kayg/infraternal
Watch
1
0
Fork
You've already forked infraternal
 0
Code Issues 356 Pull requests Projects Releases Packages Wiki Activity Actions

S1 lane: auth (setup token, passkeys with PRF, recovery key, sessions) #17

New issue
Closed
opened 2026-10-06 10:10:50 +00:00 by kayg · 21 comments
kayg commented 2026-10-06 10:10:50 +00:00
Owner
Copy link

Decisions 24–28, 53: the first-run setup token, passkey registration and login (WebAuthn, PRF for key wrapping), the 24-word recovery key with a 24 h delay, 30-day sliding sessions, and device API keys. Storage in SQLite through sqlx. Base: s1-base 386acfd. Part of #9.

Decisions 24–28, 53: the first-run setup token, passkey registration and login (WebAuthn, PRF for key wrapping), the 24-word recovery key with a 24 h delay, 30-day sliding sessions, and device API keys. Storage in SQLite through sqlx. Base: `s1-base` `386acfd`. Part of #9.
kayg commented 2026-10-06 10:11:40 +00:00
Author
Owner
Copy link

Starting auth lane on branch lane-auth, base 386acfd. Reading decisions 23–29 and 53 and the scaffold before implementing; defensive review and ceremony/storage tests will accompany the change.

Starting auth lane on branch lane-auth, base 386acfd. Reading decisions 23–29 and 53 and the scaffold before implementing; defensive review and ceremony/storage tests will accompany the change.
kayg commented 2026-10-06 10:20:19 +00:00
Author
Owner
Copy link

Defensive review finding: webauthn-rs 0.5.5 passkey API enforces UV but omits PRF and requests nonresident credentials (upstream src/lib.rs start_passkey_registration). Browser options now request residentKey=required and PRF; finish rejects PRF results. Tests use real ES256 signatures/CBOR and a browser PRF double, with wrong-origin, UV, replay, delay/cancel cases. Build prerequisite finding: vendored OpenSSL fails with Command make not found in the lane shell; resolving worktree-local tooling before the required gate.

Defensive review finding: webauthn-rs 0.5.5 passkey API enforces UV but omits PRF and requests nonresident credentials (upstream src/lib.rs start_passkey_registration). Browser options now request residentKey=required and PRF; finish rejects PRF results. Tests use real ES256 signatures/CBOR and a browser PRF double, with wrong-origin, UV, replay, delay/cancel cases. Build prerequisite finding: vendored OpenSSL fails with Command make not found in the lane shell; resolving worktree-local tooling before the required gate.
kayg commented 2026-10-06 10:25:56 +00:00
Author
Owner
Copy link

Defensive review: all 9 auth tests pass (14.02s debug); real ES256/CBOR ceremonies reject replay, wrong origin, missing UV, stale counters, wrong userHandle, and leaked PRF output. Concurrent owner/second-passkey enrollment accepts exactly one finish. Recovery cancellation invalidates begun enrollment; replacement revokes sessions/API keys, rejects old credentials/words, and cross-user wrap listing returns no other user data. Paths: crates/infraternal-server/src/auth/tests.rs and migrations/0001_auth.sql. Preliminary debug SQLite memory session n=200 p50=218us/p99=521us, Argon2id verification 540ms; optimized measurement is running. cargo-deny now passes with reviewed AGPL-compatible MPL-2.0/CC0/BSD-3-Clause/Zlib dependencies; webauthn-rs is pinned to its safe passkey API.

Defensive review: all 9 auth tests pass (14.02s debug); real ES256/CBOR ceremonies reject replay, wrong origin, missing UV, stale counters, wrong userHandle, and leaked PRF output. Concurrent owner/second-passkey enrollment accepts exactly one finish. Recovery cancellation invalidates begun enrollment; replacement revokes sessions/API keys, rejects old credentials/words, and cross-user wrap listing returns no other user data. Paths: crates/infraternal-server/src/auth/tests.rs and migrations/0001_auth.sql. Preliminary debug SQLite memory session n=200 p50=218us/p99=521us, Argon2id verification 540ms; optimized measurement is running. cargo-deny now passes with reviewed AGPL-compatible MPL-2.0/CC0/BSD-3-Clause/Zlib dependencies; webauthn-rs is pinned to its safe passkey API.
kayg commented 2026-10-06 10:29:58 +00:00
Author
Owner
Copy link

Defensive review finding: cookie sliding must refresh Max-Age on each successful cookie-authenticated HTTP action, rather than only updating SQLite expiry. Fixed in src/auth/http.rs with an HTTP wraps test. JSON parsing errors are redacted to prevent caller logs echoing submitted strings; cancellation rechecks session liveness under the replacement writer lock. Optimized benchmark evidence: n=200 SQLite memory session p50=91us p99=253us; Argon2id m=19456KiB,t=2,p=1 verification=31ms. Command: cargo test --release -p infraternal-server http_csrf_cookie_flags_body_limit_and_latency_evidence -- --nocapture; output target/auth-release-bench.log. This measures host storage/CPU, not network/browser time. Running the required final gate after the hardening edits.

Defensive review finding: cookie sliding must refresh Max-Age on each successful cookie-authenticated HTTP action, rather than only updating SQLite expiry. Fixed in src/auth/http.rs with an HTTP wraps test. JSON parsing errors are redacted to prevent caller logs echoing submitted strings; cancellation rechecks session liveness under the replacement writer lock. Optimized benchmark evidence: n=200 SQLite memory session p50=91us p99=253us; Argon2id m=19456KiB,t=2,p=1 verification=31ms. Command: cargo test --release -p infraternal-server http_csrf_cookie_flags_body_limit_and_latency_evidence -- --nocapture; output target/auth-release-bench.log. This measures host storage/CPU, not network/browser time. Running the required final gate after the hardening edits.
kayg commented 2026-10-06 10:32:17 +00:00
Author
Owner
Copy link

Finished auth library lane on branch lane-auth.
Head: a06368f538aa99e4e78caf4634e9f93e8db9b9eb
Base: 386acfd3dc

Auth core, axum HTTP handlers, SQLite migration and contracts/keywrap.md are committed atomically. Nine defensive software-authenticator/storage/HTTP tests pass. PRF is tested with a client double; real browser interoperability and linking the auth library into the running server remain the integration lanes' work. No UI was changed. Working tree is clean. No push/deploy performed; issue remains open.

Optimized local evidence: SQLite memory session n=200 p50=91us/p99=253us; Argon2id verification=31ms (m=19456KiB,t=2,p=1). Full review, scope and gate transcript: docs/verification/auth.md.

Required gate: nix shell nixpkgs#binutils nixpkgs#file -c scripts/verify fast
Exit status: 0. Gate output follows verbatim:


==> fmt

==> clippy
    Checking infraternal-server v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/lane-auth/crates/infraternal-server)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.18s

==> test
   Compiling infraternal-server v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/lane-auth/crates/infraternal-server)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 3.85s
     Running unittests src/main.rs (target/debug/deps/infraternal-e0018840803b77bb)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de)

running 9 tests
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.27s

     Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_agent

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_api

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_ssh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_protocol

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_server

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_shim

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s


==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1
   │  
20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ base64 v0.21.7
     ├── base64urlsafedata v0.5.5
     │   ├── webauthn-attestation-ca v0.5.5
     │   │   └── webauthn-rs-core v0.5.5
     │   │       └── webauthn-rs v0.5.5
     │   │           └── infraternal-server v0.1.0
     │   ├── webauthn-rs v0.5.5 (*)
     │   ├── webauthn-rs-core v0.5.5 (*)
     │   └── webauthn-rs-proto v0.5.5
     │       └── webauthn-rs-core v0.5.5 (*)
     ├── webauthn-rs-core v0.5.5 (*)
     └── webauthn-rs-proto v0.5.5 (*)
   ├ base64 v0.22.1
     ├── infraternal-server v0.1.0
     └── sqlx-core v0.8.6
         ├── sqlx v0.8.6
         │   └── infraternal-server v0.1.0 (*)
         ├── sqlx-macros v0.8.6
         │   └── sqlx v0.8.6 (*)
         ├── sqlx-macros-core v0.8.6
         │   └── sqlx-macros v0.8.6 (*)
         └── sqlx-sqlite v0.8.6
             ├── sqlx v0.8.6 (*)
             └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1
   │  
70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
   │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ getrandom v0.2.17
     └── rand_core v0.6.4
         ├── bip39 v2.2.2
         │   └── infraternal-server v0.1.0
         ├── crypto-common v0.1.7
         │   ├── aead v0.5.2
         │   │   └── aes-gcm v0.10.3
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   ├── cipher v0.4.4
         │   │   ├── aes v0.8.4
         │   │   │   └── aes-gcm v0.10.3 (*)
         │   │   ├── aes-gcm v0.10.3 (*)
         │   │   └── ctr v0.9.2
         │   │       └── aes-gcm v0.10.3 (*)
         │   ├── digest v0.10.7
         │   │   ├── blake2 v0.10.6
         │   │   │   └── argon2 v0.5.3
         │   │   │       └── infraternal-server v0.1.0 (*)
         │   │   ├── hmac v0.12.1
         │   │   │   └── hkdf v0.12.4
         │   │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   │   └── sha2 v0.10.9
         │   │       ├── infraternal-server v0.1.0 (*)
         │   │       ├── sqlx-core v0.8.6
         │   │       │   ├── sqlx v0.8.6
         │   │       │   │   └── infraternal-server v0.1.0 (*)
         │   │       │   ├── sqlx-macros v0.8.6
         │   │       │   │   └── sqlx v0.8.6 (*)
         │   │       │   ├── sqlx-macros-core v0.8.6
         │   │       │   │   └── sqlx-macros v0.8.6 (*)
         │   │       │   └── sqlx-sqlite v0.8.6
         │   │       │       ├── sqlx v0.8.6 (*)
         │   │       │       └── sqlx-macros-core v0.8.6 (*)
         │   │       └── sqlx-macros-core v0.8.6 (*)
         │   └── universal-hash v0.5.1
         │       └── polyval v0.6.2
         │           └── ghash v0.5.1
         │               └── aes-gcm v0.10.3 (*)
         ├── password-hash v0.5.0
         │   └── argon2 v0.5.3 (*)
         ├── rand v0.8.8
         │   └── bip39 v2.2.2 (*)
         └── rand_chacha v0.3.1
             └── rand v0.8.8 (*)
   ├ getrandom v0.3.4
     └── rand_core v0.9.5
         ├── rand v0.9.5
         │   ├── infraternal-server v0.1.0
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         └── rand_chacha v0.9.0
             ├── rand v0.9.5 (*)
             └── webauthn-rs-core v0.5.5 (*)
   ├ getrandom v0.4.3
     └── uuid v1.27.0
         ├── infraternal-server v0.1.0
         ├── webauthn-attestation-ca v0.5.5
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         ├── webauthn-rs v0.5.5 (*)
         └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1
   │  
75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ hashbrown v0.15.5
     ├── hashlink v0.10.0
     │   └── sqlx-core v0.8.6
     │       ├── sqlx v0.8.6
     │       │   └── infraternal-server v0.1.0
     │       ├── sqlx-macros v0.8.6
     │       │   └── sqlx v0.8.6 (*)
     │       ├── sqlx-macros-core v0.8.6
     │       │   └── sqlx-macros v0.8.6 (*)
     │       └── sqlx-sqlite v0.8.6
     │           ├── sqlx v0.8.6 (*)
     │           └── sqlx-macros-core v0.8.6 (*)
     └── sqlx-core v0.8.6 (*)
   ├ hashbrown v0.17.1
     └── indexmap v2.14.2
         └── sqlx-core v0.8.6
             ├── sqlx v0.8.6
             │   └── infraternal-server v0.1.0
             ├── sqlx-macros v0.8.6
             │   └── sqlx v0.8.6 (*)
             ├── sqlx-macros-core v0.8.6
             │   └── sqlx-macros v0.8.6 (*)
             └── sqlx-sqlite v0.8.6
                 ├── sqlx v0.8.6 (*)
                 └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1
    │  
148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ r-efi v5.3.0
      └── getrandom v0.3.4
          └── rand_core v0.9.5
              ├── rand v0.9.5
              │   ├── infraternal-server v0.1.0
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              └── rand_chacha v0.9.0
                  ├── rand v0.9.5 (*)
                  └── webauthn-rs-core v0.5.5 (*)
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          └── uuid v1.27.0
              ├── infraternal-server v0.1.0
              ├── webauthn-attestation-ca v0.5.5
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              ├── webauthn-rs v0.5.5 (*)
              └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1
    │  
150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand v0.8.8
      └── bip39 v2.2.2
          └── infraternal-server v0.1.0
    ├ rand v0.9.5
      ├── infraternal-server v0.1.0
      └── webauthn-rs-core v0.5.5
          └── webauthn-rs v0.5.5
              └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1
    │  
152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_chacha v0.3.1
      └── rand v0.8.8
          └── bip39 v2.2.2
              └── infraternal-server v0.1.0
    ├ rand_chacha v0.9.0
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_core'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1
    │  
154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_core v0.6.4
      ├── bip39 v2.2.2
      │   └── infraternal-server v0.1.0
      ├── crypto-common v0.1.7
      │   ├── aead v0.5.2
      │   │   └── aes-gcm v0.10.3
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   ├── cipher v0.4.4
      │   │   ├── aes v0.8.4
      │   │   │   └── aes-gcm v0.10.3 (*)
      │   │   ├── aes-gcm v0.10.3 (*)
      │   │   └── ctr v0.9.2
      │   │       └── aes-gcm v0.10.3 (*)
      │   ├── digest v0.10.7
      │   │   ├── blake2 v0.10.6
      │   │   │   └── argon2 v0.5.3
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── hmac v0.12.1
      │   │   │   └── hkdf v0.12.4
      │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   │   └── sha2 v0.10.9
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── sqlx-core v0.8.6
      │   │       │   ├── sqlx v0.8.6
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── sqlx-macros v0.8.6
      │   │       │   │   └── sqlx v0.8.6 (*)
      │   │       │   ├── sqlx-macros-core v0.8.6
      │   │       │   │   └── sqlx-macros v0.8.6 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6 (*)
      │   │       │       └── sqlx-macros-core v0.8.6 (*)
      │   │       └── sqlx-macros-core v0.8.6 (*)
      │   └── universal-hash v0.5.1
      │       └── polyval v0.6.2
      │           └── ghash v0.5.1
      │               └── aes-gcm v0.10.3 (*)
      ├── password-hash v0.5.0
      │   └── argon2 v0.5.3 (*)
      ├── rand v0.8.8
      │   └── bip39 v2.2.2 (*)
      └── rand_chacha v0.3.1
          └── rand v0.8.8 (*)
    ├ rand_core v0.9.5
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── rand_chacha v0.9.0
          ├── rand v0.9.5 (*)
          └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'syn'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1
    │  
181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ syn v2.0.119
      ├── asn1-rs-derive v0.5.1
      │   └── asn1-rs v0.6.2
      │       ├── der-parser v9.0.0
      │       │   ├── webauthn-rs-core v0.5.5
      │       │   │   └── webauthn-rs v0.5.5
      │       │   │       └── infraternal-server v0.1.0
      │       │   └── x509-parser v0.16.0
      │       │       └── webauthn-rs-core v0.5.5 (*)
      │       ├── oid-registry v0.7.1
      │       │   └── x509-parser v0.16.0 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── asn1-rs-impl v0.2.0
      │   └── asn1-rs v0.6.2 (*)
      ├── openssl-macros v0.1.1
      │   └── openssl v0.10.81
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5
      │       │   └── webauthn-rs-core v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── sqlx-macros v0.8.6
      │   └── sqlx v0.8.6
      │       └── infraternal-server v0.1.0 (*)
      ├── sqlx-macros-core v0.8.6
      │   └── sqlx-macros v0.8.6 (*)
      ├── synstructure v0.13.2
      │   └── asn1-rs-derive v0.5.1 (*)
      ├── thiserror-impl v1.0.69
      │   └── thiserror v1.0.69
      │       ├── asn1-rs v0.6.2 (*)
      │       ├── webauthn-rs-core v0.5.5 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── tracing-attributes v0.1.31
      │   └── tracing v0.1.44
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── axum-core v0.5.6
      │       │   └── axum v0.8.9 (*)
      │       ├── sqlx-core v0.8.6
      │       │   ├── sqlx v0.8.6 (*)
      │       │   ├── sqlx-macros v0.8.6 (*)
      │       │   ├── sqlx-macros-core v0.8.6 (*)
      │       │   └── sqlx-sqlite v0.8.6
      │       │       ├── sqlx v0.8.6 (*)
      │       │       └── sqlx-macros-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      └── zerocopy-derive v0.8.60
          └── zerocopy v0.8.60
              ├── half v2.7.1
              │   └── serde_cbor_2 v0.13.0
              │       ├── (dev) infraternal-server v0.1.0 (*)
              │       └── webauthn-rs-core v0.5.5 (*)
              └── ppv-lite86 v0.2.21
                  ├── rand_chacha v0.3.1
                  │   └── rand v0.8.8
                  │       └── bip39 v2.2.2
                  │           └── infraternal-server v0.1.0 (*)
                  └── rand_chacha v0.9.0
                      ├── rand v0.9.5
                      │   ├── infraternal-server v0.1.0 (*)
                      │   └── webauthn-rs-core v0.5.5 (*)
                      └── webauthn-rs-core v0.5.5 (*)
    ├ syn v3.0.6
      ├── clap_derive v4.6.7
      │   └── clap v4.6.7
      │       └── infraternal v0.1.0
      ├── displaydoc v0.2.7
      │   ├── asn1-rs v0.6.2
      │   │   ├── der-parser v9.0.0
      │   │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   │   └── webauthn-rs v0.5.5
      │   │   │   │       └── infraternal-server v0.1.0
      │   │   │   └── x509-parser v0.16.0
      │   │   │       └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── oid-registry v0.7.1
      │   │   │   └── x509-parser v0.16.0 (*)
      │   │   └── x509-parser v0.16.0 (*)
      │   ├── der-parser v9.0.0 (*)
      │   ├── icu_collections v2.3.0
      │   │   ├── icu_normalizer v2.3.0
      │   │   │   └── idna_adapter v1.2.2
      │   │   │       └── idna v1.1.0
      │   │   │           └── url v2.5.8
      │   │   │               ├── infraternal-server v0.1.0 (*)
      │   │   │               ├── sqlx-core v0.8.6
      │   │   │               │   ├── sqlx v0.8.6
      │   │   │               │   │   └── infraternal-server v0.1.0 (*)
      │   │   │               │   ├── sqlx-macros v0.8.6
      │   │   │               │   │   └── sqlx v0.8.6 (*)
      │   │   │               │   ├── sqlx-macros-core v0.8.6
      │   │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │   │   │               │   └── sqlx-sqlite v0.8.6
      │   │   │               │       ├── sqlx v0.8.6 (*)
      │   │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-sqlite v0.8.6 (*)
      │   │   │               ├── webauthn-rs v0.5.5 (*)
      │   │   │               ├── webauthn-rs-core v0.5.5 (*)
      │   │   │               └── webauthn-rs-proto v0.5.5
      │   │   │                   └── webauthn-rs-core v0.5.5 (*)
      │   │   └── icu_properties v2.3.0
      │   │       └── idna_adapter v1.2.2 (*)
      │   ├── icu_locale_core v2.3.0
      │   │   ├── icu_properties v2.3.0 (*)
      │   │   └── icu_provider v2.3.1
      │   │       ├── icu_normalizer v2.3.0 (*)
      │   │       └── icu_properties v2.3.0 (*)
      │   ├── icu_properties v2.3.0 (*)
      │   ├── icu_provider v2.3.1 (*)
      │   ├── tinystr v0.8.4
      │   │   └── icu_locale_core v2.3.0 (*)
      │   └── zerotrie v0.2.5
      │       ├── icu_properties v2.3.0 (*)
      │       └── icu_provider v2.3.1 (*)
      ├── serde_derive v1.0.229
      │   ├── serde v1.0.229
      │   │   ├── base64urlsafedata v0.5.5
      │   │   │   ├── webauthn-attestation-ca v0.5.5
      │   │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   │   ├── bip39 v2.2.2
      │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   ├── either v1.18.0
      │   │   │   ├── sqlx-core v0.8.6 (*)
      │   │   │   └── sqlx-macros-core v0.8.6 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   ├── serde_cbor_2 v0.13.0
      │   │   │   ├── (dev) infraternal-server v0.1.0 (*)
      │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── serde_urlencoded v0.7.1
      │   │   │   ├── axum v0.8.9
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   └── sqlx-sqlite v0.8.6 (*)
      │   │   ├── sqlx-core v0.8.6 (*)
      │   │   ├── sqlx-macros-core v0.8.6 (*)
      │   │   ├── sqlx-sqlite v0.8.6 (*)
      │   │   ├── url v2.5.8 (*)
      │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   └── url v2.5.8 (*)
      ├── synstructure v0.14.0
      │   ├── yoke-derive v0.8.4
      │   │   └── yoke v0.8.3
      │   │       ├── icu_collections v2.3.0 (*)
      │   │       ├── icu_provider v2.3.1 (*)
      │   │       ├── zerotrie v0.2.5 (*)
      │   │       └── zerovec v0.11.8
      │   │           ├── icu_collections v2.3.0 (*)
      │   │           ├── icu_locale_core v2.3.0 (*)
      │   │           ├── icu_normalizer v2.3.0 (*)
      │   │           ├── icu_properties v2.3.0 (*)
      │   │           ├── icu_provider v2.3.1 (*)
      │   │           ├── potential_utf v0.1.6
      │   │           │   └── icu_collections v2.3.0 (*)
      │   │           └── tinystr v0.8.4 (*)
      │   └── zerofrom-derive v0.1.8
      │       └── zerofrom v0.1.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── yoke v0.8.3 (*)
      │           ├── zerotrie v0.2.5 (*)
      │           └── zerovec v0.11.8 (*)
      ├── thiserror-impl v2.0.21
      │   └── thiserror v2.0.21
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       └── sqlx-sqlite v0.8.6 (*)
      ├── tokio-macros v2.7.2
      │   └── tokio v1.53.2
      │       ├── axum v0.8.9 (*)
      │       ├── hyper v1.11.1
      │       │   ├── axum v0.8.9 (*)
      │       │   └── hyper-util v0.1.21
      │       │       └── axum v0.8.9 (*)
      │       ├── hyper-util v0.1.21 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-macros-core v0.8.6 (*)
      │       ├── tokio-stream v0.1.19
      │       │   └── sqlx-core v0.8.6 (*)
      │       └── tower v0.5.3
      │           ├── axum v0.8.9 (*)
      │           └── (dev) infraternal-server v0.1.0 (*)
      ├── yoke-derive v0.8.4 (*)
      ├── zerofrom-derive v0.1.8 (*)
      └── zerovec-derive v0.11.6
          └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1
    │  
184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ synstructure v0.13.2
      └── asn1-rs-derive v0.5.1
          └── asn1-rs v0.6.2
              ├── der-parser v9.0.0
              │   ├── webauthn-rs-core v0.5.5
              │   │   └── webauthn-rs v0.5.5
              │   │       └── infraternal-server v0.1.0
              │   └── x509-parser v0.16.0
              │       └── webauthn-rs-core v0.5.5 (*)
              ├── oid-registry v0.7.1
              │   └── x509-parser v0.16.0 (*)
              └── x509-parser v0.16.0 (*)
    ├ synstructure v0.14.0
      ├── yoke-derive v0.8.4
      │   └── yoke v0.8.3
      │       ├── icu_collections v2.3.0
      │       │   ├── icu_normalizer v2.3.0
      │       │   │   └── idna_adapter v1.2.2
      │       │   │       └── idna v1.1.0
      │       │   │           └── url v2.5.8
      │       │   │               ├── infraternal-server v0.1.0
      │       │   │               ├── sqlx-core v0.8.6
      │       │   │               │   ├── sqlx v0.8.6
      │       │   │               │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   ├── sqlx-macros v0.8.6
      │       │   │               │   │   └── sqlx v0.8.6 (*)
      │       │   │               │   ├── sqlx-macros-core v0.8.6
      │       │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │       │   │               │   └── sqlx-sqlite v0.8.6
      │       │   │               │       ├── sqlx v0.8.6 (*)
      │       │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-sqlite v0.8.6 (*)
      │       │   │               ├── webauthn-rs v0.5.5
      │       │   │               │   └── infraternal-server v0.1.0 (*)
      │       │   │               ├── webauthn-rs-core v0.5.5
      │       │   │               │   └── webauthn-rs v0.5.5 (*)
      │       │   │               └── webauthn-rs-proto v0.5.5
      │       │   │                   └── webauthn-rs-core v0.5.5 (*)
      │       │   └── icu_properties v2.3.0
      │       │       └── idna_adapter v1.2.2 (*)
      │       ├── icu_provider v2.3.1
      │       │   ├── icu_normalizer v2.3.0 (*)
      │       │   └── icu_properties v2.3.0 (*)
      │       ├── zerotrie v0.2.5
      │       │   ├── icu_properties v2.3.0 (*)
      │       │   └── icu_provider v2.3.1 (*)
      │       └── zerovec v0.11.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_locale_core v2.3.0
      │           │   ├── icu_properties v2.3.0 (*)
      │           │   └── icu_provider v2.3.1 (*)
      │           ├── icu_normalizer v2.3.0 (*)
      │           ├── icu_properties v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── potential_utf v0.1.6
      │           │   └── icu_collections v2.3.0 (*)
      │           └── tinystr v0.8.4
      │               └── icu_locale_core v2.3.0 (*)
      └── zerofrom-derive v0.1.8
          └── zerofrom v0.1.8
              ├── icu_collections v2.3.0 (*)
              ├── icu_provider v2.3.1 (*)
              ├── yoke v0.8.3 (*)
              ├── zerotrie v0.2.5 (*)
              └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1
    │  
186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror v1.0.69
      ├── asn1-rs v0.6.2
      │   ├── der-parser v9.0.0
      │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   └── webauthn-rs v0.5.5
      │   │   │       └── infraternal-server v0.1.0
      │   │   └── x509-parser v0.16.0
      │   │       └── webauthn-rs-core v0.5.5 (*)
      │   ├── oid-registry v0.7.1
      │   │   └── x509-parser v0.16.0 (*)
      │   └── x509-parser v0.16.0 (*)
      ├── webauthn-rs-core v0.5.5 (*)
      └── x509-parser v0.16.0 (*)
    ├ thiserror v2.0.21
      ├── infraternal-server v0.1.0
      ├── sqlx-core v0.8.6
      │   ├── sqlx v0.8.6
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── sqlx-macros v0.8.6
      │   │   └── sqlx v0.8.6 (*)
      │   ├── sqlx-macros-core v0.8.6
      │   │   └── sqlx-macros v0.8.6 (*)
      │   └── sqlx-sqlite v0.8.6
      │       ├── sqlx v0.8.6 (*)
      │       └── sqlx-macros-core v0.8.6 (*)
      └── sqlx-sqlite v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1
    │  
188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror-impl v1.0.69
      └── thiserror v1.0.69
          ├── asn1-rs v0.6.2
          │   ├── der-parser v9.0.0
          │   │   ├── webauthn-rs-core v0.5.5
          │   │   │   └── webauthn-rs v0.5.5
          │   │   │       └── infraternal-server v0.1.0
          │   │   └── x509-parser v0.16.0
          │   │       └── webauthn-rs-core v0.5.5 (*)
          │   ├── oid-registry v0.7.1
          │   │   └── x509-parser v0.16.0 (*)
          │   └── x509-parser v0.16.0 (*)
          ├── webauthn-rs-core v0.5.5 (*)
          └── x509-parser v0.16.0 (*)
    ├ thiserror-impl v2.0.21
      └── thiserror v2.0.21
          ├── infraternal-server v0.1.0
          ├── sqlx-core v0.8.6
          │   ├── sqlx v0.8.6
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── sqlx-macros v0.8.6
          │   │   └── sqlx v0.8.6 (*)
          │   ├── sqlx-macros-core v0.8.6
          │   │   └── sqlx-macros v0.8.6 (*)
          │   └── sqlx-sqlite v0.8.6
          │       ├── sqlx v0.8.6 (*)
          │       └── sqlx-macros-core v0.8.6 (*)
          └── sqlx-sqlite v0.8.6 (*)

