Final local review-host-facts head: 19e1891915571a136f93bde7143b2a234a445753. No implementation fixes, pushes or issue closure. Confirmed tests: HF-R3(P1) non-owner configuration permission bypass; HF-R4(P2) pending facts read blocks socket control; HF-R2(P2) refused plugin keeps polling; HF-R1(P2) secondary fields exposed before more; HF-R5(P3) detected OS mark unset. Each has a committed failing test. Full test outputs: docs/reviews/host-facts-findings.md. Review and measurements: docs/reviews/host-facts.md. Production screenshot: docs/reviews/host-facts-popover.png. Findings index: /home/kayg/.local/state/codex-jobs/infraternal/review-host-facts/findings.md. Pristine-target scripts/verify fast: **PASS, exit0**, entire output below verbatim, also committed in docs/reviews/host-facts-fast.md. Review TypeScript and warning-denied focused all-target Clippy pass; feature-removal check passes. Canonical scripts/verify latency: **FAIL, exit1**. Native same-session budget failure reproduces on merge base; auth4scenarios and recovery2scenarios pass. Browser293pass/22fail/26skip in1.0h. Fifteen cases have matching baseline assertions or measured budget failures; five pass isolated head retries. Mesh frame budget and predictive-capture visibility remain unresolved. Full gate and comparisons are archived in docs/reviews/host-facts-latency.md and host-facts-browser-comparison.md. Retries do not clear the original gate. Final comparisons066c7afc; final report/screenshot19e18919. D170: 1000/10000 retained collectors, RSS deltas1028096/7864320B; 200active hosts×5viewers, 1000sequential live reads28.01/24.12ms. Collector-only, not fleet/network/UI memory. Rebuilt stripped growth +66176B x86_64 / +56256B aarch64. Seeded fuzz1740295executions/31s, no crash. Machine/load and scope limits are in the report. Temporary builds/checkouts are being removed after evidence archival. <details><summary>scripts/verify fast — complete pristine-head output, verbatim</summary> ~~~~text METRIC name=network_rtt_selftest configured_rtt_ms=300 jitter_ms=30 loss=unsupported transport=tcp-stream n=3 p50_ms=305.25 p99_ms=319.85 result=PASS ==> fmt ==> VT native fmt ==> clippy Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.56s ==> test Finished `test` profile [unoptimized + debuginfo] target(s) in 0.40s Running unittests src/main.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal-c1f8694317415770) running 2 tests test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/agent_daemon.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_daemon-e37040ed9293cb16) running 1 test test real_binary_preserves_input_and_output_across_24_abrupt_stops ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.14s Running tests/agent_queues.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_queues-2f329ae7b2cad15f) running 1 test test saturated_terminal_queues_preserve_every_byte_and_daemon_liveness ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 35.20s Running tests/agent_review.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_review-48a255937cca9ce1) running 6 tests test stalled_terminal_never_delays_control_or_sibling_dispatch ... ok test last_typist_selects_its_own_real_pty_dimensions ... ok test initial_attach_requires_explicit_credit_before_replay ... ok test retained_unwritten_input_survives_interleaved_ack_restart ... ok test two_writers_keep_independent_ack_and_exact_input_after_restart ... ok test repeated_tiny_credit_pauses_preserve_shell_progress ... ok test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 15.79s Running tests/agent_sessions.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/agent_sessions-b3b39d2e45ad0eb5) running 1 test test detached_shim_is_discovered_and_replays_from_the_last_observed_offset ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s Running tests/idle_canary.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/idle_canary-d2fff69fba46d0f3) running 1 test test one_hertz_wakeup_is_detected_past_the_legacy_half_second_window ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.13s Running tests/shim.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/shim-cf4b4029b039ff5d) running 7 tests test double_fork_survives_parent_death ... ok test replacement_connection_and_malformed_limit ... ok test disallowed_signal_only_disconnects_peer ... ok active test real_shell_reconnect_resize_and_retained_exit ... ok test user_scope_survives_parent_unit_stop ... ok test attached_backpressure_and_detached_progress ... ok test ring_wrap_snapshot_repaints_real_vim ... ok test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.23s Running tests/vt_credit.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/vt_credit-78d4da44c9250f83) running 1 test test unaffordable_repaints_park_until_sufficient_credit ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 20.74s Running tests/vt_reconnect.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/vt_reconnect-4c65cf46be9cbc1e) running 1 test test snapshot_limits_never_close_live_reconnect ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.15s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_agent-e1bd03594facf472) running 16 tests test relay::tests::output_payload_move_measurement ... ignored, release ownership versus payload-copy measurement test relay::tests::input_overlap_gap_and_restart_from_confirmed_offset ... ok test relay::tests::attachment_has_no_implicit_output_or_snapshot_credit ... ok test relay::tests::expired_credit_resumes_retained_bytes_at_the_same_cursor ... ok test relay::tests::overflowing_ranges_never_mutate_cursors ... ok test relay::tests::positive_insufficient_credit_arms_a_one_shot_deadline ... ok test relay::tests::output_partial_credit_and_dedup ... ok test relay::tests::returned_credit_cancels_starvation_and_state_has_no_payload_buffer ... ok test relay::tests::starvation_is_one_shot_and_snapshot_length_does_not_advance_sequence ... ok test sessions::tests::reader_borrow_measurement ... ignored, release borrowed versus owned asynchronous receive measurement test sessions::tests::symlink_state_cannot_redirect_private_runtime_storage ... ok test sessions::tests::refused_socket_is_removed_but_insecure_directory_is_rejected ... ok test sessions::tests::sequenced_attach_intersects_caps_and_legacy_attach_stays_zero ... ok test sessions::tests::post_listen_chmod_wakes_a_connection_refused_at_bind ... ok test sessions::tests::borrowed_reader_payload_uses_reusable_cancel_safe_storage ... ok test sessions::tests::cancelled_fragmented_shim_read_retains_header_and_body_progress ... ok test result: ok. 14 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.03s Running tests/transport.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/transport-8f3460b3ccba6a28) running 2 tests test oversized_header_and_truncated_frame_are_rejected ... ok test fragmented_headers_coalesced_frames_and_reusable_transmit ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_mesh-3f967587718407e9) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/default_arrow.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/default_arrow-312553ba19630584) running 1 test test omitted_arrow_ports_default_to_all_services ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/properties.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/properties-78f35bbe1b57dcd5) running 14 tests test overlaps_are_reported_without_silent_range_changes ... ok test directional_grants_union_and_minimal_updates ... ok test exhausted_versions_reject_mutations_without_changing_state ... ok test names_versions_and_backend_status ... ok test arrow_replacement_is_atomic_and_unrelated_nodes_keep_their_versions ... ok test checkpoint_after_suffix_change_restores_without_reallocating_addresses ... ok test private_material_never_enters_debug_or_coordination_serialization ... ok test join_to_same_tag_grants_both_initiation_directions ... ok test server_rotation_has_continuous_keys_for_every_node_during_delivery ... ok test rotation_waits_for_overlap_and_delivery_and_removal_drops_every_key ... ok test public_checkpoint_preserves_addresses_rules_versions_and_overlap ... ok test protocol_port_unions_never_grant_an_unlisted_service ... ok test addresses_are_unique_stable_and_not_recycled ... ok test seeded_random_sequences_equal_full_compile_and_deny_without_grants ... ok test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.21s Running tests/rotation_time.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/rotation_time-a58dd287253d611d) running 1 test test unrepresentable_rotation_overlap_rejects_before_mutation ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2) running 2 tests test tests::registry_rejects_oversized_json_before_plugin_dispatch ... ok test tests::registry_routes_only_declared_actions ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_plugin_host_facts-0cb65db9fbee717c) running 9 tests test tests::descriptor_declares_default_settings_actions_and_no_hidden_role_dependency ... ok test tests::linux_load_average_text_ignores_proc_metadata_and_rejects_invalid_values ... ok test tests::os_release_parser_rejects_unbounded_input_and_ignores_untrusted_lines ... ok test tests::action_decoders_reject_unknown_and_oversized_fields ... ok test tests::compatibility_fields_are_kept_in_the_rust_shape_and_architecture_on_wire ... ok test tests::static_facts_are_cached_and_live_counters_are_collected_only_when_requested ... ok test tests::os_release_uses_distribution_name_and_version_without_shell_evaluation ... ok test tests::macos_load_average_decodes_the_bounded_64_bit_sysctl_shape ... ok test tests::runtime_disable_drops_cached_facts_and_reenable_collects_them_again ... ok test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_protocol-67b9a310ef49abf9) running 7 tests test tests::rejects_oversized_noncanonical_and_malformed_frames_before_buffering_body ... ok test tests::mux_round_trip_and_incremental_decoders_preserve_frame_order ... ok test stream_tests::split_mux_header_preserves_trailing_close ... ok test