Standalone TLS: /auth/session returns 401 right after passkey registration

kayg commented

2026-10-10 07:08:15 +00:00

Owner

Found during the canvas zoom benchmarks (#121), on the production binary. In standalone TLS mode, a new owner cannot get a session right after passkey registration. Behind a proxy the same flow works.

Failing: --listen 127.0.0.1:47699 --public-origin https://localhost:47699 --tls-cert c.pem --tls-key k.pem --web-root … --data … (self-signed cert, CN and SAN localhost).

Working: --listen 127.0.0.1:47698 --public-origin https://localhost:47699 --behind-proxy --trusted-proxy 127.0.0.1, with a TLS pass-through front on 47699.

Sequence (identical in both modes until the last step):

GET / → 200; POST /auth/status → 200.
POST /auth/setup-check → 204.
POST /auth/setup-start → 200, Set-Cookie: __Host-infraternal-ceremony=…; Secure; HttpOnly; SameSite=Strict; Path=/; Max-Age=300.
POST /auth/registration-finish → 200, Set-Cookie: __Host-infraternal=…; Secure; HttpOnly; SameSite=Strict; Path=/; Max-Age=2592000.
POST /auth/session → 401 standalone, 200 proxied. The request carries both cookies in both modes.

The page then shows "Could not reach the server — Could not read this server's name".

Lead: auth/sessions.rs returns Denied for a session that is not unlocked. The session issued by registration-finish may stay pending in standalone mode, for example if a peer-address or client-IP binding differs when no proxy headers are present.

Production runs behind a proxy, so it is not affected. Self-hosters who use --tls-cert directly would be.

Found during the canvas zoom benchmarks (#121), on the production binary. In standalone TLS mode, a new owner cannot get a session right after passkey registration. Behind a proxy the same flow works. **Failing:** `--listen 127.0.0.1:47699 --public-origin https://localhost:47699 --tls-cert c.pem --tls-key k.pem --web-root … --data …` (self-signed cert, CN and SAN `localhost`). **Working:** `--listen 127.0.0.1:47698 --public-origin https://localhost:47699 --behind-proxy --trusted-proxy 127.0.0.1`, with a TLS pass-through front on 47699. **Sequence (identical in both modes until the last step):** 1. `GET /` → 200; `POST /auth/status` → 200. 2. `POST /auth/setup-check` → 204. 3. `POST /auth/setup-start` → 200, `Set-Cookie: __Host-infraternal-ceremony=…; Secure; HttpOnly; SameSite=Strict; Path=/; Max-Age=300`. 4. `POST /auth/registration-finish` → 200, `Set-Cookie: __Host-infraternal=…; Secure; HttpOnly; SameSite=Strict; Path=/; Max-Age=2592000`. 5. `POST /auth/session` → **401 standalone**, 200 proxied. The request carries both cookies in both modes. The page then shows "Could not reach the server — Could not read this server's name". **Lead:** `auth/sessions.rs` returns Denied for a session that is not unlocked. The session issued by registration-finish may stay pending in standalone mode, for example if a peer-address or client-IP binding differs when no proxy headers are present. Production runs behind a proxy, so it is not affected. Self-hosters who use `--tls-cert` directly would be.

kayg commented

2026-10-10 07:09:33 +00:00

Author

Owner

Starting #149 on branch tls-session, base d82d0fb9cd. Read #149 (no previous comments) and originating #121 with all six comments. Reproducing native TLS registration/session using the existing software authenticator; investigating split HTTP/2 Cookie fields, which current readers access with HeaderMap::get. No deployment or push.

Starting #149 on branch tls-session, base d82d0fb9cd32ca647f6f1dd64dcc91ff5e894c3b. Read #149 (no previous comments) and originating #121 with all six comments. Reproducing native TLS registration/session using the existing software authenticator; investigating split HTTP/2 Cookie fields, which current readers access with HeaderMap::get. No deployment or push.

kayg commented

2026-10-10 07:32:17 +00:00

Author

Owner

Reproduced on d82d0fb9 with a real axum-server/OpenSSL localhost TLS listener, trusted self-signed cert, ALPN h2, and the existing ES256 software passkey/PRF-wrap fixtures. registration-finish=200; joined Cookie session=200; two HTTP/2 Cookie fields (ceremony first, session second) session=401. Regression standalone_tls_registration_session_split_cookies fails: 0 passed; 1 failed; finished in 1.75s (crates/infraternal-server/src/auth/tls_tests.rs). Precise cause: auth/http.rs:106-111 uses HeaderMap::get(COOKIE), reads only the first field. This excludes the session cookie on HTTP/2; the proxy recombines fields on its HTTP/1 hop. The joined request proves registration already issues an unlocked session, excluding the initial pending-state lead. auth/binding.rs:8-13 and websocket.rs:223-227 have the same first-field limitation and miss cross-field duplicates. Fix: one allocation-free reader over get_all(COOKIE), requiring exactly one canonical capability across all fields; keep Origin, unlock, cookie flags and forwarded-address policy unchanged.

Reproduced on d82d0fb9 with a real axum-server/OpenSSL localhost TLS listener, trusted self-signed cert, ALPN h2, and the existing ES256 software passkey/PRF-wrap fixtures. registration-finish=200; joined Cookie session=200; two HTTP/2 Cookie fields (ceremony first, session second) session=401. Regression standalone_tls_registration_session_split_cookies fails: 0 passed; 1 failed; finished in 1.75s (crates/infraternal-server/src/auth/tls_tests.rs). Precise cause: auth/http.rs:106-111 uses HeaderMap::get(COOKIE), reads only the first field. This excludes the session cookie on HTTP/2; the proxy recombines fields on its HTTP/1 hop. The joined request proves registration already issues an unlocked session, excluding the initial pending-state lead. auth/binding.rs:8-13 and websocket.rs:223-227 have the same first-field limitation and miss cross-field duplicates. Fix: one allocation-free reader over get_all(COOKIE), requiring exactly one canonical capability across all fields; keep Origin, unlock, cookie flags and forwarded-address policy unchanged.

kayg commented

2026-10-10 07:34:25 +00:00

Author

Owner

Paired real TLS-terminating proxy regression passed before the fix: registration=200, joined session=200, split HTTP/2 Cookie fields=200 after the front recombines them on a real plaintext HTTP/1 upstream connection. proxy_tls_registration_session_split_cookies: 1 passed; 0 failed; 1.58s. Standalone/native h2 remained 401 (1.75s). Both use a trusted self-signed localhost cert and the same software authenticator. Source ingress receives malformed forwarded metadata in standalone (ignored), and valid replaced client metadata only from the explicitly trusted loopback proxy.

kayg commented

2026-10-10 07:41:02 +00:00

Author

Owner

Initial fast gates found a worktree fixture prerequisite, not a timing regression: scripts/verify-agent-attach-credit.py:17 creates target/ac without first creating target; this worktree had no target directory because CARGO_TARGET_DIR is under the required home scratch path. Added an ignored local target symlink to that same job-specific scratch build directory; no tracked gate code changes. Clippy now passes. Baseline static x86_64 musl production binary is 16435312 bytes, already 30496 bytes over the 16404816-byte budget (D205); PT_INTERP absent. Native TLS reproducer fails 401, real proxy reproducer passes 200. Re-running the complete gate with the fixture prerequisite satisfied.

Initial fast gates found a worktree fixture prerequisite, not a timing regression: scripts/verify-agent-attach-credit.py:17 creates target/ac<PID> without first creating target; this worktree had no target directory because CARGO_TARGET_DIR is under the required home scratch path. Added an ignored local target symlink to that same job-specific scratch build directory; no tracked gate code changes. Clippy now passes. Baseline static x86_64 musl production binary is 16435312 bytes, already 30496 bytes over the 16404816-byte budget (D205); PT_INTERP absent. Native TLS reproducer fails 401, real proxy reproducer passes 200. Re-running the complete gate with the fixture prerequisite satisfied.

kayg commented

2026-10-10 07:53:25 +00:00

Author

Owner

Paired #118 audit, same load window on infraternal-dev (load 6.02/7.33/14.96 at end):
tls-session, round 1: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.75s
detached dev 0510bd85, round 1: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.55s
tls-session, round 2: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.55s
detached dev 0510bd85, round 2: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.57s
tls-session, round 3: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.50s
detached dev 0510bd85, round 3: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.59s
Both binaries fail the identical socket_tests.rs:206 deadline assertion; source diff for socket_tests.rs/websocket.rs/auth/runtime between d82d0fb9 and dev is empty. The baseline exception is now established, unlike the first standalone baseline pass. Full fast gate: fmt PASS, VT native fmt PASS, clippy PASS, cargo-deny PASS; server test row 140 passed/1 pre-existing deadline failure/15 ignored; static size 16435312 bytes already over budget before the fix. Dependency step reuses already-locked h2 0.4.19 and tokio-openssl 0.6.5 as dev dependencies only; release size delta 0 bytes.

Paired #118 audit, same load window on infraternal-dev (load 6.02/7.33/14.96 at end): tls-session, round 1: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.75s detached dev 0510bd85, round 1: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.55s tls-session, round 2: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.55s detached dev 0510bd85, round 2: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.57s tls-session, round 3: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 155 filtered out; finished in 0.50s detached dev 0510bd85, round 3: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.59s Both binaries fail the identical socket_tests.rs:206 deadline assertion; source diff for socket_tests.rs/websocket.rs/auth/runtime between d82d0fb9 and dev is empty. The baseline exception is now established, unlike the first standalone baseline pass. Full fast gate: fmt PASS, VT native fmt PASS, clippy PASS, cargo-deny PASS; server test row 140 passed/1 pre-existing deadline failure/15 ignored; static size 16435312 bytes already over budget before the fix. Dependency step reuses already-locked h2 0.4.19 and tokio-openssl 0.6.5 as dev dependencies only; release size delta 0 bytes.

kayg commented

2026-10-10 07:53:52 +00:00

Author

Owner

Completed dependency step c66adfcc on tls-session: existing h2/tokio-openssl are now dev-only direct dependencies; no new versions or release dependencies. x86_64 static binary 16435312 bytes, delta 0. Native pre-fix regression: registration=200/joined session=200/split session=401; real proxy split session=200. #118 exception established by paired current/dev failures at socket_tests.rs:206. scripts/verify fast output (verbatim summary; exit 1 from the documented auth timeout and existing D205 size row):

Completed dependency step c66adfcc on tls-session: existing h2/tokio-openssl are now dev-only direct dependencies; no new versions or release dependencies. x86_64 static binary 16435312 bytes, delta 0. Native pre-fix regression: registration=200/joined session=200/split session=401; real proxy split session=200. #118 exception established by paired current/dev failures at socket_tests.rs:206. scripts/verify fast output (verbatim summary; exit 1 from the documented auth timeout and existing D205 size row): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-10 08:46:59 +00:00