advisories ok, bans ok, licenses ok, sources ok

==> static builds
    Finished `release` profile [optimized] target(s) in 0.08s
target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 705624 bytes
    Finished `release` profile [optimized] target(s) in 0.06s
target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 607880 bytes
server subcommand: exit 2, not implemented
agent subcommand: exit 2, not implemented

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
Finished auth library lane on branch lane-auth. Head: a06368f538aa99e4e78caf4634e9f93e8db9b9eb Base: 386acfd3dc6255c7f58f98b4f114d5d7326292ad Auth core, axum HTTP handlers, SQLite migration and contracts/keywrap.md are committed atomically. Nine defensive software-authenticator/storage/HTTP tests pass. PRF is tested with a client double; real browser interoperability and linking the auth library into the running server remain the integration lanes' work. No UI was changed. Working tree is clean. No push/deploy performed; issue remains open. Optimized local evidence: SQLite memory session n=200 p50=91us/p99=253us; Argon2id verification=31ms (m=19456KiB,t=2,p=1). Full review, scope and gate transcript: docs/verification/auth.md. Required gate: nix shell nixpkgs#binutils nixpkgs#file -c scripts/verify fast Exit status: 0. Gate output follows verbatim: ```text ==> fmt ==> clippy Checking infraternal-server v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/lane-auth/crates/infraternal-server) Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.18s ==> test Compiling infraternal-server v0.1.0 (/home/kayg/Developer/infraternal/.worktrees/lane-auth/crates/infraternal-server) Finished `test` profile [unoptimized + debuginfo] target(s) in 3.85s Running unittests src/main.rs (target/debug/deps/infraternal-e0018840803b77bb) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de) running 9 tests test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.27s Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_agent running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_api running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_ssh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_protocol running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_server running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_shim running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ==> cargo-deny warning[duplicate]: found 2 duplicate entries for crate 'base64' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1 │ 20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index 21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────┘ lock entries │ ├ base64 v0.21.7 ├── base64urlsafedata v0.5.5 │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ ├── webauthn-rs v0.5.5 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-proto v0.5.5 │ └── webauthn-rs-core v0.5.5 (*) ├── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-proto v0.5.5 (*) ├ base64 v0.22.1 ├── infraternal-server v0.1.0 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 3 duplicate entries for crate 'getrandom' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1 │ 70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index 71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index 72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ getrandom v0.2.17 └── rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'hashbrown' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1 │ 75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index 76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ hashbrown v0.15.5 ├── hashlink v0.10.0 │ └── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ └── infraternal-server v0.1.0 │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-core v0.8.6 (*) ├ hashbrown v0.17.1 └── indexmap v2.14.2 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ └── infraternal-server v0.1.0 ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'r-efi' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1 │ 148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index 149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ r-efi v5.3.0 └── getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ r-efi v6.0.0 └── getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1 │ 150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index 151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 ├ rand v0.9.5 ├── infraternal-server v0.1.0 └── webauthn-rs-core v0.5.5 └── webauthn-rs v0.5.5 └── infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1 │ 152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index 153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_chacha v0.3.1 └── rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 ├ rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_core' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1 │ 154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index 155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'syn' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1 │ 181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index 182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────┘ lock entries │ ├ syn v2.0.119 ├── asn1-rs-derive v0.5.1 │ └── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── asn1-rs-impl v0.2.0 │ └── asn1-rs v0.6.2 (*) ├── openssl-macros v0.1.1 │ └── openssl v0.10.81 │ ├── infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) ├── synstructure v0.13.2 │ └── asn1-rs-derive v0.5.1 (*) ├── thiserror-impl v1.0.69 │ └── thiserror v1.0.69 │ ├── asn1-rs v0.6.2 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── x509-parser v0.16.0 (*) ├── tracing-attributes v0.1.31 │ └── tracing v0.1.44 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-core v0.5.6 │ │ └── axum v0.8.9 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ ├── sqlx-macros v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) └── zerocopy-derive v0.8.60 └── zerocopy v0.8.60 ├── half v2.7.1 │ └── serde_cbor_2 v0.13.0 │ ├── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── ppv-lite86 v0.2.21 ├── rand_chacha v0.3.1 │ └── rand v0.8.8 │ └── bip39 v2.2.2 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ syn v3.0.6 ├── clap_derive v4.6.7 │ └── clap v4.6.7 │ └── infraternal v0.1.0 ├── displaydoc v0.2.7 │ ├── asn1-rs v0.6.2 │ │ ├── der-parser v9.0.0 │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 │ │ │ └── x509-parser v0.16.0 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── oid-registry v0.7.1 │ │ │ └── x509-parser v0.16.0 (*) │ │ └── x509-parser v0.16.0 (*) │ ├── der-parser v9.0.0 (*) │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── tinystr v0.8.4 │ │ └── icu_locale_core v2.3.0 (*) │ └── zerotrie v0.2.5 │ ├── icu_properties v2.3.0 (*) │ └── icu_provider v2.3.1 (*) ├── serde_derive v1.0.229 │ ├── serde v1.0.229 │ │ ├── base64urlsafedata v0.5.5 │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 (*) │ │ ├── bip39 v2.2.2 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── either v1.18.0 │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── serde_cbor_2 v0.13.0 │ │ │ ├── (dev) infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── serde_urlencoded v0.7.1 │ │ │ ├── axum v0.8.9 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ ├── sqlx-core v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ ├── url v2.5.8 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ ├── webauthn-rs v0.5.5 (*) │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ └── webauthn-rs-proto v0.5.5 (*) │ └── url v2.5.8 (*) ├── synstructure v0.14.0 │ ├── yoke-derive v0.8.4 │ │ └── yoke v0.8.3 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── zerotrie v0.2.5 (*) │ │ └── zerovec v0.11.8 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_locale_core v2.3.0 (*) │ │ ├── icu_normalizer v2.3.0 (*) │ │ ├── icu_properties v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── potential_utf v0.1.6 │ │ │ └── icu_collections v2.3.0 (*) │ │ └── tinystr v0.8.4 (*) │ └── zerofrom-derive v0.1.8 │ └── zerofrom v0.1.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── yoke v0.8.3 (*) │ ├── zerotrie v0.2.5 (*) │ └── zerovec v0.11.8 (*) ├── thiserror-impl v2.0.21 │ └── thiserror v2.0.21 │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 (*) ├── tokio-macros v2.7.2 │ └── tokio v1.53.2 │ ├── axum v0.8.9 (*) │ ├── hyper v1.11.1 │ │ ├── axum v0.8.9 (*) │ │ └── hyper-util v0.1.21 │ │ └── axum v0.8.9 (*) │ ├── hyper-util v0.1.21 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ └── tower v0.5.3 │ ├── axum v0.8.9 (*) │ └── (dev) infraternal-server v0.1.0 (*) ├── yoke-derive v0.8.4 (*) ├── zerofrom-derive v0.1.8 (*) └── zerovec-derive v0.11.6 └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'synstructure' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1 │ 184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index 185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ synstructure v0.13.2 └── asn1-rs-derive v0.5.1 └── asn1-rs v0.6.2 ├── der-parser v9.0.0 │ ├── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ └── x509-parser v0.16.0 │ └── webauthn-rs-core v0.5.5 (*) ├── oid-registry v0.7.1 │ └── x509-parser v0.16.0 (*) └── x509-parser v0.16.0 (*) ├ synstructure v0.14.0 ├── yoke-derive v0.8.4 │ └── yoke v0.8.3 │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── zerotrie v0.2.5 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ └── zerovec v0.11.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ ├── icu_normalizer v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── potential_utf v0.1.6 │ │ └── icu_collections v2.3.0 (*) │ └── tinystr v0.8.4 │ └── icu_locale_core v2.3.0 (*) └── zerofrom-derive v0.1.8 └── zerofrom v0.1.8 ├── icu_collections v2.3.0 (*) ├── icu_provider v2.3.1 (*) ├── yoke v0.8.3 (*) ├── zerotrie v0.2.5 (*) └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1 │ 186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index 187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror v2.0.21 ├── infraternal-server v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1 │ 188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index 189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror-impl v1.0.69 └── thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror-impl v2.0.21 └── thiserror v2.0.21 ├── infraternal-server v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) advisories ok, bans ok, licenses ok, sources ok ==> static builds Finished `release` profile [optimized] target(s) in 0.08s target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 705624 bytes Finished `release` profile [optimized] target(s) in 0.06s target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 607880 bytes server subcommand: exit 2, not implemented agent subcommand: exit 2, not implemented +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ```
kayg commented 2026-10-06 10:33:15 +00:00
Author
Owner
Copy link

Independent defensive review started in lane-auth; base s1-base and head a06368f. Read-only code review against decisions 23–29, 40, 53 and keywrap/plugin contracts. Findings and gate evidence will follow.

Independent defensive review started in lane-auth; base s1-base and head a06368f. Read-only code review against decisions 23–29, 40, 53 and keywrap/plugin contracts. Findings and gate evidence will follow.
kayg commented 2026-10-06 10:36:09 +00:00
Author
Owner
Copy link

Review findings at a06368f: BLOCKER recovery_start (auth/mod.rs:509–518) verifies a hash before an unguarded INSERT. Isolated unchanged-source race test returns success after recovery hash rotation, expected denial (0 passed / 1 failed, 2.33s). Old words can authorize a replacement after the new 24h delay; arbitrary valid-length wraps suffice for server identity replacement. BLOCKER static row builds clap-only CLI: actual aarch64 auth library build fails in vendored OpenSSL with aarch64-linux-musl-gcc missing even after supplying existing make. BLOCKER history is one commit for 5583 insertions across dependencies/schema/contracts/auth/HTTP/tests/docs, violating owner atomic-history rule. Evidence: /home/kayg/.local/state/codex-jobs/infraternal/review-auth/findings.md and adjacent logs. No tracked code edited.

Review findings at a06368f: BLOCKER recovery_start (auth/mod.rs:509–518) verifies a hash before an unguarded INSERT. Isolated unchanged-source race test returns success after recovery hash rotation, expected denial (0 passed / 1 failed, 2.33s). Old words can authorize a replacement after the new 24h delay; arbitrary valid-length wraps suffice for server identity replacement. BLOCKER static row builds clap-only CLI: actual aarch64 auth library build fails in vendored OpenSSL with aarch64-linux-musl-gcc missing even after supplying existing make. BLOCKER history is one commit for 5583 insertions across dependencies/schema/contracts/auth/HTTP/tests/docs, violating owner atomic-history rule. Evidence: /home/kayg/.local/state/codex-jobs/infraternal/review-auth/findings.md and adjacent logs. No tracked code edited.
kayg commented 2026-10-06 10:38:29 +00:00
Author
Owner
Copy link

Further evidence: BOTH actual auth musl builds fail after supplying existing make: x86_64-linux-musl-gcc and aarch64-linux-musl-gcc missing (auth-x86-with-make.log / auth-aarch64-with-make.log). Static gate scaffold sizes vs rebuilt s1-base: x86 705624 -> 705624 bytes; arm64 607880 -> 607880 bytes, delta 0; these omit auth and cannot measure its overhead. SHOULD-FIX http.rs:268–288: 120 invalid no-Origin device-redeem requests consume the shared budget; following valid owner login-start returns 401 instead of 200. Isolated test fails (0 passed / 1 failed, 0.58s). Browser PRF/resident/native WebCrypto integration has only Rust doubles, no Playwright evidence (decision 40). auth/mod.rs has 842 lines spanning multiple responsibilities; proposed module and atomic-commit splits are in findings.md. Independent optimized n=200 SQLite-memory session p50/p99=75/196us; Argon2id m=19456KiB,t=2,p=1 measured 21ms.