tests::oversized_encode_keeps_the_reusable_output_unchanged ... ok test tests::golden_vectors_encode_and_decode_every_contract_frame ... ok test stream_tests::all_short_frame_splits_match_direct_decoding ... ok test stream_tests::maximum_sized_fragmented_frame_is_not_rejected ... ok test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_server-32c9e179fdf7b126) running 109 tests test auth::tests::aaguid_projection_rejects_malformed_cbor_corpus ... ok test auth::tests::account_identity_migration_backfills_legacy_users ... ok test auth::tests::aaguid_migration_preserves_legacy_credentials_and_sessions ... ok test auth::tests::account_identity_schema_has_unique_usernames_and_display_names ... ok test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok test auth::http::hostname_tests::authenticated_session_response_includes_system_hostname ... ok test auth::crypto::verifier_tests::browser_secret_hashing_is_canonical_and_bounded ... ok test auth::crypto::verifier_tests::recovery_capacity_denial_is_not_a_legacy_credential_signal ... ok test auth::tests::audit_ceremony_browser_binding ... ok test auth::tests::audit_logout_survives_admission_exhaustion ... ok test auth::tests::discoverable_latency_at_pending_capacity ... ignored, run --release --ignored --nocapture without concurrent builds test auth::tests::audit_no_public_credential_listing ... ok test auth::tests::audit_recovery_after_page_discard_can_resume_at_original_deadline ... ok test auth::tests::audit_recovery_pending_is_visible_to_signed_in_device ... ok test auth::tests::audit_recovery_session_expiring_during_verification_keeps_delay ... ok test auth::tests::provider_labels_cover_the_cited_registry_without_guessing ... ok test auth::tests::provider_session_latency_at_50_devices ... ignored, local auth session scale measurement; run without concurrent builds test auth::tests::authenticated_prf_metadata_preserves_legacy_envelopes ... ok test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok test auth::tests::discoverable_login_handle_credential_counter_and_replay ... ok test auth::tests::enrollment_prf_input_matches_discoverable_login ... ok test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok test auth::tests::pending_unlock_expires_without_terminal_authority ... ok test auth::tests::public_status_and_discoverable_http_login ... ok test auth::tests::recovery_session_delay_latency_at_capacity ... ignored, release-only recovery measurement at 50 live sessions; run without concurrent compilation test auth::tests::recovery_audit_commits_once_with_start_cancel_and_complete ... ok test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok test auth::tests::recovery_verifier_latency_at_capacity ... ignored, release-only v2 diagnostic at 50 live session rows; record host load separately test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok test auth::tests::recovery_http_live_same_account_is_immediate ... ok test auth::tests::recovery_http_other_expired_pending_and_missing_sessions_wait ... ok test auth::tests::recovery_live_session_cannot_accelerate_an_active_delayed_request ... ok test auth::tests::recovery_live_session_revoked_during_verification_cannot_waive_delay ... ok test auth::tests::recovery_unknown_identity_pays_the_same_database_and_verifier_work ... ok test auth::tests::recovery_username_identity_is_additive_and_ambiguous_forms_fail ... ok test auth::tests::redacted_unknown_and_failed_registrations_do_not_claim_a_provider ... ok test auth::tests::registration_aaguid_survives_none_attestation_and_binds_session_provider ... ok test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok test auth::tests::review3_tests::review3_backend_reply_has_a_deadline ... ok test auth::tests::review3_tests::review3_busy_expiry ... ok test auth::tests::review3_tests::review3_busy_logout ... ok test auth::tests::review3_tests::review3_busy_recovery ... ok test auth::tests::review3_tests::review3_completion_and_cleanup_are_transaction_bound ... ok test auth::tests::review3_tests::review3_expired_handshake_must_not_welcome ... ok test auth::tests::review3_tests::review4_slow_open_at_user_capacity ... ignored, release-only connect scale measurement; run without concurrent builds test auth::tests::review3_tests::review3_identified_privacy_timing_and_binding_replays ... ok test auth::tests::review3_tests::review3_pending_routes_and_idle_expiry_recovery ... ok test auth::tests::review3_tests::review3_revoked_handshake_must_not_welcome ... ok test auth::tests::review3_tests::review3_revoked_resume_must_not_welcome ... ok test auth::tests::review3_tests::review3_unwrap_cannot_be_skipped ... ok test auth::tests::review3_tests::review3_waiting_handshake_loses_authority ... ok test auth::tests::review3_tests::review4_open_reply_and_revocation_preserve_authority ... ok test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok test auth::tests::review_old_words_race_rotation ... ok test auth::tests::reviewer_tests::reviewer_disk_cancel_complete_races ... ok test auth::tests::reviewer_tests::reviewer_disk_restart_and_concurrent_resume ... ok test auth::tests::reviewer_tests::reviewer_http_denials_and_recovery_admission ... ok test auth::tests::reviewer_tests::reviewer_http_expired_capability_cannot_complete_after_writer_wait ... ok test auth::tests::reviewer_tests::reviewer_http_expired_ceremony_cannot_complete_after_writer_wait ... ok test auth::tests::reviewer_tests::reviewer_server_clock_rollback_retains_deadline_and_reports_more_than_day ... ok test auth::tests::rotation_tests::recovery_phrase_routes_are_removed_and_words_fail_closed ... ok test auth::tests::setup_check_is_non_consuming_and_closes_after_owner_creation ... ok test auth::tests::setup_identity_validation_and_uniqueness ... ok test auth::tests::rotation_tests::recovery_rotation_cannot_follow_a_cookie_account_switch ... ok test auth::tests::setup_start_accepts_username_and_display_name ... ok test auth::tests::rotation_tests::recovery_rotation_denies_pending_expired_and_stale_sessions ... ok test auth::tests::rotation_tests::recovery_rotation_requires_session_and_replaces_legacy_envelope ... ok test auth::tests::rotation_tests::reviewer_concurrent_signed_in_rotations_commit_once ... ok test auth::tests::server_setup_terminal_echo_and_resume_preserve_offsets_once ... ok test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok test auth::tests::setup_restart_rotation_expiry_and_parallel_redemption ... ok test auth::tests::socket_tests::authenticated_idle_socket_survives_the_former_read_timeout ... ok test auth::tests::socket_tests::socket_authority_latency_at_user_capacity ... ignored, release-only measurement without concurrent compilation test auth::tests::socket_tests::clean_control_close_is_not_an_internal_error ... ok test embedded::regressions::credited_bulk_output_survives_forwarder_io_pause ... ok test embedded::regressions::credited_output_queue_at_stream_capacity ... ignored, debug actor memory/scheduling measurement; run without concurrent builds test embedded::regressions::full_output_queue_must_not_block_shared_actor ... ok test embedded::regressions::healthy_receiver_survives_ready_native_output_burst ... ok test embedded::regressions::healthy_streams_progress_at_user_attachment_capacity ... ok test embedded::regressions::output_and_snapshot_spend_remaining_restart_credit ... ok test embedded::regressions::real_agent_canonical_uuid_result_is_accepted ... ok test embedded::regressions::real_agent_open_uses_uid_and_character_dimensions ... ok test embedded::regressions::reattach_must_restore_output_credit ... ok test embedded::regressions::recovery_event_then_snapshot_keeps_embedded_connection_live ... ok test embedded::regressions::recovery_notices_preserve_order_credit_and_session_isolation ... ok test embedded::regressions::stream_close_must_not_restart_all_sessions ... ok test embedded::regressions::uncredited_output_or_repaint_is_rejected_before_queueing ... ok test runtime::reviewer_admission::reviewer_recovery_source_limit_covers_all_routes_without_forwarding_bypass ... ok test runtime::tests::proxy_mode_requires_an_explicit_peer_allowlist ... ok test runtime::tests::proxy_networks_match_only_their_address_family_and_prefix ... ok test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok test runtime::tests::router_migrates_private_storage_and_serves_health ... ok test runtime::tests::setup_socket_cleanup_preserves_symlinks_and_regular_files ... ok test runtime::tests::setup_token_socket_is_private_and_requires_explicit_request ... ok test runtime::tests::startup_with_owner_unlinks_stale_setup_token_socket ... ok test web_assets::tests::encodings_and_identity_have_correct_headers_and_sizes ... ok test web_assets::tests::spa_and_mutable_assets_revalidate_and_missing_brotli_uses_gzip ... ok test websocket::recovery_notification_bench::recovery_notification_state_at_socket_capacity ... ignored, notification state sizing diagnostic, not allocator-inclusive RSS certification test websocket::writer_tests::second_device_does_not_inherit_first_device_input_ack ... ok test websocket::writer_tests::writer_admission_at_user_capacity ... ignored, release-only scale measurement; run without concurrent builds test websocket::writer_tests::writer_ownership_capacity_unsigned_offsets_and_identity_reuse ... ok test runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment ... ok test auth::tests::socket_tests::fragmented_wire_frame_has_a_completion_deadline ... ok test auth::tests::socket_tests::half_open_sockets_obey_user_limit ... ok test auth::tests::socket_tests::incomplete_rfc_message_still_loses_authority_on_revocation ... ok test auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket ... ok test auth::tests::socket_tests::revoked_idle_socket_loses_all_authority ... ok test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok test result: ok. 100 passed; 0 failed; 9 ignored; 0 measured; 0 filtered out; finished in 102.43s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/infraternal_shim-67ffc9c8d51fcf5c) running 