Author

Owner

Completed test foundation 4f3ebcf8: real native TLS/h2 and TLS-front/HTTP1 proxy registration probes, shared software passkey RP selector, cookie boundary tests and optimized 50-session benchmark. Pre-fix native: 0 passed/1 failed, registration=200/joined session=200/split session=401 (0.82s); proxy: 1 passed, split session=200. RUST_TEST_THREADS=1 runs every test and stabilizes the prior socket deadline flake; test row now PASS. Release size unchanged at 16435312 bytes. scripts/verify fast verbatim summary (exit 1 solely for existing size row):

Completed test foundation 4f3ebcf8: real native TLS/h2 and TLS-front/HTTP1 proxy registration probes, shared software passkey RP selector, cookie boundary tests and optimized 50-session benchmark. Pre-fix native: 0 passed/1 failed, registration=200/joined session=200/split session=401 (0.82s); proxy: 1 passed, split session=200. RUST_TEST_THREADS=1 runs every test and stabilizes the prior socket deadline flake; test row now PASS. Release size unchanged at 16435312 bytes. scripts/verify fast verbatim summary (exit 1 solely for existing size row): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-10 08:59:37 +00:00

Author

Owner

Completed ceremony reader step 31540288: activates the tested get_all(COOKIE) reader for binding reuse/verification. No plaintext copies or allocations; canonical capability shape and constant-time hash comparison retained. Static x86_64 size 16435824 bytes (+512 versus test foundation). The current gate socket deadline failure was matched on detached dev 0510bd85 in this window (baseline retry round 2, socket_tests.rs:206, 0 passed/1 failed in 0.54s). All other checks pass; earlier complete test row also passed. scripts/verify fast verbatim summary:

Baseline output (verbatim):
detached dev 0510bd85 round 1

running 1 test
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.50s

detached dev 0510bd85 round 2

running 1 test

thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1172629) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5:
assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await,
Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if
response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE)
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... FAILED

failures:

failures:
auth::tests::socket_tests::expired_handshake_releases_user_permits

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.54s

Completed ceremony reader step 31540288: activates the tested get_all(COOKIE) reader for binding reuse/verification. No plaintext copies or allocations; canonical capability shape and constant-time hash comparison retained. Static x86_64 size 16435824 bytes (+512 versus test foundation). The current gate socket deadline failure was matched on detached dev 0510bd85 in this window (baseline retry round 2, socket_tests.rs:206, 0 passed/1 failed in 0.54s). All other checks pass; earlier complete test row also passed. scripts/verify fast verbatim summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Baseline output (verbatim): detached dev 0510bd85 round 1 running 1 test test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.50s detached dev 0510bd85 round 2 running 1 test thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1172629) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5: assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await, Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace test auth::tests::socket_tests::expired_handshake_releases_user_permits ... FAILED failures: failures: auth::tests::socket_tests::expired_handshake_releases_user_permits test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.54s

kayg commented

2026-10-10 09:00:05 +00:00

Author

Owner

HTTP session adapter now uses the same allocation-free whole-request cookie reader; native TLS/h2 and real proxy tests are enabled. Joined and split session cookies both return 200, either field order works, duplicates/missing cookie/foreign Origin remain 401 in both modes. Native malformed X-Forwarded-For remains ignored. No change to Secure/HttpOnly/SameSite/Path flags, unlock state, exact Origin or trusted proxy policy. First post-fix real-server test output (verbatim):

running 2 tests
test auth::tests::tls_tests::proxy_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=true registration=200 joined_session=200 split_session=200 OK
ok
test auth::tests::tls_tests::standalone_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=false registration=200 joined_session=200 split_session=200 OK
ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 154 filtered out; finished in 1.47s

HTTP session adapter now uses the same allocation-free whole-request cookie reader; native TLS/h2 and real proxy tests are enabled. Joined and split session cookies both return 200, either field order works, duplicates/missing cookie/foreign Origin remain 401 in both modes. Native malformed X-Forwarded-For remains ignored. No change to Secure/HttpOnly/SameSite/Path flags, unlock state, exact Origin or trusted proxy policy. First post-fix real-server test output (verbatim): running 2 tests test auth::tests::tls_tests::proxy_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=true registration=200 joined_session=200 split_session=200 OK ok test auth::tests::tls_tests::standalone_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=false registration=200 joined_session=200 split_session=200 OK ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 154 filtered out; finished in 1.47s

kayg commented

2026-10-10 09:09:16 +00:00

Author

Owner

Completed HTTP fix 8e6c6198: every session-cookie action uses the strict all-field reader; native/proxy TLS regression tests are enabled. Real server regressions: 2 passed/0 failed (1.47s), each native h2 and TLS-front/HTTP1 flow returns 200 with joined or split cookies; duplicate/missing/foreign-Origin cases stay 401. Native forwarded metadata stays untrusted. Browser auth 4 scenarios and recovery 2 scenarios pass. Full server suite 143 passed/0 failed/13 ignored (164.99s). Static size 16435632 bytes (-192 this step, +320 total), PT_INTERP absent. scripts/verify fast verbatim summary (exit 1 solely for pre-existing size row):

Completed HTTP fix 8e6c6198: every session-cookie action uses the strict all-field reader; native/proxy TLS regression tests are enabled. Real server regressions: 2 passed/0 failed (1.47s), each native h2 and TLS-front/HTTP1 flow returns 200 with joined or split cookies; duplicate/missing/foreign-Origin cases stay 401. Native forwarded metadata stays untrusted. Browser auth 4 scenarios and recovery 2 scenarios pass. Full server suite 143 passed/0 failed/13 ignored (164.99s). Static size 16435632 bytes (-192 this step, +320 total), PT_INTERP absent. scripts/verify fast verbatim summary (exit 1 solely for pre-existing size row): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-10 09:11:05 +00:00

Author

Owner

Additional same-cause security finding: websocket.rs:223-227 also reads only the first Cookie field. Before replacement, split_cookie_fields_preserve_socket_session and duplicate_cookie_fields_deny_socket_session both fail (0 passed/2 failed in 0.00s). Socket upgrades now delegate to exactly the same capability reader as HTTP/session and ceremony binding, so field splitting preserves the capability and duplicates fail closed. Full gate in progress. Pre-fix output (verbatim; token is a fixed, non-authorizing public test vector):

running 2 tests
test websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session ... FAILED
test websocket::cookie_tests::split_cookie_fields_preserve_socket_session ... FAILED

failures:

---- websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session stdout ----

thread 'websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session' (1264918) panicked at crates/infraternal-server/src/websocket_cookie_tests.rs:29:5:
assertion failed: session_cookie(&headers).is_none()
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace

---- websocket::cookie_tests::split_cookie_fields_preserve_socket_session stdout ----

thread 'websocket::cookie_tests::split_cookie_fields_preserve_socket_session' (1264919) panicked at crates/infraternal-server/src/websocket_cookie_tests.rs:17:5:
assertion left == right failed
left: None
right: Some("abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG")

failures:
websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session
websocket::cookie_tests::split_cookie_fields_preserve_socket_session

test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 156 filtered out; finished in 0.00s

error: test failed, to rerun pass -p infraternal-server --lib

Additional same-cause security finding: websocket.rs:223-227 also reads only the first Cookie field. Before replacement, split_cookie_fields_preserve_socket_session and duplicate_cookie_fields_deny_socket_session both fail (0 passed/2 failed in 0.00s). Socket upgrades now delegate to exactly the same capability reader as HTTP/session and ceremony binding, so field splitting preserves the capability and duplicates fail closed. Full gate in progress. Pre-fix output (verbatim; token is a fixed, non-authorizing public test vector): running 2 tests test websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session ... FAILED test websocket::cookie_tests::split_cookie_fields_preserve_socket_session ... FAILED failures: ---- websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session stdout ---- thread 'websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session' (1264918) panicked at crates/infraternal-server/src/websocket_cookie_tests.rs:29:5: assertion failed: session_cookie(&headers).is_none() note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace ---- websocket::cookie_tests::split_cookie_fields_preserve_socket_session stdout ---- thread 'websocket::cookie_tests::split_cookie_fields_preserve_socket_session' (1264919) panicked at crates/infraternal-server/src/websocket_cookie_tests.rs:17:5: assertion `left == right` failed left: None right: Some("abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG") failures: websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session websocket::cookie_tests::split_cookie_fields_preserve_socket_session test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 156 filtered out; finished in 0.00s error: test failed, to rerun pass `-p infraternal-server --lib`

kayg commented

2026-10-10 09:20:50 +00:00

Author

Owner

Completed socket-reader step dd0d7a6b: HTTP, ceremony and socket adapters share one all-field strict reader. Both socket boundary tests fail before and pass after; 144 other server tests pass. Sole auth socket deadline failure (#118) also fails on detached dev 0510bd85, same window: baseline round 4, 0 passed/1 failed in 0.48s; current isolated 0 passed/1 failed in 0.52s. Static x86_64 size 16434800 bytes (-832 this step; -512 from starting build), PT_INTERP absent. Registering/running the parser fuzz target next. scripts/verify fast verbatim summary:

Paired baseline output (verbatim):
infraternal-dev load 2.26 2.91 2.92 3/9681 1359307

running 1 test

thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1359309) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5:
assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await,
Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if
response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE)
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... FAILED

failures:

failures:
auth::tests::socket_tests::expired_handshake_releases_user_permits

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 157 filtered out; finished in 0.52s

detached dev 0510bd85 round 1

running 1 test
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.58s

detached dev 0510bd85 round 2

running 1 test
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.46s

detached dev 0510bd85 round 3

running 1 test
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.46s

detached dev 0510bd85 round 4

running 1 test

thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1359620) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5:
assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await,
Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if
response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE)
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... FAILED

failures:

failures:
auth::tests::socket_tests::expired_handshake_releases_user_permits

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.48s

Completed socket-reader step dd0d7a6b: HTTP, ceremony and socket adapters share one all-field strict reader. Both socket boundary tests fail before and pass after; 144 other server tests pass. Sole auth socket deadline failure (#118) also fails on detached dev 0510bd85, same window: baseline round 4, 0 passed/1 failed in 0.48s; current isolated 0 passed/1 failed in 0.52s. Static x86_64 size 16434800 bytes (-832 this step; -512 from starting build), PT_INTERP absent. Registering/running the parser fuzz target next. scripts/verify fast verbatim summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ Paired baseline output (verbatim): infraternal-dev load 2.26 2.91 2.92 3/9681 1359307 running 1 test thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1359309) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5: assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await, Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace test auth::tests::socket_tests::expired_handshake_releases_user_permits ... FAILED failures: failures: auth::tests::socket_tests::expired_handshake_releases_user_permits test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 157 filtered out; finished in 0.52s detached dev 0510bd85 round 1 running 1 test test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.58s detached dev 0510bd85 round 2 running 1 test test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.46s detached dev 0510bd85 round 3 running 1 test test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.46s detached dev 0510bd85 round 4 running 1 test thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1359620) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5: assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await, Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace test auth::tests::socket_tests::expired_handshake_releases_user_permits ... FAILED failures: failures: auth::tests::socket_tests::expired_handshake_releases_user_permits test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.48s