Further evidence: BOTH actual auth musl builds fail after supplying existing make: x86_64-linux-musl-gcc and aarch64-linux-musl-gcc missing (auth-x86-with-make.log / auth-aarch64-with-make.log). Static gate scaffold sizes vs rebuilt s1-base: x86 705624 -> 705624 bytes; arm64 607880 -> 607880 bytes, delta 0; these omit auth and cannot measure its overhead. SHOULD-FIX http.rs:268–288: 120 invalid no-Origin device-redeem requests consume the shared budget; following valid owner login-start returns 401 instead of 200. Isolated test fails (0 passed / 1 failed, 0.58s). Browser PRF/resident/native WebCrypto integration has only Rust doubles, no Playwright evidence (decision 40). auth/mod.rs has 842 lines spanning multiple responsibilities; proposed module and atomic-commit splits are in findings.md. Independent optimized n=200 SQLite-memory session p50/p99=75/196us; Argon2id m=19456KiB,t=2,p=1 measured 21ms.
kayg commented 2026-10-06 10:38:49 +00:00
Author
Owner
Copy link

Independent defensive review finished. Verdict: REWORK.
Head: a06368f538aa99e4e78caf4634e9f93e8db9b9eb; base: 386acfd3dc.
Blockers:

  1. auth/mod.rs:509–518: old recovery words can authorize an in-flight request after rotation; isolated unchanged-source regression fails. Recheck verified hash/version under writer lock before insertion.
  2. Static gate compiles clap-only CLI. Actual auth library builds fail for BOTH musl targets (missing target C compilers); require reproducible auth-linked builds, PT_INTERP checks and binary-size comparison. Current scaffold delta is 0 bytes and says nothing about auth overhead.
  3. One commit contains dependencies/schema/contracts/modules/HTTP/tests/docs (5583 insertions), violating owner history rule. Split into gateable logical commits as proposed in report.
    Should-fix: shared global budget permits 120 unauthenticated invalid device polls to deny legitimate browser login; real-browser PRF/resident/WebCrypto evidence missing. Module split recommended for 842-line auth/mod.rs.
    Report: /home/kayg/.local/state/codex-jobs/infraternal/review-auth/findings.md; adjacent logs and review-probes.rs preserve evidence.
    Read-only tracked code review: no code modifications, commits, push, deploy or issue closure. git status --short empty.
    Required scripts/verify fast exited 0 (scaffold-static limitation above). Verbatim output follows:

==> fmt

==> clippy
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.17s

==> test
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s
     Running unittests src/main.rs (target/debug/deps/infraternal-e0018840803b77bb)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de)

running 9 tests
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok

test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_agent

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_api

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_ssh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_protocol

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_server

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_shim

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s


==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1
   │  
20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ base64 v0.21.7
     ├── base64urlsafedata v0.5.5
     │   ├── webauthn-attestation-ca v0.5.5
     │   │   └── webauthn-rs-core v0.5.5
     │   │       └── webauthn-rs v0.5.5
     │   │           └── infraternal-server v0.1.0
     │   ├── webauthn-rs v0.5.5 (*)
     │   ├── webauthn-rs-core v0.5.5 (*)
     │   └── webauthn-rs-proto v0.5.5
     │       └── webauthn-rs-core v0.5.5 (*)
     ├── webauthn-rs-core v0.5.5 (*)
     └── webauthn-rs-proto v0.5.5 (*)
   ├ base64 v0.22.1
     ├── infraternal-server v0.1.0
     └── sqlx-core v0.8.6
         ├── sqlx v0.8.6
         │   └── infraternal-server v0.1.0 (*)
         ├── sqlx-macros v0.8.6
         │   └── sqlx v0.8.6 (*)
         ├── sqlx-macros-core v0.8.6
         │   └── sqlx-macros v0.8.6 (*)
         └── sqlx-sqlite v0.8.6
             ├── sqlx v0.8.6 (*)
             └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1
   │  
70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
   │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ getrandom v0.2.17
     └── rand_core v0.6.4
         ├── bip39 v2.2.2
         │   └── infraternal-server v0.1.0
         ├── crypto-common v0.1.7
         │   ├── aead v0.5.2
         │   │   └── aes-gcm v0.10.3
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   ├── cipher v0.4.4
         │   │   ├── aes v0.8.4
         │   │   │   └── aes-gcm v0.10.3 (*)
         │   │   ├── aes-gcm v0.10.3 (*)
         │   │   └── ctr v0.9.2
         │   │       └── aes-gcm v0.10.3 (*)
         │   ├── digest v0.10.7
         │   │   ├── blake2 v0.10.6
         │   │   │   └── argon2 v0.5.3
         │   │   │       └── infraternal-server v0.1.0 (*)
         │   │   ├── hmac v0.12.1
         │   │   │   └── hkdf v0.12.4
         │   │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   │   └── sha2 v0.10.9
         │   │       ├── infraternal-server v0.1.0 (*)
         │   │       ├── sqlx-core v0.8.6
         │   │       │   ├── sqlx v0.8.6
         │   │       │   │   └── infraternal-server v0.1.0 (*)
         │   │       │   ├── sqlx-macros v0.8.6
         │   │       │   │   └── sqlx v0.8.6 (*)
         │   │       │   ├── sqlx-macros-core v0.8.6
         │   │       │   │   └── sqlx-macros v0.8.6 (*)
         │   │       │   └── sqlx-sqlite v0.8.6
         │   │       │       ├── sqlx v0.8.6 (*)
         │   │       │       └── sqlx-macros-core v0.8.6 (*)
         │   │       └── sqlx-macros-core v0.8.6 (*)
         │   └── universal-hash v0.5.1
         │       └── polyval v0.6.2
         │           └── ghash v0.5.1
         │               └── aes-gcm v0.10.3 (*)
         ├── password-hash v0.5.0
         │   └── argon2 v0.5.3 (*)
         ├── rand v0.8.8
         │   └── bip39 v2.2.2 (*)
         └── rand_chacha v0.3.1
             └── rand v0.8.8 (*)
   ├ getrandom v0.3.4
     └── rand_core v0.9.5
         ├── rand v0.9.5
         │   ├── infraternal-server v0.1.0
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         └── rand_chacha v0.9.0
             ├── rand v0.9.5 (*)
             └── webauthn-rs-core v0.5.5 (*)
   ├ getrandom v0.4.3
     └── uuid v1.27.0
         ├── infraternal-server v0.1.0
         ├── webauthn-attestation-ca v0.5.5
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         ├── webauthn-rs v0.5.5 (*)
         └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1
   │  
75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ hashbrown v0.15.5
     ├── hashlink v0.10.0
     │   └── sqlx-core v0.8.6
     │       ├── sqlx v0.8.6
     │       │   └── infraternal-server v0.1.0
     │       ├── sqlx-macros v0.8.6
     │       │   └── sqlx v0.8.6 (*)
     │       ├── sqlx-macros-core v0.8.6
     │       │   └── sqlx-macros v0.8.6 (*)
     │       └── sqlx-sqlite v0.8.6
     │           ├── sqlx v0.8.6 (*)
     │           └── sqlx-macros-core v0.8.6 (*)
     └── sqlx-core v0.8.6 (*)
   ├ hashbrown v0.17.1
     └── indexmap v2.14.2
         └── sqlx-core v0.8.6
             ├── sqlx v0.8.6
             │   └── infraternal-server v0.1.0
             ├── sqlx-macros v0.8.6
             │   └── sqlx v0.8.6 (*)
             ├── sqlx-macros-core v0.8.6
             │   └── sqlx-macros v0.8.6 (*)
             └── sqlx-sqlite v0.8.6
                 ├── sqlx v0.8.6 (*)
                 └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1
    │  
148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ r-efi v5.3.0
      └── getrandom v0.3.4
          └── rand_core v0.9.5
              ├── rand v0.9.5
              │   ├── infraternal-server v0.1.0
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              └── rand_chacha v0.9.0
                  ├── rand v0.9.5 (*)
                  └── webauthn-rs-core v0.5.5 (*)
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          └── uuid v1.27.0
              ├── infraternal-server v0.1.0
              ├── webauthn-attestation-ca v0.5.5
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              ├── webauthn-rs v0.5.5 (*)
              └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1
    │  
150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand v0.8.8
      └── bip39 v2.2.2
          └── infraternal-server v0.1.0
    ├ rand v0.9.5
      ├── infraternal-server v0.1.0
      └── webauthn-rs-core v0.5.5
          └── webauthn-rs v0.5.5
              └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1
    │  
152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_chacha v0.3.1
      └── rand v0.8.8
          └── bip39 v2.2.2
              └── infraternal-server v0.1.0
    ├ rand_chacha v0.9.0
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_core'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1
    │  
154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_core v0.6.4
      ├── bip39 v2.2.2
      │   └── infraternal-server v0.1.0
      ├── crypto-common v0.1.7
      │   ├── aead v0.5.2
      │   │   └── aes-gcm v0.10.3
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   ├── cipher v0.4.4
      │   │   ├── aes v0.8.4
      │   │   │   └── aes-gcm v0.10.3 (*)
      │   │   ├── aes-gcm v0.10.3 (*)
      │   │   └── ctr v0.9.2
      │   │       └── aes-gcm v0.10.3 (*)
      │   ├── digest v0.10.7
      │   │   ├── blake2 v0.10.6
      │   │   │   └── argon2 v0.5.3
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── hmac v0.12.1
      │   │   │   └── hkdf v0.12.4
      │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   │   └── sha2 v0.10.9
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── sqlx-core v0.8.6
      │   │       │   ├── sqlx v0.8.6
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── sqlx-macros v0.8.6
      │   │       │   │   └── sqlx v0.8.6 (*)
      │   │       │   ├── sqlx-macros-core v0.8.6
      │   │       │   │   └── sqlx-macros v0.8.6 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6 (*)
      │   │       │       └── sqlx-macros-core v0.8.6 (*)
      │   │       └── sqlx-macros-core v0.8.6 (*)
      │   └── universal-hash v0.5.1
      │       └── polyval v0.6.2
      │           └── ghash v0.5.1
      │               └── aes-gcm v0.10.3 (*)
      ├── password-hash v0.5.0
      │   └── argon2 v0.5.3 (*)
      ├── rand v0.8.8
      │   └── bip39 v2.2.2 (*)
      └── rand_chacha v0.3.1
          └── rand v0.8.8 (*)
    ├ rand_core v0.9.5
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── rand_chacha v0.9.0
          ├── rand v0.9.5 (*)
          └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'syn'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1
    │  
181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ syn v2.0.119
      ├── asn1-rs-derive v0.5.1
      │   └── asn1-rs v0.6.2
      │       ├── der-parser v9.0.0
      │       │   ├── webauthn-rs-core v0.5.5
      │       │   │   └── webauthn-rs v0.5.5
      │       │   │       └── infraternal-server v0.1.0
      │       │   └── x509-parser v0.16.0
      │       │       └── webauthn-rs-core v0.5.5 (*)
      │       ├── oid-registry v0.7.1
      │       │   └── x509-parser v0.16.0 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── asn1-rs-impl v0.2.0
      │   └── asn1-rs v0.6.2 (*)
      ├── openssl-macros v0.1.1
      │   └── openssl v0.10.81
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5
      │       │   └── webauthn-rs-core v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── sqlx-macros v0.8.6
      │   └── sqlx v0.8.6
      │       └── infraternal-server v0.1.0 (*)
      ├── sqlx-macros-core v0.8.6
      │   └── sqlx-macros v0.8.6 (*)
      ├── synstructure v0.13.2
      │   └── asn1-rs-derive v0.5.1 (*)
      ├── thiserror-impl v1.0.69
      │   └── thiserror v1.0.69
      │       ├── asn1-rs v0.6.2 (*)
      │       ├── webauthn-rs-core v0.5.5 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── tracing-attributes v0.1.31
      │   └── tracing v0.1.44
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── axum-core v0.5.6
      │       │   └── axum v0.8.9 (*)
      │       ├── sqlx-core v0.8.6
      │       │   ├── sqlx v0.8.6 (*)
      │       │   ├── sqlx-macros v0.8.6 (*)
      │       │   ├── sqlx-macros-core v0.8.6 (*)
      │       │   └── sqlx-sqlite v0.8.6
      │       │       ├── sqlx v0.8.6 (*)
      │       │       └── sqlx-macros-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      └── zerocopy-derive v0.8.60
          └── zerocopy v0.8.60
              ├── half v2.7.1
              │   └── serde_cbor_2 v0.13.0
              │       ├── (dev) infraternal-server v0.1.0 (*)
              │       └── webauthn-rs-core v0.5.5 (*)
              └── ppv-lite86 v0.2.21
                  ├── rand_chacha v0.3.1
                  │   └── rand v0.8.8
                  │       └── bip39 v2.2.2
                  │           └── infraternal-server v0.1.0 (*)
                  └── rand_chacha v0.9.0
                      ├── rand v0.9.5
                      │   ├── infraternal-server v0.1.0 (*)
                      │   └── webauthn-rs-core v0.5.5 (*)
                      └── webauthn-rs-core v0.5.5 (*)
    ├ syn v3.0.6
      ├── clap_derive v4.6.7
      │   └── clap v4.6.7
      │       └── infraternal v0.1.0
      ├── displaydoc v0.2.7
      │   ├── asn1-rs v0.6.2
      │   │   ├── der-parser v9.0.0
      │   │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   │   └── webauthn-rs v0.5.5
      │   │   │   │       └── infraternal-server v0.1.0
      │   │   │   └── x509-parser v0.16.0
      │   │   │       └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── oid-registry v0.7.1
      │   │   │   └── x509-parser v0.16.0 (*)
      │   │   └── x509-parser v0.16.0 (*)
      │   ├── der-parser v9.0.0 (*)
      │   ├── icu_collections v2.3.0
      │   │   ├── icu_normalizer v2.3.0
      │   │   │   └── idna_adapter v1.2.2
      │   │   │       └── idna v1.1.0
      │   │   │           └── url v2.5.8
      │   │   │               ├── infraternal-server v0.1.0 (*)
      │   │   │               ├── sqlx-core v0.8.6
      │   │   │               │   ├── sqlx v0.8.6
      │   │   │               │   │   └── infraternal-server v0.1.0 (*)
      │   │   │               │   ├── sqlx-macros v0.8.6
      │   │   │               │   │   └── sqlx v0.8.6 (*)
      │   │   │               │   ├── sqlx-macros-core v0.8.6
      │   │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │   │   │               │   └── sqlx-sqlite v0.8.6
      │   │   │               │       ├── sqlx v0.8.6 (*)
      │   │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-sqlite v0.8.6 (*)
      │   │   │               ├── webauthn-rs v0.5.5 (*)
      │   │   │               ├── webauthn-rs-core v0.5.5 (*)
      │   │   │               └── webauthn-rs-proto v0.5.5
      │   │   │                   └── webauthn-rs-core v0.5.5 (*)
      │   │   └── icu_properties v2.3.0
      │   │       └── idna_adapter v1.2.2 (*)
      │   ├── icu_locale_core v2.3.0
      │   │   ├── icu_properties v2.3.0 (*)
      │   │   └── icu_provider v2.3.1
      │   │       ├── icu_normalizer v2.3.0 (*)
      │   │       └── icu_properties v2.3.0 (*)
      │   ├── icu_properties v2.3.0 (*)
      │   ├── icu_provider v2.3.1 (*)
      │   ├── tinystr v0.8.4
      │   │   └── icu_locale_core v2.3.0 (*)
      │   └── zerotrie v0.2.5
      │       ├── icu_properties v2.3.0 (*)
      │       └── icu_provider v2.3.1 (*)
      ├── serde_derive v1.0.229
      │   ├── serde v1.0.229
      │   │   ├── base64urlsafedata v0.5.5
      │   │   │   ├── webauthn-attestation-ca v0.5.5
      │   │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   │   ├── bip39 v2.2.2
      │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   ├── either v1.18.0
      │   │   │   ├── sqlx-core v0.8.6 (*)
      │   │   │   └── sqlx-macros-core v0.8.6 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   ├── serde_cbor_2 v0.13.0
      │   │   │   ├── (dev) infraternal-server v0.1.0 (*)
      │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── serde_urlencoded v0.7.1
      │   │   │   ├── axum v0.8.9
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   └── sqlx-sqlite v0.8.6 (*)
      │   │   ├── sqlx-core v0.8.6 (*)
      │   │   ├── sqlx-macros-core v0.8.6 (*)
      │   │   ├── sqlx-sqlite v0.8.6 (*)
      │   │   ├── url v2.5.8 (*)
      │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   └── url v2.5.8 (*)
      ├── synstructure v0.14.0
      │   ├── yoke-derive v0.8.4
      │   │   └── yoke v0.8.3
      │   │       ├── icu_collections v2.3.0 (*)
      │   │       ├── icu_provider v2.3.1 (*)
      │   │       ├── zerotrie v0.2.5 (*)
      │   │       └── zerovec v0.11.8
      │   │           ├── icu_collections v2.3.0 (*)
      │   │           ├── icu_locale_core v2.3.0 (*)
      │   │           ├── icu_normalizer v2.3.0 (*)
      │   │           ├── icu_properties v2.3.0 (*)
      │   │           ├── icu_provider v2.3.1 (*)
      │   │           ├── potential_utf v0.1.6
      │   │           │   └── icu_collections v2.3.0 (*)
      │   │           └── tinystr v0.8.4 (*)
      │   └── zerofrom-derive v0.1.8
      │       └── zerofrom v0.1.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── yoke v0.8.3 (*)
      │           ├── zerotrie v0.2.5 (*)
      │           └── zerovec v0.11.8 (*)
      ├── thiserror-impl v2.0.21
      │   └── thiserror v2.0.21
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       └── sqlx-sqlite v0.8.6 (*)
      ├── tokio-macros v2.7.2
      │   └── tokio v1.53.2
      │       ├── axum v0.8.9 (*)
      │       ├── hyper v1.11.1
      │       │   ├── axum v0.8.9 (*)
      │       │   └── hyper-util v0.1.21
      │       │       └── axum v0.8.9 (*)
      │       ├── hyper-util v0.1.21 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-macros-core v0.8.6 (*)
      │       ├── tokio-stream v0.1.19
      │       │   └── sqlx-core v0.8.6 (*)
      │       └── tower v0.5.3
      │           ├── axum v0.8.9 (*)
      │           └── (dev) infraternal-server v0.1.0 (*)
      ├── yoke-derive v0.8.4 (*)
      ├── zerofrom-derive v0.1.8 (*)
      └── zerovec-derive v0.11.6
          └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1
    │  
184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ synstructure v0.13.2
      └── asn1-rs-derive v0.5.1
          └── asn1-rs v0.6.2
              ├── der-parser v9.0.0
              │   ├── webauthn-rs-core v0.5.5
              │   │   └── webauthn-rs v0.5.5
              │   │       └── infraternal-server v0.1.0
              │   └── x509-parser v0.16.0
              │       └── webauthn-rs-core v0.5.5 (*)
              ├── oid-registry v0.7.1
              │   └── x509-parser v0.16.0 (*)
              └── x509-parser v0.16.0 (*)
    ├ synstructure v0.14.0
      ├── yoke-derive v0.8.4
      │   └── yoke v0.8.3
      │       ├── icu_collections v2.3.0
      │       │   ├── icu_normalizer v2.3.0
      │       │   │   └── idna_adapter v1.2.2
      │       │   │       └── idna v1.1.0
      │       │   │           └── url v2.5.8
      │       │   │               ├── infraternal-server v0.1.0
      │       │   │               ├── sqlx-core v0.8.6
      │       │   │               │   ├── sqlx v0.8.6
      │       │   │               │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   ├── sqlx-macros v0.8.6
      │       │   │               │   │   └── sqlx v0.8.6 (*)
      │       │   │               │   ├── sqlx-macros-core v0.8.6
      │       │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │       │   │               │   └── sqlx-sqlite v0.8.6
      │       │   │               │       ├── sqlx v0.8.6 (*)
      │       │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-sqlite v0.8.6 (*)
      │       │   │               ├── webauthn-rs v0.5.5
      │       │   │               │   └── infraternal-server v0.1.0 (*)
      │       │   │               ├── webauthn-rs-core v0.5.5
      │       │   │               │   └── webauthn-rs v0.5.5 (*)
      │       │   │               └── webauthn-rs-proto v0.5.5
      │       │   │                   └── webauthn-rs-core v0.5.5 (*)
      │       │   └── icu_properties v2.3.0
      │       │       └── idna_adapter v1.2.2 (*)
      │       ├── icu_provider v2.3.1
      │       │   ├── icu_normalizer v2.3.0 (*)
      │       │   └── icu_properties v2.3.0 (*)
      │       ├── zerotrie v0.2.5
      │       │   ├── icu_properties v2.3.0 (*)
      │       │   └── icu_provider v2.3.1 (*)
      │       └── zerovec v0.11.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_locale_core v2.3.0
      │           │   ├── icu_properties v2.3.0 (*)
      │           │   └── icu_provider v2.3.1 (*)
      │           ├── icu_normalizer v2.3.0 (*)
      │           ├── icu_properties v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── potential_utf v0.1.6
      │           │   └── icu_collections v2.3.0 (*)
      │           └── tinystr v0.8.4
      │               └── icu_locale_core v2.3.0 (*)
      └── zerofrom-derive v0.1.8
          └── zerofrom v0.1.8
              ├── icu_collections v2.3.0 (*)
              ├── icu_provider v2.3.1 (*)
              ├── yoke v0.8.3 (*)
              ├── zerotrie v0.2.5 (*)
              └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1
    │  
186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror v1.0.69
      ├── asn1-rs v0.6.2
      │   ├── der-parser v9.0.0
      │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   └── webauthn-rs v0.5.5
      │   │   │       └── infraternal-server v0.1.0
      │   │   └── x509-parser v0.16.0
      │   │       └── webauthn-rs-core v0.5.5 (*)
      │   ├── oid-registry v0.7.1
      │   │   └── x509-parser v0.16.0 (*)
      │   └── x509-parser v0.16.0 (*)
      ├── webauthn-rs-core v0.5.5 (*)
      └── x509-parser v0.16.0 (*)
    ├ thiserror v2.0.21
      ├── infraternal-server v0.1.0
      ├── sqlx-core v0.8.6
      │   ├── sqlx v0.8.6
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── sqlx-macros v0.8.6
      │   │   └── sqlx v0.8.6 (*)
      │   ├── sqlx-macros-core v0.8.6
      │   │   └── sqlx-macros v0.8.6 (*)
      │   └── sqlx-sqlite v0.8.6
      │       ├── sqlx v0.8.6 (*)
      │       └── sqlx-macros-core v0.8.6 (*)
      └── sqlx-sqlite v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1
    │  
188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror-impl v1.0.69
      └── thiserror v1.0.69
          ├── asn1-rs v0.6.2
          │   ├── der-parser v9.0.0
          │   │   ├── webauthn-rs-core v0.5.5
          │   │   │   └── webauthn-rs v0.5.5
          │   │   │       └── infraternal-server v0.1.0
          │   │   └── x509-parser v0.16.0
          │   │       └── webauthn-rs-core v0.5.5 (*)
          │   ├── oid-registry v0.7.1
          │   │   └── x509-parser v0.16.0 (*)
          │   └── x509-parser v0.16.0 (*)
          ├── webauthn-rs-core v0.5.5 (*)
          └── x509-parser v0.16.0 (*)
    ├ thiserror-impl v2.0.21
      └── thiserror v2.0.21
          ├── infraternal-server v0.1.0
          ├── sqlx-core v0.8.6
          │   ├── sqlx v0.8.6
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── sqlx-macros v0.8.6
          │   │   └── sqlx v0.8.6 (*)
          │   ├── sqlx-macros-core v0.8.6
          │   │   └── sqlx-macros v0.8.6 (*)
          │   └── sqlx-sqlite v0.8.6
          │       ├── sqlx v0.8.6 (*)
          │       └── sqlx-macros-core v0.8.6 (*)
          └── sqlx-sqlite v0.8.6 (*)