73 tests test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement test frame::checks::tests::golden_and_fragmented ... ok test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok test ring::checks::tests::wrap_and_exact_offsets ... ok test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile test frame::checks::golden::every_frozen_message ... ok test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok test terminal::checks::tests::fixtures_and_continuations_repaint ... ok test terminal::checks::tests::partial_csi_and_utf8_continue ... ok test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file test terminal::checks::tests::saved_origin_survives_changed_margins ... ok test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok test terminal::fidelity::fidelity_iso_protection_erase ... ok test terminal::fidelity::fidelity_cursor ... ok test terminal::fidelity::fidelity_edge ... ok test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok test terminal::fidelity::fidelity_orphaned_spacer_head ... ok test terminal::fidelity::fidelity_f1_rep ... ok test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok test terminal::fidelity::fidelity_saved_modes_future_restore ... ok test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok test terminal::fidelity::fidelity_spacer_head_attributes ... ok test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok test terminal::fidelity::fidelity_variation_tail_attributes ... ok test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok test terminal::fidelity::fidelity_variation_wrap_attributes ... ok test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok test terminal::fidelity::fidelity_recorded_corpus ... ok test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok test terminal::fidelity::fidelity_handwritten ... ok test terminal::fidelity::fidelity_extended_smoke ... ok test terminal::fidelity::fidelity_seeded_smoke ... ok test result: ok. 61 passed; 0 failed; 12 ignored; 0 measured; 0 filtered out; finished in 38.82s Running tests/detach.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/detach-c502cd554fb112ce) running 1 test test closed_standard_descriptors_become_dev_null ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.76s Running tests/mouse.rs (/home/kayg/.cache/codex-scratch/host-facts-review/target/debug/deps/mouse-523bfdef43cc46cb) running 1 test test faithful_snapshot_preserves_public_mouse_encoder_reports ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.87s Doc-tests infraternal_agent running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_mesh running 1 test test crates/infraternal-mesh/src/model.rs - model::LocalPrivateKey (line 20) - compile fail ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s Doc-tests infraternal_plugin_api running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_host_facts running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_ssh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_protocol running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_server running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_shim running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ==> cargo-deny warning[duplicate]: found 2 duplicate entries for crate 'base64' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:24:1 │ 24 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index 25 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────┘ lock entries │ ├ base64 v0.21.7 ├── base64urlsafedata v0.5.5 │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── webauthn-rs v0.5.5 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-proto v0.5.5 │ └── webauthn-rs-core v0.5.5 (*) ├── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-proto v0.5.5 (*) ├ base64 v0.22.1 ├── axum v0.8.9 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── infraternal-server v0.1.0 (*) └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 3 duplicate entries for crate 'getrandom' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:90:1 │ 90 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index 91 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index 92 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ getrandom v0.2.17 └── rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ ├── sha1 v0.10.7 │ │ │ ├── axum v0.8.9 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── tungstenite v0.29.0 │ │ │ └── tokio-tungstenite v0.29.0 │ │ │ ├── axum v0.8.9 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ getrandom v0.4.3 ├── jobserver v0.1.35 │ └── cc v1.6.0 │ ├── (build) libfuzzer-sys v0.4.13 │ │ └── infraternal-fuzz v0.1.0 │ ├── (build) libsqlite3-sys v0.30.1 │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 │ │ │ ├── infraternal v0.1.0 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ └── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── openssl-src v300.6.1+3.6.3 │ │ └── (build) openssl-sys v0.9.117 │ │ ├── axum-server v0.8.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── openssl v0.10.81 │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── tokio-openssl v0.6.5 │ │ │ │ └── axum-server v0.8.0 (*) │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── tokio-openssl v0.6.5 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ └── webauthn-rs-core v0.5.5 (*) │ └── (build) openssl-sys v0.9.117 (*) └── uuid v1.27.0 ├── infraternal-agent v0.1.0 │ └── infraternal v0.1.0 (*) ├── infraternal-server v0.1.0 (*) ├── webauthn-attestation-ca v0.5.5 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'hashbrown' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:96:1 │ 96 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index 97 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ hashbrown v0.15.5 ├── hashlink v0.10.0 │ └── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-core v0.8.6 (*) ├ hashbrown v0.17.1 └── indexmap v2.14.2 ├── h2 v0.4.19 │ └── hyper v1.11.1 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── axum-server v0.8.0 │ │ └── infraternal-server v0.1.0 (*) │ └── hyper-util v0.1.21 │ ├── axum v0.8.9 (*) │ └── axum-server v0.8.0 (*) └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'r-efi' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:186:1 │ 186 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index 187 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ r-efi v5.3.0 └── getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ r-efi v6.0.0 └── getrandom v0.4.3 ├── jobserver v0.1.35 │ └── cc v1.6.0 │ ├── (build) libfuzzer-sys v0.4.13 │ │ └── infraternal-fuzz v0.1.0 │ ├── (build) libsqlite3-sys v0.30.1 │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 │ │ │ ├── infraternal v0.1.0 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ └── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── openssl-src v300.6.1+3.6.3 │ │ └── (build) openssl-sys v0.9.117 │ │ ├── axum-server v0.8.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── openssl v0.10.81 │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── tokio-openssl v0.6.5 │ │ │ │ └── axum-server v0.8.0 (*) │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── tokio-openssl v0.6.5 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ └── webauthn-rs-core v0.5.5 (*) │ └── (build) openssl-sys v0.9.117 (*) └── uuid v1.27.0 ├── infraternal-agent v0.1.0 │ └── infraternal v0.1.0 (*) ├── infraternal-server v0.1.0 (*) ├── webauthn-attestation-ca v0.5.5 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:188:1 │ 188 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index 189 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 └── infraternal v0.1.0 ├ rand v0.9.5 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── tungstenite v0.29.0 │ └── tokio-tungstenite v0.29.0 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ └── (dev) infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 └── webauthn-rs v0.5.5 └── infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:190:1 │ 190 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index 191 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_chacha v0.3.1 └── rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 └── infraternal v0.1.0 ├ rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_core' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:192:1 │ 192 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index 193 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ ├── sha1 v0.10.7 │ │ │ ├── axum v0.8.9 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── tungstenite v0.29.0 │ │ │ └── tokio-tungstenite v0.29.0 │ │ │ ├── axum v0.8.9 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'syn' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:229:1 │ 229 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index 230 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────┘ lock entries │ ├ syn v2.0.119 ├── asn1-rs-derive v0.5.1 │ └── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── asn1-rs-impl v0.2.0 │ └── asn1-rs v0.6.2 (*) ├── enum-as-inner v0.6.1 │ └── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 │ ├── infraternal-agent v0.1.0 │ │ └── infraternal v0.1.0 (*) │ └── infraternal-fuzz v0.1.0 ├── openssl-macros v0.1.1 │ └── openssl v0.10.81 │ ├── axum-server v0.8.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── tokio-openssl v0.6.5 │ │ └── axum-server v0.8.0 (*) │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) ├── synstructure v0.13.2 │ └── asn1-rs-derive v0.5.1 (*) ├── thiserror-impl v1.0.69 │ └── thiserror v1.0.69 │ ├── asn1-rs v0.6.2 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── x509-parser v0.16.0 (*) ├── tracing-attributes v0.1.31 │ └── tracing v0.1.44 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-core v0.5.6 │ │ └── axum v0.8.9 (*) │ ├── h2 v0.4.19 │ │ └── hyper v1.11.1 │ │ ├── axum v0.8.9 (*) │ │ ├── axum-server v0.8.0 (*) │ │ └── hyper-util v0.1.21 │ │ ├── axum v0.8.9 (*) │ │ └── axum-server v0.8.