dependency refresh 2026-11

kayg commented

2026-11-07 06:25:38 +00:00

Owner

J340: inventory and refresh Rust, JS/TS, Nix, Zig and CI dependencies from origin/dev in atomic verified batches. Exclude libghostty-vt (J339). Report GotaTun fork ancestry only; defer security-sensitive major migrations. No merge or deployment.

kayg commented

2026-11-07 06:26:03 +00:00

Author

Owner

J340 started on deps-refresh-340 from origin/dev 3644950b8e. Plan: inventory registries/advisories and fork ancestry (~30 min), compatible Rust then JS then Nix updates with per-batch quick/license/duplicate/static checks (~2–3 h plus queue), isolated safe major updates (~1 h), final fast gate and report (~1 h plus queue). Estimate 4–6 h active work; stop/report at 2x. Exclude libghostty-vt (J339), no foundational replacements, no security-sensitive major code migrations. dev-02 slot free; compute01 five busy slots and five queued. One target per job; evidence under ~/.cache/codex-scratch/J340/evidence on the VM. User explicitly permits full gates on either VM; common brief notes historical dev-02 nf_tables failures, so prove any relevant failure before claiming a gate.

J340 started on deps-refresh-340 from origin/dev 3644950b8e4b5dddeefba350f97a3892189ca193. Plan: inventory registries/advisories and fork ancestry (~30 min), compatible Rust then JS then Nix updates with per-batch quick/license/duplicate/static checks (~2–3 h plus queue), isolated safe major updates (~1 h), final fast gate and report (~1 h plus queue). Estimate 4–6 h active work; stop/report at 2x. Exclude libghostty-vt (J339), no foundational replacements, no security-sensitive major code migrations. dev-02 slot free; compute01 five busy slots and five queued. One target per job; evidence under ~/.cache/codex-scratch/J340/evidence on the VM. User explicitly permits full gates on either VM; common brief notes historical dev-02 nf_tables failures, so prove any relevant failure before claiming a gate.

kayg commented

2026-11-07 06:27:46 +00:00

Author

Owner

Finding: baseline bun audit (bun 1.4.2, apps/tracer) reports 5 advisories. ws 8.18.3: GHSA-58qx-3vcg-4xpx moderate uninitialized memory disclosure (<8.20.1), GHSA-96hv-2xvq-fx4p high fragment/chunk memory exhaustion (<8.21.0). geist > next 16.3.8: GHSA-p3m5-59mp-jv5r high Server Actions DoS, GHSA-2464-fhr4-w9xw critical image optimization SVG RCE, GHSA-673q-mjm6-r5xr critical use-cache typed-array RCE (all affected through 16.4.0). Raw receipts: dev-02 ~/.cache/codex-scratch/J340/evidence/bun-audit-before.txt and bun-outdated-before.txt. Evaluating actual reachability and same-major fixes; no advisory ignores will be added. Launcher passed on dev-02: cargo 1.99.0 (5f94df478 2026-08-27).

kayg commented

2026-11-07 06:30:02 +00:00

Author

Owner

Finding: cargo audit 0.22.2 reports RUSTSEC-2023-0071 (rsa 0.9.10, Marvin timing-sidechannel key recovery, CVSS 5.9, no fixed upgrade). cargo deny check advisories reports advisories ok; cargo tree --locked -i rsa --target all reports nothing to print, so rsa is lockfile-only rather than in the selected workspace graph. No suppression added. Evidence on dev-02: ~/.cache/codex-scratch/J340/evidence/cargo-audit-before.txt, cargo-advisories-before.txt, rsa-tree-before.txt. Baseline Cargo.lock duplicate count: 54 names with multiple versions, 60 excess package versions (548 external entries). Initial compatible cargo update dry run proposes 49 packages, including tokio 1.53.3→1.54.1 and OpenSSL 0.10.81→0.10.82. Baseline static builds are running on dev-02 after a passing quick precheck.

kayg commented

2026-11-07 06:31:21 +00:00

Author

Owner

Finding: the shipped GotaTun pin 84b7bb28e385d57dfb80493e78202898fad24d1e forks from upstream 1d46b779f5e0743f30a13cc2c325b8114b901fb9 (Release 0.10.2, 2026-10-20). Upstream main is 16937ec6219afbece5aa69ece91f41e12d04d3c5 (2026-11-04): 14 upstream commits after our base; our shipped pin has 19 fork commits after it. Upstream changes include splitting packet and crypto into separate crates and RISC-V CI. Report only; neither fork base nor our dependency pin changed. Receipt: compute01 ~/.cache/codex-scratch/J340/evidence/gotatun-ancestry.txt. Fork default main is 2a867b3, distinct from the pinned integration branch, so default-branch behind counts alone would misdescribe the shipped dependency.

kayg commented

2026-11-07 06:34:42 +00:00

Author

Owner

J340 inventory, before updates, base 3644950b8e4b5dddeefba350f97a3892189ca193.

Registry inventory covers every registry package in root Cargo.lock (464 distinct names; zero lookup errors), including transitive and target-only packages. Multiple rows show existing duplicate versions, not separate update requests. Breaking gaps include 0.x minor-series changes. Transitive constraints remain owned by their parent dependency; no forced foundational replacements.

Other dependency	Current	Latest observed	Gap / qualification
Vendored russh	0.64.1 plus transport patch	0.65.1	breaking; preserve audited patch and review SSH security API separately
Vendored russh-sftp	2.1.1	3.0.1	major; source patch must be preserved and reviewed
nixpkgs unstable	885ba4d038f10c3d17d7a92e8c3cc185b99c9158	6dadaf4375be35033e1c84395adbd53ff5fded96	rolling revision
rust-overlay	96a0986b0486341fbc163fa2fabc6d3b44cdcbf1	74cebce67ef6671ea48fda353a5be2d229bd2920	rolling revision
Zig, scripts/auth-toolchain and nix/zig.nix	0.15.2	0.17.1	two breaking 0.x series; coupled to native VT build and J339, leave pinned pending compatibility proof
CI container	node:22-bookworm	Node 26 series	major; exact latest patch and runner compatibility under review
CI checkout	Forgejo actions/checkout@v4	v7.0.1	major; action-runtime and runner compatibility under review
CI cache	Forgejo actions/cache@v4	v6.1.0	major; action-runtime and cache-server compatibility under review
GotaTun fork base	upstream 1d46b779f5e0743f30a13cc2c325b8114b901fb9, release 0.10.2	upstream 16937ec6219afbece5aa69ece91f41e12d04d3c5	14 upstream commits behind; 19 fork commits ahead; report only
libghostty-vt	0.2.2 Rust wrapper plus separately pinned native source	J339 handles native 1.0	explicitly excluded; no changes

JS manifests under packages/ui and packages/protocol declare no external dependencies. apps/tracer/vendor/ghostty-web is checked-in source with a build package, not an independent installed lockfile. scripts/browser-auth is included because it participates in the gates. There are no npm/yarn/pnpm lockfiles under apps or packages.

Raw registry responses, bun outdated, bun audit, cargo audit, cargo deny check advisories, nix flake metadata --json, and upstream changelogs are saved on dev-02 under ~/.cache/codex-scratch/J340/evidence/. GotaTun ancestry receipt is under the same path on compute01.

Baseline duplicates: 54 crate names / 60 excess versions. Rust audit: RUSTSEC-2023-0071, rsa 0.9.10, no fixed release, lockfile-only in the current graph; cargo-deny advisories pass. JS audit: 5 advisories, described in the earlier finding comment. No advisory suppression or license-list expansion is planned.

Full Rust and JS tables follow.