advisories ok, bans ok, licenses ok, sources ok

==> static builds
    Finished `release` profile [optimized] target(s) in 0.06s
target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 705624 bytes
    Finished `release` profile [optimized] target(s) in 0.06s
target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 607880 bytes
server subcommand: exit 2, not implemented
agent subcommand: exit 2, not implemented

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
Independent defensive review finished. Verdict: REWORK. Head: a06368f538aa99e4e78caf4634e9f93e8db9b9eb; base: 386acfd3dc6255c7f58f98b4f114d5d7326292ad. Blockers: 1. auth/mod.rs:509–518: old recovery words can authorize an in-flight request after rotation; isolated unchanged-source regression fails. Recheck verified hash/version under writer lock before insertion. 2. Static gate compiles clap-only CLI. Actual auth library builds fail for BOTH musl targets (missing target C compilers); require reproducible auth-linked builds, PT_INTERP checks and binary-size comparison. Current scaffold delta is 0 bytes and says nothing about auth overhead. 3. One commit contains dependencies/schema/contracts/modules/HTTP/tests/docs (5583 insertions), violating owner history rule. Split into gateable logical commits as proposed in report. Should-fix: shared global budget permits 120 unauthenticated invalid device polls to deny legitimate browser login; real-browser PRF/resident/WebCrypto evidence missing. Module split recommended for 842-line auth/mod.rs. Report: /home/kayg/.local/state/codex-jobs/infraternal/review-auth/findings.md; adjacent logs and review-probes.rs preserve evidence. Read-only tracked code review: no code modifications, commits, push, deploy or issue closure. git status --short empty. Required scripts/verify fast exited 0 (scaffold-static limitation above). Verbatim output follows: ```text ==> fmt ==> clippy Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.17s ==> test Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s Running unittests src/main.rs (target/debug/deps/infraternal-e0018840803b77bb) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de) running 9 tests test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok test result: ok. 9 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.00s Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_agent running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_api running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_ssh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_protocol running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_server running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_shim running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ==> cargo-deny warning[duplicate]: found 2 duplicate entries for crate 'base64' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1 │ 20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index 21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────┘ lock entries │ ├ base64 v0.21.7 ├── base64urlsafedata v0.5.5 │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ ├── webauthn-rs v0.5.5 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-proto v0.5.5 │ └── webauthn-rs-core v0.5.5 (*) ├── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-proto v0.5.5 (*) ├ base64 v0.22.1 ├── infraternal-server v0.1.0 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 3 duplicate entries for crate 'getrandom' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1 │ 70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index 71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index 72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ getrandom v0.2.17 └── rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'hashbrown' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1 │ 75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index 76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ hashbrown v0.15.5 ├── hashlink v0.10.0 │ └── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ └── infraternal-server v0.1.0 │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-core v0.8.6 (*) ├ hashbrown v0.17.1 └── indexmap v2.14.2 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ └── infraternal-server v0.1.0 ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'r-efi' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1 │ 148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index 149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ r-efi v5.3.0 └── getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ r-efi v6.0.0 └── getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1 │ 150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index 151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 ├ rand v0.9.5 ├── infraternal-server v0.1.0 └── webauthn-rs-core v0.5.5 └── webauthn-rs v0.5.5 └── infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1 │ 152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index 153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_chacha v0.3.1 └── rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 ├ rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_core' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1 │ 154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index 155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'syn' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1 │ 181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index 182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────┘ lock entries │ ├ syn v2.0.119 ├── asn1-rs-derive v0.5.1 │ └── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── asn1-rs-impl v0.2.0 │ └── asn1-rs v0.6.2 (*) ├── openssl-macros v0.1.1 │ └── openssl v0.10.81 │ ├── infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) ├── synstructure v0.13.2 │ └── asn1-rs-derive v0.5.1 (*) ├── thiserror-impl v1.0.69 │ └── thiserror v1.0.69 │ ├── asn1-rs v0.6.2 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── x509-parser v0.16.0 (*) ├── tracing-attributes v0.1.31 │ └── tracing v0.1.44 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-core v0.5.6 │ │ └── axum v0.8.9 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ ├── sqlx-macros v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) └── zerocopy-derive v0.8.60 └── zerocopy v0.8.60 ├── half v2.7.1 │ └── serde_cbor_2 v0.13.0 │ ├── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── ppv-lite86 v0.2.21 ├── rand_chacha v0.3.1 │ └── rand v0.8.8 │ └── bip39 v2.2.2 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ syn v3.0.6 ├── clap_derive v4.6.7 │ └── clap v4.6.7 │ └── infraternal v0.1.0 ├── displaydoc v0.2.7 │ ├── asn1-rs v0.6.2 │ │ ├── der-parser v9.0.0 │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 │ │ │ └── x509-parser v0.16.0 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── oid-registry v0.7.1 │ │ │ └── x509-parser v0.16.0 (*) │ │ └── x509-parser v0.16.0 (*) │ ├── der-parser v9.0.0 (*) │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── tinystr v0.8.4 │ │ └── icu_locale_core v2.3.0 (*) │ └── zerotrie v0.2.5 │ ├── icu_properties v2.3.0 (*) │ └── icu_provider v2.3.1 (*) ├── serde_derive v1.0.229 │ ├── serde v1.0.229 │ │ ├── base64urlsafedata v0.5.5 │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 (*) │ │ ├── bip39 v2.2.2 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── either v1.18.0 │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── serde_cbor_2 v0.13.0 │ │ │ ├── (dev) infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── serde_urlencoded v0.7.1 │ │ │ ├── axum v0.8.9 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ ├── sqlx-core v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ ├── url v2.5.8 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ ├── webauthn-rs v0.5.5 (*) │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ └── webauthn-rs-proto v0.5.5 (*) │ └── url v2.5.8 (*) ├── synstructure v0.14.0 │ ├── yoke-derive v0.8.4 │ │ └── yoke v0.8.3 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── zerotrie v0.2.5 (*) │ │ └── zerovec v0.11.8 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_locale_core v2.3.0 (*) │ │ ├── icu_normalizer v2.3.0 (*) │ │ ├── icu_properties v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── potential_utf v0.1.6 │ │ │ └── icu_collections v2.3.0 (*) │ │ └── tinystr v0.8.4 (*) │ └── zerofrom-derive v0.1.8 │ └── zerofrom v0.1.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── yoke v0.8.3 (*) │ ├── zerotrie v0.2.5 (*) │ └── zerovec v0.11.8 (*) ├── thiserror-impl v2.0.21 │ └── thiserror v2.0.21 │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 (*) ├── tokio-macros v2.7.2 │ └── tokio v1.53.2 │ ├── axum v0.8.9 (*) │ ├── hyper v1.11.1 │ │ ├── axum v0.8.9 (*) │ │ └── hyper-util v0.1.21 │ │ └── axum v0.8.9 (*) │ ├── hyper-util v0.1.21 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ └── tower v0.5.3 │ ├── axum v0.8.9 (*) │ └── (dev) infraternal-server v0.1.0 (*) ├── yoke-derive v0.8.4 (*) ├── zerofrom-derive v0.1.8 (*) └── zerovec-derive v0.11.6 └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'synstructure' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1 │ 184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index 185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ synstructure v0.13.2 └── asn1-rs-derive v0.5.1 └── asn1-rs v0.6.2 ├── der-parser v9.0.0 │ ├── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ └── x509-parser v0.16.0 │ └── webauthn-rs-core v0.5.5 (*) ├── oid-registry v0.7.1 │ └── x509-parser v0.16.0 (*) └── x509-parser v0.16.0 (*) ├ synstructure v0.14.0 ├── yoke-derive v0.8.4 │ └── yoke v0.8.3 │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── zerotrie v0.2.5 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ └── zerovec v0.11.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ ├── icu_normalizer v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── potential_utf v0.1.6 │ │ └── icu_collections v2.3.0 (*) │ └── tinystr v0.8.4 │ └── icu_locale_core v2.3.0 (*) └── zerofrom-derive v0.1.8 └── zerofrom v0.1.8 ├── icu_collections v2.3.0 (*) ├── icu_provider v2.3.1 (*) ├── yoke v0.8.3 (*) ├── zerotrie v0.2.5 (*) └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1 │ 186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index 187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror v2.0.21 ├── infraternal-server v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1 │ 188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index 189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror-impl v1.0.69 └── thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror-impl v2.0.21 └── thiserror v2.0.21 ├── infraternal-server v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) advisories ok, bans ok, licenses ok, sources ok ==> static builds Finished `release` profile [optimized] target(s) in 0.06s target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 705624 bytes Finished `release` profile [optimized] target(s) in 0.06s target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 607880 bytes server subcommand: exit 2, not implemented agent subcommand: exit 2, not implemented +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ```
kayg commented 2026-10-06 10:40:16 +00:00
Author
Owner
Copy link

Starting independent-review rework on lane-auth at a06368f538aa99e4e78caf4634e9f93e8db9b9eb, base s1-base 386acfd3dc. Will preserve lane-auth-v1, reproduce the recovery rotation race, repair real auth musl linking for both architectures, isolate polling admission, add browser evidence, and rewrite local atomic gated commits. No push or deploy.

Starting independent-review rework on lane-auth at a06368f538aa99e4e78caf4634e9f93e8db9b9eb, base s1-base 386acfd3dc6255c7f58f98b4f114d5d7326292ad. Will preserve lane-auth-v1, reproduce the recovery rotation race, repair real auth musl linking for both architectures, isolate polling admission, add browser evidence, and rewrite local atomic gated commits. No push or deploy.
kayg commented 2026-10-06 10:47:30 +00:00
Author
Owner
Copy link

B1 reproduced before editing: target/recovery-before.log shows 0 passed, 1 failed in 2.02s. Hash recheck under SQLite writer transaction passes (target/recovery-after.log, 1 passed in 1.96s). Strengthened regression now pauses after actual Argon verification and commits a complete replacement through recovery_ready/registration_finish; no timing sleeps. All 11 Rust auth tests pass in 15.28s (target/auth-tests.log). S1 reproducer now verifies 60 invalid device polls return 401, later polls return 429 + Retry-After: 60, and browser login remains 200; fixed partitions cap aggregate admission at 180/minute. N1 split is underway: facade 142 lines, dedicated crypto/setup/WebAuthn/session/recovery/device/wrap modules. B2: pinned Zig 0.15.2 compiles vendored OpenSSL/SQLite for aarch64 musl; real auth-linked binary is 7805704 bytes, PT_INTERP absent. Final measurements and commit references will follow.

B1 reproduced before editing: target/recovery-before.log shows 0 passed, 1 failed in 2.02s. Hash recheck under SQLite writer transaction passes (target/recovery-after.log, 1 passed in 1.96s). Strengthened regression now pauses after actual Argon verification and commits a complete replacement through recovery_ready/registration_finish; no timing sleeps. All 11 Rust auth tests pass in 15.28s (target/auth-tests.log). S1 reproducer now verifies 60 invalid device polls return 401, later polls return 429 + Retry-After: 60, and browser login remains 200; fixed partitions cap aggregate admission at 180/minute. N1 split is underway: facade 142 lines, dedicated crypto/setup/WebAuthn/session/recovery/device/wrap modules. B2: pinned Zig 0.15.2 compiles vendored OpenSSL/SQLite for aarch64 musl; real auth-linked binary is 7805704 bytes, PT_INTERP absent. Final measurements and commit references will follow.
kayg commented 2026-10-06 10:51:00 +00:00
Author
Owner
Copy link

S2 now has real Chromium evidence: target/auth-browser.log, Chromium 149.0.7827.55, four isolated scenarios pass. Real resident UV credential registration, PRF-enabled check, fallback get, stripped PRF proof outputs, native WebCrypto HKDF/AES-GCM wrapping for both passkey and BIP-39 recovery, cookie session, login/unwrapping same DEK; unsupported PRF/missing residence/no UV abort before owner creation; native assertion without UV and altered origin fail server verification. No network port bound: scripts/verify-auth-browser uses private IPC with the actual Rust router. A physical Safari/iPhone run is deferred: no physical device is available in this job and the product browser integration has not landed; Chromium is not claimed as Safari evidence. B2 choice: retain webauthn-rs 0.5.5 and vendored OpenSSL, use checksum-pinned Zig 0.15.2 for both C targets. Core declares unconditional openssl/openssl-sys; disabling defaults does not remove them. 1Password passkey is client/authenticator, not an RP verifier (https://docs.rs/passkey/latest/passkey/). A minimal replacement would newly own attestation parsing and origin/RP/UV/signature/counter policy and require another security review; preserving the independently reviewed verifier is preferable for this rework. Auth-linked static binaries currently x86 9322720 bytes and aarch64 7809800 bytes; scaffold baselines 705624/607880 bytes are not auth overhead measurements. PT_INTERP absent for both; final exact sizes and commits follow.

S2 now has real Chromium evidence: target/auth-browser.log, Chromium 149.0.7827.55, four isolated scenarios pass. Real resident UV credential registration, PRF-enabled check, fallback get, stripped PRF proof outputs, native WebCrypto HKDF/AES-GCM wrapping for both passkey and BIP-39 recovery, cookie session, login/unwrapping same DEK; unsupported PRF/missing residence/no UV abort before owner creation; native assertion without UV and altered origin fail server verification. No network port bound: scripts/verify-auth-browser uses private IPC with the actual Rust router. A physical Safari/iPhone run is deferred: no physical device is available in this job and the product browser integration has not landed; Chromium is not claimed as Safari evidence. B2 choice: retain webauthn-rs 0.5.5 and vendored OpenSSL, use checksum-pinned Zig 0.15.2 for both C targets. Core declares unconditional openssl/openssl-sys; disabling defaults does not remove them. 1Password passkey is client/authenticator, not an RP verifier (https://docs.rs/passkey/latest/passkey/). A minimal replacement would newly own attestation parsing and origin/RP/UV/signature/counter policy and require another security review; preserving the independently reviewed verifier is preferable for this rework. Auth-linked static binaries currently x86 9322720 bytes and aarch64 7809800 bytes; scaffold baselines 705624/607880 bytes are not auth overhead measurements. PT_INTERP absent for both; final exact sizes and commits follow.
kayg commented 2026-10-06 11:03:37 +00:00
Author
Owner
Copy link

Commit dispositions now established: B1 fixed in ea4cf43 (deterministic complete-rotation regression accompanies module); B2 fixed by 469d0e8 (checksum-pinned cross C toolchain) + afbe8e2 (real Auth/router executable linkage; both static targets gated); S1 fixed in afbe8e2 (bounded 120 browser/60 CLI partitions, 429 + Retry-After, reset/header-distrust tests and documented per-source ingress policy); S2 browser evidence in 8f35170 (four Chromium 149.0.7827.55 scenarios, real native WebAuthn/PRF/WebCrypto). Physical Safari/iPhone test remains deferred because no device is available and product browser integration is outside this library lane; no Safari compatibility claim is made. N1 fixed across f019691/ecd302b/ea4cf43/294effc/afbe8e2 (147-line facade, dedicated security modules). B3: local branch is reconstructed on 386acfd with twelve atomic fast-gated commits so far, old head preserved at lane-auth-v1; evidence docs commit still to follow. Final fast/HEAD output will follow. Optimized session sample n=200: p50 56us, p99 137us; Argon2id 24ms (target/auth-rework/latency.log). No push/deploy/issue close.

Commit dispositions now established: B1 fixed in ea4cf43 (deterministic complete-rotation regression accompanies module); B2 fixed by 469d0e8 (checksum-pinned cross C toolchain) + afbe8e2 (real Auth/router executable linkage; both static targets gated); S1 fixed in afbe8e2 (bounded 120 browser/60 CLI partitions, 429 + Retry-After, reset/header-distrust tests and documented per-source ingress policy); S2 browser evidence in 8f35170 (four Chromium 149.0.7827.55 scenarios, real native WebAuthn/PRF/WebCrypto). Physical Safari/iPhone test remains deferred because no device is available and product browser integration is outside this library lane; no Safari compatibility claim is made. N1 fixed across f019691/ecd302b/ea4cf43/294effc/afbe8e2 (147-line facade, dedicated security modules). B3: local branch is reconstructed on 386acfd with twelve atomic fast-gated commits so far, old head preserved at lane-auth-v1; evidence docs commit still to follow. Final fast/HEAD output will follow. Optimized session sample n=200: p50 56us, p99 137us; Argon2id 24ms (target/auth-rework/latency.log). No push/deploy/issue close.
kayg commented 2026-10-06 11:06:58 +00:00
Author
Owner
Copy link

Finished local auth review rework on lane-auth. Base 386acfd3dc; HEAD ce3359ceab. Old head remains reachable as lane-auth-v1 (a06368f538aa99e4e78caf4634e9f93e8db9b9eb). Working tree clean; no push/deploy/issue close. All 13 atomic commits pass the five fast rows before committing; logs target/auth-rework/commit-01-fast.log through commit-13-fast.log. Final required command on committed HEAD: nix shell nixpkgs#binutils nixpkgs#file -c scripts/verify fast (exit 0).