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ ├── sqlx-macros v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── tracing-subscriber v0.3.23 │ │ └── infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) └── zerocopy-derive v0.8.60 └── zerocopy v0.8.60 ├── half v2.7.1 │ ├── ciborium-ll v0.2.2 │ │ └── ciborium v0.2.2 │ │ └── criterion v0.7.0 │ │ └── (dev) infraternal-protocol v0.1.0 │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-host-facts v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ └── serde_cbor_2 v0.13.0 │ ├── infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── ppv-lite86 v0.2.21 ├── rand_chacha v0.3.1 │ └── rand v0.8.8 │ └── bip39 v2.2.2 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 (*) │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ syn v3.0.6 ├── clap_derive v4.6.7 │ └── clap v4.6.7 │ ├── criterion v0.7.0 │ │ └── (dev) infraternal-protocol v0.1.0 │ │ ├── infraternal-agent v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ ├── infraternal-fuzz v0.1.0 │ │ ├── (dev) infraternal-plugin-host-facts v0.1.0 │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 (*) │ └── infraternal v0.1.0 (*) ├── displaydoc v0.2.7 │ ├── asn1-rs v0.6.2 │ │ ├── der-parser v9.0.0 │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── x509-parser v0.16.0 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── oid-registry v0.7.1 │ │ │ └── x509-parser v0.16.0 (*) │ │ └── x509-parser v0.16.0 (*) │ ├── der-parser v9.0.0 (*) │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── tinystr v0.8.4 │ │ └── icu_locale_core v2.3.0 (*) │ └── zerotrie v0.2.5 │ ├── icu_properties v2.3.0 (*) │ └── icu_provider v2.3.1 (*) ├── futures-macro v0.3.34 │ └── futures-util v0.3.34 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ ├── futures-executor v0.3.34 │ │ └── sqlx-sqlite v0.8.6 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── js-sys v0.3.106 │ │ └── web-sys v0.3.106 │ │ └── plotters v0.3.7 │ │ └── criterion v0.7.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── tower-http v0.6.11 │ └── infraternal-server v0.1.0 (*) ├── serde_derive v1.0.229 │ ├── serde v1.0.229 │ │ ├── base64urlsafedata v0.5.5 │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 (*) │ │ ├── bip39 v2.2.2 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── ciborium v0.2.2 │ │ │ └── criterion v0.7.0 (*) │ │ ├── criterion v0.7.0 (*) │ │ ├── either v1.18.0 │ │ │ ├── axum-server v0.8.0 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── itertools v0.13.0 │ │ │ │ ├── criterion v0.7.0 (*) │ │ │ │ └── criterion-plot v0.6.0 │ │ │ │ └── criterion v0.7.0 (*) │ │ │ ├── rayon v1.12.0 │ │ │ │ └── criterion v0.7.0 (*) │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-mesh v0.1.0 │ │ ├── infraternal-plugin-host-facts v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── serde_cbor_2 v0.13.0 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── serde_urlencoded v0.7.1 │ │ │ ├── axum v0.8.9 (*) │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ ├── sqlx-core v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ ├── tinytemplate v1.2.1 │ │ │ └── criterion v0.7.0 (*) │ │ ├── tracing-serde v0.2.0 │ │ │ └── tracing-subscriber v0.3.23 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── tracing-subscriber v0.3.23 (*) │ │ ├── url v2.5.8 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ ├── webauthn-rs v0.5.5 (*) │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ └── webauthn-rs-proto v0.5.5 (*) │ └── url v2.5.8 (*) ├── synstructure v0.14.0 │ ├── yoke-derive v0.8.4 │ │ └── yoke v0.8.3 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── zerotrie v0.2.5 (*) │ │ └── zerovec v0.11.8 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_locale_core v2.3.0 (*) │ │ ├── icu_normalizer v2.3.0 (*) │ │ ├── icu_properties v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── potential_utf v0.1.6 │ │ │ └── icu_collections v2.3.0 (*) │ │ └── tinystr v0.8.4 (*) │ └── zerofrom-derive v0.1.8 │ └── zerofrom v0.1.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── yoke v0.8.3 (*) │ ├── zerotrie v0.2.5 (*) │ └── zerovec v0.11.8 (*) ├── thiserror-impl v2.0.21 │ └── thiserror v2.0.21 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-mesh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── sysctl v0.7.1 │ │ └── infraternal-plugin-host-facts v0.1.0 (*) │ └── tungstenite v0.29.0 │ └── tokio-tungstenite v0.29.0 (*) ├── tokio-macros v2.7.2 │ └── tokio v1.53.2 │ ├── axum v0.8.9 (*) │ ├── axum-server v0.8.0 (*) │ ├── fs-err v3.3.2 │ │ └── axum-server v0.8.0 (*) │ ├── h2 v0.4.19 │ │ └── hyper v1.11.1 │ │ ├── axum v0.8.9 (*) │ │ ├── axum-server v0.8.0 (*) │ │ └── hyper-util v0.1.21 │ │ ├── axum v0.8.9 (*) │ │ └── axum-server v0.8.0 (*) │ ├── hyper v1.11.1 (*) │ ├── hyper-util v0.1.21 (*) │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── (dev) infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-openssl v0.6.5 │ │ └── axum-server v0.8.0 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ ├── tokio-tungstenite v0.29.0 (*) │ ├── tokio-util v0.7.19 │ │ ├── h2 v0.4.19 (*) │ │ └── tower-http v0.6.11 (*) │ ├── tower v0.5.3 (*) │ └── tower-http v0.6.11 (*) ├── wasm-bindgen-macro-support v0.2.129 │ └── wasm-bindgen-macro v0.2.129 │ └── wasm-bindgen v0.2.129 │ ├── js-sys v0.3.106 (*) │ ├── plotters v0.3.7 (*) │ └── web-sys v0.3.106 (*) ├── yoke-derive v0.8.4 (*) ├── zerofrom-derive v0.1.8 (*) └── zerovec-derive v0.11.6 └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'synstructure' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:232:1 │ 232 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index 233 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ synstructure v0.13.2 └── asn1-rs-derive v0.5.1 └── asn1-rs v0.6.2 ├── der-parser v9.0.0 │ ├── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── x509-parser v0.16.0 │ └── webauthn-rs-core v0.5.5 (*) ├── oid-registry v0.7.1 │ └── x509-parser v0.16.0 (*) └── x509-parser v0.16.0 (*) ├ synstructure v0.14.0 ├── yoke-derive v0.8.4 │ └── yoke v0.8.3 │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ └── infraternal v0.1.0 │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── zerotrie v0.2.5 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ └── zerovec v0.11.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ ├── icu_normalizer v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── potential_utf v0.1.6 │ │ └── icu_collections v2.3.0 (*) │ └── tinystr v0.8.4 │ └── icu_locale_core v2.3.0 (*) └── zerofrom-derive v0.1.8 └── zerofrom v0.1.8 ├── icu_collections v2.3.0 (*) ├── icu_provider v2.3.1 (*) ├── yoke v0.8.3 (*) ├── zerotrie v0.2.5 (*) └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:235:1 │ 235 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index 236 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror v2.0.21 ├── infraternal v0.1.0 ├── infraternal-mesh v0.1.0 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 (*) ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) ├── sqlx-sqlite v0.8.6 (*) ├── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 │ ├── infraternal-agent v0.1.0 │ │ └── infraternal v0.1.0 (*) │ └── infraternal-fuzz v0.1.0 └── tungstenite v0.29.0 └── tokio-tungstenite v0.29.0 ├── axum v0.8.9 │ └── infraternal-server v0.1.0 (*) └── (dev) infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl' ┌─ /home/kayg/.cache/codex-scratch/host-facts-review/head/Cargo.lock:237:1 │ 237 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index 238 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror-impl v1.0.69 └── thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror-impl v2.0.21 └── thiserror v2.0.21 ├── infraternal v0.1.0 ├── infraternal-mesh v0.1.0 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 (*) ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) ├── sqlx-sqlite v0.8.6 (*) ├── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 │ ├── infraternal-agent v0.1.0 │ │ └── infraternal v0.1.0 (*) │ └── infraternal-fuzz v0.1.0 └── tungstenite v0.29.0 └── tokio-tungstenite v0.29.0 ├── axum v0.8.9 │ └── infraternal-server v0.1.0 (*) └── (dev) infraternal-server v0.1.0 (*) advisories ok, bans ok, licenses ok, sources ok ==> static builds Finished `release` profile [optimized] target(s) in 0.38s /home/kayg/.cache/codex-scratch/host-facts-review/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 16031568 bytes (baseline 16142672 + allowance 262144 = max 16404816) Finished `release` profile [optimized] target(s) in 0.45s /home/kayg/.cache/codex-scratch/host-facts-review/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 13482320 bytes (baseline 13555672 + allowance 262144 = max 13817816) server subcommand: exit 2, not implemented agent subcommand: exit 2, not implemented +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ==> Vendored Ghostty artifact checksums dist/ghostty-web.js: OK dist/ghostty-vt.wasm: OK dist/index.d.ts: OK ==> TypeScript protocol compiler ==> Tracer compiler, precompression and bundle transfer budget bun install v1.4.2 (744846f84) Checked 38 installs across 69 packages (no changes) [21.00ms] $ bun x tsc --project tsconfig.json bun test v1.4.2 (744846f84) browser-build.test.ts: (pass) the browser renderer has no unresolved Vite Node-file shim request [31.49ms] chunk-classes.test.ts: (pass) the first screen is critical, the canvas product module and what only it uses are deferred [2.23ms] (pass) a chunk that both sides use stays critical [0.27ms] (pass) code only an action loads is on demand, even when the lazy canvas is what loads it [0.53ms] precompress.test.ts: (pass) text sidecars round-trip deterministically; compressed formats remain identity [34.78ms] test/recovery-ui.test.ts: (pass) compiled recovery UI mode off obeys its URL boundary [5.60ms] (pass) compiled recovery UI mode preview obeys its URL boundary [2.46ms] (pass) compiled recovery UI mode 1 obeys its URL boundary [1.84ms] test/recovery-crypto.test.ts: (pass) HKDF siblings match independent implementation and bind unwrap to domain, account, kind and version [14.90ms] (pass) 100 repeated wrapping