Rust crate	Locked	Latest stable	Semver gap
adler2	2.0.1	2.0.1	current
aead	0.5.2	0.6.1	breaking
aead	0.6.1	0.6.1	current
aes	0.8.4	0.9.4	breaking
aes	0.9.3	0.9.4	patch
aes-gcm	0.10.3	0.11.1	breaking
aes-gcm	0.11.1	0.11.1	current
aho-corasick	1.1.5	1.1.5	current
alacritty_terminal	0.25.1	0.26.0	breaking
allocator-api2	0.2.21	0.4.0	breaking
android_system_properties	0.1.6	0.1.6	current
anes	0.1.6	0.2.1	breaking
anstream	1.0.0	1.0.0	current
anstyle	1.0.14	1.0.14	current
anstyle-parse	1.0.0	1.0.0	current
anstyle-query	1.1.5	1.1.5	current
anstyle-wincon	3.0.11	3.0.11	current
apple-cf	0.11.7	0.11.7	current
apple-metal	0.10.4	0.10.4	current
arbitrary	1.4.2	1.5.0	minor
arc-swap	1.9.2	1.9.3	patch
argon2	0.5.3	0.6.0	breaking
argon2	0.6.0	0.6.0	current
arrayvec	0.7.8	0.7.8	current
asn1-rs	0.6.2	0.7.2	breaking
asn1-rs-derive	0.5.1	0.7.0	breaking
asn1-rs-impl	0.2.0	0.3.0	breaking
atoi	2.0.0	3.1.1	breaking
atomic-waker	1.1.2	1.1.2	current
autocfg	1.5.1	1.5.1	current
axum	0.8.9	0.8.9	current
axum-core	0.5.6	0.5.6	current
axum-server	0.8.0	0.9.0	breaking
base16ct	1.0.0	1.0.0	current
base64	0.21.7	0.23.1	breaking
base64	0.22.1	0.23.1	breaking
base64ct	1.8.3	1.8.3	current
base64urlsafedata	0.5.5	0.6.2	breaking
bcrypt-pbkdf	0.11.0	0.11.0	current
bip39	2.2.2	3.0.0	breaking
bitcoin_hashes	0.14.101	1.2.0	breaking
bitfield-struct	0.12.1	0.13.0	breaking
bitflags	2.13.2	2.13.2	current
blake2	0.10.6	0.11.0	breaking
blake2	0.11.0	0.11.0	current
block-buffer	0.10.4	0.12.1	breaking
block-buffer	0.12.1	0.12.1	current
block-padding	0.4.2	0.4.2	current
blowfish	0.10.0	0.10.0	current
bumpalo	3.20.3	3.20.3	current
byteorder	1.5.0	1.5.0	current
bytes	1.12.1	1.12.1	current
cast	0.3.0	0.3.0	current
cbc	0.2.1	0.2.1	current
cc	1.6.0	1.11.1	minor
cfg-if	1.0.5	1.0.5	current
cfg_aliases	0.2.2	0.2.2	current
chacha20	0.9.1	0.10.2	breaking
chacha20	0.10.2	0.10.2	current
chacha20poly1305	0.10.1	0.11.0	breaking
chrono	0.4.45	0.4.45	current
ciborium	0.2.2	0.2.2	current
ciborium-io	0.2.2	0.2.2	current
ciborium-ll	0.2.2	0.2.2	current
cipher	0.4.4	0.5.2	breaking
cipher	0.5.2	0.5.2	current
clap	4.6.7	4.6.7	current
clap_builder	4.6.7	4.6.7	current
clap_derive	4.6.7	4.6.7	current
clap_lex	1.1.1	1.1.1	current
cmov	0.5.4	0.5.4	current
colorchoice	1.0.5	1.0.5	current
combine	4.6.9	4.6.9	current
concurrent-queue	2.5.0	2.5.0	current
const-oid	0.9.6	0.10.2	breaking
const-oid	0.10.2	0.10.2	current
constant_time_eq	0.4.2	0.6.1	breaking
core-foundation	0.10.1	0.10.1	current
core-foundation-sys	0.8.7	0.8.7	current
cpubits	0.1.1	0.1.1	current
cpufeatures	0.2.17	0.3.1	breaking
cpufeatures	0.3.1	0.3.1	current
crc	3.4.0	3.4.0	current
crc-catalog	2.5.0	2.5.0	current
crc32fast	1.5.3	1.5.4	patch
criterion	0.7.0	0.8.2	breaking
criterion-plot	0.6.0	0.8.2	breaking
critical-section	1.2.0	1.2.0	current
crossbeam-deque	0.8.8	0.8.8	current
crossbeam-epoch	0.9.21	0.9.21	current
crossbeam-queue	0.3.14	0.3.14	current
crossbeam-utils	0.8.23	0.8.23	current
crunchy	0.2.4	0.2.4	current
crypto-bigint	0.7.10	0.7.10	current
crypto-common	0.1.7	0.2.2	breaking
crypto-common	0.2.2	0.2.2	current
ctr	0.9.2	0.10.1	breaking
ctr	0.10.1	0.10.1	current
ctutils	0.4.7	0.4.8	patch
cursor-icon	1.2.0	1.2.0	current
curve25519-dalek	4.1.3	5.0.0	breaking
curve25519-dalek	5.0.0	5.0.0	current
curve25519-dalek-derive	0.1.1	0.1.1	current
dashmap	6.2.1	6.2.1	current
data-encoding	2.11.1	2.11.1	current
delegate	0.13.5	0.13.5	current
der	0.7.10	0.8.3	breaking
der	0.8.3	0.8.3	current
der-parser	9.0.0	10.0.0	breaking
deranged	0.5.8	0.5.9	patch
des	0.9.0	0.9.0	current
digest	0.10.7	0.11.3	breaking
digest	0.11.3	0.11.3	current
displaydoc	0.2.7	0.2.7	current
doom-fish-utils	0.4.3	0.4.3	current
dotenvy	0.15.7	0.15.7	current
duplicate	2.0.1	2.0.1	current
ecdsa	0.17.0	0.17.0	current
ed25519	3.0.0	3.0.0	current
ed25519-dalek	3.0.0	3.0.0	current
either	1.18.0	1.19.0	minor
elliptic-curve	0.14.3	0.14.3	current
enum-as-inner	0.6.1	0.7.0	breaking
enum_dispatch	0.3.13	0.3.13	current
equivalent	1.0.2	1.0.3	patch
errno	0.3.14	0.3.14	current
etcetera	0.8.0	0.11.0	breaking
event-listener	5.4.2	5.4.2	current
eyre	0.6.14	0.6.14	current
fastrand	2.5.0	2.5.0	current
ff	0.14.0	0.14.0	current
fiat-crypto	0.2.9	0.3.0	breaking
fiat-crypto	0.3.0	0.3.0	current
filetime	0.2.29	0.2.29	current
find-msvc-tools	0.1.14	0.1.15	patch
flate2	1.1.10	1.1.11	patch
flume	0.11.1	0.12.0	breaking
fnv	1.0.7	1.0.7	current
foldhash	0.1.5	0.2.0	breaking
foreign-types	0.3.2	0.5.0	breaking
foreign-types-shared	0.1.1	0.3.1	breaking
form_urlencoded	1.2.2	1.2.2	current
fs-err	3.3.2	3.3.2	current
futures	0.3.34	0.3.34	current
futures-channel	0.3.34	0.3.34	current
futures-core	0.3.34	0.3.34	current
futures-executor	0.3.34	0.3.34	current
futures-intrusive	0.5.0	0.5.0	current
futures-io	0.3.34	0.3.34	current
futures-macro	0.3.34	0.3.34	current
futures-sink	0.3.34	0.3.34	current
futures-task	0.3.34	0.3.34	current
futures-util	0.3.34	0.3.34	current
generic-array	0.14.7	1.4.5	breaking
generic-array	1.4.5	1.4.5	current
getrandom	0.2.17	0.4.3	breaking
getrandom	0.3.4	0.4.3	breaking
getrandom	0.4.3	0.4.3	current
ghash	0.5.1	0.6.0	breaking
ghash	0.6.0	0.6.0	current
gloo-timers	0.4.0	0.4.0	current
group	0.14.0	0.14.0	current
h2	0.4.19	0.4.20	patch
half	2.7.1	2.7.1	current
hashbrown	0.14.5	0.17.1	breaking
hashbrown	0.15.5	0.17.1	breaking
hashbrown	0.17.1	0.17.1	current
hashlink	0.10.0	0.12.2	breaking
heck	0.5.0	0.5.0	current
hermit-abi	0.5.3	0.5.3	current
hex	0.4.3	0.4.3	current
hex-conservative	0.2.3	1.3.0	breaking
hex-literal	1.1.0	1.1.0	current
hickory-proto	0.26.3	0.26.3	current
hkdf	0.12.4	0.13.0	breaking
hkdf	0.13.0	0.13.0	current
hmac	0.12.1	0.13.0	breaking
hmac	0.13.0	0.13.0	current
home	0.5.12	0.5.12	current
http	1.5.0	1.5.0	current
http-body	1.1.0	1.1.0	current
http-body-util	0.1.5	0.1.5	current
http-range-header	0.4.2	1.0.0	breaking
httparse	1.10.1	1.10.1	current
httpdate	1.0.3	1.0.3	current
hybrid-array	0.4.15	0.4.15	current
hyper	1.11.1	1.12.0	minor
hyper-util	0.1.21	0.1.21	current
iana-time-zone	0.1.65	0.1.65	current
iana-time-zone-haiku	0.1.2	0.1.2	current
icu_collections	2.3.0	2.4.0	minor
icu_locale_core	2.3.0	2.4.0	minor
icu_normalizer	2.3.0	2.4.0	minor
icu_normalizer_data	2.3.0	2.4.0	minor
icu_properties	2.3.0	2.4.0	minor
icu_properties_data	2.3.0	2.4.0	minor
icu_provider	2.3.1	2.4.0	minor
idna	1.1.0	1.1.0	current
idna_adapter	1.2.2	1.2.2	current
indenter	0.3.4	0.3.4	current
indexmap	2.14.2	2.14.2	current
inout	0.1.4	0.2.5	breaking
inout	0.2.5	0.2.5	current
int-enum	1.2.0	1.3.0	minor
ip_network	0.4.1	0.4.1	current
ip_network_table	0.2.0	0.2.0	current
ip_network_table-deps-treebitmap	0.5.0	0.5.0	current
ipnet	2.12.2	2.12.2	current
ipnetwork	0.21.1	0.21.1	current
is_terminal_polyfill	1.70.2	1.70.2	current
itertools	0.13.0	0.15.0	breaking
itoa	1.0.18	1.0.18	current
jni	0.22.4	0.22.4	current
jni-macros	0.22.4	0.22.4	current
jni-sys	0.4.1	0.4.1	current
jni-sys-macros	0.4.1	0.4.1	current
jobserver	0.1.35	0.1.35	current
js-sys	0.3.107	0.3.107	current
keccak	0.2.2	0.2.2	current
kem	0.3.0	0.3.0	current
lazy_static	1.5.1	1.5.1	current
libc	0.2.190	0.2.191	patch
libfuzzer-sys	0.4.13	0.4.13	current
libghostty-vt	0.2.2	0.2.2	current
libghostty-vt-sys	0.2.2	0.2.2	current
libm	0.2.16	0.2.16	current
libredox	0.1.25	0.2.0	breaking
libsqlite3-sys	0.30.1	0.39.1	breaking
linux-raw-sys	0.12.1	0.12.1	current
litemap	0.8.3	0.8.3	current
lock_api	0.4.14	0.5.0	breaking
log	0.4.34	0.4.35	patch
lru-slab	0.1.3	0.1.3	current
matchers	0.2.0	0.2.0	current
matchit	0.8.4	0.9.2	breaking
md-5	0.10.6	0.11.0	breaking
md5	0.8.1	0.8.1	current
memchr	2.8.3	2.8.3	current
memoffset	0.9.1	0.9.1	current
mime	0.3.17	0.3.18	patch
mime_guess	2.0.5	2.0.5	current
minimal-lexical	0.2.1	0.2.1	current
miniz_oxide	0.9.1	0.9.1	current
mio	1.2.4	1.2.4	current
miow	0.6.1	0.6.1	current
ml-kem	0.3.4	0.3.4	current
module-lattice	0.2.4	0.2.4	current
nix	0.30.1	0.31.3	breaking
nix	0.31.3	0.31.3	current
nom	7.1.3	8.0.0	breaking
nu-ansi-term	0.50.3	0.50.3	current
num-bigint	0.4.8	0.5.1	breaking
num-bigint	0.5.1	0.5.1	current
num-bigint-dig	0.8.6	0.9.1	breaking
num-conv	0.2.2	0.2.2	current
num-integer	0.1.47	0.1.47	current
num-iter	0.1.46	0.1.46	current
num-traits	0.2.19	0.2.19	current
oid-registry	0.7.1	0.8.1	breaking
once_cell	1.21.4	1.21.4	current
once_cell_polyfill	1.70.2	1.70.2	current
oorandom	11.1.5	11.1.5	current
opaque-debug	0.3.1	0.4.0	breaking
openssl	0.10.81	0.10.82	patch
openssl-macros	0.1.1	0.1.1	current
openssl-src	300.6.1+3.6.3	110.0.0	ahead of registry
openssl-sys	0.9.117	0.9.118	patch
p256	0.14.0	0.14.0	current
p384	0.14.0	0.14.0	current
p521	0.14.0	0.14.0	current
pageant	0.2.5	0.2.5	current
parking	2.2.1	2.2.1	current
parking_lot	0.12.5	0.13.0	breaking
parking_lot_core	0.9.12	0.10.0	breaking
password-hash	0.5.0	0.6.1	breaking
password-hash	0.6.1	0.6.1	current
pastey	0.1.1	0.2.3	breaking
pbkdf2	0.13.0	0.13.0	current
pem-rfc7468	0.7.0	1.0.0	breaking
pem-rfc7468	1.0.0	1.0.0	current
percent-encoding	2.3.2	2.3.2	current
phc	0.6.1	0.6.1	current
pin-project-lite	0.2.17	0.2.17	current
piper	0.2.5	0.2.5	current
pkcs1	0.7.5	0.8.0	breaking
pkcs5	0.8.1	0.8.1	current
pkcs8	0.10.2	0.11.0	breaking
pkcs8	0.11.0	0.11.0	current
pkg-config	0.3.34	0.3.34	current
plain	0.2.3	0.2.3	current
plotters	0.3.7	0.3.7	current
plotters-backend	0.3.7	0.3.7	current
plotters-svg	0.3.7	0.3.7	current
polling	3.11.0	3.11.0	current
poly1305	0.8.0	0.9.1	breaking
poly1305	0.9.1	0.9.1	current
polyval	0.6.2	0.7.3	breaking
polyval	0.7.3	0.7.3	current
portable-atomic	1.15.0	1.15.0	current
potential_utf	0.1.6	0.1.6	current
powerfmt	0.2.1	0.2.1	current
ppv-lite86	0.2.21	0.2.21	current
primefield	0.14.0	0.14.0	current
primeorder	0.14.0	0.14.0	current
proc-macro2	1.0.107	1.0.107	current
proc-macro2-diagnostics	0.10.1	0.11.0	breaking
qrcodegen	1.8.0	1.8.0	current
quinn	0.11.12	0.11.12	current
quinn-proto	0.11.19	0.11.19	current
quinn-udp	0.5.16	0.6.3	breaking
quote	1.0.47	1.0.47	current
r-efi	5.3.0	7.1.0	breaking
r-efi	6.0.0	7.1.0	breaking
rand	0.8.8	0.10.3	breaking
rand	0.9.5	0.10.3	breaking
rand	0.10.3	0.10.3	current
rand_chacha	0.3.1	0.10.0	breaking
rand_chacha	0.9.0	0.10.0	breaking
rand_core	0.6.4	0.10.1	breaking
rand_core	0.9.5	0.10.1	breaking
rand_core	0.10.1	0.10.1	current
rand_pcg	0.10.2	0.10.2	current
rayon	1.12.0	1.12.0	current
rayon-core	1.13.0	1.13.0	current
redox_syscall	0.5.18	0.9.5	breaking
redox_syscall	0.9.4	0.9.5	patch
regex	1.13.1	1.13.1	current
regex-automata	0.4.18	0.4.18	current
regex-syntax	0.8.11	0.8.11	current
rfc6979	0.6.0	0.6.0	current
ring	0.17.14	0.17.14	current
rsa	0.9.10	0.9.10	current
russh-cryptovec	0.62.0	0.62.0	current
russh-util	0.52.0	0.52.0	current
rustc-hash	2.1.3	2.1.3	current
rustc_version	0.4.1	0.4.1	current
rusticata-macros	4.1.0	5.0.0	breaking
rustix	1.1.5	1.1.6	patch
rustix-openpty	0.2.0	0.2.0	current
rustls	0.23.46	0.23.46	current
rustls-pki-types	1.15.1	1.15.1	current
rustls-webpki	0.103.16	0.103.16	current
rustversion	1.0.23	1.0.23	current
ryu	1.0.23	1.0.23	current
salsa20	0.11.0	0.11.0	current
same-file	1.0.6	1.0.6	current
scopeguard	1.2.0	1.2.0	current
screencapturekit	11.0.0	11.1.2	minor
scrypt	0.12.0	0.12.0	current
sec1	0.8.1	0.8.1	current
security-framework	3.7.0	3.7.0	current
security-framework-sys	2.17.0	2.17.0	current
semver	1.0.28	1.0.28	current
serde	1.0.229	1.0.229	current
serde_bytes	0.11.19	0.11.19	current
serde_cbor_2	0.13.0	0.13.0	current
serde_core	1.0.229	1.0.229	current
serde_derive	1.0.229	1.0.229	current
serde_json	1.0.151	1.0.154	patch
serde_path_to_error	0.1.20	0.1.20	current
serde_urlencoded	0.7.1	0.7.1	current
serdect	0.4.3	0.4.3	current
sha1	0.10.7	0.11.0	breaking
sha1	0.11.0	0.11.0	current
sha2	0.10.9	0.11.1	breaking
sha2	0.11.1	0.11.1	current
sha3	0.12.0	0.12.0	current
shake	0.1.0	0.1.0	current
sharded-slab	0.1.7	0.1.7	current
shlex	2.0.1	2.0.1	current
signal-hook	0.3.18	0.4.6	breaking
signal-hook-registry	1.4.8	1.4.8	current
signature	2.2.0	3.0.0	breaking
signature	3.0.0	3.0.0	current
simd-adler32	0.3.10	0.3.10	current
simd_cesu8	1.2.0	1.2.0	current
simdutf8	0.1.5	0.1.5	current
slab	0.4.12	0.4.12	current
smallvec	1.16.2	1.16.5	patch
socket2	0.6.5	0.6.5	current
spin	0.9.9	0.12.3	breaking
spki	0.7.3	0.8.1	breaking
spki	0.8.1	0.8.1	current
sponge-cursor	0.1.0	0.1.0	current
sqlx	0.8.6	0.9.0	breaking
sqlx-core	0.8.6	0.9.0	breaking
sqlx-macros	0.8.6	0.9.0	breaking
sqlx-macros-core	0.8.6	0.9.0	breaking
sqlx-mysql	0.8.6	0.9.0	breaking
sqlx-postgres	0.8.6	0.9.0	breaking
sqlx-sqlite	0.8.6	0.9.0	breaking
ssh-cipher	0.3.0	0.3.0	current
ssh-encoding	0.3.0	0.3.0	current
ssh-key	0.7.0-rc.11	0.6.7	ahead of registry
stable_deref_trait	1.2.1	1.2.1	current
stringprep	0.1.5	0.1.5	current
strsim	0.11.1	0.11.1	current
subtle	2.6.1	2.6.1	current
syn	2.0.119	3.0.9	breaking
syn	3.0.6	3.0.9	patch
sync_wrapper	1.0.2	1.0.2	current
synstructure	0.13.2	0.14.0	breaking
synstructure	0.14.0	0.14.0	current
sysctl	0.7.1	0.7.1	current
tar	0.4.46	0.4.46	current
thiserror	1.0.69	2.0.21	breaking
thiserror	2.0.21	2.0.21	current
thiserror-impl	1.0.69	2.0.21	breaking
thiserror-impl	2.0.21	2.0.21	current
thread_local	1.1.10	1.1.10	current
time	0.3.55	0.3.55	current
time-core	0.1.9	0.1.9	current
time-macros	0.2.32	0.2.32	current
tinystr	0.8.4	0.8.5	patch
tinytemplate	1.2.1	1.2.1	current
tinyvec	1.13.3	1.13.3	current
tokio	1.53.3	1.54.1	minor
tokio-macros	2.7.2	2.7.2	current
tokio-openssl	0.6.5	0.6.5	current
tokio-stream	0.1.19	0.1.19	current
tokio-tungstenite	0.29.0	0.30.0	breaking
tokio-util	0.7.19	0.7.20	patch
tower	0.5.3	0.5.3	current
tower-http	0.6.11	0.7.1	breaking
tower-layer	0.3.3	0.3.3	current
tower-service	0.3.3	0.3.3	current
tracing	0.1.44	0.1.44	current
tracing-attributes	0.1.31	0.1.31	current
tracing-core	0.1.36	0.1.36	current
tracing-log	0.2.0	0.2.0	current
tracing-serde	0.2.0	0.2.0	current
tracing-subscriber	0.3.23	0.3.23	current
try-lock	0.2.5	0.2.5	current
tungstenite	0.29.0	0.30.0	breaking
typed-builder	0.21.2	0.23.2	breaking
typed-builder-macro	0.21.2	0.23.2	breaking
typenum	1.20.1	1.20.1	current
unicase	2.10.0	2.10.0	current
unicode-bidi	0.3.18	0.3.18	current
unicode-ident	1.0.26	1.0.27	patch
unicode-normalization	0.1.25	0.1.26	patch
unicode-properties	0.1.4	0.1.5	patch
unicode-width	0.2.2	0.2.3	patch
universal-hash	0.5.1	0.6.1	breaking
universal-hash	0.6.1	0.6.1	current
untrusted	0.9.0	0.9.0	current
url	2.5.8	2.5.8	current
utf8_iter	1.0.4	1.1.0	minor
utf8parse	0.2.2	0.2.2	current
uuid	1.27.0	1.29.1	minor
valuable	0.1.1	0.1.1	current
vcpkg	0.2.15	0.2.15	current
version_check	0.9.5	0.9.5	current
vt100	0.16.2	0.18.1	breaking
vte	0.15.0	0.15.0	current
walkdir	2.5.0	2.5.0	current
want	0.3.2	0.3.2	current
wasi	0.11.1+wasi-snapshot-preview1	0.7.0	ahead of registry
wasip2	1.0.4+wasi-0.2.12	2.0.1+wasi-0.2.12	breaking
wasite	0.1.0	1.0.2	breaking
wasm-bindgen	0.2.130	0.2.130	current
wasm-bindgen-futures	0.4.80	0.4.80	current
wasm-bindgen-macro	0.2.130	0.2.130	current
wasm-bindgen-macro-support	0.2.130	0.2.130	current
wasm-bindgen-shared	0.2.130	0.2.130	current
web-sys	0.3.107	0.3.107	current
web-time	1.1.0	1.1.0	current
webauthn-attestation-ca	0.5.5	0.6.2	breaking
webauthn-rs	0.5.5	0.6.2	breaking
webauthn-rs-core	0.5.5	0.6.2	breaking
webauthn-rs-proto	0.5.5	0.6.2	breaking
whoami	1.6.1	2.1.3	breaking
winapi-util	0.1.11	0.1.11	current
windows	0.62.2	0.62.2	current
windows-collections	0.3.2	0.100.0	breaking
windows-core	0.62.2	0.100.0	breaking
windows-future	0.3.2	0.100.0	breaking
windows-implement	0.60.2	0.100.0	breaking
windows-interface	0.59.3	0.100.0	breaking
windows-link	0.2.1	0.100.0	breaking
windows-numerics	0.3.1	0.100.0	breaking
windows-result	0.4.1	0.100.0	breaking
windows-strings	0.5.1	0.100.0	breaking
windows-sys	0.48.0	0.61.2	breaking
windows-sys	0.52.0	0.61.2	breaking
windows-sys	0.59.0	0.61.2	breaking
windows-sys	0.61.2	0.61.2	current
windows-targets	0.48.5	0.53.5	breaking
windows-targets	0.52.6	0.53.5	breaking
windows-threading	0.2.1	0.100.0	breaking
windows_aarch64_gnullvm	0.48.5	0.53.1	breaking
windows_aarch64_gnullvm	0.52.6	0.53.1	breaking
windows_aarch64_msvc	0.48.5	0.53.1	breaking
windows_aarch64_msvc	0.52.6	0.53.1	breaking
windows_i686_gnu	0.48.5	0.53.1	breaking
windows_i686_gnu	0.52.6	0.53.1	breaking
windows_i686_gnullvm	0.52.6	0.53.1	breaking
windows_i686_msvc	0.48.5	0.53.1	breaking
windows_i686_msvc	0.52.6	0.53.1	breaking
windows_x86_64_gnu	0.48.5	0.53.1	breaking
windows_x86_64_gnu	0.52.6	0.53.1	breaking
windows_x86_64_gnullvm	0.48.5	0.53.1	breaking
windows_x86_64_gnullvm	0.52.6	0.53.1	breaking
windows_x86_64_msvc	0.48.5	0.53.1	breaking
windows_x86_64_msvc	0.52.6	0.53.1	breaking
wit-bindgen	0.57.1	0.63.0	breaking
wnaf	0.14.1	0.14.1	current
writeable	0.6.4	0.6.4	current
x25519-dalek	2.0.1	3.0.0	breaking
x509-parser	0.16.0	0.18.1	breaking
xattr	1.6.1	1.7.0	minor
yoke	0.8.3	0.8.4	patch
yoke-derive	0.8.4	0.8.4	current
zerocopy	0.8.60	0.8.63	patch
zerocopy-derive	0.8.60	0.8.63	patch
zerofrom	0.1.8	0.1.8	current
zerofrom-derive	0.1.8	0.1.8	current
zeroize	1.9.0	1.9.1	patch
zeroize_derive	1.5.0	1.5.0	current
zerotrie	0.2.5	0.2.5	current
zerovec	0.11.8	0.11.9	patch
zerovec-derive	0.11.6	0.11.7	patch
zlib-rs	0.6.8	0.6.8	current
zmij	1.0.23	1.0.23	current
JS package	Manifest	Locked/pinned	Latest stable
---	---	---	---
@scure/bip39	apps/tracer/package.json	2.2.0	2.4.0
geist	apps/tracer/package.json	1.7.2	1.9.2
@types/bun	apps/tracer/package.json	1.3.8	1.4.4
@types/node	apps/tracer/package.json	22.19.0	26.6.6
@types/ws	apps/tracer/package.json	8.5.10	8.18.2
playwright	apps/tracer/package.json	1.61.1	1.65.0
typescript	apps/tracer/package.json	5.9.3	7.0.2
ws	apps/tracer/package.json	8.18.3	8.22.1
playwright	scripts/browser-auth/package.json	1.61.1	1.65.0
@scure/bip39	scripts/browser-auth/package.json	2.2.0	2.4.0