Every review finding answered:
B1 fixed ea4cf43: test failed before fix; deterministic regression now pauses after actual old-word Argon verification, commits full replacement, rejects resumed old words, proves no inserted recovery row/revoked old session and accepts rotated words. Writer transaction rechecks the exact verified hash.
B2 fixed 469d0e8 + afbe8e2: pinned Zig 0.15.2 cross-compiles vendored OpenSSL/SQLite for both musl targets; infraternal actually constructs Auth/router and links server/verifier. Both PT_INTERP absent. x86_64 9322720 bytes versus 705624-byte scaffold (+8617096); aarch64 7809800 versus 607880 (+7201920). Evaluated webauthn-rs features (no Rust crypto backend), 1Password passkey/types (client/authenticator, not RP), and a minimal RustCrypto/CBOR verifier (new security-sensitive parsing/policy that would require fresh independent review). Retaining the reviewed verifier plus reproducible static cross-build was chosen over introducing that verifier surface; rationale and sizes are in both relevant commit bodies and docs/verification/auth.md. No advisory/license exceptions.
B3 fixed: thirteen local atomic commits on s1-base, old head tagged, each fast-gated; list below.
S1 fixed afbe8e2: 60 CLI polling/admission slots cannot spend 120 browser slots, aggregate bounded 180/minute; 429 with Retry-After: 60; exhaustion/reset/spoofed-forwarding-header regressions and documented trusted-ingress per-source policy. This library does not infer trusted proxies from attacker-controlled headers.
S2 fixed for this library slice 8f35170: real Chromium resident UV passkeys, PRF enabled/fallback get, stripped outputs, native WebCrypto passkey/recovery envelopes, login DEK roundtrip; unsupported PRF/residence/UV abort before owner creation; wrong origin/native no-UV assertions denied. Four isolated scenarios PASS on Chromium 149.0.7827.55. Physical Safari/iPhone run deferred: no physical device is available to the job and product browser integration has not landed. Chromium is not presented as Safari evidence; this remains the physical-device integration check. No product UI exists here, so screenshot-quality review is not applicable.
N1 fixed across f019691/ecd302b/ea4cf43/294effc/afbe8e2: facade is 147 lines with dedicated crypto/setup/WebAuthn/session/recovery/device/envelope/HTTP modules and explicit transaction invariants.

Performance evidence: optimized session n=200 p50 56us/p99 137us; Argon2id 24ms (target/auth-rework/latency.log). Three alternating recovery-start probes n=50/run: old p50/p95 us 18978/20937, 19085/21350, 19919/22499; corrected 19238/22360, 19516/23321, 19449/22038. Median per-run p50 19.085ms -> 19.449ms (+0.364ms, 1.9%), p95 21.350ms -> 22.360ms (+1.010ms, 4.7%). Small noisy cost justified by preventing revoked-word takeover; Argon2 remains outside writer lock. Sources and unedited logs target/auth-rework/bench-{old,new}/ and bench-{old,new}-{1,2,3}.log. SQLite-memory/single-host numbers exclude disk/network/browser/phone latency.

New commit list:

3f7d8ee auth: specify browser key wrapping and admission (#17)
469d0e8 build: pin a musl C toolchain for auth dependencies (#17)
7462cfc auth: add reviewed runtime dependencies and license policy (#17)
21c2b6a auth: migrate identity and single-use capability storage (#17)
5e24de4 test: add authenticator and envelope verification dependencies (#17)
f019691 auth: install owner enrollment and single-use ceremonies (#17)
ecd302b auth: verify login counters and sliding fresh sessions (#17)
ea4cf43 auth: isolate recovery authorization from hash rotation (#17)
294effc auth: issue scoped device keys after fresh approval (#17)
afbe8e2 auth: mount bounded HTTP routes and link them into musl CLI (#17)
8f35170 test: verify native browser passkeys PRF and key wrapping (#17)
bed1635 test: broaden concurrent capability and recovery defenses (#17)
ce3359c docs: record auth rework gates sizes and browser evidence (#17)

Final browser gate, verbatim:

waiting for another Nix process to finish fetching input 'github:NixOS/nixpkgs/a322c65bf7233456788a9ebf03bc067db7dc090a'...
error (ignored): SQLite database '/home/kayg/.cache/nix/eval-cache-v6/5a0aa2c529c0798659f6a718ed98d126a9fc2a436caa59c41c5d0dede8f9e878.sqlite' is busy
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.22s
bun install v1.4.2 (744846f84)

Checked 5 installs across 7 packages (no changes) [2.00ms]
Bundled 11 modules in 7ms

  entropy.js  38.28 KB  (entry point)

supported: server rejected native browser assertion without UV
supported: resident UV passkey, PRF fallback get, stripped proofs, native HKDF/AES-GCM, login DEK roundtrip, wrong origin rejected
unsupported-prf: abort before finish; owner not created
nonresident: browser refused registration; owner not created
no-uv: browser refused registration; owner not created
auth browser: PASS (4 isolated scenarios; Chromium 149.0.7827.55)

Final required fast gate output, verbatim:


==> fmt

==> clippy
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.23s

==> test
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s
     Running unittests src/main.rs (target/debug/deps/infraternal-910a6a8c515fe2b1)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de)

running 12 tests
test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok
test auth::tests::review_old_words_race_rotation ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 13.07s

     Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_agent

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_api

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_ssh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_protocol

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_server

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_shim

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s


==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1
   │  
20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ base64 v0.21.7
     ├── base64urlsafedata v0.5.5
     │   ├── webauthn-attestation-ca v0.5.5
     │   │   └── webauthn-rs-core v0.5.5
     │   │       └── webauthn-rs v0.5.5
     │   │           └── infraternal-server v0.1.0
     │   │               └── infraternal v0.1.0
     │   ├── webauthn-rs v0.5.5 (*)
     │   ├── webauthn-rs-core v0.5.5 (*)
     │   └── webauthn-rs-proto v0.5.5
     │       └── webauthn-rs-core v0.5.5 (*)
     ├── webauthn-rs-core v0.5.5 (*)
     └── webauthn-rs-proto v0.5.5 (*)
   ├ base64 v0.22.1
     ├── infraternal-server v0.1.0
     │   └── infraternal v0.1.0
     └── sqlx-core v0.8.6
         ├── sqlx v0.8.6
         │   ├── infraternal v0.1.0 (*)
         │   └── infraternal-server v0.1.0 (*)
         ├── sqlx-macros v0.8.6
         │   └── sqlx v0.8.6 (*)
         ├── sqlx-macros-core v0.8.6
         │   └── sqlx-macros v0.8.6 (*)
         └── sqlx-sqlite v0.8.6
             ├── sqlx v0.8.6 (*)
             └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1
   │  
70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
   │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ getrandom v0.2.17
     └── rand_core v0.6.4
         ├── bip39 v2.2.2
         │   └── infraternal-server v0.1.0
         │       └── infraternal v0.1.0
         ├── crypto-common v0.1.7
         │   ├── aead v0.5.2
         │   │   └── aes-gcm v0.10.3
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   ├── cipher v0.4.4
         │   │   ├── aes v0.8.4
         │   │   │   └── aes-gcm v0.10.3 (*)
         │   │   ├── aes-gcm v0.10.3 (*)
         │   │   └── ctr v0.9.2
         │   │       └── aes-gcm v0.10.3 (*)
         │   ├── digest v0.10.7
         │   │   ├── blake2 v0.10.6
         │   │   │   └── argon2 v0.5.3
         │   │   │       └── infraternal-server v0.1.0 (*)
         │   │   ├── hmac v0.12.1
         │   │   │   └── hkdf v0.12.4
         │   │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   │   └── sha2 v0.10.9
         │   │       ├── infraternal-server v0.1.0 (*)
         │   │       ├── sqlx-core v0.8.6
         │   │       │   ├── sqlx v0.8.6
         │   │       │   │   ├── infraternal v0.1.0 (*)
         │   │       │   │   └── infraternal-server v0.1.0 (*)
         │   │       │   ├── sqlx-macros v0.8.6
         │   │       │   │   └── sqlx v0.8.6 (*)
         │   │       │   ├── sqlx-macros-core v0.8.6
         │   │       │   │   └── sqlx-macros v0.8.6 (*)
         │   │       │   └── sqlx-sqlite v0.8.6
         │   │       │       ├── sqlx v0.8.6 (*)
         │   │       │       └── sqlx-macros-core v0.8.6 (*)
         │   │       └── sqlx-macros-core v0.8.6 (*)
         │   └── universal-hash v0.5.1
         │       └── polyval v0.6.2
         │           └── ghash v0.5.1
         │               └── aes-gcm v0.10.3 (*)
         ├── password-hash v0.5.0
         │   └── argon2 v0.5.3 (*)
         ├── rand v0.8.8
         │   └── bip39 v2.2.2 (*)
         └── rand_chacha v0.3.1
             └── rand v0.8.8 (*)
   ├ getrandom v0.3.4
     └── rand_core v0.9.5
         ├── rand v0.9.5
         │   ├── infraternal-server v0.1.0
         │   │   └── infraternal v0.1.0
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         └── rand_chacha v0.9.0
             ├── rand v0.9.5 (*)
             └── webauthn-rs-core v0.5.5 (*)
   ├ getrandom v0.4.3
     └── uuid v1.27.0
         ├── infraternal-server v0.1.0
         │   └── infraternal v0.1.0
         ├── webauthn-attestation-ca v0.5.5
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         ├── webauthn-rs v0.5.5 (*)
         └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1
   │  
75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ hashbrown v0.15.5
     ├── hashlink v0.10.0
     │   └── sqlx-core v0.8.6
     │       ├── sqlx v0.8.6
     │       │   ├── infraternal v0.1.0
     │       │   └── infraternal-server v0.1.0
     │       │       └── infraternal v0.1.0 (*)
     │       ├── sqlx-macros v0.8.6
     │       │   └── sqlx v0.8.6 (*)
     │       ├── sqlx-macros-core v0.8.6
     │       │   └── sqlx-macros v0.8.6 (*)
     │       └── sqlx-sqlite v0.8.6
     │           ├── sqlx v0.8.6 (*)
     │           └── sqlx-macros-core v0.8.6 (*)
     └── sqlx-core v0.8.6 (*)
   ├ hashbrown v0.17.1
     └── indexmap v2.14.2
         └── sqlx-core v0.8.6
             ├── sqlx v0.8.6
             │   ├── infraternal v0.1.0
             │   └── infraternal-server v0.1.0
             │       └── infraternal v0.1.0 (*)
             ├── sqlx-macros v0.8.6
             │   └── sqlx v0.8.6 (*)
             ├── sqlx-macros-core v0.8.6
             │   └── sqlx-macros v0.8.6 (*)
             └── sqlx-sqlite v0.8.6
                 ├── sqlx v0.8.6 (*)
                 └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1
    │  
148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ r-efi v5.3.0
      └── getrandom v0.3.4
          └── rand_core v0.9.5
              ├── rand v0.9.5
              │   ├── infraternal-server v0.1.0
              │   │   └── infraternal v0.1.0
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              └── rand_chacha v0.9.0
                  ├── rand v0.9.5 (*)
                  └── webauthn-rs-core v0.5.5 (*)
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          └── uuid v1.27.0
              ├── infraternal-server v0.1.0
              │   └── infraternal v0.1.0
              ├── webauthn-attestation-ca v0.5.5
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              ├── webauthn-rs v0.5.5 (*)
              └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1
    │  
150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand v0.8.8
      └── bip39 v2.2.2
          └── infraternal-server v0.1.0
              └── infraternal v0.1.0
    ├ rand v0.9.5
      ├── infraternal-server v0.1.0
      │   └── infraternal v0.1.0
      └── webauthn-rs-core v0.5.5
          └── webauthn-rs v0.5.5
              └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1
    │  
152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_chacha v0.3.1
      └── rand v0.8.8
          └── bip39 v2.2.2
              └── infraternal-server v0.1.0
                  └── infraternal v0.1.0
    ├ rand_chacha v0.9.0
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   └── infraternal v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_core'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1
    │  
154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_core v0.6.4
      ├── bip39 v2.2.2
      │   └── infraternal-server v0.1.0
      │       └── infraternal v0.1.0
      ├── crypto-common v0.1.7
      │   ├── aead v0.5.2
      │   │   └── aes-gcm v0.10.3
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   ├── cipher v0.4.4
      │   │   ├── aes v0.8.4
      │   │   │   └── aes-gcm v0.10.3 (*)
      │   │   ├── aes-gcm v0.10.3 (*)
      │   │   └── ctr v0.9.2
      │   │       └── aes-gcm v0.10.3 (*)
      │   ├── digest v0.10.7
      │   │   ├── blake2 v0.10.6
      │   │   │   └── argon2 v0.5.3
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── hmac v0.12.1
      │   │   │   └── hkdf v0.12.4
      │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   │   └── sha2 v0.10.9
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── sqlx-core v0.8.6
      │   │       │   ├── sqlx v0.8.6
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── sqlx-macros v0.8.6
      │   │       │   │   └── sqlx v0.8.6 (*)
      │   │       │   ├── sqlx-macros-core v0.8.6
      │   │       │   │   └── sqlx-macros v0.8.6 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6 (*)
      │   │       │       └── sqlx-macros-core v0.8.6 (*)
      │   │       └── sqlx-macros-core v0.8.6 (*)
      │   └── universal-hash v0.5.1
      │       └── polyval v0.6.2
      │           └── ghash v0.5.1
      │               └── aes-gcm v0.10.3 (*)
      ├── password-hash v0.5.0
      │   └── argon2 v0.5.3 (*)
      ├── rand v0.8.8
      │   └── bip39 v2.2.2 (*)
      └── rand_chacha v0.3.1
          └── rand v0.8.8 (*)
    ├ rand_core v0.9.5
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   └── infraternal v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── rand_chacha v0.9.0
          ├── rand v0.9.5 (*)
          └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'syn'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1
    │  
181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ syn v2.0.119
      ├── asn1-rs-derive v0.5.1
      │   └── asn1-rs v0.6.2
      │       ├── der-parser v9.0.0
      │       │   ├── webauthn-rs-core v0.5.5
      │       │   │   └── webauthn-rs v0.5.5
      │       │   │       └── infraternal-server v0.1.0
      │       │   │           └── infraternal v0.1.0
      │       │   └── x509-parser v0.16.0
      │       │       └── webauthn-rs-core v0.5.5 (*)
      │       ├── oid-registry v0.7.1
      │       │   └── x509-parser v0.16.0 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── asn1-rs-impl v0.2.0
      │   └── asn1-rs v0.6.2 (*)
      ├── openssl-macros v0.1.1
      │   └── openssl v0.10.81
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5
      │       │   └── webauthn-rs-core v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── sqlx-macros v0.8.6
      │   └── sqlx v0.8.6
      │       ├── infraternal v0.1.0 (*)
      │       └── infraternal-server v0.1.0 (*)
      ├── sqlx-macros-core v0.8.6
      │   └── sqlx-macros v0.8.6 (*)
      ├── synstructure v0.13.2
      │   └── asn1-rs-derive v0.5.1 (*)
      ├── thiserror-impl v1.0.69
      │   └── thiserror v1.0.69
      │       ├── asn1-rs v0.6.2 (*)
      │       ├── webauthn-rs-core v0.5.5 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── tracing-attributes v0.1.31
      │   └── tracing v0.1.44
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── axum-core v0.5.6
      │       │   └── axum v0.8.9 (*)
      │       ├── sqlx-core v0.8.6
      │       │   ├── sqlx v0.8.6 (*)
      │       │   ├── sqlx-macros v0.8.6 (*)
      │       │   ├── sqlx-macros-core v0.8.6 (*)
      │       │   └── sqlx-sqlite v0.8.6
      │       │       ├── sqlx v0.8.6 (*)
      │       │       └── sqlx-macros-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      └── zerocopy-derive v0.8.60
          └── zerocopy v0.8.60
              ├── half v2.7.1
              │   └── serde_cbor_2 v0.13.0
              │       ├── (dev) infraternal-server v0.1.0 (*)
              │       └── webauthn-rs-core v0.5.5 (*)
              └── ppv-lite86 v0.2.21
                  ├── rand_chacha v0.3.1
                  │   └── rand v0.8.8
                  │       └── bip39 v2.2.2
                  │           └── infraternal-server v0.1.0 (*)
                  └── rand_chacha v0.9.0
                      ├── rand v0.9.5
                      │   ├── infraternal-server v0.1.0 (*)
                      │   └── webauthn-rs-core v0.5.5 (*)
                      └── webauthn-rs-core v0.5.5 (*)
    ├ syn v3.0.6
      ├── clap_derive v4.6.7
      │   └── clap v4.6.7
      │       └── infraternal v0.1.0
      ├── displaydoc v0.2.7
      │   ├── asn1-rs v0.6.2
      │   │   ├── der-parser v9.0.0
      │   │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   │   └── webauthn-rs v0.5.5
      │   │   │   │       └── infraternal-server v0.1.0
      │   │   │   │           └── infraternal v0.1.0 (*)
      │   │   │   └── x509-parser v0.16.0
      │   │   │       └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── oid-registry v0.7.1
      │   │   │   └── x509-parser v0.16.0 (*)
      │   │   └── x509-parser v0.16.0 (*)
      │   ├── der-parser v9.0.0 (*)
      │   ├── icu_collections v2.3.0
      │   │   ├── icu_normalizer v2.3.0
      │   │   │   └── idna_adapter v1.2.2
      │   │   │       └── idna v1.1.0
      │   │   │           └── url v2.5.8
      │   │   │               ├── infraternal-server v0.1.0 (*)
      │   │   │               ├── sqlx-core v0.8.6
      │   │   │               │   ├── sqlx v0.8.6
      │   │   │               │   │   ├── infraternal v0.1.0 (*)
      │   │   │               │   │   └── infraternal-server v0.1.0 (*)
      │   │   │               │   ├── sqlx-macros v0.8.6
      │   │   │               │   │   └── sqlx v0.8.6 (*)
      │   │   │               │   ├── sqlx-macros-core v0.8.6
      │   │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │   │   │               │   └── sqlx-sqlite v0.8.6
      │   │   │               │       ├── sqlx v0.8.6 (*)
      │   │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-sqlite v0.8.6 (*)
      │   │   │               ├── webauthn-rs v0.5.5 (*)
      │   │   │               ├── webauthn-rs-core v0.5.5 (*)
      │   │   │               └── webauthn-rs-proto v0.5.5
      │   │   │                   └── webauthn-rs-core v0.5.5 (*)
      │   │   └── icu_properties v2.3.0
      │   │       └── idna_adapter v1.2.2 (*)
      │   ├── icu_locale_core v2.3.0
      │   │   ├── icu_properties v2.3.0 (*)
      │   │   └── icu_provider v2.3.1
      │   │       ├── icu_normalizer v2.3.0 (*)
      │   │       └── icu_properties v2.3.0 (*)
      │   ├── icu_properties v2.3.0 (*)
      │   ├── icu_provider v2.3.1 (*)
      │   ├── tinystr v0.8.4
      │   │   └── icu_locale_core v2.3.0 (*)
      │   └── zerotrie v0.2.5
      │       ├── icu_properties v2.3.0 (*)
      │       └── icu_provider v2.3.1 (*)
      ├── serde_derive v1.0.229
      │   ├── serde v1.0.229
      │   │   ├── base64urlsafedata v0.5.5
      │   │   │   ├── webauthn-attestation-ca v0.5.5
      │   │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   │   ├── bip39 v2.2.2
      │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   ├── either v1.18.0
      │   │   │   ├── sqlx-core v0.8.6 (*)
      │   │   │   └── sqlx-macros-core v0.8.6 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   ├── serde_cbor_2 v0.13.0
      │   │   │   ├── (dev) infraternal-server v0.1.0 (*)
      │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── serde_urlencoded v0.7.1
      │   │   │   ├── axum v0.8.9
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   └── sqlx-sqlite v0.8.6 (*)
      │   │   ├── sqlx-core v0.8.6 (*)
      │   │   ├── sqlx-macros-core v0.8.6 (*)
      │   │   ├── sqlx-sqlite v0.8.6 (*)
      │   │   ├── url v2.5.8 (*)
      │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   └── url v2.5.8 (*)
      ├── synstructure v0.14.0
      │   ├── yoke-derive v0.8.4
      │   │   └── yoke v0.8.3
      │   │       ├── icu_collections v2.3.0 (*)
      │   │       ├── icu_provider v2.3.1 (*)
      │   │       ├── zerotrie v0.2.5 (*)
      │   │       └── zerovec v0.11.8
      │   │           ├── icu_collections v2.3.0 (*)
      │   │           ├── icu_locale_core v2.3.0 (*)
      │   │           ├── icu_normalizer v2.3.0 (*)
      │   │           ├── icu_properties v2.3.0 (*)
      │   │           ├── icu_provider v2.3.1 (*)
      │   │           ├── potential_utf v0.1.6
      │   │           │   └── icu_collections v2.3.0 (*)
      │   │           └── tinystr v0.8.4 (*)
      │   └── zerofrom-derive v0.1.8
      │       └── zerofrom v0.1.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── yoke v0.8.3 (*)
      │           ├── zerotrie v0.2.5 (*)
      │           └── zerovec v0.11.8 (*)
      ├── thiserror-impl v2.0.21
      │   └── thiserror v2.0.21
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       └── sqlx-sqlite v0.8.6 (*)
      ├── tokio-macros v2.7.2
      │   └── tokio v1.53.2
      │       ├── axum v0.8.9 (*)
      │       ├── hyper v1.11.1
      │       │   ├── axum v0.8.9 (*)
      │       │   └── hyper-util v0.1.21
      │       │       └── axum v0.8.9 (*)
      │       ├── hyper-util v0.1.21 (*)
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-macros-core v0.8.6 (*)
      │       ├── tokio-stream v0.1.19
      │       │   └── sqlx-core v0.8.6 (*)
      │       └── tower v0.5.3
      │           ├── axum v0.8.9 (*)
      │           └── (dev) infraternal-server v0.1.0 (*)
      ├── yoke-derive v0.8.4 (*)
      ├── zerofrom-derive v0.1.8 (*)
      └── zerovec-derive v0.11.6
          └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1
    │  
184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ synstructure v0.13.2
      └── asn1-rs-derive v0.5.1
          └── asn1-rs v0.6.2
              ├── der-parser v9.0.0
              │   ├── webauthn-rs-core v0.5.5
              │   │   └── webauthn-rs v0.5.5
              │   │       └── infraternal-server v0.1.0
              │   │           └── infraternal v0.1.0
              │   └── x509-parser v0.16.0
              │       └── webauthn-rs-core v0.5.5 (*)
              ├── oid-registry v0.7.1
              │   └── x509-parser v0.16.0 (*)
              └── x509-parser v0.16.0 (*)
    ├ synstructure v0.14.0
      ├── yoke-derive v0.8.4
      │   └── yoke v0.8.3
      │       ├── icu_collections v2.3.0
      │       │   ├── icu_normalizer v2.3.0
      │       │   │   └── idna_adapter v1.2.2
      │       │   │       └── idna v1.1.0
      │       │   │           └── url v2.5.8
      │       │   │               ├── infraternal-server v0.1.0
      │       │   │               │   └── infraternal v0.1.0
      │       │   │               ├── sqlx-core v0.8.6
      │       │   │               │   ├── sqlx v0.8.6
      │       │   │               │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   ├── sqlx-macros v0.8.6
      │       │   │               │   │   └── sqlx v0.8.6 (*)
      │       │   │               │   ├── sqlx-macros-core v0.8.6
      │       │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │       │   │               │   └── sqlx-sqlite v0.8.6
      │       │   │               │       ├── sqlx v0.8.6 (*)
      │       │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-sqlite v0.8.6 (*)
      │       │   │               ├── webauthn-rs v0.5.5
      │       │   │               │   └── infraternal-server v0.1.0 (*)
      │       │   │               ├── webauthn-rs-core v0.5.5
      │       │   │               │   └── webauthn-rs v0.5.5 (*)
      │       │   │               └── webauthn-rs-proto v0.5.5
      │       │   │                   └── webauthn-rs-core v0.5.5 (*)
      │       │   └── icu_properties v2.3.0
      │       │       └── idna_adapter v1.2.2 (*)
      │       ├── icu_provider v2.3.1
      │       │   ├── icu_normalizer v2.3.0 (*)
      │       │   └── icu_properties v2.3.0 (*)
      │       ├── zerotrie v0.2.5
      │       │   ├── icu_properties v2.3.0 (*)
      │       │   └── icu_provider v2.3.1 (*)
      │       └── zerovec v0.11.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_locale_core v2.3.0
      │           │   ├── icu_properties v2.3.0 (*)
      │           │   └── icu_provider v2.3.1 (*)
      │           ├── icu_normalizer v2.3.0 (*)
      │           ├── icu_properties v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── potential_utf v0.1.6
      │           │   └── icu_collections v2.3.0 (*)
      │           └── tinystr v0.8.4
      │               └── icu_locale_core v2.3.0 (*)
      └── zerofrom-derive v0.1.8
          └── zerofrom v0.1.8
              ├── icu_collections v2.3.0 (*)
              ├── icu_provider v2.3.1 (*)
              ├── yoke v0.8.3 (*)
              ├── zerotrie v0.2.5 (*)
              └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1
    │  
186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror v1.0.69
      ├── asn1-rs v0.6.2
      │   ├── der-parser v9.0.0
      │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   └── webauthn-rs v0.5.5
      │   │   │       └── infraternal-server v0.1.0
      │   │   │           └── infraternal v0.1.0
      │   │   └── x509-parser v0.16.0
      │   │       └── webauthn-rs-core v0.5.5 (*)
      │   ├── oid-registry v0.7.1
      │   │   └── x509-parser v0.16.0 (*)
      │   └── x509-parser v0.16.0 (*)
      ├── webauthn-rs-core v0.5.5 (*)
      └── x509-parser v0.16.0 (*)
    ├ thiserror v2.0.21
      ├── infraternal-server v0.1.0
      │   └── infraternal v0.1.0
      ├── sqlx-core v0.8.6
      │   ├── sqlx v0.8.6
      │   │   ├── infraternal v0.1.0 (*)
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── sqlx-macros v0.8.6
      │   │   └── sqlx v0.8.6 (*)
      │   ├── sqlx-macros-core v0.8.6
      │   │   └── sqlx-macros v0.8.6 (*)
      │   └── sqlx-sqlite v0.8.6
      │       ├── sqlx v0.8.6 (*)
      │       └── sqlx-macros-core v0.8.6 (*)
      └── sqlx-sqlite v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1
    │  
188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror-impl v1.0.69
      └── thiserror v1.0.69
          ├── asn1-rs v0.6.2
          │   ├── der-parser v9.0.0
          │   │   ├── webauthn-rs-core v0.5.5
          │   │   │   └── webauthn-rs v0.5.5
          │   │   │       └── infraternal-server v0.1.0
          │   │   │           └── infraternal v0.1.0
          │   │   └── x509-parser v0.16.0
          │   │       └── webauthn-rs-core v0.5.5 (*)
          │   ├── oid-registry v0.7.1
          │   │   └── x509-parser v0.16.0 (*)
          │   └── x509-parser v0.16.0 (*)
          ├── webauthn-rs-core v0.5.5 (*)
          └── x509-parser v0.16.0 (*)
    ├ thiserror-impl v2.0.21
      └── thiserror v2.0.21
          ├── infraternal-server v0.1.0
          │   └── infraternal v0.1.0
          ├── sqlx-core v0.8.6
          │   ├── sqlx v0.8.6
          │   │   ├── infraternal v0.1.0 (*)
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── sqlx-macros v0.8.6
          │   │   └── sqlx v0.8.6 (*)
          │   ├── sqlx-macros-core v0.8.6
          │   │   └── sqlx-macros v0.8.6 (*)
          │   └── sqlx-sqlite v0.8.6
          │       ├── sqlx v0.8.6 (*)
          │       └── sqlx-macros-core v0.8.6 (*)
          └── sqlx-sqlite v0.8.6 (*)