kayg referenced this issue from a commit

2026-10-10 09:20:55 +00:00

fix(auth): share strict cookie parsing with socket upgrades

kayg referenced this issue from a commit

2026-10-10 09:21:13 +00:00

test(auth): expose existing TLS and HTTP/2 libraries to socket fixtures

kayg referenced this issue from a commit

2026-10-10 09:21:13 +00:00

test(auth): reproduce split-cookie sessions on native TLS

kayg referenced this issue from a commit

2026-10-10 09:21:13 +00:00

fix(auth): enforce ceremony-cookie uniqueness across header fields

kayg referenced this issue from a commit

2026-10-10 09:21:13 +00:00

fix(auth): read session cookies across all HTTP/2 fields

kayg commented

2026-10-10 22:06:14 +00:00

Author

Owner

Completed fuzz step 7d564415: auth_cookie is registered in the existing harness and includes the production reader source. Existing axum lockfile version reused; production dependency and binary delta 0. Instrumented nightly/ASAN libFuzzer: 1781320 runs in 61s, cov=290/ft=1384, corpus=352/58KiB, RSS=366MiB, no crash; max_len=4096 and rss_limit_mb=512. infraternal-dev CPUWeight=10000 scope, load 3.87/2.86/2.87 before build/run and 7.64/9.95/6.56 after. Server suite 145 passed/0 failed/13 ignored (224.38s); all Rust checks pass except the existing size row. Static size remains 16434800 bytes (-512 total). Documentation/reviewer checklist and final gate in progress. scripts/verify fast verbatim summary (exit 1 solely for size):

Completed fuzz step 7d564415: auth_cookie is registered in the existing harness and includes the production reader source. Existing axum lockfile version reused; production dependency and binary delta 0. Instrumented nightly/ASAN libFuzzer: 1781320 runs in 61s, cov=290/ft=1384, corpus=352/58KiB, RSS=366MiB, no crash; max_len=4096 and rss_limit_mb=512. infraternal-dev CPUWeight=10000 scope, load 3.87/2.86/2.87 before build/run and 7.64/9.95/6.56 after. Server suite 145 passed/0 failed/13 ignored (224.38s); all Rust checks pass except the existing size row. Static size remains 16434800 bytes (-512 total). Documentation/reviewer checklist and final gate in progress. scripts/verify fast verbatim summary (exit 1 solely for size): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-10 22:18:02 +00:00

Author

Owner

Finished #149 on tls-session. Head 15801e9e9a6ae2d6ead6d9af760187cb3104574a; base d82d0fb9cd. Seven atomic commits; no push/deploy; issue remains open.

Cause: base auth/http.rs:106-111 used HeaderMap::get(COOKIE), reading only the first field. Native HTTP/2 splits ceremony/session cookies; the TLS proxy recombines them on its HTTP/1 hop. Registration is already unlocked: before the fix joined session=200 but split session=401. One allocation-free get_all reader now serves HTTP, ceremony binding and socket upgrades, requiring one canonical capability across the entire request. Duplicate/non-text capabilities fail closed. Origin, Secure cookie flags, unlock/expiry and native distrust of forwarded metadata are preserved.

Evidence: docs/verification/tls-session.md and fuzz/README.md. Native TLS and real TLS-front/HTTP1 proxy regressions both pass; joined/split/reordered cookies succeed, duplicate/missing/foreign-Origin cases remain 401. Standalone ignores malformed forwarded metadata. Server suite 145 passed/0 failed/13 pre-existing ignored measurements (354.46s). Real Chromium auth 4 scenarios and recovery 2 scenarios pass. TS compiler/tracer/build/budgets pass; protocol 36 passed/0 failed/34462 assertions. Instrumented ASAN/libFuzzer 1781320 runs in 61s, cov=290/ft=1384, no crash. B1/S1/S2/N1 self-review complete.

Local CPUWeight=10000 parser benchmark: medians 66.65 -> 148.97 ns/request (+82.32 ns), 50 requests add 4.12 us; 0 retained bytes/session x 50 = 0. Static stripped x86_64 musl binary 16434800 bytes, -512 from base; existing limit 16404816 exceeded by 29984. Size row exits before aarch64, so only x86_64 is measured. No new production dependency or version. Prior socket deadline flakes were matched on detached dev 0510bd85 under #118; the final test row passes.

How to test:

In the repo Nix Zig/make/perl environment, set job-specific CARGO_TARGET_DIR and TRACER_TEST_PORT=4349.
RUST_TEST_THREADS=1 cargo test --locked -p infraternal-server --lib tls_tests -- --nocapture
scripts/verify-auth-browser; RUST_TEST_THREADS=1 scripts/verify fast (existing D205 size exception).

Final scripts/verify fast output, verbatim summary (exit 1 solely for existing size):

Finished #149 on tls-session. Head 15801e9e9a6ae2d6ead6d9af760187cb3104574a; base d82d0fb9cd32ca647f6f1dd64dcc91ff5e894c3b. Seven atomic commits; no push/deploy; issue remains open. Cause: base auth/http.rs:106-111 used HeaderMap::get(COOKIE), reading only the first field. Native HTTP/2 splits ceremony/session cookies; the TLS proxy recombines them on its HTTP/1 hop. Registration is already unlocked: before the fix joined session=200 but split session=401. One allocation-free get_all reader now serves HTTP, ceremony binding and socket upgrades, requiring one canonical capability across the entire request. Duplicate/non-text capabilities fail closed. Origin, Secure cookie flags, unlock/expiry and native distrust of forwarded metadata are preserved. Evidence: docs/verification/tls-session.md and fuzz/README.md. Native TLS and real TLS-front/HTTP1 proxy regressions both pass; joined/split/reordered cookies succeed, duplicate/missing/foreign-Origin cases remain 401. Standalone ignores malformed forwarded metadata. Server suite 145 passed/0 failed/13 pre-existing ignored measurements (354.46s). Real Chromium auth 4 scenarios and recovery 2 scenarios pass. TS compiler/tracer/build/budgets pass; protocol 36 passed/0 failed/34462 assertions. Instrumented ASAN/libFuzzer 1781320 runs in 61s, cov=290/ft=1384, no crash. B1/S1/S2/N1 self-review complete. Local CPUWeight=10000 parser benchmark: medians 66.65 -> 148.97 ns/request (+82.32 ns), 50 requests add 4.12 us; 0 retained bytes/session x 50 = 0. Static stripped x86_64 musl binary 16434800 bytes, -512 from base; existing limit 16404816 exceeded by 29984. Size row exits before aarch64, so only x86_64 is measured. No new production dependency or version. Prior socket deadline flakes were matched on detached dev 0510bd85 under #118; the final test row passes. How to test: 1. In the repo Nix Zig/make/perl environment, set job-specific CARGO_TARGET_DIR and TRACER_TEST_PORT=4349. 2. RUST_TEST_THREADS=1 cargo test --locked -p infraternal-server --lib tls_tests -- --nocapture 3. scripts/verify-auth-browser; RUST_TEST_THREADS=1 scripts/verify fast (existing D205 size exception). Final scripts/verify fast output, verbatim summary (exit 1 solely for existing size): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-10 22:19:03 +00:00

Author

Owner

Final documentation head d4aa1ea3e2 supersedes 15801e9e (amended only to clarify the ignored-test count). Final suite: 145 passed/0 failed/13 ignored; those 13 comprise 12 existing measurements plus the new optimized cookie benchmark, which was executed separately at 50 sessions. Both TLS regressions and socket boundary tests are enabled and pass. All implementation, browser, TS, fuzz, size/performance evidence and review findings in the preceding completion comment remain unchanged. Seven atomic commits; no push/deploy; #149 stays open. Final scripts/verify fast verbatim summary, exit 1 only for pre-existing D205 size row:

Final documentation head d4aa1ea3e221ef4452cc4a74dc8b9eac87f6a823 supersedes 15801e9e (amended only to clarify the ignored-test count). Final suite: 145 passed/0 failed/13 ignored; those 13 comprise 12 existing measurements plus the new optimized cookie benchmark, which was executed separately at 50 sessions. Both TLS regressions and socket boundary tests are enabled and pass. All implementation, browser, TS, fuzz, size/performance evidence and review findings in the preceding completion comment remain unchanged. Seven atomic commits; no push/deploy; #149 stays open. Final scripts/verify fast verbatim summary, exit 1 only for pre-existing D205 size row: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg referenced this issue from a commit

2026-10-10 22:24:33 +00:00

test(auth): fuzz capability fields with the production cookie reader

kayg referenced this issue from a commit

2026-10-10 22:24:33 +00:00

docs(auth): record native TLS cookie regression and security evidence

kayg commented

2026-10-10 22:32:03 +00:00

Author

Owner

Independent verification review started on local branch review-tls-session at d4aa1ea3e2; merge base with dev d82d0fb9cd. Read all 15 comments on #149 and all 6 parent #121 comments, contract, architecture/process and report. No earlier review findings. Running unmodified-head fast gate, checking native/proxy TLS, all-field capability validation and performance/fuzz evidence. No implementation edits, push or deployment.

Independent verification review started on local branch review-tls-session at d4aa1ea3e221ef4452cc4a74dc8b9eac87f6a823; merge base with dev d82d0fb9cd32ca647f6f1dd64dcc91ff5e894c3b. Read all 15 comments on #149 and all 6 parent #121 comments, contract, architecture/process and report. No earlier review findings. Running unmodified-head fast gate, checking native/proxy TLS, all-field capability validation and performance/fuzz evidence. No implementation edits, push or deployment.

kayg commented

2026-10-10 22:46:23 +00:00

Author

Owner

Independent source/contract review at d4aa1ea3: all production HTTP session, ceremony binding and socket readers delegate to cookies::capability; no remaining first-field reader, wire/schema change or new production dependency version. No confirmed finding yet. Unmodified-head fast attempts stopped at RTT self-test (p99 372.60 and 691.00 ms); a CPUWeight=10000 scoped retry passed and is compiling. Host has 8 cores, load 25-36 during review. Bounded auth_cookie fuzz build is in progress with synthetic split/distinct-duplicate/non-text seeds. Additional real-TLS ceremony assertions prepared; not applied until head gate completes.