J340 inventory, before updates, base `3644950b8e4b5dddeefba350f97a3892189ca193`. Registry inventory covers every registry package in root Cargo.lock (464 distinct names; zero lookup errors), including transitive and target-only packages. Multiple rows show existing duplicate versions, not separate update requests. Breaking gaps include 0.x minor-series changes. Transitive constraints remain owned by their parent dependency; no forced foundational replacements. | Other dependency | Current | Latest observed | Gap / qualification | |---|---|---|---| | Vendored russh | 0.64.1 plus transport patch | 0.65.1 | breaking; preserve audited patch and review SSH security API separately | | Vendored russh-sftp | 2.1.1 | 3.0.1 | major; source patch must be preserved and reviewed | | nixpkgs unstable | 885ba4d038f10c3d17d7a92e8c3cc185b99c9158 | 6dadaf4375be35033e1c84395adbd53ff5fded96 | rolling revision | | rust-overlay | 96a0986b0486341fbc163fa2fabc6d3b44cdcbf1 | 74cebce67ef6671ea48fda353a5be2d229bd2920 | rolling revision | | Zig, scripts/auth-toolchain and nix/zig.nix | 0.15.2 | 0.17.1 | two breaking 0.x series; coupled to native VT build and J339, leave pinned pending compatibility proof | | CI container | node:22-bookworm | Node 26 series | major; exact latest patch and runner compatibility under review | | CI checkout | Forgejo actions/checkout@v4 | v7.0.1 | major; action-runtime and runner compatibility under review | | CI cache | Forgejo actions/cache@v4 | v6.1.0 | major; action-runtime and cache-server compatibility under review | | GotaTun fork base | upstream 1d46b779f5e0743f30a13cc2c325b8114b901fb9, release 0.10.2 | upstream 16937ec6219afbece5aa69ece91f41e12d04d3c5 | 14 upstream commits behind; 19 fork commits ahead; report only | | libghostty-vt | 0.2.2 Rust wrapper plus separately pinned native source | J339 handles native 1.0 | explicitly excluded; no changes | JS manifests under packages/ui and packages/protocol declare no external dependencies. apps/tracer/vendor/ghostty-web is checked-in source with a build package, not an independent installed lockfile. scripts/browser-auth is included because it participates in the gates. There are no npm/yarn/pnpm lockfiles under apps or packages. Raw registry responses, `bun outdated`, `bun audit`, `cargo audit`, `cargo deny check advisories`, `nix flake metadata --json`, and upstream changelogs are saved on dev-02 under `~/.cache/codex-scratch/J340/evidence/`. GotaTun ancestry receipt is under the same path on compute01. Baseline duplicates: **54 crate names / 60 excess versions**. Rust audit: **RUSTSEC-2023-0071, rsa 0.9.10, no fixed release**, lockfile-only in the current graph; cargo-deny advisories pass. JS audit: **5 advisories**, described in the earlier finding comment. No advisory suppression or license-list expansion is planned. Full Rust and JS tables follow. | Rust crate | Locked | Latest stable | Semver gap | |---|---|---|---| | adler2 | 2.0.1 | 2.0.1 | current | | aead | 0.5.2 | 0.6.1 | breaking | | aead | 0.6.1 | 0.6.1 | current | | aes | 0.8.4 | 0.9.4 | breaking | | aes | 0.9.3 | 0.9.4 | patch | | aes-gcm | 0.10.3 | 0.11.1 | breaking | | aes-gcm | 0.11.1 | 0.11.1 | current | | aho-corasick | 1.1.5 | 1.1.5 | current | | alacritty_terminal | 0.25.1 | 0.26.0 | breaking | | allocator-api2 | 0.2.21 | 0.4.0 | breaking | | android_system_properties | 0.1.6 | 0.1.6 | current | | anes | 0.1.6 | 0.2.1 | breaking | | anstream | 1.0.0 | 1.0.0 | current | | anstyle | 1.0.14 | 1.0.14 | current | | anstyle-parse | 1.0.0 | 1.0.0 | current | | anstyle-query | 1.1.5 | 1.1.5 | current | | anstyle-wincon | 3.0.11 | 3.0.11 | current | | apple-cf | 0.11.7 | 0.11.7 | current | | apple-metal | 0.10.4 | 0.10.4 | current | | arbitrary | 1.4.2 | 1.5.0 | minor | | arc-swap | 1.9.2 | 1.9.3 | patch | | argon2 | 0.5.3 | 0.6.0 | breaking | | argon2 | 0.6.0 | 0.6.0 | current | | arrayvec | 0.7.8 | 0.7.8 | current | | asn1-rs | 0.6.2 | 0.7.2 | breaking | | asn1-rs-derive | 0.5.1 | 0.7.0 | breaking | | asn1-rs-impl | 0.2.0 | 0.3.0 | breaking | | atoi | 2.0.0 | 3.1.1 | breaking | | atomic-waker | 1.1.2 | 1.1.2 | current | | autocfg | 1.5.1 | 1.5.1 | current | | axum | 0.8.9 | 0.8.9 | current | | axum-core | 0.5.6 | 0.5.6 | current | | axum-server | 0.8.0 | 0.9.0 | breaking | | base16ct | 1.0.0 | 1.0.0 | current | | base64 | 0.21.7 | 0.23.1 | breaking | | base64 | 0.22.1 | 0.23.1 | breaking | | base64ct | 1.8.3 | 1.8.3 | current | | base64urlsafedata | 0.5.5 | 0.6.2 | breaking | | bcrypt-pbkdf | 0.11.0 | 0.11.0 | current | | bip39 | 2.2.2 | 3.0.0 | breaking | | bitcoin_hashes | 0.14.101 | 1.2.0 | breaking | | bitfield-struct | 0.12.1 | 0.13.0 | breaking | | bitflags | 2.13.2 | 2.13.2 | current | | blake2 | 0.10.6 | 0.11.0 | breaking | | blake2 | 0.11.0 | 0.11.0 | current | | block-buffer | 0.10.4 | 0.12.1 | breaking | | block-buffer | 0.12.1 | 0.12.1 | current | | block-padding | 0.4.2 | 0.4.2 | current | | blowfish | 0.10.0 | 0.10.0 | current | | bumpalo | 3.20.3 | 3.20.3 | current | | byteorder | 1.5.0 | 1.5.0 | current | | bytes | 1.12.1 | 1.12.1 | current | | cast | 0.3.0 | 0.3.0 | current | | cbc | 0.2.1 | 0.2.1 | current | | cc | 1.6.0 | 1.11.1 | minor | | cfg-if | 1.0.5 | 1.0.5 | current | | cfg_aliases | 0.2.2 | 0.2.2 | current | | chacha20 | 0.9.1 | 0.10.2 | breaking | | chacha20 | 0.10.2 | 0.10.2 | current | | chacha20poly1305 | 0.10.1 | 0.11.0 | breaking | | chrono | 0.4.45 | 0.4.45 | current | | ciborium | 0.2.2 | 0.2.2 | current | | ciborium-io | 0.2.2 | 0.2.2 | current | | ciborium-ll | 0.2.2 | 0.2.2 | current | | cipher | 0.4.4 | 0.5.2 | breaking | | cipher | 0.5.2 | 0.5.2 | current | | clap | 4.6.7 | 4.6.7 | current | | clap_builder | 4.6.7 | 4.6.7 | current | | clap_derive | 4.6.7 | 4.6.7 | current | | clap_lex | 1.1.1 | 1.1.1 | current | | cmov | 0.5.4 | 0.5.4 | current | | colorchoice | 1.0.5 | 1.0.5 | current | | combine | 4.6.9 | 4.6.9 | current | | concurrent-queue | 2.5.0 | 2.5.0 | current | | const-oid | 0.9.6 | 0.10.2 | breaking | | const-oid | 0.10.2 | 0.10.2 | current | | constant_time_eq | 0.4.2 | 0.6.1 | breaking | | core-foundation | 0.10.1 | 0.10.1 | current | | core-foundation-sys | 0.8.7 | 0.8.7 | current | | cpubits | 0.1.1 | 0.1.1 | current | | cpufeatures | 0.2.17 | 0.3.1 | breaking | | cpufeatures | 0.3.1 | 0.3.1 | current | | crc | 3.4.0 | 3.4.0 | current | | crc-catalog | 2.5.0 | 2.5.0 | current | | crc32fast | 1.5.3 | 1.5.4 | patch | | criterion | 0.7.0 | 0.8.2 | breaking | | criterion-plot | 0.6.0 | 0.8.2 | breaking | | critical-section | 1.2.0 | 1.2.0 | current | | crossbeam-deque | 0.8.8 | 0.8.8 | current | | crossbeam-epoch | 0.9.21 | 0.9.21 | current | | crossbeam-queue | 0.3.14 | 0.3.14 | current | | crossbeam-utils | 0.8.23 | 0.8.23 | current | | crunchy | 0.2.4 | 0.2.4 | current | | crypto-bigint | 0.7.10 | 0.7.10 | current | | crypto-common | 0.1.7 | 0.2.2 | breaking | | crypto-common | 0.2.2 | 0.2.2 | current | | ctr | 0.9.2 | 0.10.1 | breaking | | ctr | 0.10.1 | 0.10.1 | current | | ctutils | 0.4.7 | 0.4.8 | patch | | cursor-icon | 1.2.0 | 1.2.0 | current | | curve25519-dalek | 4.1.3 | 5.0.0 | breaking | | curve25519-dalek | 5.0.0 | 5.0.0 | current | | curve25519-dalek-derive | 0.1.1 | 0.1.1 | current | | dashmap | 6.2.1 | 6.2.1 | current | | data-encoding | 2.11.1 | 2.11.1 | current | | delegate | 0.13.5 | 0.13.5 | current | | der | 0.7.10 | 0.8.3 | breaking | | der | 0.8.3 | 0.8.3 | current | | der-parser | 9.0.0 | 10.0.0 | breaking | | deranged | 0.5.8 | 0.5.9 | patch | | des | 0.9.0 | 0.9.0 | current | | digest | 0.10.7 | 0.11.3 | breaking | | digest | 0.11.3 | 0.11.3 | current | | displaydoc | 0.2.7 | 0.2.7 | current | | doom-fish-utils | 0.4.3 | 0.4.3 | current | | dotenvy | 0.15.7 | 0.15.7 | current | | duplicate | 2.0.1 | 2.0.1 | current | | ecdsa | 0.17.0 | 0.17.0 | current | | ed25519 | 3.0.0 | 3.0.0 | current | | ed25519-dalek | 3.0.0 | 3.0.0 | current | | either | 1.18.0 | 1.19.0 | minor | | elliptic-curve | 0.14.3 | 0.14.3 | current | | enum-as-inner | 0.6.1 | 0.7.0 | breaking | | enum_dispatch | 0.3.13 | 0.3.13 | current | | equivalent | 1.0.2 | 1.0.3 | patch | | errno | 0.3.14 | 0.3.14 | current | | etcetera | 0.8.0 | 0.11.0 | breaking | | event-listener | 5.4.2 | 5.4.2 | current | | eyre | 0.6.14 | 0.6.14 | current | | fastrand | 2.5.0 | 2.5.0 | current | | ff | 0.14.0 | 0.14.0 | current | | fiat-crypto | 0.2.9 | 0.3.0 | breaking | | fiat-crypto | 0.3.0 | 0.3.0 | current | | filetime | 0.2.29 | 0.2.29 | current | | find-msvc-tools | 0.1.14 | 0.1.15 | patch | | flate2 | 1.1.10 | 1.1.11 | patch | | flume | 0.11.1 | 0.12.0 | breaking | | fnv | 1.0.7 | 1.0.7 | current | | foldhash | 0.1.5 | 0.2.0 | breaking | | foreign-types | 0.3.2 | 0.5.0 | breaking | | foreign-types-shared | 0.1.1 | 0.3.1 | breaking | | form_urlencoded | 1.2.2 | 1.2.2 | current | | fs-err | 3.3.2 | 3.3.2 | current | | futures | 0.3.34 | 0.3.34 | current | | futures-channel | 0.3.34 | 0.3.34 | current | | futures-core | 0.3.34 | 0.3.34 | current | | futures-executor | 0.3.34 | 0.3.34 | current | | futures-intrusive | 0.5.0 | 0.5.0 | current | | futures-io | 0.3.34 | 0.3.34 | current | | futures-macro | 0.3.34 | 0.3.34 | current | | futures-sink | 0.3.34 | 0.3.34 | current | | futures-task | 0.3.34 | 0.3.34 | current | | futures-util | 0.3.34 | 0.3.34 | current | | generic-array | 0.14.7 | 1.4.5 | breaking | | generic-array | 1.4.5 | 1.4.5 | current | | getrandom | 0.2.17 | 0.4.3 | breaking | | getrandom | 0.3.4 | 0.4.3 | breaking | | getrandom | 0.4.3 | 0.4.3 | current | | ghash | 0.5.1 | 0.6.0 | breaking | | ghash | 0.6.0 | 0.6.0 | current | | gloo-timers | 0.4.0 | 0.4.0 | current | | group | 0.14.0 | 0.14.0 | current | | h2 | 0.4.19 | 0.4.20 | patch | | half | 2.7.1 | 2.7.1 | current | | hashbrown | 0.14.5 | 0.17.1 | breaking | | hashbrown | 0.15.5 | 0.17.1 | breaking | | hashbrown | 0.17.1 | 0.17.1 | current | | hashlink | 0.10.0 | 0.12.2 | breaking | | heck | 0.5.0 | 0.5.0 | current | | hermit-abi | 0.5.3 | 0.5.3 | current | | hex | 0.4.3 | 0.4.3 | current | | hex-conservative | 0.2.3 | 1.3.0 | breaking | | hex-literal | 1.1.0 | 1.1.0 | current | | hickory-proto | 0.26.3 | 0.26.3 | current | | hkdf | 0.12.4 | 0.13.0 | breaking | | hkdf | 0.13.0 | 0.13.0 | current | | hmac | 0.12.1 | 0.13.0 | breaking | | hmac | 0.13.0 | 0.13.0 | current | | home | 0.5.12 | 0.5.12 | current | | http | 1.5.0 | 1.5.0 | current | | http-body | 1.1.0 | 1.1.0 | current | | http-body-util | 0.1.5 | 0.1.5 | current | | http-range-header | 0.4.2 | 1.0.0 | breaking | | httparse | 1.10.1 | 1.10.1 | current | | httpdate | 1.0.3 | 1.0.3 | current | | hybrid-array | 0.4.15 | 0.4.15 | current | | hyper | 1.11.1 | 1.12.0 | minor | | hyper-util | 0.1.21 | 0.1.21 | current | | iana-time-zone | 0.1.65 | 0.1.65 | current | | iana-time-zone-haiku | 0.1.2 | 0.1.2 | current | | icu_collections | 2.3.0 | 2.4.0 | minor | | icu_locale_core | 2.3.0 | 2.4.0 | minor | | icu_normalizer | 2.3.0 | 2.4.0 | minor | | icu_normalizer_data | 2.3.0 | 2.4.0 | minor | | icu_properties | 2.3.0 | 2.4.0 | minor | | icu_properties_data | 2.3.0 | 2.4.0 | minor | | icu_provider | 2.3.1 | 2.4.0 | minor | | idna | 1.1.0 | 1.1.0 | current | | idna_adapter | 1.2.2 | 1.2.2 | current | | indenter | 0.3.4 | 0.3.4 | current | | indexmap | 2.14.2 | 2.14.2 | current | | inout | 0.1.4 | 0.2.5 | breaking | | inout | 0.2.5 | 0.2.5 | current | | int-enum | 1.2.0 | 1.3.0 | minor | | ip_network | 0.4.1 | 0.4.1 | current | | ip_network_table | 0.2.0 | 0.2.0 | current | | ip_network_table-deps-treebitmap | 0.5.0 | 0.5.0 | current | | ipnet | 2.12.2 | 2.12.2 | current | | ipnetwork | 0.21.1 | 0.21.1 | current | | is_terminal_polyfill | 1.70.2 | 1.70.2 | current | | itertools | 0.13.0 | 0.15.0 | breaking | | itoa | 1.0.18 | 1.0.18 | current | | jni | 0.22.4 | 0.22.4 | current | | jni-macros | 0.22.4 | 0.22.4 | current | | jni-sys | 0.4.1 | 0.4.1 | current | | jni-sys-macros | 0.4.1 | 0.4.1 | current | | jobserver | 0.1.35 | 0.1.35 | current | | js-sys | 0.3.107 | 0.3.107 | current | | keccak | 0.2.2 | 0.2.2 | current | | kem | 0.3.0 | 0.3.0 | current | | lazy_static | 1.5.1 | 1.5.1 | current | | libc | 0.2.190 | 0.2.191 | patch | | libfuzzer-sys | 0.4.13 | 0.4.13 | current | | libghostty-vt | 0.2.2 | 0.2.2 | current | | libghostty-vt-sys | 0.2.2 | 0.2.2 | current | | libm | 0.2.16 | 0.2.16 | current | | libredox | 0.1.25 | 0.2.0 | breaking | | libsqlite3-sys | 0.30.1 | 0.39.1 | breaking | | linux-raw-sys | 0.12.1 | 0.12.1 | current | | litemap | 0.8.3 | 0.8.3 | current | | lock_api | 0.4.14 | 0.5.0 | breaking | | log | 0.4.34 | 0.4.35 | patch | | lru-slab | 0.1.3 | 0.1.3 | current | | matchers | 0.2.0 | 0.2.0 | current | | matchit | 0.8.4 | 0.9.2 | breaking | | md-5 | 0.10.6 | 0.11.0 | breaking | | md5 | 0.8.1 | 0.8.1 | current | | memchr | 2.8.3 | 2.8.3 | current | | memoffset | 0.9.1 | 0.9.1 | current | | mime | 0.3.17 | 0.3.18 | patch | | mime_guess | 2.0.5 | 2.0.5 | current | | minimal-lexical | 0.2.1 | 0.2.1 | current | | miniz_oxide | 0.9.1 | 0.9.1 | current | | mio | 1.2.4 | 1.2.4 | current | | miow | 0.6.1 | 0.6.1 | current | | ml-kem | 0.3.4 | 0.3.4 | current | | module-lattice | 0.2.4 | 0.2.4 | current | | nix | 0.30.1 | 0.31.3 | breaking | | nix | 0.31.3 | 0.31.3 | current | | nom | 7.1.3 | 8.0.0 | breaking | | nu-ansi-term | 0.50.3 | 0.50.3 | current | | num-bigint | 0.4.8 | 0.5.1 | breaking | | num-bigint | 0.5.1 | 0.5.1 | current | | num-bigint-dig | 0.8.6 | 0.9.1 | breaking | | num-conv | 0.2.2 | 0.2.2 | current | | num-integer | 0.1.47 | 0.1.47 | current | | num-iter | 0.1.46 | 0.1.46 | current | | num-traits | 0.2.19 | 0.2.19 | current | | oid-registry | 0.7.1 | 0.8.1 | breaking | | once_cell | 1.21.4 | 1.21.4 | current | | once_cell_polyfill | 1.70.2 | 1.70.2 | current | | oorandom | 11.1.5 | 11.1.5 | current | | opaque-debug | 0.3.1 | 0.4.0 | breaking | | openssl | 0.10.81 | 0.10.82 | patch | | openssl-macros | 0.1.1 | 0.1.1 | current | | openssl-src | 300.6.1+3.6.3 | 110.0.0 | ahead of registry | | openssl-sys | 0.9.117 | 0.9.118 | patch | | p256 | 0.14.0 | 0.14.0 | current | | p384 | 0.14.0 | 0.14.0 | current | | p521 | 0.14.0 | 0.14.0 | current | | pageant | 0.2.5 | 0.2.5 | current | | parking | 2.2.1 | 2.2.1 | current | | parking_lot | 0.12.5 | 0.13.0 | breaking | | parking_lot_core | 0.9.12 | 0.10.0 | breaking | | password-hash | 0.5.0 | 0.6.1 | breaking | | password-hash | 0.6.1 | 0.6.1 | current | | pastey | 0.1.1 | 0.2.3 | breaking | | pbkdf2 | 0.13.0 | 0.13.0 | current | | pem-rfc7468 | 0.7.0 | 1.0.0 | breaking | | pem-rfc7468 | 1.0.0 | 1.0.0 | current | | percent-encoding | 2.3.2 | 2.3.2 | current | | phc | 0.6.1 | 0.6.1 | current | | pin-project-lite | 0.2.17 | 0.2.17 | current | | piper | 0.2.5 | 0.2.5 | current | | pkcs1 | 0.7.5 | 0.8.0 | breaking | | pkcs5 | 0.8.1 | 0.8.1 | current | | pkcs8 | 0.10.2 | 0.11.0 | breaking | | pkcs8 | 0.11.0 | 0.11.0 | current | | pkg-config | 0.3.34 | 0.3.34 | current | | plain | 0.2.3 | 0.2.3 | current | | plotters | 0.3.7 | 0.3.7 | current | | plotters-backend | 0.3.7 | 0.3.7 | current | | plotters-svg | 0.3.7 | 0.3.7 | current | | polling | 3.11.0 | 3.11.0 | current | | poly1305 | 0.8.0 | 0.9.1 | breaking | | poly1305 | 0.9.1 | 0.9.1 | current | | polyval | 0.6.2 | 0.7.3 | breaking | | polyval | 0.7.3 | 0.7.3 | current | | portable-atomic | 1.15.0 | 1.15.0 | current | | potential_utf | 0.1.6 | 0.1.6 | current | | powerfmt | 0.2.1 | 0.2.1 | current | | ppv-lite86 | 0.2.21 | 0.2.21 | current | | primefield | 0.14.0 | 0.14.0 | current | | primeorder | 0.14.0 | 0.14.0 | current | | proc-macro2 | 1.0.107 | 1.0.107 | current | | proc-macro2-diagnostics | 0.10.1 | 0.11.0 | breaking | | qrcodegen | 1.8.0 | 1.8.0 | current | | quinn | 0.11.12 | 0.11.12 | current | | quinn-proto | 0.11.19 | 0.11.19 | current | | quinn-udp | 0.5.16 | 0.6.3 | breaking | | quote | 1.0.47 | 1.0.47 | current | | r-efi | 5.3.0 | 7.1.0 | breaking | | r-efi | 6.0.0 | 7.1.0 | breaking | | rand | 0.8.8 | 0.10.3 | breaking | | rand | 0.9.5 | 0.10.3 | breaking | | rand | 0.10.3 | 0.10.3 | current | | rand_chacha | 0.3.1 | 0.10.0 | breaking | | rand_chacha | 0.9.0 | 0.10.0 | breaking | | rand_core | 0.6.4 | 0.10.1 | breaking | | rand_core | 0.9.5 | 0.10.1 | breaking | | rand_core | 0.10.1 | 0.10.1 | current | | rand_pcg | 0.10.2 | 0.10.2 | current | | rayon | 1.12.0 | 1.12.0 | current | | rayon-core | 1.13.0 | 1.13.0 | current | | redox_syscall | 0.5.18 | 0.9.5 | breaking | | redox_syscall | 0.9.4 | 0.9.5 | patch | | regex | 1.13.1 | 1.13.1 | current | | regex-automata | 0.4.18 | 0.4.18 | current | | regex-syntax | 0.8.11 | 0.8.11 | current | | rfc6979 | 0.6.0 | 0.6.0 | current | | ring | 0.17.14 | 0.17.14 | current | | rsa | 0.9.10 | 0.9.10 | current | | russh-cryptovec | 0.62.0 | 0.62.0 | current | | russh-util | 0.52.0 | 0.52.0 | current | | rustc-hash | 2.1.3 | 2.1.3 | current | | rustc_version | 0.4.1 | 0.4.1 | current | | rusticata-macros | 4.1.0 | 5.0.0 | breaking | | rustix | 1.1.5 | 1.1.6 | patch | | rustix-openpty | 0.2.0 | 0.2.0 | current | | rustls | 0.23.46 | 0.23.46 | current | | rustls-pki-types | 1.15.1 | 1.15.1 | current | | rustls-webpki | 0.103.16 | 0.103.16 | current | | rustversion | 1.0.23 | 1.0.23 | current | | ryu | 1.0.23 | 1.0.23 | current | | salsa20 | 0.11.0 | 0.11.0 | current | | same-file | 1.0.6 | 1.0.6 | current | | scopeguard | 1.2.0 | 1.2.0 | current | | screencapturekit | 11.0.0 | 11.1.2 | minor | | scrypt | 0.12.0 | 0.12.0 | current | | sec1 | 0.8.1 | 0.8.1 | current | | security-framework | 3.7.0 | 3.7.0 | current | | security-framework-sys | 2.17.0 | 2.17.0 | current | | semver | 1.0.28 | 1.0.28 | current | | serde | 1.0.229 | 1.0.229 | current | | serde_bytes | 0.11.19 | 0.11.19 | current | | serde_cbor_2 | 0.13.0 | 0.13.0 | current | | serde_core | 1.0.229 | 1.0.229 | current | | serde_derive | 1.0.229 | 1.0.229 | current | | serde_json | 1.0.151 | 1.0.154 | patch | | serde_path_to_error | 0.1.20 | 0.1.20 | current | | serde_urlencoded | 0.7.1 | 0.7.1 | current | | serdect | 0.4.3 | 0.4.3 | current | | sha1 | 0.10.7 | 0.11.0 | breaking | | sha1 | 0.11.0 | 0.11.0 | current | | sha2 | 0.10.9 | 0.11.1 | breaking | | sha2 | 0.11.1 | 0.11.1 | current | | sha3 | 0.12.0 | 0.12.0 | current | | shake | 0.1.0 | 0.1.0 | current | | sharded-slab | 0.1.7 | 0.1.7 | current | | shlex | 2.0.1 | 2.0.1 | current | | signal-hook | 0.3.18 | 0.4.6 | breaking | | signal-hook-registry | 1.4.8 | 1.4.8 | current | | signature | 2.2.0 | 3.0.0 | breaking | | signature | 3.0.0 | 3.0.0 | current | | simd-adler32 | 0.3.10 | 0.3.10 | current | | simd_cesu8 | 1.2.0 | 1.2.0 | current | | simdutf8 | 0.1.5 | 0.1.5 | current | | slab | 0.4.12 | 0.4.12 | current | | smallvec | 1.16.2 | 1.16.5 | patch | | socket2 | 0.6.5 | 0.6.5 | current | | spin | 0.9.9 | 0.12.3 | breaking | | spki | 0.7.3 | 0.8.1 | breaking | | spki | 0.8.1 | 0.8.1 | current | | sponge-cursor | 0.1.0 | 0.1.0 | current | | sqlx | 0.8.6 | 0.9.0 | breaking | | sqlx-core | 0.8.6 | 0.9.0 | breaking | | sqlx-macros | 0.8.6 | 0.9.0 | breaking | | sqlx-macros-core | 0.8.6 | 0.9.0 | breaking | | sqlx-mysql | 0.8.6 | 0.9.0 | breaking | | sqlx-postgres | 0.8.6 | 0.9.0 | breaking | | sqlx-sqlite | 0.8.6 | 0.9.0 | breaking | | ssh-cipher | 0.3.0 | 0.3.0 | current | | ssh-encoding | 0.3.0 | 0.3.0 | current | | ssh-key | 0.7.0-rc.11 | 0.6.7 | ahead of registry | | stable_deref_trait | 1.2.1 | 1.2.1 | current | | stringprep | 0.1.5 | 0.1.5 | current | | strsim | 0.11.1 | 0.11.1 | current | | subtle | 2.6.1 | 2.6.1 | current | | syn | 2.0.119 | 3.0.9 | breaking | | syn | 3.0.6 | 3.0.9 | patch | | sync_wrapper | 1.0.2 | 1.0.2 | current | | synstructure | 0.13.2 | 0.14.0 | breaking | | synstructure | 0.14.0 | 0.14.0 | current | | sysctl | 0.7.1 | 0.7.1 | current | | tar | 0.4.46 | 0.4.46 | current | | thiserror | 1.0.69 | 2.0.21 | breaking | | thiserror | 2.0.21 | 2.0.21 | current | | thiserror-impl | 1.0.69 | 2.0.21 | breaking | | thiserror-impl | 2.0.21 | 2.0.21 | current | | thread_local | 1.1.10 | 1.1.10 | current | | time | 0.3.55 | 0.3.55 | current | | time-core | 0.1.9 | 0.1.9 | current | | time-macros | 0.2.32 | 0.2.32 | current | | tinystr | 0.8.4 | 0.8.5 | patch | | tinytemplate | 1.2.1 | 1.2.1 | current | | tinyvec | 1.13.3 | 1.13.3 | current | | tokio | 1.53.3 | 1.54.1 | minor | | tokio-macros | 2.7.2 | 2.7.2 | current | | tokio-openssl | 0.6.5 | 0.6.5 | current | | tokio-stream | 0.1.19 | 0.1.19 | current | | tokio-tungstenite | 0.29.0 | 0.30.0 | breaking | | tokio-util | 0.7.19 | 0.7.20 | patch | | tower | 0.5.3 | 0.5.3 | current | | tower-http | 0.6.11 | 0.7.1 | breaking | | tower-layer | 0.3.3 | 0.3.3 | current | | tower-service | 0.3.3 | 0.3.3 | current | | tracing | 0.1.44 | 0.1.44 | current | | tracing-attributes | 0.1.31 | 0.1.31 | current | | tracing-core | 0.1.36 | 0.1.36 | current | | tracing-log | 0.2.0 | 0.2.0 | current | | tracing-serde | 0.2.0 | 0.2.0 | current | | tracing-subscriber | 0.3.23 | 0.3.23 | current | | try-lock | 0.2.5 | 0.2.5 | current | | tungstenite | 0.29.0 | 0.30.0 | breaking | | typed-builder | 0.21.2 | 0.23.2 | breaking | | typed-builder-macro | 0.21.2 | 0.23.2 | breaking | | typenum | 1.20.1 | 1.20.1 | current | | unicase | 2.10.0 | 2.10.0 | current | | unicode-bidi | 0.3.18 | 0.3.18 | current | | unicode-ident | 1.0.26 | 1.0.27 | patch | | unicode-normalization | 0.1.25 | 0.1.26 | patch | | unicode-properties | 0.1.4 | 0.1.5 | patch | | unicode-width | 0.2.2 | 0.2.3 | patch | | universal-hash | 0.5.1 | 0.6.1 | breaking | | universal-hash | 0.6.1 | 0.6.1 | current | | untrusted | 0.9.0 | 0.9.0 | current | | url | 2.5.8 | 2.5.8 | current | | utf8_iter | 1.0.4 | 1.1.0 | minor | | utf8parse | 0.2.2 | 0.2.2 | current | | uuid | 1.27.0 | 1.29.1 | minor | | valuable | 0.1.1 | 0.1.1 | current | | vcpkg | 0.2.15 | 0.2.15 | current | | version_check | 0.9.5 | 0.9.5 | current | | vt100 | 0.16.2 | 0.18.1 | breaking | | vte | 0.15.0 | 0.15.0 | current | | walkdir | 2.5.0 | 2.5.0 | current | | want | 0.3.2 | 0.3.2 | current | | wasi | 0.11.1+wasi-snapshot-preview1 | 0.7.0 | ahead of registry | | wasip2 | 1.0.4+wasi-0.2.12 | 2.0.1+wasi-0.2.12 | breaking | | wasite | 0.1.0 | 1.0.2 | breaking | | wasm-bindgen | 0.2.130 | 0.2.130 | current | | wasm-bindgen-futures | 0.4.80 | 0.4.80 | current | | wasm-bindgen-macro | 0.2.130 | 0.2.130 | current | | wasm-bindgen-macro-support | 0.2.130 | 0.2.130 | current | | wasm-bindgen-shared | 0.2.130 | 0.2.130 | current | | web-sys | 0.3.107 | 0.3.107 | current | | web-time | 1.1.0 | 1.1.0 | current | | webauthn-attestation-ca | 0.5.5 | 0.6.2 | breaking | | webauthn-rs | 0.5.5 | 0.6.2 | breaking | | webauthn-rs-core | 0.5.5 | 0.6.2 | breaking | | webauthn-rs-proto | 0.5.5 | 0.6.2 | breaking | | whoami | 1.6.1 | 2.1.3 | breaking | | winapi-util | 0.1.11 | 0.1.11 | current | | windows | 0.62.2 | 0.62.2 | current | | windows-collections | 0.3.2 | 0.100.0 | breaking | | windows-core | 0.62.2 | 0.100.0 | breaking | | windows-future | 0.3.2 | 0.100.0 | breaking | | windows-implement | 0.60.2 | 0.100.0 | breaking | | windows-interface | 0.59.3 | 0.100.0 | breaking | | windows-link | 0.2.1 | 0.100.0 | breaking | | windows-numerics | 0.3.1 | 0.100.0 | breaking | | windows-result | 0.4.1 | 0.100.0 | breaking | | windows-strings | 0.5.1 | 0.100.0 | breaking | | windows-sys | 0.48.0 | 0.61.2 | breaking | | windows-sys | 0.52.0 | 0.61.2 | breaking | | windows-sys | 0.59.0 | 0.61.2 | breaking | | windows-sys | 0.61.2 | 0.61.2 | current | | windows-targets | 0.48.5 | 0.53.5 | breaking | | windows-targets | 0.52.6 | 0.53.5 | breaking | | windows-threading | 0.2.1 | 0.100.0 | breaking | | windows_aarch64_gnullvm | 0.48.5 | 0.53.1 | breaking | | windows_aarch64_gnullvm | 0.52.6 | 0.53.1 | breaking | | windows_aarch64_msvc | 0.48.5 | 0.53.1 | breaking | | windows_aarch64_msvc | 0.52.6 | 0.53.1 | breaking | | windows_i686_gnu | 0.48.5 | 0.53.1 | breaking | | windows_i686_gnu | 0.52.6 | 0.53.1 | breaking | | windows_i686_gnullvm | 0.52.6 | 0.53.1 | breaking | | windows_i686_msvc | 0.48.5 | 0.53.1 | breaking | | windows_i686_msvc | 0.52.6 | 0.53.1 | breaking | | windows_x86_64_gnu | 0.48.5 | 0.53.1 | breaking | | windows_x86_64_gnu | 0.52.6 | 0.53.1 | breaking | | windows_x86_64_gnullvm | 0.48.5 | 0.53.1 | breaking | | windows_x86_64_gnullvm | 0.52.6 | 0.53.1 | breaking | | windows_x86_64_msvc | 0.48.5 | 0.53.1 | breaking | | windows_x86_64_msvc | 0.52.6 | 0.53.1 | breaking | | wit-bindgen | 0.57.1 | 0.63.0 | breaking | | wnaf | 0.14.1 | 0.14.1 | current | | writeable | 0.6.4 | 0.6.4 | current | | x25519-dalek | 2.0.1 | 3.0.0 | breaking | | x509-parser | 0.16.0 | 0.18.1 | breaking | | xattr | 1.6.1 | 1.7.0 | minor | | yoke | 0.8.3 | 0.8.4 | patch | | yoke-derive | 0.8.4 | 0.8.4 | current | | zerocopy | 0.8.60 | 0.8.63 | patch | | zerocopy-derive | 0.8.60 | 0.8.63 | patch | | zerofrom | 0.1.8 | 0.1.8 | current | | zerofrom-derive | 0.1.8 | 0.1.8 | current | | zeroize | 1.9.0 | 1.9.1 | patch | | zeroize_derive | 1.5.0 | 1.5.0 | current | | zerotrie | 0.2.5 | 0.2.5 | current | | zerovec | 0.11.8 | 0.11.9 | patch | | zerovec-derive | 0.11.6 | 0.11.7 | patch | | zlib-rs | 0.6.8 | 0.6.8 | current | | zmij | 1.0.23 | 1.0.23 | current | | JS package | Manifest | Locked/pinned | Latest stable | Semver gap | |---|---|---|---|---| | @scure/bip39 | apps/tracer/package.json | 2.2.0 | 2.4.0 | minor | | geist | apps/tracer/package.json | 1.7.2 | 1.9.2 | minor | | @types/bun | apps/tracer/package.json | 1.3.8 | 1.4.4 | minor | | @types/node | apps/tracer/package.json | 22.19.0 | 26.6.6 | breaking | | @types/ws | apps/tracer/package.json | 8.5.10 | 8.18.2 | minor | | playwright | apps/tracer/package.json | 1.61.1 | 1.65.0 | minor | | typescript | apps/tracer/package.json | 5.9.3 | 7.0.2 | breaking | | ws | apps/tracer/package.json | 8.18.3 | 8.22.1 | minor | | playwright | scripts/browser-auth/package.json | 1.61.1 | 1.65.0 | minor | | @scure/bip39 | scripts/browser-auth/package.json | 2.2.0 | 2.4.0 | minor |