advisories ok, bans ok, licenses ok, sources ok

==> static builds
    Finished `release` profile [optimized] target(s) in 0.15s
target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 9322720 bytes
    Finished `release` profile [optimized] target(s) in 0.16s
target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 7809800 bytes
server subcommand: exit 2, not implemented
agent subcommand: exit 2, not implemented

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
Finished local auth review rework on lane-auth. Base 386acfd3dc6255c7f58f98b4f114d5d7326292ad; HEAD ce3359ceab19684d5e11366aee5a1f02bac650d2. Old head remains reachable as lane-auth-v1 (a06368f538aa99e4e78caf4634e9f93e8db9b9eb). Working tree clean; no push/deploy/issue close. All 13 atomic commits pass the five fast rows before committing; logs target/auth-rework/commit-01-fast.log through commit-13-fast.log. Final required command on committed HEAD: nix shell nixpkgs#binutils nixpkgs#file -c scripts/verify fast (exit 0). Every review finding answered: B1 fixed ea4cf43: test failed before fix; deterministic regression now pauses after actual old-word Argon verification, commits full replacement, rejects resumed old words, proves no inserted recovery row/revoked old session and accepts rotated words. Writer transaction rechecks the exact verified hash. B2 fixed 469d0e8 + afbe8e2: pinned Zig 0.15.2 cross-compiles vendored OpenSSL/SQLite for both musl targets; infraternal actually constructs Auth/router and links server/verifier. Both PT_INTERP absent. x86_64 9322720 bytes versus 705624-byte scaffold (+8617096); aarch64 7809800 versus 607880 (+7201920). Evaluated webauthn-rs features (no Rust crypto backend), 1Password passkey/types (client/authenticator, not RP), and a minimal RustCrypto/CBOR verifier (new security-sensitive parsing/policy that would require fresh independent review). Retaining the reviewed verifier plus reproducible static cross-build was chosen over introducing that verifier surface; rationale and sizes are in both relevant commit bodies and docs/verification/auth.md. No advisory/license exceptions. B3 fixed: thirteen local atomic commits on s1-base, old head tagged, each fast-gated; list below. S1 fixed afbe8e2: 60 CLI polling/admission slots cannot spend 120 browser slots, aggregate bounded 180/minute; 429 with Retry-After: 60; exhaustion/reset/spoofed-forwarding-header regressions and documented trusted-ingress per-source policy. This library does not infer trusted proxies from attacker-controlled headers. S2 fixed for this library slice 8f35170: real Chromium resident UV passkeys, PRF enabled/fallback get, stripped outputs, native WebCrypto passkey/recovery envelopes, login DEK roundtrip; unsupported PRF/residence/UV abort before owner creation; wrong origin/native no-UV assertions denied. Four isolated scenarios PASS on Chromium 149.0.7827.55. Physical Safari/iPhone run deferred: no physical device is available to the job and product browser integration has not landed. Chromium is not presented as Safari evidence; this remains the physical-device integration check. No product UI exists here, so screenshot-quality review is not applicable. N1 fixed across f019691/ecd302b/ea4cf43/294effc/afbe8e2: facade is 147 lines with dedicated crypto/setup/WebAuthn/session/recovery/device/envelope/HTTP modules and explicit transaction invariants. Performance evidence: optimized session n=200 p50 56us/p99 137us; Argon2id 24ms (target/auth-rework/latency.log). Three alternating recovery-start probes n=50/run: old p50/p95 us 18978/20937, 19085/21350, 19919/22499; corrected 19238/22360, 19516/23321, 19449/22038. Median per-run p50 19.085ms -> 19.449ms (+0.364ms, 1.9%), p95 21.350ms -> 22.360ms (+1.010ms, 4.7%). Small noisy cost justified by preventing revoked-word takeover; Argon2 remains outside writer lock. Sources and unedited logs target/auth-rework/bench-{old,new}/ and bench-{old,new}-{1,2,3}.log. SQLite-memory/single-host numbers exclude disk/network/browser/phone latency. New commit list: ```text 3f7d8ee auth: specify browser key wrapping and admission (#17) 469d0e8 build: pin a musl C toolchain for auth dependencies (#17) 7462cfc auth: add reviewed runtime dependencies and license policy (#17) 21c2b6a auth: migrate identity and single-use capability storage (#17) 5e24de4 test: add authenticator and envelope verification dependencies (#17) f019691 auth: install owner enrollment and single-use ceremonies (#17) ecd302b auth: verify login counters and sliding fresh sessions (#17) ea4cf43 auth: isolate recovery authorization from hash rotation (#17) 294effc auth: issue scoped device keys after fresh approval (#17) afbe8e2 auth: mount bounded HTTP routes and link them into musl CLI (#17) 8f35170 test: verify native browser passkeys PRF and key wrapping (#17) bed1635 test: broaden concurrent capability and recovery defenses (#17) ce3359c docs: record auth rework gates sizes and browser evidence (#17) ``` Final browser gate, verbatim: ```text waiting for another Nix process to finish fetching input 'github:NixOS/nixpkgs/a322c65bf7233456788a9ebf03bc067db7dc090a'... error (ignored): SQLite database '/home/kayg/.cache/nix/eval-cache-v6/5a0aa2c529c0798659f6a718ed98d126a9fc2a436caa59c41c5d0dede8f9e878.sqlite' is busy Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.22s bun install v1.4.2 (744846f84) Checked 5 installs across 7 packages (no changes) [2.00ms] Bundled 11 modules in 7ms entropy.js 38.28 KB (entry point) supported: server rejected native browser assertion without UV supported: resident UV passkey, PRF fallback get, stripped proofs, native HKDF/AES-GCM, login DEK roundtrip, wrong origin rejected unsupported-prf: abort before finish; owner not created nonresident: browser refused registration; owner not created no-uv: browser refused registration; owner not created auth browser: PASS (4 isolated scenarios; Chromium 149.0.7827.55) ``` Final required fast gate output, verbatim: ```text ==> fmt ==> clippy Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.23s ==> test Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s Running unittests src/main.rs (target/debug/deps/infraternal-910a6a8c515fe2b1) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de) running 12 tests test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok test auth::tests::review_old_words_race_rotation ... ok test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 13.07s Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_agent running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_api running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_ssh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_protocol running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_server running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_shim running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ==> cargo-deny warning[duplicate]: found 2 duplicate entries for crate 'base64' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1 │ 20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index 21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────┘ lock entries │ ├ base64 v0.21.7 ├── base64urlsafedata v0.5.5 │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── webauthn-rs v0.5.5 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-proto v0.5.5 │ └── webauthn-rs-core v0.5.5 (*) ├── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-proto v0.5.5 (*) ├ base64 v0.22.1 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 3 duplicate entries for crate 'getrandom' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1 │ 70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index 71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index 72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ getrandom v0.2.17 └── rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'hashbrown' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1 │ 75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index 76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ hashbrown v0.15.5 ├── hashlink v0.10.0 │ └── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-core v0.8.6 (*) ├ hashbrown v0.17.1 └── indexmap v2.14.2 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'r-efi' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1 │ 148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index 149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ r-efi v5.3.0 └── getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ r-efi v6.0.0 └── getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1 │ 150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index 151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 └── infraternal v0.1.0 ├ rand v0.9.5 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 └── webauthn-rs-core v0.5.5 └── webauthn-rs v0.5.5 └── infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1 │ 152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index 153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_chacha v0.3.1 └── rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 └── infraternal v0.1.0 ├ rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_core' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1 │ 154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index 155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'syn' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1 │ 181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index 182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────┘ lock entries │ ├ syn v2.0.119 ├── asn1-rs-derive v0.5.1 │ └── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── asn1-rs-impl v0.2.0 │ └── asn1-rs v0.6.2 (*) ├── openssl-macros v0.1.1 │ └── openssl v0.10.81 │ ├── infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) ├── synstructure v0.13.2 │ └── asn1-rs-derive v0.5.1 (*) ├── thiserror-impl v1.0.69 │ └── thiserror v1.0.69 │ ├── asn1-rs v0.6.2 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── x509-parser v0.16.0 (*) ├── tracing-attributes v0.1.31 │ └── tracing v0.1.44 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-core v0.5.6 │ │ └── axum v0.8.9 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ ├── sqlx-macros v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) └── zerocopy-derive v0.8.60 └── zerocopy v0.8.60 ├── half v2.7.1 │ └── serde_cbor_2 v0.13.0 │ ├── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── ppv-lite86 v0.2.21 ├── rand_chacha v0.3.1 │ └── rand v0.8.8 │ └── bip39 v2.2.2 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ syn v3.0.6 ├── clap_derive v4.6.7 │ └── clap v4.6.7 │ └── infraternal v0.1.0 ├── displaydoc v0.2.7 │ ├── asn1-rs v0.6.2 │ │ ├── der-parser v9.0.0 │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ └── x509-parser v0.16.0 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── oid-registry v0.7.1 │ │ │ └── x509-parser v0.16.0 (*) │ │ └── x509-parser v0.16.0 (*) │ ├── der-parser v9.0.0 (*) │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── tinystr v0.8.4 │ │ └── icu_locale_core v2.3.0 (*) │ └── zerotrie v0.2.5 │ ├── icu_properties v2.3.0 (*) │ └── icu_provider v2.3.1 (*) ├── serde_derive v1.0.229 │ ├── serde v1.0.229 │ │ ├── base64urlsafedata v0.5.5 │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 (*) │ │ ├── bip39 v2.2.2 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── either v1.18.0 │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── serde_cbor_2 v0.13.0 │ │ │ ├── (dev) infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── serde_urlencoded v0.7.1 │ │ │ ├── axum v0.8.9 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ ├── sqlx-core v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ ├── url v2.5.8 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ ├── webauthn-rs v0.5.5 (*) │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ └── webauthn-rs-proto v0.5.5 (*) │ └── url v2.5.8 (*) ├── synstructure v0.14.0 │ ├── yoke-derive v0.8.4 │ │ └── yoke v0.8.3 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── zerotrie v0.2.5 (*) │ │ └── zerovec v0.11.8 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_locale_core v2.3.0 (*) │ │ ├── icu_normalizer v2.3.0 (*) │ │ ├── icu_properties v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── potential_utf v0.1.6 │ │ │ └── icu_collections v2.3.0 (*) │ │ └── tinystr v0.8.4 (*) │ └── zerofrom-derive v0.1.8 │ └── zerofrom v0.1.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── yoke v0.8.3 (*) │ ├── zerotrie v0.2.5 (*) │ └── zerovec v0.11.8 (*) ├── thiserror-impl v2.0.21 │ └── thiserror v2.0.21 │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 (*) ├── tokio-macros v2.7.2 │ └── tokio v1.53.2 │ ├── axum v0.8.9 (*) │ ├── hyper v1.11.1 │ │ ├── axum v0.8.9 (*) │ │ └── hyper-util v0.1.21 │ │ └── axum v0.8.9 (*) │ ├── hyper-util v0.1.21 (*) │ ├── infraternal v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ └── tower v0.5.3 │ ├── axum v0.8.9 (*) │ └── (dev) infraternal-server v0.1.0 (*) ├── yoke-derive v0.8.4 (*) ├── zerofrom-derive v0.1.8 (*) └── zerovec-derive v0.11.6 └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'synstructure' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1 │ 184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index 185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ synstructure v0.13.2 └── asn1-rs-derive v0.5.1 └── asn1-rs v0.6.2 ├── der-parser v9.0.0 │ ├── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── x509-parser v0.16.0 │ └── webauthn-rs-core v0.5.5 (*) ├── oid-registry v0.7.1 │ └── x509-parser v0.16.0 (*) └── x509-parser v0.16.0 (*) ├ synstructure v0.14.0 ├── yoke-derive v0.8.4 │ └── yoke v0.8.3 │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ └── infraternal v0.1.0 │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── zerotrie v0.2.5 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ └── zerovec v0.11.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ ├── icu_normalizer v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── potential_utf v0.1.6 │ │ └── icu_collections v2.3.0 (*) │ └── tinystr v0.8.4 │ └── icu_locale_core v2.3.0 (*) └── zerofrom-derive v0.1.8 └── zerofrom v0.1.8 ├── icu_collections v2.3.0 (*) ├── icu_provider v2.3.1 (*) ├── yoke v0.8.3 (*) ├── zerotrie v0.2.5 (*) └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1 │ 186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index 187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror v2.0.21 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1 │ 188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index 189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror-impl v1.0.69 └── thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror-impl v2.0.21 └── thiserror v2.0.21 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) advisories ok, bans ok, licenses ok, sources ok ==> static builds Finished `release` profile [optimized] target(s) in 0.15s target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 9322720 bytes Finished `release` profile [optimized] target(s) in 0.16s target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 7809800 bytes server subcommand: exit 2, not implemented agent subcommand: exit 2, not implemented +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ```
kayg commented 2026-10-06 11:10:09 +00:00
Author
Owner
Copy link

Second independent auth review started on lane-auth at ce3359c; base s1-base (386acfd3dc). Checking all first-review findings, recovery-rotation reproduction, all 13 commit gates, static size/RSS and pure-Rust alternatives. Lane commits remain read-only.