Independent source/contract review at d4aa1ea3: all production HTTP session, ceremony binding and socket readers delegate to cookies::capability; no remaining first-field reader, wire/schema change or new production dependency version. No confirmed finding yet. Unmodified-head fast attempts stopped at RTT self-test (p99 372.60 and 691.00 ms); a CPUWeight=10000 scoped retry passed and is compiling. Host has 8 cores, load 25-36 during review. Bounded auth_cookie fuzz build is in progress with synthetic split/distinct-duplicate/non-text seeds. Additional real-TLS ceremony assertions prepared; not applied until head gate completes.

kayg commented

2026-10-10 22:55:18 +00:00

Author

Owner

Independent auth_cookie fuzz verification at d4aa1ea3 completed under local CPUWeight=10000 scope: 914987 runs in 61 seconds, cov=290, ft=1351, corpus=347/51KiB, RSS=317MiB, max_len=4096, rss_limit_mb=512, no crash. Seeds cover split session/ceremony, distinct duplicates and non-text fields. Host infraternal-dev, 8 cores; observed load 34.66/30.97/28.86 near build start, 24.95/27.00/27.94 after run. No production or test source changed yet; unmodified-head gate still compiles vendored OpenSSL. TS tracer compiler/build/transfer budget passed; differential stream test awaits Rust oracle build.

Independent auth_cookie fuzz verification at d4aa1ea3 completed under local CPUWeight=10000 scope: 914987 runs in 61 seconds, cov=290, ft=1351, corpus=347/51KiB, RSS=317MiB, max_len=4096, rss_limit_mb=512, no crash. Seeds cover split session/ceremony, distinct duplicates and non-text fields. Host infraternal-dev, 8 cores; observed load 34.66/30.97/28.86 near build start, 24.95/27.00/27.94 after run. No production or test source changed yet; unmodified-head gate still compiles vendored OpenSSL. TS tracer compiler/build/transfer budget passed; differential stream test awaits Rust oracle build.

kayg commented

2026-10-10 23:17:48 +00:00

Author

Owner

Independent real native TLS/h2 and TLS-front/HTTP1 proxy regression run on untouched d4aa1ea3: 2 passed; 0 failed; 0 ignored; 156 filtered out; finished in 5.27s. Both registration=200, joined session=200 and split session=200. The fixtures also enforce reordered acceptance, duplicate/missing/foreign-Origin denial, trusted localhost certificate and h2 ALPN. Host load 23.67/25.59/25.53 after run. Full head fast gate and browser/TS differential tests continue. No confirmed finding.

Independent real native TLS/h2 and TLS-front/HTTP1 proxy regression run on untouched d4aa1ea3: 2 passed; 0 failed; 0 ignored; 156 filtered out; finished in 5.27s. Both registration=200, joined session=200 and split session=200. The fixtures also enforce reordered acceptance, duplicate/missing/foreign-Origin denial, trusted localhost certificate and h2 ALPN. Host load 23.67/25.59/25.53 after run. Full head fast gate and browser/TS differential tests continue. No confirmed finding.

kayg commented

2026-10-10 23:22:48 +00:00

Author

Owner

Independent unmodified-head browser verification at d4aa1ea3 passed: auth browser PASS, 4 isolated scenarios; native recovery PASS, 2 real-verifier scenarios; Chromium 149.0.7827.55, original DEK preserved. Isolated full TypeScript/tracer gate passed: protocol 36 pass/0 fail/34462 assertions in 3.88s. Initial parallel TS run timed out only because src/stream.test.ts:76 invokes cargo run while another gate holds the same target lock; using a separate job scratch CARGO_TARGET_DIR removes the contention without changing any threshold/source. Full Rust head suite is running, including auth authority/revocation tests; no confirmed finding.

Independent unmodified-head browser verification at d4aa1ea3 passed: auth browser PASS, 4 isolated scenarios; native recovery PASS, 2 real-verifier scenarios; Chromium 149.0.7827.55, original DEK preserved. Isolated full TypeScript/tracer gate passed: protocol 36 pass/0 fail/34462 assertions in 3.88s. Initial parallel TS run timed out only because src/stream.test.ts:76 invokes cargo run while another gate holds the same target lock; using a separate job scratch CARGO_TARGET_DIR removes the contention without changing any threshold/source. Full Rust head suite is running, including auth authority/revocation tests; no confirmed finding.

kayg commented

2026-10-10 23:43:22 +00:00

Author

Owner

Independent 50-session cookie measurement at d4aa1ea3, compiled against gate optimized musl axum/dependencies, local CPUWeight=10000 scope, 200000 requests/session x 50 per run x 3 runs/profile. opt=3 old/new ns/request: 128.16/252.55, 118.07/223.99, 89.38/214.01; medians 118.07 -> 223.99 (+105.92ns/request; +5.296us/50). Server profile opt=s: 308.40/318.65, 229.81/296.43, 211.86/290.40; medians 229.81 -> 296.43 (+66.62ns/request; +3.331us/50). Host infraternal-dev, 8 cores; load start 19.32/29.08/29.28, end 20.96/28.72/29.15. Parser adds no allocation or retained session state, 0 bytes x 50. Averages exclude TLS/SQLite/browser and are not end-to-end percentile claims. The small admission cost is explained by all-field duplicate rejection and alphabet validation. Full unmodified-head Rust tests passed (server 145/0/13 ignored, 303.79s); release size build is in progress.

Independent 50-session cookie measurement at d4aa1ea3, compiled against gate optimized musl axum/dependencies, local CPUWeight=10000 scope, 200000 requests/session x 50 per run x 3 runs/profile. opt=3 old/new ns/request: 128.16/252.55, 118.07/223.99, 89.38/214.01; medians 118.07 -> 223.99 (+105.92ns/request; +5.296us/50). Server profile opt=s: 308.40/318.65, 229.81/296.43, 211.86/290.40; medians 229.81 -> 296.43 (+66.62ns/request; +3.331us/50). Host infraternal-dev, 8 cores; load start 19.32/29.08/29.28, end 20.96/28.72/29.15. Parser adds no allocation or retained session state, 0 bytes x 50. Averages exclude TLS/SQLite/browser and are not end-to-end percentile claims. The small admission cost is explained by all-field duplicate rejection and alphabet validation. Full unmodified-head Rust tests passed (server 145/0/13 ignored, 303.79s); release size build is in progress.

kayg commented

2026-10-11 00:05:07 +00:00

Author

Owner

Independent stripped x86_64 musl size comparison completed in local CPUWeight=10000 scope: detached merge base d82d0fb9 = 16435312 bytes; job head d4aa1ea3 = 16434800 bytes; delta -512 bytes, matching the report. Both have no PT_INTERP. Head remains 29984 bytes above unchanged 16404816-byte limit; this is the D205 pre-existing size row, not a new regression. Head binary SHA256 479708572b8a47bde97137b73ec2f3c9b4eebd18817a2d350692126c21a35e4d; baseline e57ef9d7c7db41f72ac99ad98dce22f36bb6e7666259c9ddca8b4d185a93cfd3. Size baseline used the same Cargo configuration/toolchain as head; restored the captured head artifact before subsequent gate static checks. Extra native/proxy ceremony assertions pass 2/0 in 2.78s: split-field binding reuse, distinct/malformed duplicate denial in either field order, then success with the same signed proof. Test-only diff; full review gate in progress. No confirmed finding.

Independent stripped x86_64 musl size comparison completed in local CPUWeight=10000 scope: detached merge base d82d0fb9 = 16435312 bytes; job head d4aa1ea3 = 16434800 bytes; delta -512 bytes, matching the report. Both have no PT_INTERP. Head remains 29984 bytes above unchanged 16404816-byte limit; this is the D205 pre-existing size row, not a new regression. Head binary SHA256 479708572b8a47bde97137b73ec2f3c9b4eebd18817a2d350692126c21a35e4d; baseline e57ef9d7c7db41f72ac99ad98dce22f36bb6e7666259c9ddca8b4d185a93cfd3. Size baseline used the same Cargo configuration/toolchain as head; restored the captured head artifact before subsequent gate static checks. Extra native/proxy ceremony assertions pass 2/0 in 2.78s: split-field binding reuse, distinct/malformed duplicate denial in either field order, then success with the same signed proof. Test-only diff; full review gate in progress. No confirmed finding.

kayg commented

2026-10-11 00:36:11 +00:00

Author

Owner

Independent #118 audit: final review gate's sole Rust test failure is expired_handshake_releases_user_permits at socket_tests.rs:206 (144 passed/1 failed/13 ignored, 228.29s). Detached dev f91517019a reproduces the identical assertion on paired trial 4 (0 passed/1 failed, 0.64s), same load window 17.51/17.55/20.03. Socket test file diff is empty. Earlier untouched-head and expanded-fixture full server suites both passed 145/0. No timeout/source changed or test skipped. Brief's #118 exception is established; other rows pass except independently reproduced D205 size. Test-only boolean diagnostic adjustment passes Clippy without printing capabilities.

Review failure, verbatim:
---- auth::tests::socket_tests::expired_handshake_releases_user_permits stdout ----

thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1115812) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5:
assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await,
Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if
response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE)
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace

failures:
auth::tests::socket_tests::expired_handshake_releases_user_permits

test result: FAILED. 144 passed; 1 failed; 13 ignored; 0 measured; 0 filtered out; finished in 228.29s

Detached dev, verbatim:
PAIRED_TRIAL=4 source=dev load=17.51 17.55 20.03 7/2916 1188843

running 1 test
test auth::tests::socket_tests::expired_handshake_releases_user_permits ...
thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1188845) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5:
assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await,
Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if
response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE)
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
FAILED

failures:

failures:
auth::tests::socket_tests::expired_handshake_releases_user_permits

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.64s

DEV_MATCH trial=4 exit=101

Independent #118 audit: final review gate's sole Rust test failure is expired_handshake_releases_user_permits at socket_tests.rs:206 (144 passed/1 failed/13 ignored, 228.29s). Detached dev f91517019a83e6d66226841267f72b82f907ae46 reproduces the identical assertion on paired trial 4 (0 passed/1 failed, 0.64s), same load window 17.51/17.55/20.03. Socket test file diff is empty. Earlier untouched-head and expanded-fixture full server suites both passed 145/0. No timeout/source changed or test skipped. Brief's #118 exception is established; other rows pass except independently reproduced D205 size. Test-only boolean diagnostic adjustment passes Clippy without printing capabilities. Review failure, verbatim: ---- auth::tests::socket_tests::expired_handshake_releases_user_permits stdout ---- thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1115812) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5: assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await, Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: auth::tests::socket_tests::expired_handshake_releases_user_permits test result: FAILED. 144 passed; 1 failed; 13 ignored; 0 measured; 0 filtered out; finished in 228.29s Detached dev, verbatim: PAIRED_TRIAL=4 source=dev load=17.51 17.55 20.03 7/2916 1188843 running 1 test test auth::tests::socket_tests::expired_handshake_releases_user_permits ... thread 'auth::tests::socket_tests::expired_handshake_releases_user_permits' (1188845) panicked at crates/infraternal-server/src/auth/socket_tests.rs:206:5: assertion failed: matches!(connect_async(test_ws_request(address, &cookie)).await, Err(tokio_tungstenite::tungstenite::Error::Http(ref response)) if response.status() == axum::http::StatusCode::SERVICE_UNAVAILABLE) note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace FAILED failures: failures: auth::tests::socket_tests::expired_handshake_releases_user_permits test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 150 filtered out; finished in 0.64s DEV_MATCH trial=4 exit=101

kayg commented

2026-10-11 00:43:59 +00:00

Author

Owner

Review test evidence committed locally: 59c72a4952 on review-tls-session. Reuses the existing native/proxy real TLS fixtures for split-field ceremony reuse and distinct/malformed duplicate refusal before signed-proof consumption; both TLS tests pass. Final diagnostic asserts a boolean, preserving no-capability logging, and Clippy passes. No production change/dependency, intended runtime size delta 0. Full suites passed 145/0 twice; later named #118 timeout matched detached dev on paired trial 4 (0/1, 0.64s). No confirmed finding. Final verification is running after clearing only server release artifacts: shared cross-checkout Cargo caching had reused the baseline binary in a later size row (exact baseline SHA256), so final evidence must use a fresh review-source release build. Head's independent original size remains 16434800 vs baseline 16435312 (-512). No push/deploy.