kayg commented

2026-11-07 06:34:54 +00:00

Author

Owner

Inventory correction: vendored russh-sftp is already 3.0.1, matching the latest stable release. The preceding table incorrectly said 2.1.1; no russh-sftp major upgrade is needed. Verified vendor/russh-sftp/Cargo.toml version = "3.0.1". russh itself remains 0.64.1 versus latest 0.65.1.

kayg commented

2026-11-07 06:37:06 +00:00

Author

Owner

Baseline static receipt (dev-02, pinned 1.99.0 toolchain, static-cargo recipe, unchanged base 3644950b8): x86_64-musl 27,779,344 B; aarch64-musl 24,988,232 B. Both static PIE, stripped, no PT_INTERP; native aarch64 secure-key-memory and CLI checks passed. x86 runtime vector/key-memory checks explicitly skipped on this ARM host. baseline-static.log ends STATIC_EXIT=0. These actual same-base sizes, rather than the older gate baselines (22,418,256 / 20,453,280), will be used for dependency deltas. Building the existing runtime-responsiveness and remote_ca_bench examples for before/after measurements on the x86 perf VM. No new benchmark harness. Branch pushed at its starting SHA for crash recovery; source update batch not committed yet.

Baseline static receipt (dev-02, pinned 1.99.0 toolchain, static-cargo recipe, unchanged base 3644950b8): x86_64-musl 27,779,344 B; aarch64-musl 24,988,232 B. Both static PIE, stripped, no PT_INTERP; native aarch64 secure-key-memory and CLI checks passed. x86 runtime vector/key-memory checks explicitly skipped on this ARM host. baseline-static.log ends STATIC_EXIT=0. These actual same-base sizes, rather than the older gate baselines (22,418,256 / 20,453,280), will be used for dependency deltas. Building the existing runtime-responsiveness and remote_ca_bench examples for before/after measurements on the x86 perf VM. No new benchmark harness. Branch pushed at its starting SHA for crash recovery; source update batch not committed yet.

kayg commented

2026-11-07 06:39:18 +00:00

Author

Owner

Compatible Rust batch applied with cargo update: 49 package updates, no manifest changes, no libghostty-vt change. Duplicate names 54→54; excess versions 60→60; no individual crate gained a duplicate version. cargo metadata shows zero newly introduced license expressions. Raw hygiene receipt: dev-02 ~/.cache/codex-scratch/J340/evidence/rust-compatible-hygiene.txt; update log rust-compatible-update.log; lock snapshot Cargo.rust-compatible.lock. Quick + cargo-deny running on dev-02, same worktree target; CARGO_INCREMENTAL=0 and test/dev debug symbols disabled to stay within SSD capacity. Static release recipe/settings remain unchanged. Initial inventory tables are recorded above; per-batch verification and sizes follow before commit.

kayg commented

2026-11-07 06:40:43 +00:00

Author

Owner

Queue update: Rust quick/deny is first in dev-02 queue behind J341 quick; compute01 remains five busy slots with nine queued, only 27G free (25G floor). dev-02 has 47G free and remains the shortest safe queue. Perf baseline is waiting for the shared perf-run lock, with its process kept alive; no measurements run outside the lock. Evidence: rust-compatible-quick.log on dev-02; baseline-perf.log on perf VM. Security-major finding: axum-server 0.9 wraps TLS services (changelog breaking item); server_tls.rs explicitly requires Accept<Service = ()> and destructures (stream, ()), so it needs TLS code/test changes and is deferred (~0.5–1 day). SQLx 0.9 requires SqlSafeStr for dynamic query strings and changes SQLite value Send/Sync; auth/recovery.rs and auth/migration_data_tests.rs use dynamic strings, so this also needs a separate security/data migration review (~1–2 days). Upstream release notes saved under evidence/upstream/.

kayg commented

2026-11-07 06:44:16 +00:00

Author

Owner

Further inventory findings: CI runner API reports the single docker runner infraternal-dev v13.2.0 offline, with recent workflows cancelled. Latest Forgejo action mirrors are checkout v7.0.1 and cache v6.1.0; upstream notes require Node 24 runtime (v5+), ESM at checkout v7/cache v6, and changed checkout credential storage at v6. Node current stable/LTS is 26.13.0. Runner/action compatibility will be checked before modifying CI; live workflow execution is currently unavailable. Receipts on code: ~/.cache/codex-scratch/J340/evidence/ci-runners.json and ci-runs.json; action notes on dev-02. Crypto migration finding: argon2 0.6/password-hash 0.6 remove the old SaltString interface and change hash/verify signatures used in auth/crypto.rs; defer that major (~0.5–1 day). bip39 3 changes generation to WordCount, while auth tests and recovery flows call Mnemonic::generate(24); defer (~0.5 day). Base64 0.23 would add a third base64 version because SQLx 0.8 still requires 0.22, so defer under the no-new-duplicates constraint.

kayg commented

2026-11-07 06:48:10 +00:00

Author

Owner

Progress checkpoint: compatible Rust lockfile is pushed as WIP e44fcfaf4 on deps-refresh-340 for crash safety. Quick plus cargo-deny is still running on dev-02, PID 2593494, log /home/claude/.cache/codex-scratch/J340/evidence/rust-compatible-quick.log. One target remains /home/claude/worktrees/J340/target. Both static baseline sizes and baseline runtime/crypto benchmarks are recorded; updated static and perf runs follow before this becomes an atomic validated commit. compute01 has five active slots, nine queued runs and 24G free, below its 25G floor; dev-02 has 44G free.

Progress checkpoint: compatible Rust lockfile is pushed as WIP e44fcfaf4 on deps-refresh-340 for crash safety. Quick plus cargo-deny is still running on dev-02, PID 2593494, log /home/claude/.cache/codex-scratch/J340/evidence/rust-compatible-quick.log. One target remains /home/claude/worktrees/J340/target. Both static baseline sizes and baseline runtime/crypto benchmarks are recorded; updated static and perf runs follow before this becomes an atomic validated commit. compute01 has five active slots, nine queued runs and 24G free, below its 25G floor; dev-02 has 44G free.

kayg commented

2026-11-07 06:51:28 +00:00

Author

Owner

Prepared JS patch/minor batch in scratch: @scure/bip39 2.4.0, geist 1.9.2, @types/bun 1.4.4, @types/node 22.20.5, @types/ws 8.18.2, playwright 1.65.0, ws 8.22.1. bun audit fix updates the existing unused Next peer 16.3.8 to 16.4.1 without a new direct dependency or major override. Audit now reports: No vulnerabilities found (checked 66 packages). Evidence dev-02 ~/.cache/codex-scratch/J340/evidence/bun-audit-fix.txt and bun-audit-js-minor-fixed.txt. TypeScript remains 5.9.3 for a separate major commit. Rust quick and deny completed with BATCH_QUICK_DENY_EXIT=0; static rebuild is active, PID 2654666, rust-compatible-static.log.

kayg commented

2026-11-07 06:55:21 +00:00

Author

Owner

Major review finding: webauthn-rs 0.5.5 → 0.6.2 changes its foundational cryptographic backend. Upstream README states: “As of v0.6.0, webauthn-rs uses RustCrypto for its core cryptographic operations, instead of OpenSSL.” Saved source: dev-02 ~/.cache/codex-scratch/J340/evidence/upstream/webauthn-rs-0.6.2/README.md lines 33–34. This needs the owner’s foundational-library decision and a separate auth compatibility/performance job, estimate 1–2 days after the decision. No bump in J340. Compatible Rust static receipt rust-compatible-static.log has STATIC_EXIT=0: x86 27,894,064 B (+114,720 B vs same-base 27,779,344); arm64 25,068,408 B (+80,176 B vs 24,988,232). Both no PT_INTERP. Updated benchmark drivers are next.

kayg commented

2026-11-07 06:58:00 +00:00

Author

Owner

Security-sensitive major review: hkdf 0.13 uses digest::EagerHash / hmac 0.13, while our auth test oracle instantiates Hkdfsha2::Sha256 and the workspace selects sha2 0.10 (digest 0.10). sha2 0.11 moves to digest 0.11. They require a coordinated auth-vector migration rather than independent major commits; defer both, estimate 0.5–1 day including auth/recovery vectors. Changelogs saved at dev-02 evidence/upstream/{hkdf-0.13.0,sha2-0.11.1}/CHANGELOG.md. tokio-tungstenite 0.30 requires tungstenite 0.30, while axum 0.8 still selects the 0.29 pair: defer until its parent stack can move together, because adding a second WebSocket parser version violates this job’s duplicate rule (estimate 0.5 day once Axum permits it). base64 0.23 similarly adds a third line while SQLx and the transport still require 0.21/0.22; synchronize with their later migrations. CI runner infraternal-dev v13.2.0 is offline, so checkout v7/cache v6 ESM + Node24 action-runtime execution and Node26 container validation are unavailable; recommend a separate runner-online CI-only update, 0.5 day. Zig 0.17.1 remains coupled to excluded native VT/J339, not changed here.