operations generate independent salts and nonces [11.05ms] test/recovery-wait.test.ts: (pass) server remaining wait 0s is accepted through the capability policy maximum [4.28ms] (pass) server remaining wait 86400s is accepted through the capability policy maximum [0.83ms] (pass) server remaining wait 90000s is accepted through the capability policy maximum [0.59ms] (pass) server remaining wait 172800s is accepted through the capability policy maximum [0.61ms] (pass) malformed or excessive remaining wait -1 is denied [0.99ms] (pass) malformed or excessive remaining wait 0.5 is denied [0.65ms] (pass) malformed or excessive remaining wait 172801 is denied [0.71ms] (pass) malformed or excessive remaining wait 9007199254740992 is denied [0.88ms] (pass) malformed or excessive remaining wait 90000 is denied [0.59ms] test/recovery-rotation.test.ts: (pass) signed-in rotation sends only a local envelope and verifier after acknowledgement [6.52ms] (pass) abandoned word acknowledgement uploads nothing [2.53ms] (pass) settled acknowledgement cannot upload later (dismissed) [1.71ms] (pass) settled acknowledgement cannot upload later (no acknowledgement) [1.58ms] src/canvas/windows/details-facts.test.ts: (pass) host facts become the existing Host key/value rows [0.51ms] (pass) unknown optional host facts stay absent instead of appearing as placeholders [0.11ms] src/canvas/mesh/protocol.test.ts: (pass) the server's own list becomes nodes, tags and grants, by name [0.64ms] (pass) without `access` (today's server) the person may view and may not edit [0.21ms] (pass) fields the server does not send are absent, never invented [0.15ms] (pass) anything that is not a list is refused, whole [4.69ms] (pass) a node's own tag list and the tag table agree even when a server sends only one [0.15ms] (pass) the subscription's events: a pushed list, a revision that invalidates, and the end of the subscription [0.18ms] (pass) answers carry the new revision, and a create the new arrow's id [0.05ms] (pass) endpoints go out as the server writes them: a node by id, a tag by name [0.06ms] src/canvas/mesh/layout.test.ts: (pass) a small mesh keeps the approved arrangement: tags down the left, hosts two to a row [10.94ms] (pass) the layout is deterministic and does not depend on input order [7.17ms] (pass) no two cards overlap, and every card lies inside the graph [4.67ms] (pass) the sheet is wider than tall, roughly 16:10 [1.34ms] (pass) a pinned node stays where it was put and the others do not move [1.44ms] (pass) a pin beyond the sheet grows the graph [0.52ms] (pass) a host's other tags do not move it; a tag nobody carries still has its node [0.20ms] (pass) 1,000 nodes lay out in a few milliseconds [11.23ms] src/canvas/layout/stops.test.ts: (pass) a view that fits the viewport has one stop, centred [0.30ms] (pass) a wide view has one stop per column and the last stop ends at the right edge [0.11ms] (pass) a view taller than the viewport is scaled down so it fits [0.02ms] (pass) nearestStop picks the stop whose centre is closest [0.09ms] (pass) a big graph opens fitted whole, in one stop, and its canvas is free [0.13ms] (pass) a small graph keeps one stop per node column [0.11ms] (pass) on a narrow screen a big graph does not shrink past where its names can be read: it starts at the top left [0.09ms] src/canvas/layout/geometry.test.ts: (pass) a dropped view pushes the one it lands on along the axis of least overlap, never itself [0.33ms] (pass) a chain of neighbours is pushed in turn [0.06ms] (pass) snapping rounds to whole cells [0.03ms] (pass) reach follows grants through tags and keeps the relay [0.15ms] src/canvas/model/document.test.ts: (pass) a document holds references and layout, never content [0.22ms] (pass) a document survives JSON and rebuilds the same columns [0.42ms] (pass) a target that no longer exists is dropped, and an emptied column with it [0.10ms] (pass) parseDocument rejects anything that is not a document of this format [0.22ms] 56 pass 0 fail 9946 expect() calls Ran 56 tests across 13 files. [241.00ms] $ bun run build.ts built chunk-k3789ryh.js, chunk-r3mgv63s.js, chunk-cy892tb7.js, main.js, chunk-pw0rta48.js, chunk-xrb0zjcp.js, chunk-z5p786p6.js, chunk-sxk8w2p8.js, chunk-5753zf8s.js, chunk-aqpxqt98.js, chunk-ww2m8ee0.js, chunk-axbkkqp1.js, chunk-b1x17cec.js, chunk-xyvqg7t7.js, chunk-93r1e5ch.js, chunk-1hfqw9kz.js, chunk-v52cv3b9.js, chunk-k93v5q4e.js, chunk-5b5vfws5.js, chunk-84k2mb1x.js, chunk-s78fgkex.js, chunk-tvpjb29t.js, chunk-nrhjdsd2.js, backdrop.worker.js, faulty-terminal.worker.js, chunk-1gmd77gh.js, chunk-sajgyt5b.js, chunk-krag9pdw.js, chunk-y667rdh9.js, chunk-cmc3x3e5.js critical chunk-cmc3x3e5.js: identity=39 gzip=39 brotli=39 bytes onDemand chunk-aqpxqt98.js: identity=14856 gzip=5465 brotli=4890 bytes onDemand chunk-84k2mb1x.js: identity=538 gzip=352 brotli=314 bytes critical chunk-b1x17cec.js: identity=702015 gzip=203602 brotli=164847 bytes critical faulty-terminal.worker.js: identity=1086 gzip=558 brotli=481 bytes critical backdrop.worker.js: identity=243 gzip=212 brotli=164 bytes onDemand chunk-5b5vfws5.js: identity=4351 gzip=1722 brotli=1496 bytes deferred chunk-r3mgv63s.js: identity=37378 gzip=14585 brotli=12770 bytes critical chunk-axbkkqp1.js: identity=90 gzip=90 brotli=78 bytes critical chunk-sxk8w2p8.js: identity=1916 gzip=845 brotli=734 bytes critical chunk-z5p786p6.js: identity=8172 gzip=3514 brotli=3108 bytes onDemand chunk-v52cv3b9.js: identity=5749 gzip=2762 brotli=2497 bytes critical chunk-xrb0zjcp.js: identity=6483 gzip=3110 brotli=2814 bytes critical chunk-k3789ryh.js: identity=20074 gzip=6378 brotli=5694 bytes onDemand chunk-xyvqg7t7.js: identity=5787 gzip=2584 brotli=2348 bytes critical chunk-pw0rta48.js: identity=8377 gzip=3574 brotli=3186 bytes onDemand chunk-tvpjb29t.js: identity=4112 gzip=1734 brotli=1522 bytes deferred chunk-93r1e5ch.js: identity=93321 gzip=32397 brotli=28652 bytes critical chunk-1gmd77gh.js: identity=9810 gzip=4020 brotli=3461 bytes critical chunk-1hfqw9kz.js: identity=49 gzip=49 brotli=49 bytes critical chunk-sajgyt5b.js: identity=199 gzip=160 brotli=134 bytes onDemand chunk-nrhjdsd2.js: identity=11538 gzip=4877 brotli=4302 bytes critical chunk-5753zf8s.js: identity=386 gzip=237 brotli=195 bytes onDemand chunk-s78fgkex.js: identity=5327 gzip=2569 brotli=2286 bytes critical chunk-y667rdh9.js: identity=39 gzip=39 brotli=39 bytes onDemand chunk-cy892tb7.js: identity=2108 gzip=1037 brotli=870 bytes critical main.js: identity=105479 gzip=38352 brotli=33200 bytes critical chunk-krag9pdw.js: identity=57474 gzip=18833 brotli=16884 bytes onDemand chunk-k93v5q4e.js: identity=20875 gzip=8490 brotli=7640 bytes onDemand chunk-ww2m8ee0.js: identity=1026 gzip=623 brotli=498 bytes JavaScript transfer, critical: identity=921931 gzip=283612/307200 brotli=235107/256000 bytes JavaScript transfer, deferred: identity=130699 gzip=46982/51200 brotli=41422/45056 bytes JavaScript transfer, onDemand: identity=76267 gzip=32215/20480 brotli=28663/18432 bytes JavaScript transfer, onDemand largest chunk chunk-k93v5q4e.js: gzip=8490/20480 brotli=7640/18432 bytes (class total gzip=32215 brotli=28663, not limited) fonts/monaspace-neon/italic.latin.woff2: identity=44324 gzip=44324 brotli=44324 bytes fonts/monaspace-neon/roman.latin.woff2: identity=40016 gzip=40016 brotli=40016 bytes fonts/jetbrains-mono/italic.latin.woff2: identity=36316 gzip=36316 brotli=36316 bytes fonts/jetbrains-mono/roman.latin.woff2: identity=34068 gzip=34068 brotli=34068 bytes fonts/source-code-pro/italic.latin.woff2: identity=23612 gzip=23612 brotli=23612 bytes fonts/source-code-pro/roman.latin.woff2: identity=22872 gzip=22872 brotli=22872 bytes fonts/geist-mono/italic.latin.woff2: identity=21380 gzip=21380 brotli=21380 bytes fonts/geist-mono/roman.latin.woff2: identity=19984 gzip=19984 brotli=19981 bytes fonts/ibm-plex-mono/italic.latin.woff2: identity=22296 gzip=22296 brotli=22296 bytes fonts/ibm-plex-mono/roman.latin.woff2: identity=19048 gzip=19048 brotli=19047 bytes fonts/cascadia-code/italic.latin.woff2: identity=44404 gzip=44404 brotli=44404 bytes fonts/cascadia-code/roman.latin.woff2: identity=40604 gzip=40604 brotli=40604 bytes fonts/maple-mono-nf/italic.latin.woff2: identity=53444 gzip=53444 brotli=53444 bytes fonts/maple-mono-nf/roman.latin.woff2: identity=46432 gzip=46432 brotli=46432 bytes fonts/nerd-symbols.woff2: identity=223748 gzip=223748 brotli=223748 bytes fonts/fira-code/roman.latin.woff2: identity=36756 gzip=36756 brotli=36756 bytes fonts/commit-mono/italic-400.latin.woff2: identity=18716 gzip=18716 brotli=18716 bytes fonts/commit-mono/italic-700.latin.woff2: identity=18352 gzip=18352 brotli=18352 bytes fonts/commit-mono/roman-400.latin.woff2: identity=17484 gzip=17484 brotli=17484 bytes fonts/commit-mono/roman-700.latin.woff2: identity=17260 gzip=17260 brotli=17260 bytes Font transfer: monaspace-neon=84340/88064 jetbrains-mono=70384/75776 source-code-pro=46484/49152 geist-mono=41364/45056 ibm-plex-mono=41344/45056 cascadia-code=85008/88064 maple-mono-nf=99876/106496 (critical 46432/51200) symbols=223748/235520 fira-code=36756/40960 commit-mono=71812/75776 bytes ==> Rust stream oracle (for the differential test) ==> TypeScript protocol tests bun test v1.4.2 (744846f84) src/codec.test.ts: (pass) wire protocol golden vectors > encodes and decodes each frame exactly as the shared manifest describes [6.28ms] (pass) wire protocol golden vectors > returns borrowed payload views and writes into reusable buffers [0.13ms] (pass) wire protocol golden vectors > decodes muxed messages split across WebSocket messages [0.73ms] (pass) wire protocol golden vectors > rejects oversized, non-canonical, unknown, and malformed frame bytes [0.14ms] (pass) split mux header preserves trailing Close [0.20ms] src/stream.test.ts: stream differential: 134 streams, 11439 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [3416.79ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [11.75ms] 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [3.44s] ~~~~ </details>