Second independent auth review started on lane-auth at ce3359c; base s1-base (386acfd3dc6255c7f58f98b4f114d5d7326292ad). Checking all first-review findings, recovery-rotation reproduction, all 13 commit gates, static size/RSS and pure-Rust alternatives. Lane commits remain read-only.
kayg commented 2026-10-06 11:12:51 +00:00
Author
Owner
Copy link

Second-review evidence: original recovery-rotation reproducer rerun against an isolated copy of ce3359c passes (1 passed, 0 failed, 2.21 s; target/review-auth2/old-recovery-repro.log). The retained deterministic full-replacement regression also passes in the head fast gate. Chromium browser gate passes all four scenarios on 149.0.7827.55 (target/review-auth2/browser.log). Measurement limitation: crates/infraternal/src/main.rs agent mode prints not implemented and exits 2, so this head has no sustained idle infraternal-agent state; decision 41 idle RSS compliance cannot yet be measured. Measuring transient startup separately, not claiming it proves the idle budget.

Second-review evidence: original recovery-rotation reproducer rerun against an isolated copy of ce3359c passes (1 passed, 0 failed, 2.21 s; target/review-auth2/old-recovery-repro.log). The retained deterministic full-replacement regression also passes in the head fast gate. Chromium browser gate passes all four scenarios on 149.0.7827.55 (target/review-auth2/browser.log). Measurement limitation: crates/infraternal/src/main.rs agent mode prints not implemented and exits 2, so this head has no sustained idle infraternal-agent state; decision 41 idle RSS compliance cannot yet be measured. Measuring transient startup separately, not claiming it proves the idle budget.
kayg commented 2026-10-06 11:17:03 +00:00
Author
Owner
Copy link

Size-alternative finding: scratch webauthn_rp 0.3.0 musl release probe links real registration and signature-verification paths at 1,174,496 bytes (target/review-auth2/rp-prototype/). However cargo deny advisories fails on rsa 0.9.10 / RUSTSEC-2023-0071, no safe upgrade available (target/review-auth2/rp-advisories.log). The advisory concerns private-key RSA timing; this RP uses public verification, so this is not evidence of an exploitable RP flaw, but adopting it fails our current supply-chain gate without a reviewed policy change. Latest published RP release is 2025-04-03; upstream log has later weak-Ed25519-key / backup-eligibility / PRF changes. This weakens the case for switching as part of this lane.

Size-alternative finding: scratch webauthn_rp 0.3.0 musl release probe links real registration and signature-verification paths at 1,174,496 bytes (target/review-auth2/rp-prototype/). However cargo deny advisories fails on rsa 0.9.10 / RUSTSEC-2023-0071, no safe upgrade available (target/review-auth2/rp-advisories.log). The advisory concerns private-key RSA timing; this RP uses public verification, so this is not evidence of an exploitable RP flaw, but adopting it fails our current supply-chain gate without a reviewed policy change. Latest published RP release is 2025-04-03; upstream log has later weak-Ed25519-key / backup-eligibility / PRF changes. This weakens the case for switching as part of this lane.
kayg commented 2026-10-06 11:19:31 +00:00
Author
Owner
Copy link

Second-review size evidence: x86_64 shipped binary 9,322,720 bytes; .text 6,304,536 bytes. cargo-bloat plus deduplicated native-archive symbol attribution identifies OpenSSL text 2,447,122 bytes and SQLite text 1,345,533 bytes (target/review-auth2/bloat.log, native-attribution.log, sections.log). Zig is build tooling and is not distributed in the binary. Exact shipped agent stub exits 2 in 8.074–35.814 ms; transient peak RSS 2,752–4,928 KiB over 30 invocations. A separately labelled same-source parked runtime probe also remains exactly 9,322,720 bytes and has stable RSS 4,920 KiB / PSS 4,916 KiB, nine threads, over 30 seconds (target/review-auth2/parked-rss.log). This excludes all future transport/plugin/shim work and is not proof of decision 41 compliance for a functioning infraternal agent.

Second-review size evidence: x86_64 shipped binary 9,322,720 bytes; .text 6,304,536 bytes. cargo-bloat plus deduplicated native-archive symbol attribution identifies OpenSSL text 2,447,122 bytes and SQLite text 1,345,533 bytes (target/review-auth2/bloat.log, native-attribution.log, sections.log). Zig is build tooling and is not distributed in the binary. Exact shipped agent stub exits 2 in 8.074–35.814 ms; transient peak RSS 2,752–4,928 KiB over 30 invocations. A separately labelled same-source parked runtime probe also remains exactly 9,322,720 bytes and has stable RSS 4,920 KiB / PSS 4,916 KiB, nine threads, over 30 seconds (target/review-auth2/parked-rss.log). This excludes all future transport/plugin/shim work and is not proof of decision 41 compliance for a functioning infraternal agent.
kayg commented 2026-10-06 11:23:00 +00:00
Author
Owner
Copy link

Second independent review finished: verdict MERGE for the scoped auth library lane. Head ce3359ceab, base 386acfd3dc. B1/B2/B3 and Chromium S2 fixed; S1 polling isolation passes; physical Safari/iPhone and functioning infraternal-agent idle RSS remain future integration evidence, not claimed complete. All 13 commits independently pass the requested fast command; temporary /tmp worktree removed. Original recovery reproduction passes, 1/0 in 2.21 s; retained deterministic replacement regression passes; browser 4/4 on Chromium 149.0.7827.55.

Size recommendation: Keep webauthn-rs with vendored OpenSSL for this lane: the measured parked-runtime baseline is about 4.8 MiB RSS, while neither evaluated alternative currently provides a reviewed, gate-passing replacement with demonstrated parity for this auth policy. Revisit webauthn_rp in a separate migration after a security review of a current released version, PRF/browser/counter/backup-policy compatibility tests and resolution of its RSA advisory gate; its smaller prototype makes that investigation worthwhile, at the cost of migration and security-review work.

Measured x86 file 9,322,720 bytes / aarch64 7,809,800; PT_INTERP absent. OpenSSL linked text 2,447,122 bytes, SQLite 1,345,533; whole .text 6,304,536. Actual agent stub has no idle state (exits 2); separately parked same-source/runtime probe is 9,322,720 bytes, RSS 4,920 KiB over 30 seconds, nine threads, not proof of completed daemon budget. RP prototype 1,174,496 bytes, but cargo-deny fails rsa advisory; passkey/types have no RP verifier. Unloaded release session n=200 p50 79 us/p99 273 us; Argon2 21 ms.

Report: /home/kayg/.local/state/codex-jobs/infraternal/review-auth2/findings.md. Full evidence target/review-auth2/. No tracked changes, push, deploy, decisions edited or issue closure. Final fast command exit 0; unedited gate output follows verbatim:


==> fmt

==> clippy
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.19s

==> test
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s
     Running unittests src/main.rs (target/debug/deps/infraternal-910a6a8c515fe2b1)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de)

running 12 tests
test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::review_old_words_race_rotation ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.94s

     Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_agent

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_api

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_ssh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_protocol

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_server

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_shim

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s


==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1
   │  
20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ base64 v0.21.7
     ├── base64urlsafedata v0.5.5
     │   ├── webauthn-attestation-ca v0.5.5
     │   │   └── webauthn-rs-core v0.5.5
     │   │       └── webauthn-rs v0.5.5
     │   │           └── infraternal-server v0.1.0
     │   │               └── infraternal v0.1.0
     │   ├── webauthn-rs v0.5.5 (*)
     │   ├── webauthn-rs-core v0.5.5 (*)
     │   └── webauthn-rs-proto v0.5.5
     │       └── webauthn-rs-core v0.5.5 (*)
     ├── webauthn-rs-core v0.5.5 (*)
     └── webauthn-rs-proto v0.5.5 (*)
   ├ base64 v0.22.1
     ├── infraternal-server v0.1.0
     │   └── infraternal v0.1.0
     └── sqlx-core v0.8.6
         ├── sqlx v0.8.6
         │   ├── infraternal v0.1.0 (*)
         │   └── infraternal-server v0.1.0 (*)
         ├── sqlx-macros v0.8.6
         │   └── sqlx v0.8.6 (*)
         ├── sqlx-macros-core v0.8.6
         │   └── sqlx-macros v0.8.6 (*)
         └── sqlx-sqlite v0.8.6
             ├── sqlx v0.8.6 (*)
             └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1
   │  
70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
   │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ getrandom v0.2.17
     └── rand_core v0.6.4
         ├── bip39 v2.2.2
         │   └── infraternal-server v0.1.0
         │       └── infraternal v0.1.0
         ├── crypto-common v0.1.7
         │   ├── aead v0.5.2
         │   │   └── aes-gcm v0.10.3
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   ├── cipher v0.4.4
         │   │   ├── aes v0.8.4
         │   │   │   └── aes-gcm v0.10.3 (*)
         │   │   ├── aes-gcm v0.10.3 (*)
         │   │   └── ctr v0.9.2
         │   │       └── aes-gcm v0.10.3 (*)
         │   ├── digest v0.10.7
         │   │   ├── blake2 v0.10.6
         │   │   │   └── argon2 v0.5.3
         │   │   │       └── infraternal-server v0.1.0 (*)
         │   │   ├── hmac v0.12.1
         │   │   │   └── hkdf v0.12.4
         │   │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   │   └── sha2 v0.10.9
         │   │       ├── infraternal-server v0.1.0 (*)
         │   │       ├── sqlx-core v0.8.6
         │   │       │   ├── sqlx v0.8.6
         │   │       │   │   ├── infraternal v0.1.0 (*)
         │   │       │   │   └── infraternal-server v0.1.0 (*)
         │   │       │   ├── sqlx-macros v0.8.6
         │   │       │   │   └── sqlx v0.8.6 (*)
         │   │       │   ├── sqlx-macros-core v0.8.6
         │   │       │   │   └── sqlx-macros v0.8.6 (*)
         │   │       │   └── sqlx-sqlite v0.8.6
         │   │       │       ├── sqlx v0.8.6 (*)
         │   │       │       └── sqlx-macros-core v0.8.6 (*)
         │   │       └── sqlx-macros-core v0.8.6 (*)
         │   └── universal-hash v0.5.1
         │       └── polyval v0.6.2
         │           └── ghash v0.5.1
         │               └── aes-gcm v0.10.3 (*)
         ├── password-hash v0.5.0
         │   └── argon2 v0.5.3 (*)
         ├── rand v0.8.8
         │   └── bip39 v2.2.2 (*)
         └── rand_chacha v0.3.1
             └── rand v0.8.8 (*)
   ├ getrandom v0.3.4
     └── rand_core v0.9.5
         ├── rand v0.9.5
         │   ├── infraternal-server v0.1.0
         │   │   └── infraternal v0.1.0
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         └── rand_chacha v0.9.0
             ├── rand v0.9.5 (*)
             └── webauthn-rs-core v0.5.5 (*)
   ├ getrandom v0.4.3
     └── uuid v1.27.0
         ├── infraternal-server v0.1.0
         │   └── infraternal v0.1.0
         ├── webauthn-attestation-ca v0.5.5
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         ├── webauthn-rs v0.5.5 (*)
         └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
   ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1
   │  
75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ hashbrown v0.15.5
     ├── hashlink v0.10.0
     │   └── sqlx-core v0.8.6
     │       ├── sqlx v0.8.6
     │       │   ├── infraternal v0.1.0
     │       │   └── infraternal-server v0.1.0
     │       │       └── infraternal v0.1.0 (*)
     │       ├── sqlx-macros v0.8.6
     │       │   └── sqlx v0.8.6 (*)
     │       ├── sqlx-macros-core v0.8.6
     │       │   └── sqlx-macros v0.8.6 (*)
     │       └── sqlx-sqlite v0.8.6
     │           ├── sqlx v0.8.6 (*)
     │           └── sqlx-macros-core v0.8.6 (*)
     └── sqlx-core v0.8.6 (*)
   ├ hashbrown v0.17.1
     └── indexmap v2.14.2
         └── sqlx-core v0.8.6
             ├── sqlx v0.8.6
             │   ├── infraternal v0.1.0
             │   └── infraternal-server v0.1.0
             │       └── infraternal v0.1.0 (*)
             ├── sqlx-macros v0.8.6
             │   └── sqlx v0.8.6 (*)
             ├── sqlx-macros-core v0.8.6
             │   └── sqlx-macros v0.8.6 (*)
             └── sqlx-sqlite v0.8.6
                 ├── sqlx v0.8.6 (*)
                 └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1
    │  
148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ r-efi v5.3.0
      └── getrandom v0.3.4
          └── rand_core v0.9.5
              ├── rand v0.9.5
              │   ├── infraternal-server v0.1.0
              │   │   └── infraternal v0.1.0
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              └── rand_chacha v0.9.0
                  ├── rand v0.9.5 (*)
                  └── webauthn-rs-core v0.5.5 (*)
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          └── uuid v1.27.0
              ├── infraternal-server v0.1.0
              │   └── infraternal v0.1.0
              ├── webauthn-attestation-ca v0.5.5
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              ├── webauthn-rs v0.5.5 (*)
              └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1
    │  
150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand v0.8.8
      └── bip39 v2.2.2
          └── infraternal-server v0.1.0
              └── infraternal v0.1.0
    ├ rand v0.9.5
      ├── infraternal-server v0.1.0
      │   └── infraternal v0.1.0
      └── webauthn-rs-core v0.5.5
          └── webauthn-rs v0.5.5
              └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1
    │  
152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_chacha v0.3.1
      └── rand v0.8.8
          └── bip39 v2.2.2
              └── infraternal-server v0.1.0
                  └── infraternal v0.1.0
    ├ rand_chacha v0.9.0
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   └── infraternal v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_core'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1
    │  
154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_core v0.6.4
      ├── bip39 v2.2.2
      │   └── infraternal-server v0.1.0
      │       └── infraternal v0.1.0
      ├── crypto-common v0.1.7
      │   ├── aead v0.5.2
      │   │   └── aes-gcm v0.10.3
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   ├── cipher v0.4.4
      │   │   ├── aes v0.8.4
      │   │   │   └── aes-gcm v0.10.3 (*)
      │   │   ├── aes-gcm v0.10.3 (*)
      │   │   └── ctr v0.9.2
      │   │       └── aes-gcm v0.10.3 (*)
      │   ├── digest v0.10.7
      │   │   ├── blake2 v0.10.6
      │   │   │   └── argon2 v0.5.3
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── hmac v0.12.1
      │   │   │   └── hkdf v0.12.4
      │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   │   └── sha2 v0.10.9
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── sqlx-core v0.8.6
      │   │       │   ├── sqlx v0.8.6
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── sqlx-macros v0.8.6
      │   │       │   │   └── sqlx v0.8.6 (*)
      │   │       │   ├── sqlx-macros-core v0.8.6
      │   │       │   │   └── sqlx-macros v0.8.6 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6 (*)
      │   │       │       └── sqlx-macros-core v0.8.6 (*)
      │   │       └── sqlx-macros-core v0.8.6 (*)
      │   └── universal-hash v0.5.1
      │       └── polyval v0.6.2
      │           └── ghash v0.5.1
      │               └── aes-gcm v0.10.3 (*)
      ├── password-hash v0.5.0
      │   └── argon2 v0.5.3 (*)
      ├── rand v0.8.8
      │   └── bip39 v2.2.2 (*)
      └── rand_chacha v0.3.1
          └── rand v0.8.8 (*)
    ├ rand_core v0.9.5
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   └── infraternal v0.1.0
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── rand_chacha v0.9.0
          ├── rand v0.9.5 (*)
          └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'syn'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1
    │  
181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ syn v2.0.119
      ├── asn1-rs-derive v0.5.1
      │   └── asn1-rs v0.6.2
      │       ├── der-parser v9.0.0
      │       │   ├── webauthn-rs-core v0.5.5
      │       │   │   └── webauthn-rs v0.5.5
      │       │   │       └── infraternal-server v0.1.0
      │       │   │           └── infraternal v0.1.0
      │       │   └── x509-parser v0.16.0
      │       │       └── webauthn-rs-core v0.5.5 (*)
      │       ├── oid-registry v0.7.1
      │       │   └── x509-parser v0.16.0 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── asn1-rs-impl v0.2.0
      │   └── asn1-rs v0.6.2 (*)
      ├── openssl-macros v0.1.1
      │   └── openssl v0.10.81
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5
      │       │   └── webauthn-rs-core v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── sqlx-macros v0.8.6
      │   └── sqlx v0.8.6
      │       ├── infraternal v0.1.0 (*)
      │       └── infraternal-server v0.1.0 (*)
      ├── sqlx-macros-core v0.8.6
      │   └── sqlx-macros v0.8.6 (*)
      ├── synstructure v0.13.2
      │   └── asn1-rs-derive v0.5.1 (*)
      ├── thiserror-impl v1.0.69
      │   └── thiserror v1.0.69
      │       ├── asn1-rs v0.6.2 (*)
      │       ├── webauthn-rs-core v0.5.5 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── tracing-attributes v0.1.31
      │   └── tracing v0.1.44
      │       ├── axum v0.8.9
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── axum-core v0.5.6
      │       │   └── axum v0.8.9 (*)
      │       ├── sqlx-core v0.8.6
      │       │   ├── sqlx v0.8.6 (*)
      │       │   ├── sqlx-macros v0.8.6 (*)
      │       │   ├── sqlx-macros-core v0.8.6 (*)
      │       │   └── sqlx-sqlite v0.8.6
      │       │       ├── sqlx v0.8.6 (*)
      │       │       └── sqlx-macros-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      └── zerocopy-derive v0.8.60
          └── zerocopy v0.8.60
              ├── half v2.7.1
              │   └── serde_cbor_2 v0.13.0
              │       ├── (dev) infraternal-server v0.1.0 (*)
              │       └── webauthn-rs-core v0.5.5 (*)
              └── ppv-lite86 v0.2.21
                  ├── rand_chacha v0.3.1
                  │   └── rand v0.8.8
                  │       └── bip39 v2.2.2
                  │           └── infraternal-server v0.1.0 (*)
                  └── rand_chacha v0.9.0
                      ├── rand v0.9.5
                      │   ├── infraternal-server v0.1.0 (*)
                      │   └── webauthn-rs-core v0.5.5 (*)
                      └── webauthn-rs-core v0.5.5 (*)
    ├ syn v3.0.6
      ├── clap_derive v4.6.7
      │   └── clap v4.6.7
      │       └── infraternal v0.1.0
      ├── displaydoc v0.2.7
      │   ├── asn1-rs v0.6.2
      │   │   ├── der-parser v9.0.0
      │   │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   │   └── webauthn-rs v0.5.5
      │   │   │   │       └── infraternal-server v0.1.0
      │   │   │   │           └── infraternal v0.1.0 (*)
      │   │   │   └── x509-parser v0.16.0
      │   │   │       └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── oid-registry v0.7.1
      │   │   │   └── x509-parser v0.16.0 (*)
      │   │   └── x509-parser v0.16.0 (*)
      │   ├── der-parser v9.0.0 (*)
      │   ├── icu_collections v2.3.0
      │   │   ├── icu_normalizer v2.3.0
      │   │   │   └── idna_adapter v1.2.2
      │   │   │       └── idna v1.1.0
      │   │   │           └── url v2.5.8
      │   │   │               ├── infraternal-server v0.1.0 (*)
      │   │   │               ├── sqlx-core v0.8.6
      │   │   │               │   ├── sqlx v0.8.6
      │   │   │               │   │   ├── infraternal v0.1.0 (*)
      │   │   │               │   │   └── infraternal-server v0.1.0 (*)
      │   │   │               │   ├── sqlx-macros v0.8.6
      │   │   │               │   │   └── sqlx v0.8.6 (*)
      │   │   │               │   ├── sqlx-macros-core v0.8.6
      │   │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │   │   │               │   └── sqlx-sqlite v0.8.6
      │   │   │               │       ├── sqlx v0.8.6 (*)
      │   │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-sqlite v0.8.6 (*)
      │   │   │               ├── webauthn-rs v0.5.5 (*)
      │   │   │               ├── webauthn-rs-core v0.5.5 (*)
      │   │   │               └── webauthn-rs-proto v0.5.5
      │   │   │                   └── webauthn-rs-core v0.5.5 (*)
      │   │   └── icu_properties v2.3.0
      │   │       └── idna_adapter v1.2.2 (*)
      │   ├── icu_locale_core v2.3.0
      │   │   ├── icu_properties v2.3.0 (*)
      │   │   └── icu_provider v2.3.1
      │   │       ├── icu_normalizer v2.3.0 (*)
      │   │       └── icu_properties v2.3.0 (*)
      │   ├── icu_properties v2.3.0 (*)
      │   ├── icu_provider v2.3.1 (*)
      │   ├── tinystr v0.8.4
      │   │   └── icu_locale_core v2.3.0 (*)
      │   └── zerotrie v0.2.5
      │       ├── icu_properties v2.3.0 (*)
      │       └── icu_provider v2.3.1 (*)
      ├── serde_derive v1.0.229
      │   ├── serde v1.0.229
      │   │   ├── base64urlsafedata v0.5.5
      │   │   │   ├── webauthn-attestation-ca v0.5.5
      │   │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   │   ├── bip39 v2.2.2
      │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   ├── either v1.18.0
      │   │   │   ├── sqlx-core v0.8.6 (*)
      │   │   │   └── sqlx-macros-core v0.8.6 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   ├── serde_cbor_2 v0.13.0
      │   │   │   ├── (dev) infraternal-server v0.1.0 (*)
      │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── serde_urlencoded v0.7.1
      │   │   │   ├── axum v0.8.9
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   └── sqlx-sqlite v0.8.6 (*)
      │   │   ├── sqlx-core v0.8.6 (*)
      │   │   ├── sqlx-macros-core v0.8.6 (*)
      │   │   ├── sqlx-sqlite v0.8.6 (*)
      │   │   ├── url v2.5.8 (*)
      │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   └── url v2.5.8 (*)
      ├── synstructure v0.14.0
      │   ├── yoke-derive v0.8.4
      │   │   └── yoke v0.8.3
      │   │       ├── icu_collections v2.3.0 (*)
      │   │       ├── icu_provider v2.3.1 (*)
      │   │       ├── zerotrie v0.2.5 (*)
      │   │       └── zerovec v0.11.8
      │   │           ├── icu_collections v2.3.0 (*)
      │   │           ├── icu_locale_core v2.3.0 (*)
      │   │           ├── icu_normalizer v2.3.0 (*)
      │   │           ├── icu_properties v2.3.0 (*)
      │   │           ├── icu_provider v2.3.1 (*)
      │   │           ├── potential_utf v0.1.6
      │   │           │   └── icu_collections v2.3.0 (*)
      │   │           └── tinystr v0.8.4 (*)
      │   └── zerofrom-derive v0.1.8
      │       └── zerofrom v0.1.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── yoke v0.8.3 (*)
      │           ├── zerotrie v0.2.5 (*)
      │           └── zerovec v0.11.8 (*)
      ├── thiserror-impl v2.0.21
      │   └── thiserror v2.0.21
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       └── sqlx-sqlite v0.8.6 (*)
      ├── tokio-macros v2.7.2
      │   └── tokio v1.53.2
      │       ├── axum v0.8.9 (*)
      │       ├── hyper v1.11.1
      │       │   ├── axum v0.8.9 (*)
      │       │   └── hyper-util v0.1.21
      │       │       └── axum v0.8.9 (*)
      │       ├── hyper-util v0.1.21 (*)
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-macros-core v0.8.6 (*)
      │       ├── tokio-stream v0.1.19
      │       │   └── sqlx-core v0.8.6 (*)
      │       └── tower v0.5.3
      │           ├── axum v0.8.9 (*)
      │           └── (dev) infraternal-server v0.1.0 (*)
      ├── yoke-derive v0.8.4 (*)
      ├── zerofrom-derive v0.1.8 (*)
      └── zerovec-derive v0.11.6
          └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1
    │  
184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ synstructure v0.13.2
      └── asn1-rs-derive v0.5.1
          └── asn1-rs v0.6.2
              ├── der-parser v9.0.0
              │   ├── webauthn-rs-core v0.5.5
              │   │   └── webauthn-rs v0.5.5
              │   │       └── infraternal-server v0.1.0
              │   │           └── infraternal v0.1.0
              │   └── x509-parser v0.16.0
              │       └── webauthn-rs-core v0.5.5 (*)
              ├── oid-registry v0.7.1
              │   └── x509-parser v0.16.0 (*)
              └── x509-parser v0.16.0 (*)
    ├ synstructure v0.14.0
      ├── yoke-derive v0.8.4
      │   └── yoke v0.8.3
      │       ├── icu_collections v2.3.0
      │       │   ├── icu_normalizer v2.3.0
      │       │   │   └── idna_adapter v1.2.2
      │       │   │       └── idna v1.1.0
      │       │   │           └── url v2.5.8
      │       │   │               ├── infraternal-server v0.1.0
      │       │   │               │   └── infraternal v0.1.0
      │       │   │               ├── sqlx-core v0.8.6
      │       │   │               │   ├── sqlx v0.8.6
      │       │   │               │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   ├── sqlx-macros v0.8.6
      │       │   │               │   │   └── sqlx v0.8.6 (*)
      │       │   │               │   ├── sqlx-macros-core v0.8.6
      │       │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │       │   │               │   └── sqlx-sqlite v0.8.6
      │       │   │               │       ├── sqlx v0.8.6 (*)
      │       │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-sqlite v0.8.6 (*)
      │       │   │               ├── webauthn-rs v0.5.5
      │       │   │               │   └── infraternal-server v0.1.0 (*)
      │       │   │               ├── webauthn-rs-core v0.5.5
      │       │   │               │   └── webauthn-rs v0.5.5 (*)
      │       │   │               └── webauthn-rs-proto v0.5.5
      │       │   │                   └── webauthn-rs-core v0.5.5 (*)
      │       │   └── icu_properties v2.3.0
      │       │       └── idna_adapter v1.2.2 (*)
      │       ├── icu_provider v2.3.1
      │       │   ├── icu_normalizer v2.3.0 (*)
      │       │   └── icu_properties v2.3.0 (*)
      │       ├── zerotrie v0.2.5
      │       │   ├── icu_properties v2.3.0 (*)
      │       │   └── icu_provider v2.3.1 (*)
      │       └── zerovec v0.11.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_locale_core v2.3.0
      │           │   ├── icu_properties v2.3.0 (*)
      │           │   └── icu_provider v2.3.1 (*)
      │           ├── icu_normalizer v2.3.0 (*)
      │           ├── icu_properties v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── potential_utf v0.1.6
      │           │   └── icu_collections v2.3.0 (*)
      │           └── tinystr v0.8.4
      │               └── icu_locale_core v2.3.0 (*)
      └── zerofrom-derive v0.1.8
          └── zerofrom v0.1.8
              ├── icu_collections v2.3.0 (*)
              ├── icu_provider v2.3.1 (*)
              ├── yoke v0.8.3 (*)
              ├── zerotrie v0.2.5 (*)
              └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1
    │  
186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror v1.0.69
      ├── asn1-rs v0.6.2
      │   ├── der-parser v9.0.0
      │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   └── webauthn-rs v0.5.5
      │   │   │       └── infraternal-server v0.1.0
      │   │   │           └── infraternal v0.1.0
      │   │   └── x509-parser v0.16.0
      │   │       └── webauthn-rs-core v0.5.5 (*)
      │   ├── oid-registry v0.7.1
      │   │   └── x509-parser v0.16.0 (*)
      │   └── x509-parser v0.16.0 (*)
      ├── webauthn-rs-core v0.5.5 (*)
      └── x509-parser v0.16.0 (*)
    ├ thiserror v2.0.21
      ├── infraternal-server v0.1.0
      │   └── infraternal v0.1.0
      ├── sqlx-core v0.8.6
      │   ├── sqlx v0.8.6
      │   │   ├── infraternal v0.1.0 (*)
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── sqlx-macros v0.8.6
      │   │   └── sqlx v0.8.6 (*)
      │   ├── sqlx-macros-core v0.8.6
      │   │   └── sqlx-macros v0.8.6 (*)
      │   └── sqlx-sqlite v0.8.6
      │       ├── sqlx v0.8.6 (*)
      │       └── sqlx-macros-core v0.8.6 (*)
      └── sqlx-sqlite v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
    ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1
    │  
188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror-impl v1.0.69
      └── thiserror v1.0.69
          ├── asn1-rs v0.6.2
          │   ├── der-parser v9.0.0
          │   │   ├── webauthn-rs-core v0.5.5
          │   │   │   └── webauthn-rs v0.5.5
          │   │   │       └── infraternal-server v0.1.0
          │   │   │           └── infraternal v0.1.0
          │   │   └── x509-parser v0.16.0
          │   │       └── webauthn-rs-core v0.5.5 (*)
          │   ├── oid-registry v0.7.1
          │   │   └── x509-parser v0.16.0 (*)
          │   └── x509-parser v0.16.0 (*)
          ├── webauthn-rs-core v0.5.5 (*)
          └── x509-parser v0.16.0 (*)
    ├ thiserror-impl v2.0.21
      └── thiserror v2.0.21
          ├── infraternal-server v0.1.0
          │   └── infraternal v0.1.0
          ├── sqlx-core v0.8.6
          │   ├── sqlx v0.8.6
          │   │   ├── infraternal v0.1.0 (*)
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── sqlx-macros v0.8.6
          │   │   └── sqlx v0.8.6 (*)
          │   ├── sqlx-macros-core v0.8.6
          │   │   └── sqlx-macros v0.8.6 (*)
          │   └── sqlx-sqlite v0.8.6
          │       ├── sqlx v0.8.6 (*)
          │       └── sqlx-macros-core v0.8.6 (*)
          └── sqlx-sqlite v0.8.6 (*)