Security-sensitive major review: hkdf 0.13 uses digest::EagerHash / hmac 0.13, while our auth test oracle instantiates Hkdf<sha2::Sha256> and the workspace selects sha2 0.10 (digest 0.10). sha2 0.11 moves to digest 0.11. They require a coordinated auth-vector migration rather than independent major commits; defer both, estimate 0.5–1 day including auth/recovery vectors. Changelogs saved at dev-02 evidence/upstream/{hkdf-0.13.0,sha2-0.11.1}/CHANGELOG.md. tokio-tungstenite 0.30 requires tungstenite 0.30, while axum 0.8 still selects the 0.29 pair: defer until its parent stack can move together, because adding a second WebSocket parser version violates this job’s duplicate rule (estimate 0.5 day once Axum permits it). base64 0.23 similarly adds a third line while SQLx and the transport still require 0.21/0.22; synchronize with their later migrations. CI runner infraternal-dev v13.2.0 is offline, so checkout v7/cache v6 ESM + Node24 action-runtime execution and Node26 container validation are unavailable; recommend a separate runner-online CI-only update, 0.5 day. Zig 0.17.1 remains coupled to excluded native VT/J339, not changed here.

kayg commented

2026-11-07 07:00:08 +00:00

Author

Owner

ScreenCaptureKit 11.0.0 → 11.1.2 native validation passed: cargo check --locked -p infraternal-plugin-desktop --features desktop --bins on the Mac under lockf, MAC_SCREENCAPTURE_CHECK_EXIT=0, 1m00s compiler wall time (not a performance measurement). The initial Nix shell combines native Swift with Nix SDK 14.4 and DEVELOPER_DIR; a minimal Foundation probe fails with that SDK and passes with the native SDK. Validation used native SDKROOT, DEVELOPER_DIR and Apple tools on PATH while retaining Rust 1.99.0. No repository/toolchain configuration was changed. Evidence Mac ~/.cache/codex-scratch/J340/evidence/{screencapture-check.log,mac-sdk-probe.log,screencapture-native-sdk-check.log,screencapture-native-toolchain-check.log}. J340 target was removed before lock release, confirmed MAC_TARGET_CLEANED. Dependency pin/lock change will be its own compatible maintenance commit after Linux hygiene/quick checks.

kayg commented

2026-11-07 07:04:43 +00:00

Author

Owner

Performance finding, NOT accepted yet: alternating baseline/updated benchmark binaries under one perf-run lock confirms slower Ed25519 CSR/issue/verify after the full compatible Rust refresh. Baseline p50_us 294/288/288, updated 355/349/349; p99_us baseline 314/310/312, updated 375/373/372. Runtime slow-write p99_ns baseline 18474/17542/18254, updated 18435/15629/18125. Both quiet receipts and zero steal, PERF_EXIT=0. Artifact perf VM ~/.cache/codex-scratch/J340/evidence/rust-compatible-paired.log and rust-compatible-paired/. Rust batch remains WIP while I isolate the crypto regression; no performance justification has been accepted. JS minor quick/typecheck/deny/audit and 2 focused font-picker browser tests passed (js-minor-check.log, JS_MINOR_CHECK_EXIT=0). Nix browser-cache hash and production screenshots are queued separately, PID 2744159.

kayg commented

2026-11-07 07:14:39 +00:00

Author

Owner

Isolation finding: keeping all compatible updates except openssl 0.10.82 / openssl-sys 0.9.118 removes the measured crypto regression. Paired baseline p50_us 294/293/294 and p99_us 313/313/314; refreshed graph with old bindings p50_us 288/291/289 and p99_us 312/314/314. Retained-500 RSS is within 8 KiB. No steal, PERF_EXIT=0. Artifact perf VM ~/.cache/codex-scratch/J340/evidence/openssl-isolation-perf.log and its quiet receipts. The native curve25519, x25519 and sha512 objects are byte-identical in both builds. Narrowing the binding pair next rather than attributing the regression to the native engine or cc without evidence.

kayg commented

2026-11-07 07:16:50 +00:00

Author

Owner

JS maintenance batch: commit e0f4ad1b2 (the initial Rust WIP parent will be split before handoff).

Updated both Bun workspaces' patch/minor pins, ws 8.22.1 and the existing font-package peer next 16.4.1. No TypeScript major in this batch. All five initial JS advisories are cleared: No vulnerabilities found (checked 66 packages).

Evidence on dev-02 under /home/claude/.cache/codex-scratch/J340/evidence/:

js-minor-check.log: quick/typecheck, cargo-deny and both production-build font-picker checks passed, JS_MINOR_CHECK_EXIT=0.
js-bun-deps-hash.log and js-bun-deps-confirm.log: new frozen Nix cache hash sha256-OWo43tRTqASAQWrgDuV9MPSbmF8oAsB/4jvgVy46TEI= verified.
js-minor-evidence.log: both static checks passed; x86 27,894,064 B / arm64 25,068,408 B, delta 0 / 0 for this JS-only batch. Rust duplicates remain 54 names / 60 excess versions. JS license-expression set is unchanged (js-licenses-js-minor.txt, zero metadata errors).
js-screenshot-check.log: JS_SCREENSHOTS_EXIT=0, JS_SCREENSHOT_CHECK_EXIT=0; fixture server stopped, no remaining J340 browser/server process.

Attached production-build screenshots use DPR 2, at 1440×900, 393×852 and 375×667, with ink/paper themes. The capture waits for finite opening animations. The flow is terminal fixture connects → command palette → font results. checks.json records the correct title, connected fixture, visible palette and zero page errors for all six cases. Browser plugin unavailable, so this uses the repository's Playwright installation. Selected captures have been inspected at DPR 2; visual acceptance belongs to the orchestrator, not this implementation job. All six captures remain in js-minor-screenshots/.

JS maintenance batch: commit `e0f4ad1b2` (the initial Rust WIP parent will be split before handoff). Updated both Bun workspaces' patch/minor pins, `ws` 8.22.1 and the existing font-package peer `next` 16.4.1. No TypeScript major in this batch. All five initial JS advisories are cleared: `No vulnerabilities found (checked 66 packages)`. Evidence on dev-02 under `/home/claude/.cache/codex-scratch/J340/evidence/`: - `js-minor-check.log`: quick/typecheck, cargo-deny and both production-build font-picker checks passed, `JS_MINOR_CHECK_EXIT=0`. - `js-bun-deps-hash.log` and `js-bun-deps-confirm.log`: new frozen Nix cache hash `sha256-OWo43tRTqASAQWrgDuV9MPSbmF8oAsB/4jvgVy46TEI=` verified. - `js-minor-evidence.log`: both static checks passed; x86 27,894,064 B / arm64 25,068,408 B, delta **0 / 0** for this JS-only batch. Rust duplicates remain **54 names / 60 excess versions**. JS license-expression set is unchanged (`js-licenses-js-minor.txt`, zero metadata errors). - `js-screenshot-check.log`: `JS_SCREENSHOTS_EXIT=0`, `JS_SCREENSHOT_CHECK_EXIT=0`; fixture server stopped, no remaining J340 browser/server process. Attached production-build screenshots use DPR 2, at 1440×900, 393×852 and 375×667, with ink/paper themes. The capture waits for finite opening animations. The flow is terminal fixture connects → command palette → font results. `checks.json` records the correct title, connected fixture, visible palette and zero page errors for all six cases. Browser plugin unavailable, so this uses the repository's Playwright installation. Selected captures have been inspected at DPR 2; visual acceptance belongs to the orchestrator, not this implementation job. All six captures remain in `js-minor-screenshots/`.

1440-ink.png

215 KiB

393-paper.png

138 KiB

375-ink.png

142 KiB

checks.json

934 B

kayg commented

2026-11-07 07:17:04 +00:00

Author

Owner

Additional security evidence: openssl 0.10.82 upstream CHANGELOG lists out-of-bounds writes in Triple-DES key-wrap CipherCtx updates and PkeyCtx verify_recover, use-after-free after X509StoreContext init, and reference-count failure double-free handling, plus null DSA parameter fixes. cargo audit did not report these; its database output is still only the unfixed rsa advisory. Source receipt dev-02 ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/openssl-0.10.82/CHANGELOG.md (also being copied into J340 evidence). Plan refinement: split the OpenSSL binding pair into its own security-maintenance commit with the measured cost, instead of hiding it in the broad compatible refresh. The measured additional ~61 µs per enrollment certificate operation is a correctness tradeoff for upstream memory-safety fixes; it does not change the terminal I/O engine. Orchestrator review should assess that tradeoff explicitly. The 47 other compatible updates retain baseline crypto performance and are being quick/deny checked separately now, PID 2792261, rust-compatible-isolated-quick.log.

kayg commented

2026-11-07 07:19:49 +00:00

Author

Owner

Tool-pin inventory follow-up: official stable manifest reports Rust 1.99.1 (58cf8f9c3, 2026-10-13), versus our 1.99.0 pin: a patch gap. cargo-deny 0.20.2 is already latest. Raw receipts dev-02 evidence/rust-stable.txt and cargo-deny-latest.txt. I will include the Rust patch in the build-environment refresh with the Nix inputs and measure that batch separately. Historical benchmark/tool-source documentation keeps its original versions; only the current tool pin/current setup text will advance.

kayg commented

2026-11-07 07:30:18 +00:00

Author

Owner

Atomic-history checkpoint: the initial Rust WIP has been split and replaced on deps-refresh-340 using a lease-protected rewrite. Validated compatible Rust commit is ed6874ac5; unchanged JS maintenance commit is now 8819d8fb5 (formerly e0f4ad1b2). No WIP remains. Rust isolated quick/deny and static logs both pass; x86 27,891,952 B (+112,608), arm64 25,062,552 B (+74,320) vs same-base baseline. Duplicates 54/60 unchanged, no new license expressions. Crypto paired samples match baseline with the old binding pair, runtime p99 remains within baseline range. Evidence rust-compatible-isolated-{quick,static,hygiene} on dev-02 and openssl-isolation-perf.log on perf VM. OpenSSL safety update, Nix/tool-pin refresh and safe isolated majors remain next. Current target: /home/claude/worktrees/J340/target; static/baseline benchmark build is finished, no J340 build is running now.

Atomic-history checkpoint: the initial Rust WIP has been split and replaced on deps-refresh-340 using a lease-protected rewrite. Validated compatible Rust commit is ed6874ac5; unchanged JS maintenance commit is now 8819d8fb5 (formerly e0f4ad1b2). No WIP remains. Rust isolated quick/deny and static logs both pass; x86 27,891,952 B (+112,608), arm64 25,062,552 B (+74,320) vs same-base baseline. Duplicates 54/60 unchanged, no new license expressions. Crypto paired samples match baseline with the old binding pair, runtime p99 remains within baseline range. Evidence rust-compatible-isolated-{quick,static,hygiene} on dev-02 and openssl-isolation-perf.log on perf VM. OpenSSL safety update, Nix/tool-pin refresh and safe isolated majors remain next. Current target: /home/claude/worktrees/J340/target; static/baseline benchmark build is finished, no J340 build is running now.

kayg commented

2026-11-07 07:32:14 +00:00

Author

Owner

Orchestrator decision received: TAKE openssl 0.10.82 / openssl-sys 0.9.118 as a separate security-maintenance commit. The measured ~61 µs extra certificate cost is on rare enrollment/rotation control paths, outside terminal/packet hot paths; upstream OOB/UAF/double-free fixes justify it. Commit will include paired p50/p99 and RSS. Further source/individual-binding narrowing is follow-up work and will not block the batch. Restored the approved pair; quick/deny is queued on dev-02, PID 2855480, openssl-security-quick.log. The 47 other updates are already committed as ed6874ac5, with JS maintenance at 8819d8fb5.

Orchestrator decision received: TAKE openssl 0.10.82 / openssl-sys 0.9.118 as a separate security-maintenance commit. The measured ~61 µs extra certificate cost is on rare enrollment/rotation control paths, outside terminal/packet hot paths; upstream OOB/UAF/double-free fixes justify it. Commit will include paired p50/p99 and RSS. Further source/individual-binding narrowing is follow-up work and will not block the batch. Restored the approved pair; quick/deny is queued on dev-02, PID 2855480, openssl-security-quick.log. The 47 other updates are already committed as ed6874ac5, with JS maintenance at 8819d8fb5.

kayg commented

2026-11-07 07:34:15 +00:00

Author

Owner

Non-blocking binding follow-up: source inspection narrows the likely change to Rust wrapper/code-layout effects rather than a new native crypto implementation. openssl-sys 0.9.118 adds extern declarations/constants and cfg support; its lib.rs runtime changes apply only to other providers. openssl 0.10.82 adds unconditional reference-count/null-result assertions and clears borrowed X509 pointers during context cleanup. The Ed25519/CSR benchmark does not use X509StoreContext chain verification, so those cleanup calls are not its direct per-sample path. Native curve25519/x25519/sha512 object hashes match exactly. No supported feature flag selectively changes these safety checks, and disabling them would lose the fixes. This is source-based narrowing, not a proven attribution to a single binding; an individual-sys build or profile remains a follow-up if useful. Saved diff: dev-02 evidence/openssl-source-followup.diff. Main batch continues with the approved update.

kayg commented

2026-11-07 07:37:25 +00:00

Author

Owner

Build-environment review: refreshed nixpkgs provides Bun 1.4.4, matching latest upstream (old shell 1.4.2); Node remains the nixpkgs-selected supported 24.21.0 line. Receipt dev-02 evidence/nix-updated-tool-versions.json plus bun-release-latest.json. Rust 1.99.1 release notes fix x86_64 FFI bool-return miscompilation, missing wcslen on embedded/UEFI, and the macOS rust-lld libLLVM rpath. No API migration is listed. Official source saved as evidence/rust-release-notes.md. Prepared input/compiler patch keeps toolchain, CI compiler install and current setup text consistent; historical 1.99.0 measurements/source audit are explicitly retained.

kayg commented

2026-11-07 07:42:46 +00:00

Author

Owner

J340 continuation: the orchestrator-approved OpenSSL security-maintenance commit is isolated in Cargo.lock and its fresh quick/deny/static/hygiene recheck is queued on dev-02 (PID 2855480, target /home/claude/worktrees/J340/target). Both VM statuses checked: dev-02 has one job ahead; compute01 has ten queued and all five slots busy. Exact Nix launcher reports cargo 1.99.0 successfully.

Prepared the next build-environment slice separately: nixpkgs 6dadaf4375be35033e1c84395adbd53ff5fded96, rust-overlay 74cebce67ef6671ea48fda353a5be2d229bd2920, Rust 1.99.1 patch (including x86_64 bool-return FFI miscompilation fix), and Bun 1.4.4 from nixpkgs. No VT/Zig pins changed. OpenSSL evidence log: dev-02 ~/.cache/codex-scratch/J340/evidence/openssl-security-quick.log. Current pushed head remains 8819d8fb5.

J340 continuation: the orchestrator-approved OpenSSL security-maintenance commit is isolated in Cargo.lock and its fresh quick/deny/static/hygiene recheck is queued on dev-02 (PID 2855480, target /home/claude/worktrees/J340/target). Both VM statuses checked: dev-02 has one job ahead; compute01 has ten queued and all five slots busy. Exact Nix launcher reports cargo 1.99.0 successfully. Prepared the next build-environment slice separately: nixpkgs 6dadaf4375be35033e1c84395adbd53ff5fded96, rust-overlay 74cebce67ef6671ea48fda353a5be2d229bd2920, Rust 1.99.1 patch (including x86_64 bool-return FFI miscompilation fix), and Bun 1.4.4 from nixpkgs. No VT/Zig pins changed. OpenSSL evidence log: dev-02 ~/.cache/codex-scratch/J340/evidence/openssl-security-quick.log. Current pushed head remains 8819d8fb5.

kayg commented

2026-11-07 08:01:49 +00:00

Author

Owner

Committed and pushed the approved OpenSSL security-maintenance slice as 652ffc793. Only Cargo.lock changed: openssl 0.10.81 → 0.10.82 and openssl-sys 0.9.117 → 0.9.118. The commit records the paired p50/p99/RSS, upstream OOB-write/use-after-free/double-free fixes, and rare enrollment/rotation scope outside the terminal and packet hot paths.

Fresh per-batch receipt on dev-02: ~/.cache/codex-scratch/J340/evidence/openssl-security-quick.log:

advisories ok, bans ok, licenses ok, sources ok
BATCH_QUICK_DENY_EXIT=0
OPENSSL_SECURITY_EVIDENCE_EXIT=0
duplicate names: 54 -> 54
excess versions: 60 -> 60
new duplicate versions: {}
new license expressions: []

Both static PIE images are stripped with no PT_INTERP. x86 27,894,064 B (+2,112 B this slice); aarch64 25,068,408 B (+5,856 B this slice). Same-base total dependency-refresh deltas are +114,720 B / +80,176 B respectively. Existing static metadata, native key/CLI and artifact-defect probes passed; x86 execution is explicitly skipped on this arm64 host.

The binding-pair performance/source isolation receipts remain as previously reported. No supported safe opt-out has been found; individual root cause remains a nonblocking follow-up.

Next: the prepared Nix/Rust patch toolchain slice, followed by individually gated compatible major migrations. One Linux target remains /home/claude/worktrees/J340/target, to be cleaned at completion.

Committed and pushed the approved OpenSSL security-maintenance slice as **652ffc793**. Only Cargo.lock changed: openssl 0.10.81 → 0.10.82 and openssl-sys 0.9.117 → 0.9.118. The commit records the paired p50/p99/RSS, upstream OOB-write/use-after-free/double-free fixes, and rare enrollment/rotation scope outside the terminal and packet hot paths. Fresh per-batch receipt on dev-02: `~/.cache/codex-scratch/J340/evidence/openssl-security-quick.log`: ``` advisories ok, bans ok, licenses ok, sources ok BATCH_QUICK_DENY_EXIT=0 OPENSSL_SECURITY_EVIDENCE_EXIT=0 duplicate names: 54 -> 54 excess versions: 60 -> 60 new duplicate versions: {} new license expressions: [] ``` Both static PIE images are stripped with no PT_INTERP. x86 **27,894,064 B (+2,112 B this slice)**; aarch64 **25,068,408 B (+5,856 B this slice)**. Same-base total dependency-refresh deltas are +114,720 B / +80,176 B respectively. Existing static metadata, native key/CLI and artifact-defect probes passed; x86 execution is explicitly skipped on this arm64 host. The binding-pair performance/source isolation receipts remain as previously reported. No supported safe opt-out has been found; individual root cause remains a nonblocking follow-up. Next: the prepared Nix/Rust patch toolchain slice, followed by individually gated compatible major migrations. One Linux target remains `/home/claude/worktrees/J340/target`, to be cleaned at completion.

kayg commented

2026-11-07 08:02:47 +00:00

Author

Owner

Build-environment slice is now synced to dev-02. Exact launcher nix develop /home/claude/worktrees/J340 -c cargo --version succeeds with cargo 1.99.1. Removed this job's old compiler artifact directories (about 8.3 GiB) while retaining its one native-tool cache; no other job's files touched.

Both queues checked: dev-02 has four jobs ahead and 51G free; compute01 has seven queued jobs and only 8G free, below its 25G launch floor. The new quick/deny/metadata/frozen-Nix-cache/tracer check is queued on dev-02. Receipt: ~/.cache/codex-scratch/J340/evidence/build-env-quick.log. This slice deliberately keeps Cargo.lock and all VT/Zig pins unchanged.