kayg commented

2026-10-09 19:15:50 +00:00

Author

Owner

Verdict: merge after fixes — 0 P0, 1 P1, 3 P2, 1 P3. Final local review branch: review-host-facts, head 19e1891915571a136f93bde7143b2a234a445753.

Review, five failing tests, production screenshot and gate evidence are committed. Findings index updated. Owned temporary checkouts/builds/logs removed; worktree clean. No implementation fixes, push, deployment or issue closure.

Pristine target 38b53f45: scripts/verify fast PASS, exit 0. Complete verbatim output is in the preceding finish comment and docs/reviews/host-facts-fast.md. Its summary, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Latency gate FAIL, exit 1: 293 browser tests passed, 22 failed, 26 skipped. Native same-session budget failure reproduces on merge base. Mesh frame budget and predictive-capture visibility remain unresolved. Full attribution and numbers: docs/reviews/host-facts.md, host-facts-latency.md, host-facts-browser-comparison.md.

Verdict: **merge after fixes** — 0 P0, 1 P1, 3 P2, 1 P3. Final local review branch: `review-host-facts`, head `19e1891915571a136f93bde7143b2a234a445753`. Review, five failing tests, production screenshot and gate evidence are committed. Findings index updated. Owned temporary checkouts/builds/logs removed; worktree clean. No implementation fixes, push, deployment or issue closure. Pristine target `38b53f45`: `scripts/verify fast` PASS, exit 0. Complete verbatim output is in the preceding finish comment and `docs/reviews/host-facts-fast.md`. Its summary, verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Latency gate FAIL, exit 1: 293 browser tests passed, 22 failed, 26 skipped. Native same-session budget failure reproduces on merge base. Mesh frame budget and predictive-capture visibility remain unresolved. Full attribution and numbers: `docs/reviews/host-facts.md`, `host-facts-latency.md`, `host-facts-browser-comparison.md`.

kayg commented

2026-10-09 19:17:22 +00:00

Author

Owner

Starting repair on branch host-facts at 38b53f456dcb0d7c2abb02e35a32a66bca88c101; current dev is f9af8e0e. I’ve read all #144 and parent #127 comments plus the review report. Merging dev first, then applying the five review regressions and fixing P1 first.

Starting repair on branch `host-facts` at `38b53f456dcb0d7c2abb02e35a32a66bca88c101`; current `dev` is `f9af8e0e`. I’ve read all #144 and parent #127 comments plus the review report. Merging `dev` first, then applying the five review regressions and fixing P1 first.

kayg commented

2026-10-09 19:17:34 +00:00

Author

Owner

Step complete: merged dev at f9af8e0e into host-facts; merge commit 8603b6f3996cd5b9a3af55d7c1b561fa073d1430. The merge applied cleanly (30 files, 922 insertions, 97 deletions). The review screenshot was preserved in job scratch before browser regeneration.

Step complete: merged `dev` at `f9af8e0e` into `host-facts`; merge commit `8603b6f3996cd5b9a3af55d7c1b561fa073d1430`. The merge applied cleanly (30 files, 922 insertions, 97 deletions). The review screenshot was preserved in job scratch before browser regeneration.

kayg commented

2026-10-09 19:19:16 +00:00

Author

Owner

Finding HF-R3 (P1): after cherry-picking the review regression, cargo test --locked --offline -p infraternal-server --lib non_owner_without_host_configure_permission_is_refused_before_leg_b -- --nocapture fails at crates/infraternal-server/src/auth/socket_tests.rs:595: the real signed-in non-owner configuration call reaches leg B. The focused test compiled with the documented Nix make/perl environment. I’m fixing the authorization path before the other findings.