Review test evidence committed locally: 59c72a4952c15602378eb2db664542c2c2f1fc82 on review-tls-session. Reuses the existing native/proxy real TLS fixtures for split-field ceremony reuse and distinct/malformed duplicate refusal before signed-proof consumption; both TLS tests pass. Final diagnostic asserts a boolean, preserving no-capability logging, and Clippy passes. No production change/dependency, intended runtime size delta 0. Full suites passed 145/0 twice; later named #118 timeout matched detached dev on paired trial 4 (0/1, 0.64s). No confirmed finding. Final verification is running after clearing only server release artifacts: shared cross-checkout Cargo caching had reused the baseline binary in a later size row (exact baseline SHA256), so final evidence must use a fresh review-source release build. Head's independent original size remains 16434800 vs baseline 16435312 (-512). No push/deploy.

kayg commented

2026-10-11 00:55:15 +00:00

Author

Owner

Finished independent #149 review: MERGE (no P0/P1). Counts: P0=0, P1=0, P2=0, P3=0.
Target tls-session d4aa1ea3e2; merge base d82d0fb9cd. Local review-tls-session head 68dbb1fcb2: test evidence 59c72a49, report 68dbb1fc. Worktree clean, temporary build targets/baseline worktrees removed; no implementation fix, push/deploy or issue closure.

Evidence: docs/verification/tls-session-review.md. Native/proxy TLS 2/0; expanded split ceremony reuse + malformed/distinct duplicate refusal preserves signed proof. Final server suite 145/0/13 ignored, 293.58s; Chromium auth/recovery 4+2 pass; TS/protocol/tracer pass, 36 tests/34462 assertions. ASAN/nightly fuzz 914987 inputs/61s, no crash, cov=290/ft=1351. Local CPUWeight=10000 50-request median added parser cost: 5.296us (opt=3), 3.331us (opt=s), load 19.32/29.08/29.28 -> 20.96/28.72/29.15; retained reader state 0 bytes x 50.

Independent static x86_64 sizes: base 16435312 -> head 16434800 (-512 bytes), no PT_INTERP. Review tests/docs add 0 runtime bytes. D205 existing limit 16404816 exceeded by 29984; final gate exit 1 solely for that row. Intermediate #118 deadline failure reproduced at socket_tests.rs:206 on detached dev f9151701, paired trial 4 (0/1, 0.64s); final full test row passes. Shared-release cache contamination was corrected by clearing server release artifacts and rebuilding review source; final size is the correct head value.

scripts/verify fast on untouched job head and final review source produced the identical verbatim summary:

Finished independent #149 review: MERGE (no P0/P1). Counts: P0=0, P1=0, P2=0, P3=0. Target tls-session d4aa1ea3e221ef4452cc4a74dc8b9eac87f6a823; merge base d82d0fb9cd32ca647f6f1dd64dcc91ff5e894c3b. Local review-tls-session head 68dbb1fcb234afcaa31766c06d8d5ea4a364af4e: test evidence 59c72a49, report 68dbb1fc. Worktree clean, temporary build targets/baseline worktrees removed; no implementation fix, push/deploy or issue closure. Evidence: docs/verification/tls-session-review.md. Native/proxy TLS 2/0; expanded split ceremony reuse + malformed/distinct duplicate refusal preserves signed proof. Final server suite 145/0/13 ignored, 293.58s; Chromium auth/recovery 4+2 pass; TS/protocol/tracer pass, 36 tests/34462 assertions. ASAN/nightly fuzz 914987 inputs/61s, no crash, cov=290/ft=1351. Local CPUWeight=10000 50-request median added parser cost: 5.296us (opt=3), 3.331us (opt=s), load 19.32/29.08/29.28 -> 20.96/28.72/29.15; retained reader state 0 bytes x 50. Independent static x86_64 sizes: base 16435312 -> head 16434800 (-512 bytes), no PT_INTERP. Review tests/docs add 0 runtime bytes. D205 existing limit 16404816 exceeded by 29984; final gate exit 1 solely for that row. Intermediate #118 deadline failure reproduced at socket_tests.rs:206 on detached dev f9151701, paired trial 4 (0/1, 0.64s); final full test row passes. Shared-release cache contamination was corrected by clearing server release artifacts and rebuilding review source; final size is the correct head value. scripts/verify fast on untouched job head and final review source produced the identical verbatim summary: +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-11 03:10:27 +00:00

Author

Owner

Starting production integration #149 / D206 on tls-session-prod, base 04cdc52a01. Read all 25 #149 comments and parent #121 (6 comments), CLAUDE/DECISIONS/ARCHITECTURE/PROCESS. Preserve #158 final Close 4404, #151 bounds and all production auth modules/tests. Carry review test commit 59c72a49 separately. Production-only bootstrap_api.rs:158 rejects multiple Cookie fields before shared socket reader; will reproduce and route through strict capability parser in a separate fix. Push each completed commit; no deploy.

Starting production integration #149 / D206 on tls-session-prod, base 04cdc52a0147e2a281b5545caafca014096dec9e. Read all 25 #149 comments and parent #121 (6 comments), CLAUDE/DECISIONS/ARCHITECTURE/PROCESS. Preserve #158 final Close 4404, #151 bounds and all production auth modules/tests. Carry review test commit 59c72a49 separately. Production-only bootstrap_api.rs:158 rejects multiple Cookie fields before shared socket reader; will reproduce and route through strict capability parser in a separate fix. Push each completed commit; no deploy.

kayg commented

2026-10-11 03:13:20 +00:00

Author

Owner

Merge resolutions prepared: Cargo.lock retains every production entry and adds only already-locked h2 to server test dependencies and axum to fuzz; metadata regeneration changed no versions (2 added dependency edges). Cargo.toml retains remote_ca_bench and existing workspace tokio-openssl, adds h2 dev dependency. auth/http.rs and websocket.rs retain pub(crate) visibility for production CA/remote/removal/bootstrap consumers while delegating to strict all-field parser. auth/mod.rs keeps bootstrap_authorization plus cookies; auth/tests.rs keeps every production module plus TLS fixtures; fuzz manifest keeps all production dependencies/targets plus auth_cookie. websocket session lifecycle/frame/admission code unchanged from 04cdc52a. Running merge fast gate with serial tests, job-owned target and CPUWeight=10000; host infraternal-dev load 17.71/19.61/24.42 at gate start.

Merge resolutions prepared: Cargo.lock retains every production entry and adds only already-locked h2 to server test dependencies and axum to fuzz; metadata regeneration changed no versions (2 added dependency edges). Cargo.toml retains remote_ca_bench and existing workspace tokio-openssl, adds h2 dev dependency. auth/http.rs and websocket.rs retain pub(crate) visibility for production CA/remote/removal/bootstrap consumers while delegating to strict all-field parser. auth/mod.rs keeps bootstrap_authorization plus cookies; auth/tests.rs keeps every production module plus TLS fixtures; fuzz manifest keeps all production dependencies/targets plus auth_cookie. websocket session lifecycle/frame/admission code unchanged from 04cdc52a. Running merge fast gate with serial tests, job-owned target and CPUWeight=10000; host infraternal-dev load 17.71/19.61/24.42 at gate start.

kayg commented

2026-10-11 03:21:32 +00:00

Author

Owner

Tracer bun run check passes. Initial unscoped bun test src: 141 pass/1 fail, unchanged 1,000-node layout timing assertion (3473.41ms), 22.11s suite. Immediate CPUWeight=10000 scoped run: 142 pass/0 fail, 10901 expectations, 640ms suite; no threshold/source changes or waiver. Cargo.lock package/version/source sets exactly match 04cdc52a (zero additions/removals). Native merge gate and exact 04cdc52a static baseline cold builds continue on infraternal-dev; load reached 46.08/32.91/28.15.

Tracer bun run check passes. Initial unscoped bun test src: 141 pass/1 fail, unchanged 1,000-node layout timing assertion (3473.41ms), 22.11s suite. Immediate CPUWeight=10000 scoped run: 142 pass/0 fail, 10901 expectations, 640ms suite; no threshold/source changes or waiver. Cargo.lock package/version/source sets exactly match 04cdc52a (zero additions/removals). Native merge gate and exact 04cdc52a static baseline cold builds continue on infraternal-dev; load reached 46.08/32.91/28.15.

kayg commented

2026-10-11 03:52:24 +00:00

Author

Owner

Exact 04cdc52a baseline fresh static x86_64 build: 19,992,512 bytes, no PT_INTERP (separate baseline-target; artifact baseline-infraternal). Merge workspace server suite: 277 passed/0 failed/31 ignored, 418.07s; both native h2 and TLS-front/HTTP1 session regressions pass, handshake timeout passes. Local CPUWeight=10000 unchanged strict parser probe (opt=3, production musl dependencies), 200,000 requests x 50 sessions x 3 rounds: old [110.27, 139.65, 92.41], strict [225.79, 181.41, 219.53] ns/request; median 110.27 -> 219.53, +109.26 ns/request, +5.463 us/50 requests. Retained reader state 0 bytes/session x 50 = 0. Machine/load lines in parser-bench.log; these are parser-only averages under shared host load. Tracer production transfer passes: critical Brotli 241134/256000, deferred 44733/45056 bytes.