Build-environment slice is now synced to dev-02. Exact launcher `nix develop /home/claude/worktrees/J340 -c cargo --version` succeeds with **cargo 1.99.1**. Removed this job's old compiler artifact directories (about 8.3 GiB) while retaining its one native-tool cache; no other job's files touched. Both queues checked: dev-02 has four jobs ahead and 51G free; compute01 has seven queued jobs and only 8G free, below its 25G launch floor. The new quick/deny/metadata/frozen-Nix-cache/tracer check is queued on dev-02. Receipt: `~/.cache/codex-scratch/J340/evidence/build-env-quick.log`. This slice deliberately keeps Cargo.lock and all VT/Zig pins unchanged.

kayg commented

2026-11-07 08:04:17 +00:00

Author

Owner

Changelog review for the remaining candidate major slices (each will still get its own commit, quick/deny/hygiene/static receipts):

candidate	upstream break checked against our use
nix 0.30 → 0.31.3	SigHandler loses Eq/PartialEq; our call sites install handlers and do not compare them. Epoll/kqueue unknown flags now use from_bits_retain.
criterion 0.7 → 0.8.2	async-std support removed, not enabled here; MSRV 1.86 fits our compiler. New alloca-based benchmark layout randomisation is benchmark-only.
alacritty_terminal 0.25 → 0.26	ChildExit now contains ExitStatus; the existing benchmark uses VoidListener and never consumes it. It remains a nonshipping benchmark oracle.
tower-http 0.6 → 0.7.1	fs gains a Backend abstraction with default TokioBackend, ETags, and changes range/error responses. We use ServeDir/ServeFile with explicit fallback and precompressed assets; existing web_assets tests cover our serving/cache/security headers.
vt100 0.16 → 0.18.1	dimensions become NonZeroU16, formatted snapshots become String; fixed 60×200 test/benchmark constructors and snapshot replay need mechanical updates. Its resize behavior changes, but these oracle instances are fixed-size. It remains test/benchmark-only.
rand 0.9 → 0.10.3	renamed Rng/OsRng/seeding APIs are not used; repository use is rand::random. Upstream changes StdRng internals from rand_chacha to chacha20 with the same output. No auth source migration is planned.
aes-gcm 0.10 → 0.11.1	aead/cipher API families advance; used only by auth test oracles. Try the manifest update without auth changes; defer if actual auth-crypto source changes are needed.
TypeScript 5.9.3 → 7.0.2	removed legacy targets/resolution/baseUrl and compiler API do not match our usage: check is CLI tsc, target ES2022, ESNext/Bundler, no compiler API imports. Native compiler optional packages are development tools; production uses Bun.build.

Upstream changelog/manifests are preserved under dev-02 ~/.cache/codex-scratch/J340/evidence/upstream/<crate>-<version>/; TypeScript official release notes and npm metadata are under the same evidence root. Existing VT baseline is on the perf VM at evidence/vt-baseline-perf.log (three quiet trials, PERF_EXIT=0).

Changelog review for the remaining candidate major slices (each will still get its own commit, quick/deny/hygiene/static receipts): | candidate | upstream break checked against our use | | --- | --- | | nix 0.30 → 0.31.3 | SigHandler loses Eq/PartialEq; our call sites install handlers and do not compare them. Epoll/kqueue unknown flags now use from_bits_retain. | | criterion 0.7 → 0.8.2 | async-std support removed, not enabled here; MSRV 1.86 fits our compiler. New alloca-based benchmark layout randomisation is benchmark-only. | | alacritty_terminal 0.25 → 0.26 | ChildExit now contains ExitStatus; the existing benchmark uses VoidListener and never consumes it. It remains a nonshipping benchmark oracle. | | tower-http 0.6 → 0.7.1 | fs gains a Backend abstraction with default TokioBackend, ETags, and changes range/error responses. We use ServeDir/ServeFile with explicit fallback and precompressed assets; existing web_assets tests cover our serving/cache/security headers. | | vt100 0.16 → 0.18.1 | dimensions become NonZeroU16, formatted snapshots become String; fixed 60×200 test/benchmark constructors and snapshot replay need mechanical updates. Its resize behavior changes, but these oracle instances are fixed-size. It remains test/benchmark-only. | | rand 0.9 → 0.10.3 | renamed Rng/OsRng/seeding APIs are not used; repository use is rand::random. Upstream changes StdRng internals from rand_chacha to chacha20 with the same output. No auth source migration is planned. | | aes-gcm 0.10 → 0.11.1 | aead/cipher API families advance; used only by auth test oracles. Try the manifest update without auth changes; defer if actual auth-crypto source changes are needed. | | TypeScript 5.9.3 → 7.0.2 | removed legacy targets/resolution/baseUrl and compiler API do not match our usage: check is CLI tsc, target ES2022, ESNext/Bundler, no compiler API imports. Native compiler optional packages are development tools; production uses Bun.build. | Upstream changelog/manifests are preserved under dev-02 `~/.cache/codex-scratch/J340/evidence/upstream/<crate>-<version>/`; TypeScript official release notes and npm metadata are under the same evidence root. Existing VT baseline is on the perf VM at `evidence/vt-baseline-perf.log` (three quiet trials, PERF_EXIT=0).

kayg commented

2026-11-07 08:04:51 +00:00

Author

Owner

ScreenCaptureKit maintenance finding: 11.1.2 fixes a process crash when the native framework completes a screenshot/shareable-content request with neither result nor error (including a sleeping display). It now reports an error through completion-handler bridge APIs. 11.1.1 also fixes SwiftPM product-directory discovery; 11.1.0 prevents restarting a timed-out capture stream. These are compatible updates from our exact =11.0.0 pin, with no application API changes required.

The native desktop plugin check already passed with 11.1.2 on the Mac under its shared lock, and that target was removed before releasing the lock. Receipt: evidence/screencapture-native-toolchain-check.log, MAC_SCREENCAPTURE_CHECK_EXIT=0. Changelog is preserved at dev-02 evidence/upstream/screencapturekit-11.1.2/CHANGELOG.md. The patch will be committed in its own compatible slice after Linux quick/deny/hygiene/static checks; final Mac compile guard will use the repository's existing scripts/macos-build-check --check.

ScreenCaptureKit maintenance finding: 11.1.2 fixes a process crash when the native framework completes a screenshot/shareable-content request with neither result nor error (including a sleeping display). It now reports an error through completion-handler bridge APIs. 11.1.1 also fixes SwiftPM product-directory discovery; 11.1.0 prevents restarting a timed-out capture stream. These are compatible updates from our exact =11.0.0 pin, with no application API changes required. The native desktop plugin check already passed with 11.1.2 on the Mac under its shared lock, and that target was removed before releasing the lock. Receipt: `evidence/screencapture-native-toolchain-check.log`, `MAC_SCREENCAPTURE_CHECK_EXIT=0`. Changelog is preserved at dev-02 `evidence/upstream/screencapturekit-11.1.2/CHANGELOG.md`. The patch will be committed in its own compatible slice after Linux quick/deny/hygiene/static checks; final Mac compile guard will use the repository's existing `scripts/macos-build-check --check`.

kayg commented

2026-11-07 08:18:30 +00:00

Author

Owner

Nix/Rust patch slice first-stage validation passed on dev-02:

advisories ok, bans ok, licenses ok, sources ok
duplicate names: 54 -> 54
excess versions: 60 -> 60
new duplicate versions: {}
new license expressions: []
No vulnerabilities found (checked 66 packages)
2 passed (23.2s)
BUILD_ENV_QUICK_EXIT=0

The log includes cargo 1.99.1, Bun 1.4.4, Node v24.21.0, successful workspace quick/clippy/tests and tracer CLI typecheck: ~/.cache/codex-scratch/J340/evidence/build-env-quick.log. Updated flake metadata is in evidence/flake-metadata-updated.json.

Now queued for a forced Bun dependency-cache rebuild (avoid merely reusing the old fixed-output cache path), both static builds, and the repository's existing runtime/crypto/VT benchmark drivers. Both statuses checked again: compute01 reports one apparently free slot but seven jobs already queued; dev-02 has two queued ahead and 89G free. Stay with the shorter queue and same-host static baseline on dev-02. Next receipt: evidence/build-env-static.log.

Nix/Rust patch slice first-stage validation passed on dev-02: ``` advisories ok, bans ok, licenses ok, sources ok duplicate names: 54 -> 54 excess versions: 60 -> 60 new duplicate versions: {} new license expressions: [] No vulnerabilities found (checked 66 packages) 2 passed (23.2s) BUILD_ENV_QUICK_EXIT=0 ``` The log includes cargo 1.99.1, Bun 1.4.4, Node v24.21.0, successful workspace quick/clippy/tests and tracer CLI typecheck: `~/.cache/codex-scratch/J340/evidence/build-env-quick.log`. Updated flake metadata is in `evidence/flake-metadata-updated.json`. Now queued for a **forced** Bun dependency-cache rebuild (avoid merely reusing the old fixed-output cache path), both static builds, and the repository's existing runtime/crypto/VT benchmark drivers. Both statuses checked again: compute01 reports one apparently free slot but seven jobs already queued; dev-02 has two queued ahead and 89G free. Stay with the shorter queue and same-host static baseline on dev-02. Next receipt: `evidence/build-env-static.log`.

kayg commented

2026-11-07 08:22:46 +00:00

Author

Owner

Inventory correction from a fresh, uncached recheck of all 464 Rust registry crate names, zero lookup errors: two cached latest-version records had excluded versions with build metadata. The corrected full table is attached; all other 462 latest-version records agree with the fresh index.

crate	previous latest entry	correct latest stable
openssl-src	110.0.0	400.0.2+4.0.3
wasi	0.7.0	0.14.7+wasi-0.2.4

openssl-sys 0.9.118 explicitly constrains its vendored build dependency to openssl-src = "300.2.0" (Cargo.toml lines 78–81). Cargo correctly keeps 300.6.1+3.6.3, the latest compatible 300.x series. Adopting the 400.x/OpenSSL 4 source release requires upstream vendoring support or a separately reviewed binding patch; this refresh will not override the parent's constraint. The already accepted 0.10.82/0.9.118 binding safety fixes remain included. wasi is likewise retained by transitive parent constraints, with no direct workspace dependency to bump.

Evidence on dev-02: evidence/{crates-registry-rechecked.json,inventory-rust-recheck.log,openssl-src-registry-raw.jsonl,registry-inventory-corrections.md,rust-inventory-corrected.md}. Supersedes only those two rows in the initial inventory, not the measured updates or gate results.

Inventory correction from a fresh, uncached recheck of **all 464 Rust registry crate names, zero lookup errors**: two cached latest-version records had excluded versions with build metadata. The corrected full table is attached; all other 462 latest-version records agree with the fresh index. | crate | previous latest entry | correct latest stable | | --- | --- | --- | | openssl-src | 110.0.0 | 400.0.2+4.0.3 | | wasi | 0.7.0 | 0.14.7+wasi-0.2.4 | `openssl-sys 0.9.118` explicitly constrains its vendored build dependency to `openssl-src = "300.2.0"` (Cargo.toml lines 78–81). Cargo correctly keeps **300.6.1+3.6.3**, the latest compatible 300.x series. Adopting the 400.x/OpenSSL 4 source release requires upstream vendoring support or a separately reviewed binding patch; this refresh will not override the parent's constraint. The already accepted 0.10.82/0.9.118 binding safety fixes remain included. `wasi` is likewise retained by transitive parent constraints, with no direct workspace dependency to bump. Evidence on dev-02: `evidence/{crates-registry-rechecked.json,inventory-rust-recheck.log,openssl-src-registry-raw.jsonl,registry-inventory-corrections.md,rust-inventory-corrected.md}`. Supersedes only those two rows in the initial inventory, not the measured updates or gate results.

rust-inventory-corrected.md

22 KiB

kayg commented

2026-11-07 08:26:53 +00:00

Author

Owner

Crash-safety checkpoint pushed: 050cdebf64, WIP Nix/Rust patch slice. It contains only flake.lock, rust-toolchain.toml, the matching CI Rust installer pin and current-pin docs. The completed OpenSSL security commit remains 652ffc793 immediately below it. Do not integrate the WIP yet; it will be amended into the final atomic toolchain commit after measurements.

Quick/deny/tracer/audit/font tests pass. Forced Bun 1.4.4 Nix dependency-cache rebuild passed with the existing hash; full derivation output is at dev-02 evidence/build-env-bun-fod.log. Both static builds plus existing runtime/crypto/VT benchmark-driver builds are running through build-slot, PID 3104954, receipt evidence/build-env-static.log, one target /home/claude/worktrees/J340/target.

Mac target is already cleaned; no Mac/perf task is running. Remaining safe version bumps have not been applied yet. Corrected full registry inventory is attached in comment 84102; OpenSSL source 400.x is constrained out by upstream openssl-sys's 300.x vendoring requirement, and no override will be introduced here.

Crash-safety checkpoint pushed: **050cdebf6413fd22ee54fc18daec21a41e2e9538**, WIP Nix/Rust patch slice. It contains only flake.lock, rust-toolchain.toml, the matching CI Rust installer pin and current-pin docs. The completed OpenSSL security commit remains **652ffc793** immediately below it. Do not integrate the WIP yet; it will be amended into the final atomic toolchain commit after measurements. Quick/deny/tracer/audit/font tests pass. Forced Bun 1.4.4 Nix dependency-cache rebuild passed with the existing hash; full derivation output is at dev-02 `evidence/build-env-bun-fod.log`. Both static builds plus existing runtime/crypto/VT benchmark-driver builds are running through build-slot, PID **3104954**, receipt `evidence/build-env-static.log`, one target `/home/claude/worktrees/J340/target`. Mac target is already cleaned; no Mac/perf task is running. Remaining safe version bumps have not been applied yet. Corrected full registry inventory is attached in comment 84102; OpenSSL source 400.x is constrained out by upstream openssl-sys's 300.x vendoring requirement, and no override will be introduced here.

kayg commented

2026-11-07 08:36:57 +00:00

Author

Owner

Nix/Rust patch slice finalized and pushed as 6fbc785068. Replaced the WIP checkpoint; no WIP commit remains. nixpkgs/rust-overlay advance to the inventoried revisions; Rust is 1.99.1, Bun 1.4.4 and Node 24.21.0. Cargo.lock and all VT/Zig pins are unchanged by this commit.

Useful nonblocking OpenSSL follow-up: take this already planned, supported build-environment refresh as the cheap way to retain 0.10.82/0.9.118's safety fixes while recovering the measured certificate-operation cost. No safety checks or features were disabled. A fresh three-way run on the quiet perf VM (zero steal, exit 0) measured:

configuration	p50 µs, trials → median	p99 µs, trials → median	retained-500 median RSS
original dependencies / old environment	296 / 290 / 297 → 296	312 / 309 / 321 → 312	5300 KiB
fixed OpenSSL bindings / old environment	347 / 358 / 353 → 353	368 / 378 / 375 → 375	5300 KiB
fixed OpenSSL bindings / refreshed environment	296 / 294 / 298 → 296	316 / 317 / 315 → 316	5300 KiB

The new p99 is within the original trial range, and all retain the same 177,500 DER bytes. This narrows the interaction to build environment plus bindings; it does not isolate the Rust patch from the Nix input changes. Individual source-level attribution remains a follow-up, without blocking the other updates.

The wider paired run also passed: runtime p99 ns 19366/18625/18354 → 18545/19497/18464; alacritty oracle MB/s 87.59/81.26/83.28 → 85.48/86.66/84.61; vt100 oracle MB/s 45.81/43.93/44.03 → 43.88/44.30/44.19. Ranges overlap. VT snapshot medians 80.52 → 81.05 µs; repaint/cursor equality true throughout, RSS within 68 KiB for 10,000 history rows. These VT libraries remain nonshipping benchmark oracles.

Validation receipts on dev-02:

evidence/build-env-quick.log: BUILD_ENV_QUICK_EXIT=0, quick/deny/typecheck/two font tests, zero-advisory Bun audit, duplicate names 54→54, excess versions 60→60, no new duplicate versions or license expressions.
evidence/build-env-bun-fod.log: forced Bun 1.4.4 fixed-output rebuild reproduces sha256-OWo43tRTqASAQWrgDuV9MPSbmF8oAsB/4jvgVy46TEI=.
evidence/build-env-static.log: BUILD_ENV_STATIC_EXIT=0, BENCH_BUILD_EXIT=0. Stripped static PIE x86 27,894,608 B (+544 this slice); arm64 25,072,888 B (+4,480 this slice); no PT_INTERP, native arm64 key/CLI probes and metadata/defect probes pass.

Both attached perf logs and perf VM before/after receipts remain under ~/.cache/codex-scratch/J340/evidence/. No Linux, Mac or perf build/run from this slice remains active. Next: compatible ScreenCaptureKit pin, then individually committed safe major bumps.

Nix/Rust patch slice finalized and pushed as **6fbc7850683c1d22f65ae78261a36b9f73477011**. Replaced the WIP checkpoint; no WIP commit remains. nixpkgs/rust-overlay advance to the inventoried revisions; Rust is 1.99.1, Bun 1.4.4 and Node 24.21.0. Cargo.lock and all VT/Zig pins are unchanged by this commit. **Useful nonblocking OpenSSL follow-up:** take this already planned, supported build-environment refresh as the cheap way to retain 0.10.82/0.9.118's safety fixes while recovering the measured certificate-operation cost. No safety checks or features were disabled. A fresh three-way run on the quiet perf VM (zero steal, exit 0) measured: | configuration | p50 µs, trials → median | p99 µs, trials → median | retained-500 median RSS | | --- | --- | --- | --- | | original dependencies / old environment | 296 / 290 / 297 → **296** | 312 / 309 / 321 → **312** | 5300 KiB | | fixed OpenSSL bindings / old environment | 347 / 358 / 353 → **353** | 368 / 378 / 375 → **375** | 5300 KiB | | fixed OpenSSL bindings / refreshed environment | 296 / 294 / 298 → **296** | 316 / 317 / 315 → **316** | 5300 KiB | The new p99 is within the original trial range, and all retain the same 177,500 DER bytes. This narrows the interaction to build environment plus bindings; it does **not** isolate the Rust patch from the Nix input changes. Individual source-level attribution remains a follow-up, without blocking the other updates. The wider paired run also passed: runtime p99 ns 19366/18625/18354 → 18545/19497/18464; alacritty oracle MB/s 87.59/81.26/83.28 → 85.48/86.66/84.61; vt100 oracle MB/s 45.81/43.93/44.03 → 43.88/44.30/44.19. Ranges overlap. VT snapshot medians 80.52 → 81.05 µs; repaint/cursor equality true throughout, RSS within 68 KiB for 10,000 history rows. These VT libraries remain nonshipping benchmark oracles. Validation receipts on dev-02: - `evidence/build-env-quick.log`: **BUILD_ENV_QUICK_EXIT=0**, quick/deny/typecheck/two font tests, zero-advisory Bun audit, duplicate names **54→54**, excess versions **60→60**, no new duplicate versions or license expressions. - `evidence/build-env-bun-fod.log`: forced Bun 1.4.4 fixed-output rebuild reproduces `sha256-OWo43tRTqASAQWrgDuV9MPSbmF8oAsB/4jvgVy46TEI=`. - `evidence/build-env-static.log`: **BUILD_ENV_STATIC_EXIT=0**, **BENCH_BUILD_EXIT=0**. Stripped static PIE x86 **27,894,608 B (+544 this slice)**; arm64 **25,072,888 B (+4,480 this slice)**; no PT_INTERP, native arm64 key/CLI probes and metadata/defect probes pass. Both attached perf logs and perf VM before/after receipts remain under `~/.cache/codex-scratch/J340/evidence/`. No Linux, Mac or perf build/run from this slice remains active. Next: compatible ScreenCaptureKit pin, then individually committed safe major bumps.

build-env-perf.log

4 KiB

build-env-three-way.log

3.2 KiB

kayg commented

2026-11-07 08:37:57 +00:00

Author

Owner

ScreenCaptureKit compatible slice started from 6fbc78506: exact pin and its one lock entry 11.0.0 → 11.1.2, no transitive resolution changes. Both slot statuses and cargo launcher checked; dev-02 has no queued jobs, versus seven on compute01. Queued per-batch quick/deny/hygiene/static check there, receipt evidence/screencapture-linux-check.log. Prior native Mac plugin check for this exact version remains passed and attached as previously recorded.