advisories ok, bans ok, licenses ok, sources ok

==> static builds
    Finished `release` profile [optimized] target(s) in 0.18s
target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 9322720 bytes
    Finished `release` profile [optimized] target(s) in 0.16s
target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 7809800 bytes
server subcommand: exit 2, not implemented
agent subcommand: exit 2, not implemented

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
Second independent review finished: verdict MERGE for the scoped auth library lane. Head ce3359ceab19684d5e11366aee5a1f02bac650d2, base 386acfd3dc6255c7f58f98b4f114d5d7326292ad. B1/B2/B3 and Chromium S2 fixed; S1 polling isolation passes; physical Safari/iPhone and functioning infraternal-agent idle RSS remain future integration evidence, not claimed complete. All 13 commits independently pass the requested fast command; temporary /tmp worktree removed. Original recovery reproduction passes, 1/0 in 2.21 s; retained deterministic replacement regression passes; browser 4/4 on Chromium 149.0.7827.55. Size recommendation: Keep webauthn-rs with vendored OpenSSL for this lane: the measured parked-runtime baseline is about 4.8 MiB RSS, while neither evaluated alternative currently provides a reviewed, gate-passing replacement with demonstrated parity for this auth policy. Revisit webauthn_rp in a separate migration after a security review of a current released version, PRF/browser/counter/backup-policy compatibility tests and resolution of its RSA advisory gate; its smaller prototype makes that investigation worthwhile, at the cost of migration and security-review work. Measured x86 file 9,322,720 bytes / aarch64 7,809,800; PT_INTERP absent. OpenSSL linked text 2,447,122 bytes, SQLite 1,345,533; whole .text 6,304,536. Actual agent stub has no idle state (exits 2); separately parked same-source/runtime probe is 9,322,720 bytes, RSS 4,920 KiB over 30 seconds, nine threads, not proof of completed daemon budget. RP prototype 1,174,496 bytes, but cargo-deny fails rsa advisory; passkey/types have no RP verifier. Unloaded release session n=200 p50 79 us/p99 273 us; Argon2 21 ms. Report: /home/kayg/.local/state/codex-jobs/infraternal/review-auth2/findings.md. Full evidence target/review-auth2/. No tracked changes, push, deploy, decisions edited or issue closure. Final fast command exit 0; unedited gate output follows verbatim: ```text ==> fmt ==> clippy Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.19s ==> test Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s Running unittests src/main.rs (target/debug/deps/infraternal-910a6a8c515fe2b1) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_agent-eadaa10b8c42bfd9) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-4480fd7032f11ca2) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-22a9a893799c7f17) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-342516d5dbf00714) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_server-586b711bb7c7a9de) running 12 tests test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok test auth::tests::review_old_words_race_rotation ... ok test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok test auth::tests::setup_expiry_single_announcement_and_parallel_redemption ... ok test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.94s Running unittests src/lib.rs (target/debug/deps/infraternal_shim-2036f3f8f778c3eb) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_agent running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_api running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_ssh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_protocol running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_server running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_shim running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ==> cargo-deny warning[duplicate]: found 2 duplicate entries for crate 'base64' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:20:1 │ 20 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index 21 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────┘ lock entries │ ├ base64 v0.21.7 ├── base64urlsafedata v0.5.5 │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ ├── webauthn-rs v0.5.5 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-proto v0.5.5 │ └── webauthn-rs-core v0.5.5 (*) ├── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-proto v0.5.5 (*) ├ base64 v0.22.1 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 3 duplicate entries for crate 'getrandom' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:70:1 │ 70 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index 71 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index 72 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ getrandom v0.2.17 └── rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'hashbrown' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:75:1 │ 75 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index 76 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ hashbrown v0.15.5 ├── hashlink v0.10.0 │ └── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-core v0.8.6 (*) ├ hashbrown v0.17.1 └── indexmap v2.14.2 └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'r-efi' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:148:1 │ 148 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index 149 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ r-efi v5.3.0 └── getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ r-efi v6.0.0 └── getrandom v0.4.3 └── uuid v1.27.0 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── webauthn-attestation-ca v0.5.5 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:150:1 │ 150 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index 151 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 └── infraternal v0.1.0 ├ rand v0.9.5 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 └── webauthn-rs-core v0.5.5 └── webauthn-rs v0.5.5 └── infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:152:1 │ 152 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index 153 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_chacha v0.3.1 └── rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 └── infraternal v0.1.0 ├ rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_core' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:154:1 │ 154 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index 155 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'syn' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:181:1 │ 181 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index 182 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────┘ lock entries │ ├ syn v2.0.119 ├── asn1-rs-derive v0.5.1 │ └── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── asn1-rs-impl v0.2.0 │ └── asn1-rs v0.6.2 (*) ├── openssl-macros v0.1.1 │ └── openssl v0.10.81 │ ├── infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) ├── synstructure v0.13.2 │ └── asn1-rs-derive v0.5.1 (*) ├── thiserror-impl v1.0.69 │ └── thiserror v1.0.69 │ ├── asn1-rs v0.6.2 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── x509-parser v0.16.0 (*) ├── tracing-attributes v0.1.31 │ └── tracing v0.1.44 │ ├── axum v0.8.9 │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-core v0.5.6 │ │ └── axum v0.8.9 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ ├── sqlx-macros v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) └── zerocopy-derive v0.8.60 └── zerocopy v0.8.60 ├── half v2.7.1 │ └── serde_cbor_2 v0.13.0 │ ├── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── ppv-lite86 v0.2.21 ├── rand_chacha v0.3.1 │ └── rand v0.8.8 │ └── bip39 v2.2.2 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ syn v3.0.6 ├── clap_derive v4.6.7 │ └── clap v4.6.7 │ └── infraternal v0.1.0 ├── displaydoc v0.2.7 │ ├── asn1-rs v0.6.2 │ │ ├── der-parser v9.0.0 │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ └── x509-parser v0.16.0 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── oid-registry v0.7.1 │ │ │ └── x509-parser v0.16.0 (*) │ │ └── x509-parser v0.16.0 (*) │ ├── der-parser v9.0.0 (*) │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── tinystr v0.8.4 │ │ └── icu_locale_core v2.3.0 (*) │ └── zerotrie v0.2.5 │ ├── icu_properties v2.3.0 (*) │ └── icu_provider v2.3.1 (*) ├── serde_derive v1.0.229 │ ├── serde v1.0.229 │ │ ├── base64urlsafedata v0.5.5 │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 (*) │ │ ├── bip39 v2.2.2 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── either v1.18.0 │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── serde_cbor_2 v0.13.0 │ │ │ ├── (dev) infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── serde_urlencoded v0.7.1 │ │ │ ├── axum v0.8.9 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ ├── sqlx-core v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ ├── url v2.5.8 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ ├── webauthn-rs v0.5.5 (*) │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ └── webauthn-rs-proto v0.5.5 (*) │ └── url v2.5.8 (*) ├── synstructure v0.14.0 │ ├── yoke-derive v0.8.4 │ │ └── yoke v0.8.3 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── zerotrie v0.2.5 (*) │ │ └── zerovec v0.11.8 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_locale_core v2.3.0 (*) │ │ ├── icu_normalizer v2.3.0 (*) │ │ ├── icu_properties v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── potential_utf v0.1.6 │ │ │ └── icu_collections v2.3.0 (*) │ │ └── tinystr v0.8.4 (*) │ └── zerofrom-derive v0.1.8 │ └── zerofrom v0.1.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── yoke v0.8.3 (*) │ ├── zerotrie v0.2.5 (*) │ └── zerovec v0.11.8 (*) ├── thiserror-impl v2.0.21 │ └── thiserror v2.0.21 │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 (*) ├── tokio-macros v2.7.2 │ └── tokio v1.53.2 │ ├── axum v0.8.9 (*) │ ├── hyper v1.11.1 │ │ ├── axum v0.8.9 (*) │ │ └── hyper-util v0.1.21 │ │ └── axum v0.8.9 (*) │ ├── hyper-util v0.1.21 (*) │ ├── infraternal v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ └── tower v0.5.3 │ ├── axum v0.8.9 (*) │ └── (dev) infraternal-server v0.1.0 (*) ├── yoke-derive v0.8.4 (*) ├── zerofrom-derive v0.1.8 (*) └── zerovec-derive v0.11.6 └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'synstructure' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:184:1 │ 184 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index 185 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ synstructure v0.13.2 └── asn1-rs-derive v0.5.1 └── asn1-rs v0.6.2 ├── der-parser v9.0.0 │ ├── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ └── infraternal v0.1.0 │ └── x509-parser v0.16.0 │ └── webauthn-rs-core v0.5.5 (*) ├── oid-registry v0.7.1 │ └── x509-parser v0.16.0 (*) └── x509-parser v0.16.0 (*) ├ synstructure v0.14.0 ├── yoke-derive v0.8.4 │ └── yoke v0.8.3 │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ └── infraternal v0.1.0 │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── zerotrie v0.2.5 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ └── zerovec v0.11.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ ├── icu_normalizer v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── potential_utf v0.1.6 │ │ └── icu_collections v2.3.0 (*) │ └── tinystr v0.8.4 │ └── icu_locale_core v2.3.0 (*) └── zerofrom-derive v0.1.8 └── zerofrom v0.1.8 ├── icu_collections v2.3.0 (*) ├── icu_provider v2.3.1 (*) ├── yoke v0.8.3 (*) ├── zerotrie v0.2.5 (*) └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:186:1 │ 186 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index 187 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror v2.0.21 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl' ┌─ /home/kayg/Developer/infraternal/.worktrees/lane-auth/Cargo.lock:188:1 │ 188 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index 189 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror-impl v1.0.69 └── thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ └── infraternal v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror-impl v2.0.21 └── thiserror v2.0.21 ├── infraternal-server v0.1.0 │ └── infraternal v0.1.0 ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-sqlite v0.8.6 (*) advisories ok, bans ok, licenses ok, sources ok ==> static builds Finished `release` profile [optimized] target(s) in 0.18s target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 9322720 bytes Finished `release` profile [optimized] target(s) in 0.16s target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 7809800 bytes server subcommand: exit 2, not implemented agent subcommand: exit 2, not implemented +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ```
kayg commented 2026-10-06 11:30:52 +00:00
Author
Owner
Copy link

Merged into dev as 7668d0c (after 188c805, the s1-base merge). Gate on the merge result: fmt, clippy, test, cargo-deny, static builds all PASS. Passkey crypto: webauthn-rs with OpenSSL, approved by the owner (DECISIONS 86).

Merged into `dev` as `7668d0c` (after `188c805`, the s1-base merge). Gate on the merge result: fmt, clippy, test, cargo-deny, static builds all PASS. Passkey crypto: webauthn-rs with OpenSSL, approved by the owner (DECISIONS 86).
kayg commented 2026-10-28 17:52:10 +00:00
Author
Owner
Copy link

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Auth lane merged to dev as 7668d0c (verified in dev) after rework and second review verdict MERGE; D86 approved crypto. Reopen if anything is still missing.

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Auth lane merged to dev as 7668d0c (verified in dev) after rework and second review verdict MERGE; D86 approved crypto. Reopen if anything is still missing.
kayg closed this issue 2026-10-28 17:52:10 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
Labels
Clear labels   
launch-qa
Findings from launch QA.

No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#17
No description provided.