Exact 04cdc52a baseline fresh static x86_64 build: 19,992,512 bytes, no PT_INTERP (separate baseline-target; artifact baseline-infraternal). Merge workspace server suite: 277 passed/0 failed/31 ignored, 418.07s; both native h2 and TLS-front/HTTP1 session regressions pass, handshake timeout passes. Local CPUWeight=10000 unchanged strict parser probe (opt=3, production musl dependencies), 200,000 requests x 50 sessions x 3 rounds: old [110.27, 139.65, 92.41], strict [225.79, 181.41, 219.53] ns/request; median 110.27 -> 219.53, +109.26 ns/request, +5.463 us/50 requests. Retained reader state 0 bytes/session x 50 = 0. Machine/load lines in parser-bench.log; these are parser-only averages under shared host load. Tracer production transfer passes: critical Brotli 241134/256000, deferred 44733/45056 bytes.

kayg commented

2026-10-11 03:57:30 +00:00

Author

Owner

Confirmed production-only bootstrap bug after merged shared reader: bootstrap_api.rs:158 rejects any second Cookie field, including unrelated ceremony cookies, so both Settings auth and bootstrap upgrades still reject a canonical session. Temporary real-passkey/live SQLite + loopback WebSocket regression prepared in bootstrap_api_tests.rs; before fix it fails the shared admission assertion in 1.07s (0 passed/1 failed). Test addition saved as bootstrap-test.patch and removed from merge tree; no capability values in diagnostics. Will remove only the field-count guard after merge and retain strict request-wide duplicate/malformed/non-text rejection, exact Origin, owner/unlock/revocation and admission bounds.

running 1 test
test bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority ... FAILED

failures:

---- bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority stdout ----

thread 'bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority' (2934028) panicked at crates/infraternal-server/src/bootstrap_api_tests.rs:866:9:
assertion failed: authenticate_headers(&api, &headers).await.is_ok()
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace

failures:
bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority

test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 193 filtered out; finished in 1.07s

error: test failed, to rerun pass -p infraternal-server --lib

Confirmed production-only bootstrap bug after merged shared reader: bootstrap_api.rs:158 rejects any second Cookie field, including unrelated ceremony cookies, so both Settings auth and bootstrap upgrades still reject a canonical session. Temporary real-passkey/live SQLite + loopback WebSocket regression prepared in bootstrap_api_tests.rs; before fix it fails the shared admission assertion in 1.07s (0 passed/1 failed). Test addition saved as bootstrap-test.patch and removed from merge tree; no capability values in diagnostics. Will remove only the field-count guard after merge and retain strict request-wide duplicate/malformed/non-text rejection, exact Origin, owner/unlock/revocation and admission bounds. running 1 test test bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority ... FAILED failures: ---- bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority stdout ---- thread 'bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority' (2934028) panicked at crates/infraternal-server/src/bootstrap_api_tests.rs:866:9: assertion failed: authenticate_headers(&api, &headers).await.is_ok() note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 193 filtered out; finished in 1.07s error: test failed, to rerun pass `-p infraternal-server --lib`

kayg referenced this issue from a commit

2026-10-11 04:17:44 +00:00

Merge TLS session cookie fix onto production (#149; D206)

kayg commented

2026-10-11 04:18:25 +00:00

Author

Owner

Completed/pushed merge 1694e11f7b on tls-session-prod. All seven conflict resolutions described in commit body; #158 Close 4404/#151 bounds/newer auth paths and every test retained. 607 workspace tests pass, 0 fail, 64 ignored; server 277/0/31 in 418.07s. Separate auth 110/0/8 plus one integration match; native/proxy TLS 2/0 in 1.88s, both registration/joined/split session=200. Static x86_64 19991552 bytes, -960 versus exact 04cdc52a 19992512, PT_INTERP absent. Tracer 142/0; protocol 36/0/34462 assertions; production transfer passes. No #118 waiver. Fast gate summary verbatim (exit 1 solely known size):

Completed/pushed merge 1694e11f7b79012ac068689d8c6e26173b9cf90e on tls-session-prod. All seven conflict resolutions described in commit body; #158 Close 4404/#151 bounds/newer auth paths and every test retained. 607 workspace tests pass, 0 fail, 64 ignored; server 277/0/31 in 418.07s. Separate auth 110/0/8 plus one integration match; native/proxy TLS 2/0 in 1.88s, both registration/joined/split session=200. Static x86_64 19991552 bytes, -960 versus exact 04cdc52a 19992512, PT_INTERP absent. Tracer 142/0; protocol 36/0/34462 assertions; production transfer passes. No #118 waiver. Fast gate summary verbatim (exit 1 solely known size): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-11 04:20:08 +00:00

Author

Owner

Bootstrap regression now passes after removing only the Cookie field-count guard (bootstrap_api.rs:158). Shared adapter accepts unrelated/session split fields in either order with live SQLite owner authority; real loopback WebSocket upgrades succeed. Same/different-shaped duplicate capabilities and non-text fields deny in either order. Existing owner/unlock/revocation and exact single-Origin checks remain. Before 0/1 in 1.07s; after:

running 1 test
test bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 193 filtered out; finished in 0.70s

Final source audit: all production Cookie parsing occurs only at auth/cookies.rs:8; remaining HeaderMap::get(COOKIE) is the intentionally ignored old-reader benchmark. Full follow-up fast gate running; Clippy passes.

Bootstrap regression now passes after removing only the Cookie field-count guard (bootstrap_api.rs:158). Shared adapter accepts unrelated/session split fields in either order with live SQLite owner authority; real loopback WebSocket upgrades succeed. Same/different-shaped duplicate capabilities and non-text fields deny in either order. Existing owner/unlock/revocation and exact single-Origin checks remain. Before 0/1 in 1.07s; after: running 1 test test bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 193 filtered out; finished in 0.70s Final source audit: all production Cookie parsing occurs only at auth/cookies.rs:8; remaining HeaderMap::get(COOKIE) is the intentionally ignored old-reader benchmark. Full follow-up fast gate running; Clippy passes.

kayg referenced this issue from a commit

2026-10-11 04:34:41 +00:00

fix(auth): accept split Cookie fields for bootstrap owner admission (#149)

kayg commented

2026-10-11 04:35:29 +00:00

Author

Owner

Completed/pushed bootstrap follow-up 0e6899c545. Removed only field-count guard and added live authority/real socket regression: before 0/1 (1.07s), after 1/0 (0.70s). Full workspace 608 passed/0 failed/64 ignored; exact Origin/owner/unlock/revocation/component-disable cases pass. Static 19991488 bytes, -64 this step, -1024 versus exact 04cdc52a; PT_INTERP absent. No dependencies/budgets/timeouts changed; no #118 waiver. Next: replay independent TLS ceremony tests 59c72a49. Fast summary verbatim (exit 1 solely known size):

Completed/pushed bootstrap follow-up 0e6899c54535680ac3d5f5c8337f56a80534180f. Removed only field-count guard and added live authority/real socket regression: before 0/1 (1.07s), after 1/0 (0.70s). Full workspace 608 passed/0 failed/64 ignored; exact Origin/owner/unlock/revocation/component-disable cases pass. Static 19991488 bytes, -64 this step, -1024 versus exact 04cdc52a; PT_INTERP absent. No dependencies/budgets/timeouts changed; no #118 waiver. Next: replay independent TLS ceremony tests 59c72a49. Fast summary verbatim (exit 1 solely known size): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-11 04:37:15 +00:00

Author

Owner

Independent test commit 59c72a49 replayed without conflicts on production + bootstrap fix. Expanded native/proxy real TLS fixtures pass split ceremony-binding reuse, distinct/malformed duplicate denial in either order, then successful redemption of the same signed proof. Boolean diagnostics do not print capabilities. Test-only change; no new production dependency/runtime code. Full gate underway; fmt/Clippy pass. Targeted output verbatim:

running 2 tests
test auth::tests::tls_tests::proxy_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=true registration=200 joined_session=200 split_session=200 OK
ok
test auth::tests::tls_tests::standalone_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=false registration=200 joined_session=200 split_session=200 OK
ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 192 filtered out; finished in 2.38s

Independent test commit 59c72a49 replayed without conflicts on production + bootstrap fix. Expanded native/proxy real TLS fixtures pass split ceremony-binding reuse, distinct/malformed duplicate denial in either order, then successful redemption of the same signed proof. Boolean diagnostics do not print capabilities. Test-only change; no new production dependency/runtime code. Full gate underway; fmt/Clippy pass. Targeted output verbatim: running 2 tests test auth::tests::tls_tests::proxy_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=true registration=200 joined_session=200 split_session=200 OK ok test auth::tests::tls_tests::standalone_tls_registration_session_split_cookies ... TLS_HTTP2 proxy=false registration=200 joined_session=200 split_session=200 OK ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 192 filtered out; finished in 2.38s

kayg commented

2026-10-11 04:45:56 +00:00

Author

Owner

Review-test full gate found one failure outside the permitted #118 exception: unchanged Mesh headroom test at auth/tests.rs:1731, server closed websocket unexpectedly: None. Server row 277 pass/1 fail/31 ignored, 298.27s. Native/proxy TLS and bootstrap split regression pass; every non-test row passes except known size. The Mesh test/source and post-handshake socket code are unchanged by #149; both preceding full merge/bootstrap gates passed this test. No waiver, timeout or source change: isolating the test and requiring a new passing full gate before the review-test commit. Failure evidence verbatim:

---- auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket stdout ----
nodes=10000 grants=30000 snapshot_event_bytes=64595 frame_limit=4194304 load=13.08 14.17 16.39 22/3006 3382238
liveness_resyncs=1 expiry_frame_bytes=64602

thread 'auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket' (3381712) panicked at crates/infraternal-server/src/auth/tests.rs:1731:17:
server closed websocket unexpectedly: None
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace

failures:
auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket

test result: FAILED. 277 passed; 1 failed; 31 ignored; 0 measured; 0 filtered out; finished in 298.27s

Review-test full gate found one failure outside the permitted #118 exception: unchanged Mesh headroom test at auth/tests.rs:1731, server closed websocket unexpectedly: None. Server row 277 pass/1 fail/31 ignored, 298.27s. Native/proxy TLS and bootstrap split regression pass; every non-test row passes except known size. The Mesh test/source and post-handshake socket code are unchanged by #149; both preceding full merge/bootstrap gates passed this test. No waiver, timeout or source change: isolating the test and requiring a new passing full gate before the review-test commit. Failure evidence verbatim: ---- auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket stdout ---- nodes=10000 grants=30000 snapshot_event_bytes=64595 frame_limit=4194304 load=13.08 14.17 16.39 22/3006 3382238 liveness_resyncs=1 expiry_frame_bytes=64602 thread 'auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket' (3381712) panicked at crates/infraternal-server/src/auth/tests.rs:1731:17: server closed websocket unexpectedly: None note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace failures: auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket test result: FAILED. 277 passed; 1 failed; 31 ignored; 0 measured; 0 filtered out; finished in 298.27s

kayg commented

2026-10-11 04:49:29 +00:00

Author

Owner

Mesh isolation passes unchanged in both runs. Exact failing workspace test binary: 1 passed/0 failed, 81.73s; 10000 nodes/30000 grants assembled in 88 pages, maximum frame 64612 bytes (<65536), shared socket Pong=true; liveness resync handled. cargo test --locked -p infraternal-server --lib --features remote matching test: 1 passed/0 failed, 76.87s, same 88 pages/64612 max/Pong=true. Logs mesh-exact-retry.log and mesh-retry.log; host load 10.98/13.19/15.66 and 14.13/13.73/15.76 during fixtures. No source/threshold/timeout changes or exception. Full fast gate retry running and must pass test row before commit.