Also building the repository's existing wire_codec benchmark driver with current Criterion 0.7, so the later Criterion major has a same-compiler baseline. No protocol implementation is changing.

ScreenCaptureKit compatible slice started from **6fbc78506**: exact pin and its one lock entry 11.0.0 → 11.1.2, no transitive resolution changes. Both slot statuses and cargo launcher checked; dev-02 has no queued jobs, versus seven on compute01. Queued per-batch quick/deny/hygiene/static check there, receipt `evidence/screencapture-linux-check.log`. Prior native Mac plugin check for this exact version remains passed and attached as previously recorded. Also building the repository's existing `wire_codec` benchmark driver with current Criterion 0.7, so the later Criterion major has a same-compiler baseline. No protocol implementation is changing.

kayg commented

2026-11-07 08:47:27 +00:00

Author

Owner

Compatible ScreenCaptureKit slice committed and pushed: 6a2c5f1989. Exact 11.0.0 → 11.1.2 pin plus its one lock entry only; upstream fixes and native Mac compile receipt described above.

Fresh dev-02 receipt evidence/screencapture-linux-check.log:

advisories ok, bans ok, licenses ok, sources ok
duplicate names: 54 -> 54
excess versions: 60 -> 60
new duplicate versions: {}
new license expressions: []
RUST_MAJOR_CHECK_EXIT=0

Quick and both static checks pass. Sizes remain x86 27,894,608 B, arm64 25,072,888 B, zero delta on both. No VT/Zig changes. Built the existing wire_codec driver for a same-toolchain Criterion 0.7 baseline; its performance run is preserved separately under the perf VM's evidence/wire-baseline-perf*.

Next individual major: nix 0.30 → 0.31.3. Changelog review found only removed SigHandler equality traits relevant to our API surface; repository call sites do not compare handlers. No source API migration planned.

Compatible ScreenCaptureKit slice committed and pushed: **6a2c5f19893707a46ed44a454414f1ed9f814560**. Exact 11.0.0 → 11.1.2 pin plus its one lock entry only; upstream fixes and native Mac compile receipt described above. Fresh dev-02 receipt `evidence/screencapture-linux-check.log`: ``` advisories ok, bans ok, licenses ok, sources ok duplicate names: 54 -> 54 excess versions: 60 -> 60 new duplicate versions: {} new license expressions: [] RUST_MAJOR_CHECK_EXIT=0 ``` Quick and both static checks pass. Sizes remain x86 **27,894,608 B**, arm64 **25,072,888 B**, **zero delta on both**. No VT/Zig changes. Built the existing wire_codec driver for a same-toolchain Criterion 0.7 baseline; its performance run is preserved separately under the perf VM's `evidence/wire-baseline-perf*`. Next individual major: nix 0.30 → 0.31.3. Changelog review found only removed SigHandler equality traits relevant to our API surface; repository call sites do not compare handlers. No source API migration planned.

kayg commented

2026-11-07 08:48:49 +00:00

Author

Owner

Individual nix major slice prepared from 6a2c5f198: workspace requirement 0.30 → 0.31, resolved 0.31.3 already in the graph. cargo update --workspace adds zero packages and removes nix 0.30.1. No source changes; SigHandler equality removal is unused by our callers. This should reduce excess crate versions, to be confirmed by the per-batch metadata check.

Both status/launcher checks repeated; dev-02 has three queued versus five on compute01, with 85G free and the same-target baseline cached. Per-batch quick/deny/hygiene/static and runtime/crypto benchmark-driver build queued there, receipt evidence/nix-major-check.log. One target remains /home/claude/worktrees/J340/target.

The initial standalone Criterion invocation exercised test mode successfully. Preserved it as evidence/wire-baseline-smoke.log; the actual measurement run explicitly uses --bench and is in evidence/wire-baseline-perf.log on the perf VM. No timing claim relies on smoke mode.

Individual nix major slice prepared from **6a2c5f198**: workspace requirement 0.30 → 0.31, resolved **0.31.3** already in the graph. `cargo update --workspace` adds zero packages and **removes nix 0.30.1**. No source changes; SigHandler equality removal is unused by our callers. This should reduce excess crate versions, to be confirmed by the per-batch metadata check. Both status/launcher checks repeated; dev-02 has three queued versus five on compute01, with 85G free and the same-target baseline cached. Per-batch quick/deny/hygiene/static and runtime/crypto benchmark-driver build queued there, receipt `evidence/nix-major-check.log`. One target remains `/home/claude/worktrees/J340/target`. The initial standalone Criterion invocation exercised test mode successfully. Preserved it as `evidence/wire-baseline-smoke.log`; the actual measurement run explicitly uses `--bench` and is in `evidence/wire-baseline-perf.log` on the perf VM. No timing claim relies on smoke mode.

kayg commented

2026-11-07 09:05:17 +00:00

Author

Owner

Individual nix major committed and pushed: 5ddf95d842. Workspace 0.30 → 0.31.3 removes the old wrapper crate; no application source changes needed. SigHandler equality removal is unused, while unknown epoll/kqueue flags now retain bits instead of panicking.

Dev-02 evidence/nix-major-check.log:

advisories ok, bans ok, licenses ok, sources ok
duplicate names: 54 -> 53
excess versions: 60 -> 59
new duplicate versions: {}
new license expressions: []
RUST_MAJOR_CHECK_EXIT=0

Quick and both static checks passed. x86 27,895,920 B (+1,312 B this slice); aarch64 25,061,432 B (−11,456 B). Both are stripped static PIE with no PT_INTERP; native arm key/CLI and artifact-defect probes pass.

Perf VM paired repeat: runtime p99 ns 18715/18955/20047 → 19647/17964/18815, overlapping ranges; certificate p50 µs 290/290/290 → 288/287/288 (median 290→288), p99 309/310/310 → 308/310/312 (median 310→310). Retained-500 median RSS 5304→5300 KiB, DER bytes unchanged. Quiet before/after checks, exit 0; 1/8648 steal jiffies. The first run flagged post-run CPU activity and is retained as evidence/nix-major-perf.log; the attached nix-major-perf-confirm.log is the performance receipt used for the commit.

No own background task remains from this slice. Next: Criterion 0.7 → 0.8.2 in its own commit; async-std removal is unused, MSRV 1.86 fits, and the existing wire_codec 0.7 benchmark baseline has completed in actual --bench mode (zero steal, exit 0).

Individual nix major committed and pushed: **5ddf95d8423d3e952e8ff8132d5c6e8f7da1ebef**. Workspace 0.30 → 0.31.3 removes the old wrapper crate; no application source changes needed. SigHandler equality removal is unused, while unknown epoll/kqueue flags now retain bits instead of panicking. Dev-02 `evidence/nix-major-check.log`: ``` advisories ok, bans ok, licenses ok, sources ok duplicate names: 54 -> 53 excess versions: 60 -> 59 new duplicate versions: {} new license expressions: [] RUST_MAJOR_CHECK_EXIT=0 ``` Quick and both static checks passed. x86 **27,895,920 B (+1,312 B this slice)**; aarch64 **25,061,432 B (−11,456 B)**. Both are stripped static PIE with no PT_INTERP; native arm key/CLI and artifact-defect probes pass. Perf VM paired repeat: runtime p99 ns 18715/18955/20047 → 19647/17964/18815, overlapping ranges; certificate p50 µs 290/290/290 → 288/287/288 (median **290→288**), p99 309/310/310 → 308/310/312 (median **310→310**). Retained-500 median RSS **5304→5300 KiB**, DER bytes unchanged. Quiet before/after checks, exit 0; 1/8648 steal jiffies. The first run flagged post-run CPU activity and is retained as `evidence/nix-major-perf.log`; the attached `nix-major-perf-confirm.log` is the performance receipt used for the commit. No own background task remains from this slice. Next: Criterion 0.7 → 0.8.2 in its own commit; async-std removal is unused, MSRV 1.86 fits, and the existing wire_codec 0.7 benchmark baseline has completed in actual `--bench` mode (zero steal, exit 0).

nix-major-perf-confirm.log

2.5 KiB

kayg commented

2026-11-07 09:06:10 +00:00

Author

Owner

Criterion major slice queued from 5ddf95d84: 0.7.0 → 0.8.2, criterion-plot 0.6.0 → 0.8.2 through its parent requirement, plus alloca 0.4.0/page_size 0.6.0 and target-only winapi packages. No benchmark source changes. Upstream removes unused async-std support, raises MSRV to 1.86, adds layout randomisation, and fixes uniform-duration benchmark panics.

Both statuses/launcher checked again; dev-02 has one queued versus four on compute01, 83G free, cargo 1.99.1. Per-batch quick/deny/duplicate/license/static and existing wire_codec driver build: evidence/criterion-major-check.log. Existing Criterion 0.7 actual measurements: perf VM evidence/wire-baseline-perf.log and wire-baseline-data/, zero steal, PERF_EXIT=0. Next run will also explicitly use --bench.

Criterion major slice queued from **5ddf95d84**: 0.7.0 → **0.8.2**, criterion-plot 0.6.0 → 0.8.2 through its parent requirement, plus alloca 0.4.0/page_size 0.6.0 and target-only winapi packages. No benchmark source changes. Upstream removes unused async-std support, raises MSRV to 1.86, adds layout randomisation, and fixes uniform-duration benchmark panics. Both statuses/launcher checked again; dev-02 has one queued versus four on compute01, 83G free, cargo 1.99.1. Per-batch quick/deny/duplicate/license/static and existing wire_codec driver build: `evidence/criterion-major-check.log`. Existing Criterion 0.7 actual measurements: perf VM `evidence/wire-baseline-perf.log` and `wire-baseline-data/`, zero steal, PERF_EXIT=0. Next run will also explicitly use `--bench`.

kayg commented

2026-11-07 09:17:51 +00:00

Author

Owner

Criterion 0.8.2 slice passed verify quick, cargo-deny (advisories/bans/licenses/sources all ok), both static builds and actual wire_codec measurements (--bench --noplot, exit 0, zero steal). Duplicate names 53 → 53, excess versions 59 → 59, no new SPDX expressions. Static sizes unchanged: x86 27,895,920 B, arm64 25,061,432 B. Wire case point estimates range −5.3% to +3.7% across the development-only harness change, with no shipping protocol changes. Logs: criterion-major-check.log, wire-criterion-major-perf.log; Criterion raw data retained on perf VM.

Criterion 0.8.2 slice passed `verify quick`, cargo-deny (advisories/bans/licenses/sources all ok), both static builds and actual wire_codec measurements (`--bench --noplot`, exit 0, zero steal). Duplicate names **53 → 53**, excess versions **59 → 59**, no new SPDX expressions. Static sizes unchanged: x86 **27,895,920 B**, arm64 **25,061,432 B**. Wire case point estimates range −5.3% to +3.7% across the development-only harness change, with no shipping protocol changes. Logs: `criterion-major-check.log`, `wire-criterion-major-perf.log`; Criterion raw data retained on perf VM.

kayg commented

2026-11-07 09:20:10 +00:00

Author

Owner

Criterion is pushed at 65d1749ca. Next atomic slice: alacritty_terminal 0.25.1 → 0.26.0, signal-hook 0.3.18 → 0.4.6 via its requirement. This is the existing benchmark oracle only; upstream ChildExit payload change is unused by VoidListener. Current gate PID 3311316, dev-02 alacritty-major-check.log; both slot statuses and cargo launcher checked. Compute01 has five active/six queued, dev-02 one active/two queued, so dev-02 is shorter. Fresh dev fetched at af033d0b4 (11 commits advanced), no dependency conflicts apparent; will rebase before final gate.

Criterion is pushed at **65d1749ca**. Next atomic slice: alacritty_terminal 0.25.1 → 0.26.0, signal-hook 0.3.18 → 0.4.6 via its requirement. This is the existing benchmark oracle only; upstream ChildExit payload change is unused by VoidListener. Current gate PID **3311316**, dev-02 `alacritty-major-check.log`; both slot statuses and cargo launcher checked. Compute01 has five active/six queued, dev-02 one active/two queued, so dev-02 is shorter. Fresh dev fetched at af033d0b4 (11 commits advanced), no dependency conflicts apparent; will rebase before final gate.

kayg commented

2026-11-07 09:21:10 +00:00

Author

Owner

Fresh cargo-audit 0.22.2 receipt (current alacritty candidate graph, 553 lock dependencies, 1422 advisories): exactly RUSTSEC-2023-0071, rsa 0.9.10 Marvin timing, severity 5.9, no fixed upgrade available, exit 1. This matches the baseline finding; no new advisory. Initial invocation through the dev shell had no cargo-audit command; successful explicit invocation is nix shell --inputs-from /home/claude/worktrees/J340 nixpkgs#cargo-audit -c cargo audit --file /home/claude/worktrees/J340/Cargo.lock. Receipt evidence/audit-late.log. Per-batch cargo-deny continues to validate the selected dependency graph, without new suppressions.

Fresh cargo-audit 0.22.2 receipt (current alacritty candidate graph, 553 lock dependencies, 1422 advisories): exactly **RUSTSEC-2023-0071**, rsa 0.9.10 Marvin timing, severity 5.9, **no fixed upgrade available**, exit 1. This matches the baseline finding; no new advisory. Initial invocation through the dev shell had no cargo-audit command; successful explicit invocation is `nix shell --inputs-from /home/claude/worktrees/J340 nixpkgs#cargo-audit -c cargo audit --file /home/claude/worktrees/J340/Cargo.lock`. Receipt `evidence/audit-late.log`. Per-batch cargo-deny continues to validate the selected dependency graph, without new suppressions.

kayg commented

2026-11-07 09:28:07 +00:00

Author

Owner

Alacritty benchmark-oracle slice is verified: quick, deny and both static checks passed, 53 duplicated names / 59 excess versions unchanged, no new SPDX expressions, x86 27,895,920 B / arm64 25,061,432 B unchanged. Paired perf zero steal/exit 0: alacritty median 93.02 → 91.86 MB/s (−1.25%), total RSS median 55,264 → 55,264 KiB; unchanged vt100 control median 47.05 → 46.66 MB/s, snapshot 78.57 → 78.55 µs, 2331 bytes, replay/cursor all true. The small throughput cost affects only this nonshipping benchmark oracle. Receipts: dev-02 alacritty-major-check.log, perf VM alacritty-major-perf.log.

Alacritty benchmark-oracle slice is verified: quick, deny and both static checks passed, **53 duplicated names / 59 excess versions** unchanged, no new SPDX expressions, x86 **27,895,920 B** / arm64 **25,061,432 B** unchanged. Paired perf zero steal/exit 0: alacritty median **93.02 → 91.86 MB/s (−1.25%)**, total RSS median **55,264 → 55,264 KiB**; unchanged vt100 control median **47.05 → 46.66 MB/s**, snapshot **78.57 → 78.55 µs**, 2331 bytes, replay/cursor all true. The small throughput cost affects only this nonshipping benchmark oracle. Receipts: dev-02 `alacritty-major-check.log`, perf VM `alacritty-major-perf.log`.

kayg commented

2026-11-07 09:29:12 +00:00

Author

Owner

Tower-http slice starts from 3bbe78c0b: 0.6.11 → 0.7.1, only lock + root manifest. Upstream changes checked against ServeDir/ServeFile use: default TokioBackend preserves local filesystem service; new ETag/conditional handling, multipart-range rejection and error response changes are relevant and covered by existing web_assets tests. No TLS/auth/parser code changes. Both queue statuses/launcher checked; dev-02 free vs five active/six queued compute01. PID 3325736, tower-major-check.log; quick/deny/hygiene/static then runtime+certificate driver build.

Tower-http slice starts from **3bbe78c0b**: 0.6.11 → 0.7.1, only lock + root manifest. Upstream changes checked against ServeDir/ServeFile use: default TokioBackend preserves local filesystem service; new ETag/conditional handling, multipart-range rejection and error response changes are relevant and covered by existing web_assets tests. No TLS/auth/parser code changes. Both queue statuses/launcher checked; dev-02 free vs five active/six queued compute01. PID **3325736**, `tower-major-check.log`; quick/deny/hygiene/static then runtime+certificate driver build.

kayg commented

2026-11-07 09:35:04 +00:00

Author

Owner

Tower-http quick found one real compatibility-test failure: web_assets encoding test expected exact Vary: Accept-Encoding; new service emits Vary: accept-encoding (log lines 2564–2575, 948 pass / 1 fail). Header field-name tokens are case-insensitive, so this is valid wire behavior. Updating the existing assertion with eq_ignore_ascii_case, preserving exact token cardinality and adding the required function doc comment. No application or auth/TLS/parser code change. All other workspace tests passed; batch will rerun quick and its remaining checks before commit.

Tower-http quick found one real compatibility-test failure: web_assets encoding test expected exact `Vary: Accept-Encoding`; new service emits `Vary: accept-encoding` (log lines 2564–2575, 948 pass / 1 fail). Header field-name tokens are case-insensitive, so this is valid wire behavior. Updating the existing assertion with `eq_ignore_ascii_case`, preserving exact token cardinality and adding the required function doc comment. No application or auth/TLS/parser code change. All other workspace tests passed; batch will rerun quick and its remaining checks before commit.

kayg commented

2026-11-07 09:41:05 +00:00

Author

Owner

Fresh cargo-audit 0.22.2 receipt (current alacritty candidate graph, 553 lock dependencies, 1422 advisories): exactly RUSTSEC-2023-0071, rsa 0.9.10 Marvin timing, severity 5.9, no fixed upgrade available, exit 1. This matches the baseline finding; no new advisory. Initial invocation through the dev shell had no cargo-audit command; successful explicit invocation is nix shell --inputs-from /home/claude/worktrees/J340 nixpkgs#cargo-audit -c cargo audit --file /home/claude/worktrees/J340/Cargo.lock. Receipt evidence/audit-late.log. Per-batch cargo-deny continues to validate the selected dependency graph, without new suppressions.

Fresh cargo-audit 0.22.2 receipt (current alacritty candidate graph, 553 lock dependencies, 1422 advisories): exactly **RUSTSEC-2023-0071**, rsa 0.9.10 Marvin timing, severity 5.9, **no fixed upgrade available**, exit 1. This matches the baseline finding; no new advisory. Initial invocation through the dev shell had no cargo-audit command; successful explicit invocation is `nix shell --inputs-from /home/claude/worktrees/J340 nixpkgs#cargo-audit -c cargo audit --file /home/claude/worktrees/J340/Cargo.lock`. Receipt `evidence/audit-late.log`. Per-batch cargo-deny continues to validate the selected dependency graph, without new suppressions.

audit-late.log

674 B

alacritty-major-perf.log

1.9 KiB

wire-criterion-major-perf.log

4.5 KiB

kayg commented

2026-11-07 09:46:32 +00:00

Author

Owner

Tower-http rerun passed quick after the case-insensitive Vary assertion adjustment, cargo-deny and static checks. No new licences or duplicate versions (53 names / 59 excess). x86 27,922,288 B (+26,368); arm64 25,097,192 B (+35,760). Existing web_assets encoding/cache/framing tests pass. Runtime/certificate drivers built successfully; perf-run has been waiting for its shared lock since the logged 10:44:54 UTC. No Linux build slot held while waiting. Batch commit follows the measurement receipt.