Finding HF-R3 (P1): after cherry-picking the review regression, `cargo test --locked --offline -p infraternal-server --lib non_owner_without_host_configure_permission_is_refused_before_leg_b -- --nocapture` fails at `crates/infraternal-server/src/auth/socket_tests.rs:595`: the real signed-in non-owner configuration call reaches leg B. The focused test compiled with the documented Nix make/perl environment. I’m fixing the authorization path before the other findings.

kayg commented

2026-10-09 19:29:24 +00:00

Author

Owner

Verification finding: after HF-R3, the full server library suite completed 100 passed / 1 failed / 9 ignored; expired_handshake_releases_user_permits missed its expected 503 in the parallel run. An isolated rerun of that test passed (1/1, 0.48s). This is a socket deadline case; I’ll apply the brief’s baseline comparison if it recurs in scripts/verify fast.

Verification finding: after HF-R3, the full server library suite completed 100 passed / 1 failed / 9 ignored; `expired_handshake_releases_user_permits` missed its expected 503 in the parallel run. An isolated rerun of that test passed (1/1, 0.48s). This is a socket deadline case; I’ll apply the brief’s baseline comparison if it recurs in `scripts/verify fast`.

kayg commented

2026-10-09 19:29:50 +00:00

Author

Owner

Step complete: df9d9b81 adds server-side authorization from compiled action descriptors and the existing owner bit, with no extra query on each host-facts poll. The review test fails before the fix and passes after (1/1); cargo fmt --all -- --check and git diff --check pass. Full server run: 100 passed, 1 timeout test failed, 9 ignored; that timeout test passes in isolation (1/1, 0.48s). The transient is recorded above for the final fast-gate baseline rule.

Step complete: `df9d9b81` adds server-side authorization from compiled action descriptors and the existing owner bit, with no extra query on each host-facts poll. The review test fails before the fix and passes after (1/1); `cargo fmt --all -- --check` and `git diff --check` pass. Full server run: 100 passed, 1 timeout test failed, 9 ignored; that timeout test passes in isolation (1/1, 0.48s). The transient is recorded above for the final fast-gate baseline rule.

kayg commented

2026-10-09 19:32:44 +00:00

Author

Owner

Finding HF-R4 (P2): pending_host_facts_read_keeps_control_ping_responsive fails after the real socketpair observes host.facts.read on leg B; with its Result withheld, the same browser socket receives no Pong for an independent Ping within one second (0 passed / 1 failed, 6.60s). The test includes the compiled action descriptor, so this reproduces the receive-loop wait after the P1 authorization fix. I’m moving pending plugin calls off the receive loop and keeping the result bound to the live socket session.

Finding HF-R4 (P2): `pending_host_facts_read_keeps_control_ping_responsive` fails after the real socketpair observes `host.facts.read` on leg B; with its Result withheld, the same browser socket receives no Pong for an independent Ping within one second (0 passed / 1 failed, 6.60s). The test includes the compiled action descriptor, so this reproduces the receive-loop wait after the P1 authorization fix. I’m moving pending plugin calls off the receive loop and keeping the result bound to the live socket session.

kayg commented

2026-10-09 19:34:02 +00:00

Author

Owner

Step complete: 3694232d routes plugin reads through a bounded per-socket future set, preserves control dispatch, checks session authority before sending results, and drops waits when the socket closes. HF-R4 fails before the fix and passes after (1/1); HF-R3 still passes (1/1). Pending calls are capped at 4 per socket with 8 KiB input/output limits: at the 256-socket server cap, retained request/result bodies are bounded to 16 MiB plus small future state. Wire frames and protocol bytes are unchanged.

Step complete: `3694232d` routes plugin reads through a bounded per-socket future set, preserves control dispatch, checks session authority before sending results, and drops waits when the socket closes. HF-R4 fails before the fix and passes after (1/1); HF-R3 still passes (1/1). Pending calls are capped at 4 per socket with 8 KiB input/output limits: at the 256-socket server cap, retained request/result bodies are bounded to 16 MiB plus small future state. Wire frames and protocol bytes are unchanged.

kayg commented

2026-10-09 19:34:27 +00:00

Author

Owner

Finding HF-R2 (P2): bun test src/canvas/sessions/details-live.test.ts fails on the review test: after one ActionRefused("action unavailable"), expected 0 pending timers but received 1 (0 passed / 1 failed). The rejection is caught, then finally schedules the next read. I’m stopping recurring reads on server refusals while preserving the retry path for transient connection errors.

Finding HF-R2 (P2): `bun test src/canvas/sessions/details-live.test.ts` fails on the review test: after one `ActionRefused("action unavailable")`, expected 0 pending timers but received 1 (0 passed / 1 failed). The rejection is caught, then `finally` schedules the next read. I’m stopping recurring reads on server refusals while preserving the retry path for transient connection errors.

kayg commented

2026-10-09 19:36:59 +00:00

Author

Owner

Step complete: d6b6f64c stops the current popover poll loop on a structured ActionRefused; transport failures still retry after reconnect. HF-R2 failed before the fix (1 timer) and passes after (1/1, 0 timers). bun run check exits 0; git diff --check passes. No dependency or wire change.

Step complete: `d6b6f64c` stops the current popover poll loop on a structured `ActionRefused`; transport failures still retry after reconnect. HF-R2 failed before the fix (1 timer) and passes after (1/1, 0 timers). `bun run check` exits 0; `git diff --check` passes. No dependency or wire change.

kayg commented

2026-10-09 19:37:23 +00:00

Author

Owner

Finding HF-R1 (P2): bun test src/canvas/windows/details-facts.test.ts reports 2 pass / 1 fail. The failing disclosure test lists Init, Virtualization, Shell and Locale among the default nonempty Host rows; all four come from the secondary host-facts fields in details-facts.ts. I’m checking the existing details/UI primitives before selecting the smallest fix that keeps those facts behind the documented More boundary.

Finding HF-R1 (P2): `bun test src/canvas/windows/details-facts.test.ts` reports 2 pass / 1 fail. The failing disclosure test lists Init, Virtualization, Shell and Locale among the default nonempty Host rows; all four come from the secondary host-facts fields in `details-facts.ts`. I’m checking the existing details/UI primitives before selecting the smallest fix that keeps those facts behind the documented More boundary.

kayg commented

2026-10-09 19:39:09 +00:00

Author

Owner

HF-R1 fixed in 6b38aa9c5e. Init, Virtualization, Shell and Locale now use the shared More capsule tab; the mock and live sources share the same section model. bun test src/canvas/windows/details-facts.test.ts: 3 pass, 0 fail; bun run check: exit 0. No binary size change (tracer UI only).

HF-R1 fixed in 6b38aa9c5eb1097708307885eb2a53e4eb5adc72. Init, Virtualization, Shell and Locale now use the shared More capsule tab; the mock and live sources share the same section model. `bun test src/canvas/windows/details-facts.test.ts`: 3 pass, 0 fail; `bun run check`: exit 0. No binary size change (tracer UI only).

kayg commented

2026-10-09 19:39:34 +00:00

Author

Owner

HF-R5 reproduced: after a valid host.facts.read response with os: "Debian GNU/Linux", the live details System row shows Debian GNU/Linux 13 but DetailsFacts.os is undefined. bun test src/canvas/sessions/details-live.test.ts: the new OS mark test fails (expected debian, got undefined); refused-action timer regression passes.

HF-R5 reproduced: after a valid `host.facts.read` response with `os: "Debian GNU/Linux"`, the live details `System` row shows `Debian GNU/Linux 13` but `DetailsFacts.os` is undefined. `bun test src/canvas/sessions/details-live.test.ts`: the new OS mark test fails (expected `debian`, got `undefined`); refused-action timer regression passes.

kayg commented

2026-10-09 19:41:14 +00:00

Author

Owner

HF-R5 fixed in 827fb96dc6. The live source now maps detected OS labels to shared platform marks, and details refresh updates the header after facts arrive. bun test src/canvas/sessions/details-live.test.ts src/canvas/windows/details-facts.test.ts: 5 pass, 0 fail; bun run check: exit 0. No binary size change (browser TypeScript/UI only).

HF-R5 fixed in 827fb96dc6a1909857b9f021749a99a63ab3295d. The live source now maps detected OS labels to shared platform marks, and details refresh updates the header after facts arrive. `bun test src/canvas/sessions/details-live.test.ts src/canvas/windows/details-facts.test.ts`: 5 pass, 0 fail; `bun run check`: exit 0. No binary size change (browser TypeScript/UI only).

kayg commented

2026-10-09 19:47:03 +00:00

Author

Owner

Scripts/verify fast finding: Clippy rejects runtime.rs:247 because build_router became unused after descriptor-aware dispatch, and rejects runtime.rs:191 because serve_with_plugin_descriptors has no # Errors documentation. These are compile-time issues in the server changes, not load-sensitive failures; I will remove the obsolete helper and document the returned error before rerunning the gate.