Exact binary output verbatim:
running 1 test
test auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket ... nodes=10000 grants=30000 snapshot_event_bytes=64595 frame_limit=4194304 load=10.98 13.19 15.66 14/2847 3398961
liveness_resyncs=1 expiry_frame_bytes=64602
assembled_nodes=10000 assembled_grants=30000 pages=88 max_frame_bytes=64612 total_frame_bytes=5630655 shared_socket_pong=true
ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 308 filtered out; finished in 81.73s

Mesh isolation passes unchanged in both runs. Exact failing workspace test binary: 1 passed/0 failed, 81.73s; 10000 nodes/30000 grants assembled in 88 pages, maximum frame 64612 bytes (<65536), shared socket Pong=true; liveness resync handled. cargo test --locked -p infraternal-server --lib --features remote matching test: 1 passed/0 failed, 76.87s, same 88 pages/64612 max/Pong=true. Logs mesh-exact-retry.log and mesh-retry.log; host load 10.98/13.19/15.66 and 14.13/13.73/15.76 during fixtures. No source/threshold/timeout changes or exception. Full fast gate retry running and must pass test row before commit. Exact binary output verbatim: running 1 test test auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket ... nodes=10000 grants=30000 snapshot_event_bytes=64595 frame_limit=4194304 load=10.98 13.19 15.66 14/2847 3398961 liveness_resyncs=1 expiry_frame_bytes=64602 assembled_nodes=10000 assembled_grants=30000 pages=88 max_frame_bytes=64612 total_frame_bytes=5630655 shared_socket_pong=true ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 308 filtered out; finished in 81.73s

kayg referenced this issue from a commit

2026-10-11 04:58:34 +00:00

test(auth): retain independent TLS ceremony regressions on production (#149)

kayg commented

2026-10-11 04:59:34 +00:00

Author

Owner

Completed/pushed review-test replay abb80a0536 (from 59c72a49). Expanded native/proxy TLS 2/0, 2.38s; split binding reuse and duplicate refusal preserve signed proof. Full retry: 608 passed/0 failed/64 ignored. Earlier unchanged Mesh snapshot close failure is recorded; exact binary and cargo isolation both pass (88 pages, 10000 nodes/30000 grants, 64612-byte max, shared socket Pong), and full retry passes the row. No waiver/threshold/source adjustment. Runtime delta 0; static 19991488 (-1024 from exact 04cdc52a), PT_INTERP absent. Short result.md and final gate next. Fast retry summary verbatim (exit 1 solely known size):

Completed/pushed review-test replay abb80a053619d53b292412f1cce11589d24f3513 (from 59c72a49). Expanded native/proxy TLS 2/0, 2.38s; split binding reuse and duplicate refusal preserve signed proof. Full retry: 608 passed/0 failed/64 ignored. Earlier unchanged Mesh snapshot close failure is recorded; exact binary and cargo isolation both pass (88 pages, 10000 nodes/30000 grants, 64612-byte max, shared socket Pong), and full retry passes the row. No waiver/threshold/source adjustment. Runtime delta 0; static 19991488 (-1024 from exact 04cdc52a), PT_INTERP absent. Short result.md and final gate next. Fast retry summary verbatim (exit 1 solely known size): +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+

kayg commented

2026-10-11 05:02:51 +00:00

Author

Owner

Added local CPUWeight=10000 50-session probe with the existing production server opt-level=s (Cargo.toml:92-93), no profile/source changes. Three rounds old [342.43, 275.47, 287.49], strict [409.88, 313.39, 308.72] ns/request; medians 287.49 -> 313.39, +25.90 ns/request, +1.295 us/50. Retained 0 B/session x expected 200 = 0 B. Machine infraternal-dev, 8 CPUs, 200000 requests/session x50 x3. Load 22.76 18.03 17.24 25/2903 3544091 -> 24.41 18.72 17.49 28/2919 3545929. This supplements opt=3 +5.463us/50 and remains a parser-only average, not a production end-to-end percentile. result.md now distinguishes both profiles. Raw log parser-bench-size.log.

kayg referenced this issue from a commit

2026-10-11 05:10:49 +00:00

docs: record production TLS-session integration evidence (#149)

kayg commented

2026-10-11 05:14:29 +00:00

Author

Owner

Finished #149 / D206 production integration. Head 5d02b8d6b9 on tls-session-prod; remote SHA matches, worktree clean. Four atomic commits, each pushed: merge 1694e11f (all seven resolutions in body), bootstrap strict-reader follow-up 0e6899c5, review test replay abb80a05 (59c72a49), result.md 5d02b8d6. No deployment or issue closure.

Preserved #158 final Close 4404, #151 bounds, newer CA/remote/removal/bootstrap paths and every test. Every production Cookie reader now delegates to the same strict all-field capability parser; duplicate/malformed/non-text fields deny. Bootstrap regression before 0/1 (1.07s), after 1/0 (0.70s), including live owner/SQLite and real socket field-order checks. Expanded native/proxy TLS tests 2/0 (2.38s): registration/joined/split session=200, ceremony binding reuse, duplicate refusal without consuming signed proof. Existing Origin, cookie flags, ingress, unlock/expiry/revocation and admission policies unchanged. Auth B1/S1/S2/N1 self-review complete; reviewed auth_cookie fuzz target retained, parser source unchanged from tls-session.

Final workspace: 608 passed/0 failed/64 ignored. Required auth run: 110 unit +1 matching integration passed. Tracer check/142 src tests pass; protocol compiler/36 tests/34462 assertions pass; production build/transfer pass (critical Brotli 241134/256000, deferred 44733/45056 bytes). Workspace lockfile regeneration byte-identical, Cargo locked 0 new packages; --locked metadata passes, package/version/source sets unchanged from 04cdc52a.

Exact fresh x86_64 static baseline 04cdc52a: 19992512 bytes -> final 19991488 (-1024); no PT_INTERP. Known 16404816-byte limit remains unchanged; size row stops before aarch64. Separate build roots prevented baseline artifact reuse. Local CPUWeight=10000 parser probes, 3x200000 requests/session x50: production opt=s median 287.49->313.39 ns/request (+25.90ns; +1.295us/50); opt=3 +5.463us/50. Retained state 0 B/session x200=0 B. infraternal-dev, 8 CPUs; opt=s load 22.76/18.03/17.24 ->24.41/18.72/17.49. Parser-only averages, not end-to-end percentiles.

Initial tracer timing failure passed scoped rerun. Initial review Mesh snapshot socket-close failure passed two unchanged isolated runs and both complete retry/final gates; no waiver or timeout change. Mesh evidence: 10000 nodes/30000 grants, 88 pages, 64612-byte maximum frame, shared socket Pong=true. All failures/findings and outputs remain in preceding comments.

Short report: result.md. Logs/evidence under $HOME/.cache/codex-scratch/tls-session-prod/; job-owned targets, baseline checkout, probes and local target symlink removed. Final scripts/verify fast summary verbatim (exit 1 solely known size):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Finished #149 / D206 production integration. Head 5d02b8d6b9f882695d92e1d17f80abb8f6af2e06 on tls-session-prod; remote SHA matches, worktree clean. Four atomic commits, each pushed: merge 1694e11f (all seven resolutions in body), bootstrap strict-reader follow-up 0e6899c5, review test replay abb80a05 (59c72a49), result.md 5d02b8d6. No deployment or issue closure. Preserved #158 final Close 4404, #151 bounds, newer CA/remote/removal/bootstrap paths and every test. Every production Cookie reader now delegates to the same strict all-field capability parser; duplicate/malformed/non-text fields deny. Bootstrap regression before 0/1 (1.07s), after 1/0 (0.70s), including live owner/SQLite and real socket field-order checks. Expanded native/proxy TLS tests 2/0 (2.38s): registration/joined/split session=200, ceremony binding reuse, duplicate refusal without consuming signed proof. Existing Origin, cookie flags, ingress, unlock/expiry/revocation and admission policies unchanged. Auth B1/S1/S2/N1 self-review complete; reviewed auth_cookie fuzz target retained, parser source unchanged from tls-session. Final workspace: 608 passed/0 failed/64 ignored. Required auth run: 110 unit +1 matching integration passed. Tracer check/142 src tests pass; protocol compiler/36 tests/34462 assertions pass; production build/transfer pass (critical Brotli 241134/256000, deferred 44733/45056 bytes). Workspace lockfile regeneration byte-identical, Cargo locked 0 new packages; --locked metadata passes, package/version/source sets unchanged from 04cdc52a. Exact fresh x86_64 static baseline 04cdc52a: 19992512 bytes -> final 19991488 (-1024); no PT_INTERP. Known 16404816-byte limit remains unchanged; size row stops before aarch64. Separate build roots prevented baseline artifact reuse. Local CPUWeight=10000 parser probes, 3x200000 requests/session x50: production opt=s median 287.49->313.39 ns/request (+25.90ns; +1.295us/50); opt=3 +5.463us/50. Retained state 0 B/session x200=0 B. infraternal-dev, 8 CPUs; opt=s load 22.76/18.03/17.24 ->24.41/18.72/17.49. Parser-only averages, not end-to-end percentiles. Initial tracer timing failure passed scoped rerun. Initial review Mesh snapshot socket-close failure passed two unchanged isolated runs and both complete retry/final gates; no waiver or timeout change. Mesh evidence: 10000 nodes/30000 grants, 88 pages, 64612-byte maximum frame, shared socket Pong=true. All failures/findings and outputs remain in preceding comments. Short report: result.md. Logs/evidence under $HOME/.cache/codex-scratch/tls-session-prod/; job-owned targets, baseline checkout, probes and local target symlink removed. Final scripts/verify fast summary verbatim (exit 1 solely known size): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg commented

2026-10-11 05:20:01 +00:00

Author

Owner

Independent delta review started on review-tls-session-prod at 5d02b8d6b9; production review base 04cdc52a01, merge base with current dev 2eaaaa36a2. Read all 39 #149 comments and all 6 parent #121 comments, required repo documents and previous review report. Earlier review records zero findings; independent test commit 59c72a49 is already replayed as abb80a05. Scope restricted to delta and earlier tests. Running untouched job-head fast gate with unique TRACER_TEST_PORT=4397 and job-owned scratch; no implementation edits, push or deployment.

Independent delta review started on review-tls-session-prod at 5d02b8d6b9f882695d92e1d17f80abb8f6af2e06; production review base 04cdc52a0147e2a281b5545caafca014096dec9e, merge base with current dev 2eaaaa36a2dcdda12582150d29c14d660e6bcb2f. Read all 39 #149 comments and all 6 parent #121 comments, required repo documents and previous review report. Earlier review records zero findings; independent test commit 59c72a49 is already replayed as abb80a05. Scope restricted to delta and earlier tests. Running untouched job-head fast gate with unique TRACER_TEST_PORT=4397 and job-owned scratch; no implementation edits, push or deployment.

kayg commented

2026-10-11 05:30:30 +00:00

Author

Owner

Delta review checkpoint at untouched 5d02b8d6: independent test patch 59c72a49 and replay abb80a05 are byte-identical; zero earlier confirmed findings to replay. All production readers route through cookies::capability; contracts and steady terminal socket processing unchanged from 04cdc52a. Independent nightly/ASAN run of exact repository auth_cookie target completed 1901880 inputs in 67s, cov=300/ft=1279/corpus=266, oom/timeout/crash=0/0/0, exit 0; max_len=4096, rss_limit_mb=512. Isolated scratch manifest reuses locked axum 0.8.9/libfuzzer-sys 0.4.13 and includes the original target source; no repo dependency edits. Local infraternal-dev CPUWeight=10000, 8 CPUs, observed load 21.80/18.69/17.61 near start and 16.77/18.55/17.90 after run. Full job-head fast gate continues. No confirmed finding.

Delta review checkpoint at untouched 5d02b8d6: independent test patch 59c72a49 and replay abb80a05 are byte-identical; zero earlier confirmed findings to replay. All production readers route through cookies::capability; contracts and steady terminal socket processing unchanged from 04cdc52a. Independent nightly/ASAN run of exact repository auth_cookie target completed 1901880 inputs in 67s, cov=300/ft=1279/corpus=266, oom/timeout/crash=0/0/0, exit 0; max_len=4096, rss_limit_mb=512. Isolated scratch manifest reuses locked axum 0.8.9/libfuzzer-sys 0.4.13 and includes the original target source; no repo dependency edits. Local infraternal-dev CPUWeight=10000, 8 CPUs, observed load 21.80/18.69/17.61 near start and 16.77/18.55/17.90 after run. Full job-head fast gate continues. No confirmed finding.

kayg commented

2026-10-11 05:39:11 +00:00

Author

Owner

Independent local parser remeasurement completed on untouched 5d02b8d6 under CPUWeight=10000: 3 rounds x 200000 requests/session x 50. Production reader opt=s median old 204.73 -> strict 229.89 ns/request, +1.258 us/50; opt=3 79.41 -> 172.38, +4.649 us/50. Native GNU rustc 1.99.0 with independently rebuilt opt=3 axum 0.8.9 dependencies; unlike author musl probes, this is a target-different corroboration, not an exact timing comparison. infraternal-dev /8 cores, load 20.97/18.85/18.11 ->19.55/18.66/18.07. No allocation or retained parser state: 0 B/session x 200 = 0 B. Parser averages only; not end-to-end percentile claims. Scope/source/security review found no confirmed gap; required untouched-head test/gate run continues.

Independent local parser remeasurement completed on untouched 5d02b8d6 under CPUWeight=10000: 3 rounds x 200000 requests/session x 50. Production reader opt=s median old 204.73 -> strict 229.89 ns/request, +1.258 us/50; opt=3 79.41 -> 172.38, +4.649 us/50. Native GNU rustc 1.99.0 with independently rebuilt opt=3 axum 0.8.9 dependencies; unlike author musl probes, this is a target-different corroboration, not an exact timing comparison. infraternal-dev /8 cores, load 20.97/18.85/18.11 ->19.55/18.66/18.07. No allocation or retained parser state: 0 B/session x 200 = 0 B. Parser averages only; not end-to-end percentile claims. Scope/source/security review found no confirmed gap; required untouched-head test/gate run continues.

kayg commented

2026-10-11 05:48:41 +00:00

Author

Owner

Untouched 5d02b8d6 independent fast gate: all 608 Rust tests passed, 0 failed, 64 ignored; fmt, VT native fmt, Clippy and cargo-deny passed. Retained native/proxy TLS tests both pass, including earlier 59c72a49 ceremony binding reuse/refusal-before-proof-consumption assertions. Bootstrap split-field owner-authority regression passes. No #118 exception needed. Static musl build is still running; no implementation/test source changed and no confirmed finding.

Untouched 5d02b8d6 independent fast gate: all 608 Rust tests passed, 0 failed, 64 ignored; fmt, VT native fmt, Clippy and cargo-deny passed. Retained native/proxy TLS tests both pass, including earlier 59c72a49 ceremony binding reuse/refusal-before-proof-consumption assertions. Bootstrap split-field owner-authority regression passes. No #118 exception needed. Static musl build is still running; no implementation/test source changed and no confirmed finding.

kayg commented

2026-10-11 06:06:53 +00:00

Author

Owner

Finished independent delta review #149: MERGE (no P0/P1); verdict merge. Counts P0=0, P1=0, P2=0, P3=0.
Target tls-session-prod 5d02b8d6b9; scope 04cdc52a..5d02b8d6. Local review-tls-session-prod head 91f1979a27; one documentation-only evidence commit, worktree clean. No implementation fix, push, deployment or issue closure. Temporary build targets/corpus removed.

Earlier review had no confirmed findings. Independent test patch 59c72a49 is already replayed byte-for-byte as abb80a05. Both retained real native/proxy TLS tests pass: split ceremony reuse and duplicate/malformed refusal preserve signed proof. Bootstrap split-owner regression and both socket cookie tests pass. Supplemental normal-location live-authority probe passes 1/0 in 0.71s: both cookie orders refuse owner removal, pending unlock, expiry and deletion through direct admission and real WebSocket handshakes (16 assertions); temporary source restored, patch/log retained. No gap requiring a failing test commit.

Untouched job-head fast gate: 608 passed/0 failed/64 ignored; server 278/0/31 in 300.56s. No #118 exception. Exact fresh static x86_64 head 19991488 B, stripped/no PT_INTERP; matches author head and is 1024 B below author's recorded 04cdc52a baseline (baseline not rebuilt in this delta review). Existing 16404816 B limit fails by 3586672 B; D205 row stops before aarch64/TS. No TS/UI delta. Review documentation adds 0 runtime bytes.

Independent exact-source nightly/ASAN fuzz: 1901880 inputs/67s, cov=300/ft=1279, oom/timeout/crash=0/0/0, exit 0. Local CPUWeight=10000 parser probe, 3x200000 requests/session x50: opt=s medians 204.73->229.89 ns/request (+1.258us/50), opt=3 +4.649us/50; 0 B retained x200. infraternal-dev/8 CPUs; load 20.97/18.85/18.11 ->19.55/18.66/18.07. GNU probe versus author's musl: corroborating parser averages, not an identical-target or end-to-end percentile claim.

Evidence: docs/verification/tls-session-prod-review.md; findings.md under job state; logs/reproduction patch under $HOME/.cache/codex-scratch/tls-session-prod-review/.

scripts/verify fast on job head, verbatim summary (exit 1 solely known static size):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Finished independent delta review #149: MERGE (no P0/P1); verdict merge. Counts P0=0, P1=0, P2=0, P3=0. Target tls-session-prod 5d02b8d6b9f882695d92e1d17f80abb8f6af2e06; scope 04cdc52a..5d02b8d6. Local review-tls-session-prod head 91f1979a27879d27504a91470434e25639d9fa4a; one documentation-only evidence commit, worktree clean. No implementation fix, push, deployment or issue closure. Temporary build targets/corpus removed. Earlier review had no confirmed findings. Independent test patch 59c72a49 is already replayed byte-for-byte as abb80a05. Both retained real native/proxy TLS tests pass: split ceremony reuse and duplicate/malformed refusal preserve signed proof. Bootstrap split-owner regression and both socket cookie tests pass. Supplemental normal-location live-authority probe passes 1/0 in 0.71s: both cookie orders refuse owner removal, pending unlock, expiry and deletion through direct admission and real WebSocket handshakes (16 assertions); temporary source restored, patch/log retained. No gap requiring a failing test commit. Untouched job-head fast gate: 608 passed/0 failed/64 ignored; server 278/0/31 in 300.56s. No #118 exception. Exact fresh static x86_64 head 19991488 B, stripped/no PT_INTERP; matches author head and is 1024 B below author's recorded 04cdc52a baseline (baseline not rebuilt in this delta review). Existing 16404816 B limit fails by 3586672 B; D205 row stops before aarch64/TS. No TS/UI delta. Review documentation adds 0 runtime bytes. Independent exact-source nightly/ASAN fuzz: 1901880 inputs/67s, cov=300/ft=1279, oom/timeout/crash=0/0/0, exit 0. Local CPUWeight=10000 parser probe, 3x200000 requests/session x50: opt=s medians 204.73->229.89 ns/request (+1.258us/50), opt=3 +4.649us/50; 0 B retained x200. infraternal-dev/8 CPUs; load 20.97/18.85/18.11 ->19.55/18.66/18.07. GNU probe versus author's musl: corroborating parser averages, not an identical-target or end-to-end percentile claim. Evidence: docs/verification/tls-session-prod-review.md; findings.md under job state; logs/reproduction patch under $HOME/.cache/codex-scratch/tls-session-prod-review/. scripts/verify fast on job head, verbatim summary (exit 1 solely known static size): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```

kayg referenced this issue from a commit

2026-10-11 10:57:07 +00:00

Merge prod-batch into release-prod-2: deployed 707a4572 (#151 #149 #154, machine sections, CA unlock, inbox)

kayg referenced this issue from a commit

2026-10-11 12:50:10 +00:00

Merge production into dev while retaining plugin-driven CLI (#163)

kayg commented

2026-10-28 17:52:50 +00:00

Author

Owner

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: TLS session fix merged and deployed in prod-batch (6320f5b52 / 5d02b8d6b ancestor of release-prod-live and dev); delta review found no gap. Reopen if anything is still missing.

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: TLS session fix merged and deployed in prod-batch (6320f5b52 / 5d02b8d6b ancestor of release-prod-live and dev); delta review found no gap. Reopen if anything is still missing.

kayg closed this issue

2026-10-28 17:52:50 +00:00

~~kayg referenced this issue 2026-10-28 17:53:55 +00:00~~

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg referenced this issue

2026-10-28 18:00:45 +00:00

Orchestrator handover 2026-10-28: moving to a new machine #254

Rows
Columns

Standalone TLS: /auth/session returns 401 right after passkey registration #149