`Scripts/verify fast` finding: Clippy rejects `runtime.rs:247` because `build_router` became unused after descriptor-aware dispatch, and rejects `runtime.rs:191` because `serve_with_plugin_descriptors` has no `# Errors` documentation. These are compile-time issues in the server changes, not load-sensitive failures; I will remove the obsolete helper and document the returned error before rerunning the gate.

kayg commented

2026-10-09 20:00:32 +00:00

Author

Owner

Fast-gate Clippy finding fixed in aef4f318c4: the compatibility router builder is now test-only and the public descriptor-aware serve entry point documents its errors. cargo fmt --all --check and cargo clippy --locked -p infraternal-server --all-targets -- -D warnings both pass. The full fast gate is being rerun before final browser checks.

Fast-gate Clippy finding fixed in aef4f318c443aedd7951d30ad47640e251e9a1e6: the compatibility router builder is now test-only and the public descriptor-aware serve entry point documents its errors. `cargo fmt --all --check` and `cargo clippy --locked -p infraternal-server --all-targets -- -D warnings` both pass. The full fast gate is being rerun before final browser checks.

kayg commented

2026-10-09 20:11:59 +00:00

Author

Owner

The requested mock details spec now reaches the popover and exposes the new shared More tab. The spec fails only because its old expected tab list is [Host, Connection, Session]; actual is [Host, More, Connection, Session]. Remaining 3/4 mock tests pass, including keyboard and phone placement. Updating the expectation and checking the tab selection.

The requested mock details spec now reaches the popover and exposes the new shared `More` tab. The spec fails only because its old expected tab list is `[Host, Connection, Session]`; actual is `[Host, More, Connection, Session]`. Remaining 3/4 mock tests pass, including keyboard and phone placement. Updating the expectation and checking the tab selection.

kayg commented

2026-10-09 20:13:21 +00:00

Author

Owner

Updated the mock details browser spec in 022890a8af to expect and select the shared More tab. TRACER_TEST_PORT=4214 bun x playwright test test/details.spec.ts --reporter=list: 4 passed in 34.3s.

Updated the mock details browser spec in 022890a8af1d2385189533c45b84a72968049717 to expect and select the shared More tab. `TRACER_TEST_PORT=4214 bun x playwright test test/details.spec.ts --reporter=list`: 4 passed in 34.3s.

kayg commented

2026-10-09 20:16:39 +00:00

Author

Owner

Real-server popover spec passed in 5cf106de27 with an explicit rendered-mark assertion. TRACER_TEST_PORT=4214 ... bun x playwright test -c playwright.real.config.ts real/host-facts.spec.ts: 1 passed (5.2s test, 29.6s total). Fresh production screenshot: apps/tracer/real/host-facts-popover.png (400×824, 113657 bytes); it shows the Debian mark after host facts load.

Real-server popover spec passed in 5cf106de27379b116553fff3e2cfd754d021390f with an explicit rendered-mark assertion. `TRACER_TEST_PORT=4214 ... bun x playwright test -c playwright.real.config.ts real/host-facts.spec.ts`: 1 passed (5.2s test, 29.6s total). Fresh production screenshot: `apps/tracer/real/host-facts-popover.png` (400×824, 113657 bytes); it shows the Debian mark after host facts load.

kayg commented

2026-10-09 20:23:51 +00:00

Author

Owner

Finished on host-facts at 5cf106de27379b116553fff3e2cfd754d021390f.

Repair commits cover all five findings. P1 authorization is checked against the compiled action descriptor and persisted owner authority before leg B; pending plugin calls are capped at four per socket, time out after five seconds and drop with the socket. HF-R2 refusal stops polling, HF-R1 puts Init/Virtualization/Shell/Locale in More, and HF-R5 refreshes the rendered OS mark after live facts arrive. No protocol frames, schema or dependencies changed. Plugin removal check cargo check --locked -p infraternal --no-default-features: exit 0. cargo tree --locked -d shows only the existing duplicate graph; Cargo.toml and Cargo.lock are unchanged.

TRACER_TEST_PORT=4214 bun x playwright test test/details.spec.ts --reporter=list: 4 passed (34.3s). Real-server host-facts.spec.ts: 1 passed (29.6s) with the rendered mark assertion. Fresh screenshot: apps/tracer/real/host-facts-popover.png (400×824, 113657 bytes). It shows Debian's mark and the More control after facts load. Reviewer checklist: permission/refusal/pending-call paths, response bounds, plugin-off path, D126 disclosure, wire stability, feature removal, dependency diff and production screenshot checked. The host-facts parser is unchanged; its existing fuzz target was exercised in the independent review.

Binary size versus the pre-repair host-facts head (38b53f45): x86_64 musl 16031568 → 16046576 bytes (+15008); aarch64 musl 13482320 → 13494576 bytes (+12256). The combined increase comes from the two server repair commits; tracer and test commits add no static-binary bytes. Both remain below the configured fast-gate ceilings (16404816 and 13817816 bytes).

scripts/verify fast at this head exited 0. Gate output, verbatim:

METRIC name=network_rtt_selftest configured_rtt_ms=300 jitter_ms=30 loss=unsupported transport=tcp-stream n=3 p50_ms=293.91 p99_ms=300.16 result=PASS

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

advisories ok, bans ok, licenses ok, sources ok

 59 pass
 0 fail
 9956 expect() calls
Ran 59 tests across 14 files. [878.00ms]
JavaScript transfer, critical: identity=922601 gzip=283782/307200 brotli=235404/256000 bytes
JavaScript transfer, deferred: identity=133043 gzip=47822/51200 brotli=42128/45056 bytes
JavaScript transfer, onDemand: identity=76797 gzip=32431/20480 brotli=28855/18432 bytes
stream differential: 134 streams, 11439 schedules, zero divergences
 7 pass
 0 fail
 34390 expect() calls
Ran 7 tests across 2 files. [4.32s]

Finished on `host-facts` at `5cf106de27379b116553fff3e2cfd754d021390f`. Repair commits cover all five findings. P1 authorization is checked against the compiled action descriptor and persisted owner authority before leg B; pending plugin calls are capped at four per socket, time out after five seconds and drop with the socket. HF-R2 refusal stops polling, HF-R1 puts Init/Virtualization/Shell/Locale in More, and HF-R5 refreshes the rendered OS mark after live facts arrive. No protocol frames, schema or dependencies changed. Plugin removal check `cargo check --locked -p infraternal --no-default-features`: exit 0. `cargo tree --locked -d` shows only the existing duplicate graph; Cargo.toml and Cargo.lock are unchanged. `TRACER_TEST_PORT=4214 bun x playwright test test/details.spec.ts --reporter=list`: `4 passed (34.3s)`. Real-server `host-facts.spec.ts`: `1 passed (29.6s)` with the rendered mark assertion. Fresh screenshot: `apps/tracer/real/host-facts-popover.png` (400×824, 113657 bytes). It shows Debian's mark and the More control after facts load. Reviewer checklist: permission/refusal/pending-call paths, response bounds, plugin-off path, D126 disclosure, wire stability, feature removal, dependency diff and production screenshot checked. The host-facts parser is unchanged; its existing fuzz target was exercised in the independent review. Binary size versus the pre-repair host-facts head (`38b53f45`): x86_64 musl 16031568 → 16046576 bytes (+15008); aarch64 musl 13482320 → 13494576 bytes (+12256). The combined increase comes from the two server repair commits; tracer and test commits add no static-binary bytes. Both remain below the configured fast-gate ceilings (16404816 and 13817816 bytes). `scripts/verify fast` at this head exited 0. Gate output, verbatim: ```text METRIC name=network_rtt_selftest configured_rtt_ms=300 jitter_ms=30 loss=unsupported transport=tcp-stream n=3 p50_ms=293.91 p99_ms=300.16 result=PASS +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ advisories ok, bans ok, licenses ok, sources ok 59 pass 0 fail 9956 expect() calls Ran 59 tests across 14 files. [878.00ms] JavaScript transfer, critical: identity=922601 gzip=283782/307200 brotli=235404/256000 bytes JavaScript transfer, deferred: identity=133043 gzip=47822/51200 brotli=42128/45056 bytes JavaScript transfer, onDemand: identity=76797 gzip=32431/20480 brotli=28855/18432 bytes stream differential: 134 streams, 11439 schedules, zero divergences 7 pass 0 fail 34390 expect() calls Ran 7 tests across 2 files. [4.32s] ```

kayg referenced this issue

2026-10-09 21:14:12 +00:00

Mesh API for the Mesh view: hosts, tags and grants (D163-D167, D180, D187) #108