Tower-http rerun passed quick after the case-insensitive Vary assertion adjustment, cargo-deny and static checks. No new licences or duplicate versions (53 names / 59 excess). x86 **27,922,288 B (+26,368)**; arm64 **25,097,192 B (+35,760)**. Existing web_assets encoding/cache/framing tests pass. Runtime/certificate drivers built successfully; perf-run has been waiting for its shared lock since the logged 10:44:54 UTC. No Linux build slot held while waiting. Batch commit follows the measurement receipt.

kayg commented

2026-11-07 09:50:01 +00:00

Author

Owner

Tower-http is pushed as 0dc28820d, with the successful checks and size/duplicate receipt above. Its additional runtime/certificate comparison remains queued behind the perf lock and will be collected before handoff; it is not a terminal/packet hot-path dependency.

Next atomic slice, vt100 0.16.2 → 0.18.1: fixed positive dimensions now use NonZeroU16; formatted snapshots are Strings and replay uses their bytes. Only the existing test/benchmark oracle constructors and replay code change, with D345 docs on touched functions. Shipping libghostty/native VT remains untouched. vte remains 0.15, no parent-family change. Both statuses/launcher checked, dev-02 one active/one queued vs compute01 five active/eight queued. PID 3376352, vt100-major-check.log: quick/deny/hygiene/static, full real shim integration test and paired oracle benchmark build.

Tower-http is pushed as **0dc28820d**, with the successful checks and size/duplicate receipt above. Its additional runtime/certificate comparison remains queued behind the perf lock and will be collected before handoff; it is not a terminal/packet hot-path dependency. Next atomic slice, vt100 **0.16.2 → 0.18.1**: fixed positive dimensions now use NonZeroU16; formatted snapshots are Strings and replay uses their bytes. Only the existing test/benchmark oracle constructors and replay code change, with D345 docs on touched functions. Shipping libghostty/native VT remains untouched. vte remains 0.15, no parent-family change. Both statuses/launcher checked, dev-02 one active/one queued vs compute01 five active/eight queued. PID **3376352**, `vt100-major-check.log`: quick/deny/hygiene/static, full real shim integration test and paired oracle benchmark build.

kayg commented

2026-11-07 09:53:17 +00:00

Author

Owner

Additional tower-http comparison completed for pushed 0dc28820d: perf-run exit 0, 1 / 8623 steal jiffies, no quiet warning. Three alternating immediate shipping baselines: runtime slow-write p99 15419/15228/15720 → 17112/10790/19307 ns (overlapping ranges); certificate p50 288/286/288 → 288/288/288 µs, p99 313/312/313 → 314/308/312 µs, retained-500 median RSS 5304 → 5304 KiB, identical DER bytes. No persistent certificate regression; runtime probe is noisy at this sample size. Full receipt attached.

Additional tower-http comparison completed for pushed **0dc28820d**: perf-run exit 0, **1 / 8623 steal jiffies**, no quiet warning. Three alternating immediate shipping baselines: runtime slow-write p99 **15419/15228/15720 → 17112/10790/19307 ns** (overlapping ranges); certificate p50 **288/286/288 → 288/288/288 µs**, p99 **313/312/313 → 314/308/312 µs**, retained-500 median RSS **5304 → 5304 KiB**, identical DER bytes. No persistent certificate regression; runtime probe is noisy at this sample size. Full receipt attached.

tower-major-perf.log

2.6 KiB

kayg commented

2026-11-07 09:55:16 +00:00

Author

Owner

Final manifest scan also records the dependency-free private vendored browser renderer manifest: apps/tracer/vendor/ghostty-web/package.json is 0.5.0-rc.0, source pin 5f0c6b7720e5ac241208afe7a2335981ded1b486, MIT. Fresh npm latest is 0.4.0, gitHead 9e4e126d89ac3537d2b2ebec075849851566de9f, MIT (ghostty-web-registry-final.json). The vendored source is ahead of stable, so no downgrade/update is appropriate. It has no dependency declarations or lockfile. No renderer/native VT source or pins changed.

Final manifest scan also records the dependency-free private vendored browser renderer manifest: `apps/tracer/vendor/ghostty-web/package.json` is **0.5.0-rc.0**, source pin **5f0c6b7720e5ac241208afe7a2335981ded1b486**, MIT. Fresh npm `latest` is **0.4.0**, gitHead **9e4e126d89ac3537d2b2ebec075849851566de9f**, MIT (`ghostty-web-registry-final.json`). The vendored source is ahead of stable, so no downgrade/update is appropriate. It has no dependency declarations or lockfile. No renderer/native VT source or pins changed.

kayg commented

2026-11-07 10:06:57 +00:00

Author

Owner

vt100 0.18.1 slice passed quick, deny, both static checks and 31/31 real shim integration tests, including ring_wrap_snapshot_repaints_real_vim. Duplicate names/excess stay 53/59, no new SPDX expressions; x86 27,922,288 B, arm64 25,097,192 B, both unchanged.

Paired benchmark, exit 0/zero steal: vt100 median throughput 46.24 → 38.62 MB/s (−16.5%), total RSS 65,848 → 15,208 KiB (−76.9%), snapshot 79.86 → 50.92 µs (−36.2%), identical 2331 bytes and all replay/cursor checks true. Alacritty control median 90.99 → 91.03 MB/s. The slower parse benchmark trades against much lower memory and faster snapshots in a nonshipping test oracle; the shipping engine/pins are untouched. Receipt attached; build log vt100-major-check.log.

vt100 0.18.1 slice passed quick, deny, both static checks and **31/31 real shim integration tests**, including `ring_wrap_snapshot_repaints_real_vim`. Duplicate names/excess stay **53/59**, no new SPDX expressions; x86 **27,922,288 B**, arm64 **25,097,192 B**, both unchanged. Paired benchmark, exit 0/zero steal: vt100 median throughput **46.24 → 38.62 MB/s (−16.5%)**, total RSS **65,848 → 15,208 KiB (−76.9%)**, snapshot **79.86 → 50.92 µs (−36.2%)**, identical 2331 bytes and all replay/cursor checks true. Alacritty control median **90.99 → 91.03 MB/s**. The slower parse benchmark trades against much lower memory and faster snapshots in a **nonshipping test oracle**; the shipping engine/pins are untouched. Receipt attached; build log `vt100-major-check.log`.

vt100-major-perf.log

1.8 KiB

kayg commented

2026-11-07 10:08:10 +00:00

Author

Owner

Rand slice from d63438ffe: workspace 0.9 → existing 0.10.3, no new package versions resolved and no auth source changes. Repository only uses rand::random; removed/renamed Rng/OsRng/seeding APIs are unused. Upstream changes StdRng internals to chacha20 while retaining its algorithm output. Both queues/launcher checked: dev-02 one active/no queue vs compute01 five active/five queued. rand-major-check.log covers quick/deny/hygiene/static and runtime/certificate driver builds; paired crypto/runtime comparison follows.

Rand slice from **d63438ffe**: workspace 0.9 → existing **0.10.3**, no new package versions resolved and no auth source changes. Repository only uses `rand::random`; removed/renamed Rng/OsRng/seeding APIs are unused. Upstream changes StdRng internals to chacha20 while retaining its algorithm output. Both queues/launcher checked: dev-02 one active/no queue vs compute01 five active/five queued. `rand-major-check.log` covers quick/deny/hygiene/static and runtime/certificate driver builds; paired crypto/runtime comparison follows.

kayg commented

2026-11-07 10:28:36 +00:00

Author

Owner

Rand slice verified: quick/deny/static checks passed, no auth source changes or new package versions, no new SPDX expressions or duplicates (53 names / 59 excess, unchanged). Static x86 27,923,056 B (+768), arm64 25,088,744 B (−8448).

Paired probe exit 0, 1 / 7416 steal jiffies, no quiet warning. Certificate median p50 288 → 288 µs, p99 312 → 314 µs, retained-500 RSS median 5300 → 5300 KiB; p99 ranges overlap (312–317 vs 306–326). Runtime p99 38021/12634/20439 → 28905/11411/18785 ns, overlapping ranges. Full receipt attached.

Rand slice verified: quick/deny/static checks passed, no auth source changes or new package versions, no new SPDX expressions or duplicates (**53 names / 59 excess**, unchanged). Static x86 **27,923,056 B (+768)**, arm64 **25,088,744 B (−8448)**. Paired probe exit 0, **1 / 7416 steal jiffies**, no quiet warning. Certificate median p50 **288 → 288 µs**, p99 **312 → 314 µs**, retained-500 RSS median **5300 → 5300 KiB**; p99 ranges overlap (312–317 vs 306–326). Runtime p99 **38021/12634/20439 → 28905/11411/18785 ns**, overlapping ranges. Full receipt attached.

rand-major-perf.log

2.4 KiB

kayg commented

2026-11-07 10:29:01 +00:00

Author

Owner

AES-GCM test-oracle slice from 412cd24b9: workspace 0.10 → existing 0.11.1. Resolution adds no packages and removes obsolete aes 0.8.4/aes-gcm 0.10.3/ctr 0.9.2/ghash 0.5.1/polyval 0.6.2. Trying manifest-only; any real auth-crypto source migration will be reverted/deferred per task. Both statuses and cargo launcher checked: compute01 has a free slot but only 18G, below its 25G admission floor, so it cannot accept a build; dev-02 76G, one active/one queued. aes-major-check.log queues quick/deny/hygiene/both static checks. This is only our auth test oracle; shipping encryption stays OpenSSL.

AES-GCM test-oracle slice from **412cd24b9**: workspace 0.10 → existing **0.11.1**. Resolution adds no packages and removes obsolete aes 0.8.4/aes-gcm 0.10.3/ctr 0.9.2/ghash 0.5.1/polyval 0.6.2. Trying manifest-only; any real auth-crypto source migration will be reverted/deferred per task. Both statuses and cargo launcher checked: compute01 has a free slot but only **18G**, below its 25G admission floor, so it cannot accept a build; dev-02 76G, one active/one queued. `aes-major-check.log` queues quick/deny/hygiene/both static checks. This is only our auth test oracle; shipping encryption stays OpenSSL.

kayg commented

2026-11-07 10:38:48 +00:00

Author

Owner

Defer AES-GCM 0.10.3 → 0.11.1, candidate reverted. Quick's workspace clippy fails at crates/infraternal-server/src/auth/tests.rs:191,219: Nonce::from_slice is deprecated in the new hybrid-array API; upstream requires TryFrom. No application-source fix or deprecation suppression was applied. This is an auth crypto oracle and the task explicitly defers majors needing code changes in security-sensitive areas. A separate job can migrate the two constructors, review the cryptographic vectors and run full gates: 1–2 hours. It would remove five obsolete AES-family package versions, so it remains useful for J337's graph cleanup. Failed candidate lock is retained as Cargo.aes-deferred.lock, full red quick log attached. Branch remains at pushed 412cd24b9 for Rust.

**Defer AES-GCM 0.10.3 → 0.11.1**, candidate reverted. Quick's workspace clippy fails at `crates/infraternal-server/src/auth/tests.rs:191,219`: `Nonce::from_slice` is deprecated in the new hybrid-array API; upstream requires `TryFrom`. No application-source fix or deprecation suppression was applied. This is an auth crypto oracle and the task explicitly defers majors needing code changes in security-sensitive areas. A separate job can migrate the two constructors, review the cryptographic vectors and run full gates: **1–2 hours**. It would remove five obsolete AES-family package versions, so it remains useful for J337's graph cleanup. Failed candidate lock is retained as `Cargo.aes-deferred.lock`, full red quick log attached. Branch remains at pushed **412cd24b9** for Rust.

aes-major-check.log

13 KiB

kayg commented

2026-11-07 10:40:42 +00:00

Author

Owner

Rust work is now rebased onto latest dev af033d0b4f, pushed at d92a12b243. All 11 patches compare equal in git range-diff; mapping attached, so historical batch receipts remain attributable. No native VT changes arrived in this rebase.

Final native Mac guard queued under the shared lockf -k /tmp/mac-bench.lock, PID 5849, mac-final-check.log, Rust tree d92a12b24. It checks existing CLI + desktop configurations and deletes its own target before releasing the lock.

TypeScript 5.9.3 → 7.0.2 slice starts from d92a12b24. Reviewed removed legacy targets/resolution/baseUrl/compiler API against our ES2022/ESNext/Bundler CLI-only usage; none are used. Production assets still build through Bun. Optional native development compiler packages are excluded from the Nix production dependency cache, with its existing comment clarified. GOMAXPROCS=3. Both Linux statuses checked, both queues empty; dev-02 chosen to reuse this job's single warm target and 77G free. typescript-major-check.log: quick/typecheck, production build, audit, deny, graph/license/static receipts and forced Bun FOD rebuild.

Rust work is now rebased onto latest dev **af033d0b4fc5e9a6164c6b528914a0a99bb93b55**, pushed at **d92a12b2439b284992931e9c2885f28ad37e4eb0**. All 11 patches compare **equal** in `git range-diff`; mapping attached, so historical batch receipts remain attributable. No native VT changes arrived in this rebase. Final native Mac guard queued under the shared `lockf -k /tmp/mac-bench.lock`, PID **5849**, `mac-final-check.log`, Rust tree d92a12b24. It checks existing CLI + desktop configurations and deletes its own target before releasing the lock. TypeScript **5.9.3 → 7.0.2** slice starts from d92a12b24. Reviewed removed legacy targets/resolution/baseUrl/compiler API against our ES2022/ESNext/Bundler CLI-only usage; none are used. Production assets still build through Bun. Optional native development compiler packages are excluded from the Nix production dependency cache, with its existing comment clarified. GOMAXPROCS=3. Both Linux statuses checked, both queues empty; dev-02 chosen to reuse this job's single warm target and 77G free. `typescript-major-check.log`: quick/typecheck, production build, audit, deny, graph/license/static receipts and forced Bun FOD rebuild.

final-rebase-range-diff.txt

951 B

kayg commented

2026-11-07 10:42:30 +00:00

Author

Owner

TypeScript 7 quick/typecheck found three DOM declaration changes: HTMLElement.hidden now includes "until-found", so two sidebar/palette open calls need explicit Boolean coercion; the synchronized-input test spy accepts the old broad ArrayBufferLike union while native WebSocket.send now accepts BufferSource. Adapting the two nonsecurity UI calls and using Parameters<WebSocket["send"]>[0] in the instrumentation signature, with documentation. The spy's parsing/control flow is unchanged; its annotation is erased at runtime. No auth/TLS/crypto or shipping protocol-parser logic changes. Existing sidebar, palette, font-picker and synchronized-input browser specs are added to this slice's checks. Original red quick receipt preserved as typescript-major-check-red.log.

TypeScript 7 quick/typecheck found three DOM declaration changes: `HTMLElement.hidden` now includes `"until-found"`, so two sidebar/palette open calls need explicit Boolean coercion; the synchronized-input test spy accepts the old broad ArrayBufferLike union while native WebSocket.send now accepts BufferSource. Adapting the two nonsecurity UI calls and using `Parameters<WebSocket["send"]>[0]` in the instrumentation signature, with documentation. The spy's parsing/control flow is unchanged; its annotation is erased at runtime. No auth/TLS/crypto or shipping protocol-parser logic changes. Existing sidebar, palette, font-picker and synchronized-input browser specs are added to this slice's checks. Original red quick receipt preserved as `typescript-major-check-red.log`.

kayg commented

2026-11-07 10:57:24 +00:00

Author

Owner

Native dependency-head guard failed on macOS at crates/infraternal-agent/src/logins.rs:437: SockFlag::SOCK_CLOEXEC is not available on Darwin. Investigation: nix 0.30.1 and 0.31.3 have identical cfg guards excluding Darwin for this flag; the socket call also predates the refresh and is unchanged by the recent dev rebase. The updated CLI cannot pass this pre-existing login compilation path. Checking unmodified dev af033d0b4 with its own pinned toolchain/Nix inputs under the Mac lock now, log mac-baseline-check.log, PID 42155, to obtain a direct baseline receipt. No login/auth workaround is being introduced in this dependency job. First failed native guard cleaned its target before releasing the lock.

Native dependency-head guard failed on macOS at `crates/infraternal-agent/src/logins.rs:437`: `SockFlag::SOCK_CLOEXEC` is not available on Darwin. Investigation: nix 0.30.1 and 0.31.3 have **identical cfg guards** excluding Darwin for this flag; the socket call also predates the refresh and is unchanged by the recent dev rebase. The updated CLI cannot pass this pre-existing login compilation path. Checking **unmodified dev af033d0b4 with its own pinned toolchain/Nix inputs** under the Mac lock now, log `mac-baseline-check.log`, PID **42155**, to obtain a direct baseline receipt. No login/auth workaround is being introduced in this dependency job. First failed native guard cleaned its target before releasing the lock.

kayg commented

2026-11-07 10:59:18 +00:00

Author

Owner

TypeScript 7.0.2 slice verified: quick/typecheck, production build, Bun audit (zero vulnerabilities), cargo-deny, initial Nix cache build plus forced rebuild, and 8/8 font-picker/palette/sidebar/synchronized-input browser tests. New FOD hash sha256-+EP9FVfwBT0uUQzh2HE8nt6I6S9IX5ORVDR9xDnGM84=. Npm license-expression sets are equal, 68 → 88 locked packages, zero metadata errors; Rust duplicates 53/59, unchanged.

Both shipping binaries are byte-identical between this candidate and clean rebased parent d92a12b24: x86 27,928,176 B, arm64 25,090,696 B, JS delta 0 / 0. The rebase's inherited dev code accounts for +5120/+1952 bytes versus pre-rebase Rand receipt; it is not a dependency/JS delta. REBASED_PARENT_BINARY_COMPARE_EXIT=0, JS_BASELINE_VISUAL_EXIT=0.

Six DPR-2 production captures: 1440×900, 393×852 and 375×667 in ink/paper. Every case is connected with a visible palette and zero page errors. Selected captures, checks JSON, successful batch log and baseline comparison attached. These are evidence for independent visual review, not self-approval. Fixture server/browser exited and all candidate changes restored after the clean-parent comparison.

TypeScript 7.0.2 slice verified: quick/typecheck, production build, Bun audit (zero vulnerabilities), cargo-deny, initial Nix cache build plus forced rebuild, and **8/8** font-picker/palette/sidebar/synchronized-input browser tests. New FOD hash **sha256-+EP9FVfwBT0uUQzh2HE8nt6I6S9IX5ORVDR9xDnGM84=**. Npm license-expression sets are **equal**, 68 → 88 locked packages, zero metadata errors; Rust duplicates **53/59**, unchanged. Both shipping binaries are **byte-identical** between this candidate and clean rebased parent d92a12b24: x86 **27,928,176 B**, arm64 **25,090,696 B**, JS delta **0 / 0**. The rebase's inherited dev code accounts for +5120/+1952 bytes versus pre-rebase Rand receipt; it is not a dependency/JS delta. `REBASED_PARENT_BINARY_COMPARE_EXIT=0`, `JS_BASELINE_VISUAL_EXIT=0`. Six DPR-2 production captures: 1440×900, 393×852 and 375×667 in ink/paper. Every case is connected with a visible palette and **zero page errors**. Selected captures, checks JSON, successful batch log and baseline comparison attached. These are evidence for independent visual review, not self-approval. Fixture server/browser exited and all candidate changes restored after the clean-parent comparison.

1440-ink.png

215 KiB

393-paper.png

138 KiB

375-ink.png

142 KiB

checks.json

934 B

js-baseline-visual.log

5.5 KiB

typescript-major-check.log

352 KiB

kayg commented

2026-11-07 11:07:12 +00:00

Author

Owner

Mac baseline confirmed: unmodified dev af033d0b4, its original Nix inputs and cargo 1.99.0, fails with the same E0599 at logins.rs:437, SockFlag::SOCK_CLOEXEC as the refreshed dependencies/cargo 1.99.1. Both complete guard logs attached. This is a pre-existing Darwin login compile defect, not a nix 0.31 regression (both versions have identical cfg guards). No login/auth source changes in this job. Focused updated desktop dependency check now queued under Mac lock, PID 87915, mac-desktop-final.log; all earlier targets were removed before releasing their locks.

TypeScript is pushed at db97298d66 (full SHA available on branch). Next own atomic slice: @types/node 22.20.5 → 26.6.6, already resolved transitively; unifies the direct type package, moves its direct undici-types dependency to existing 8.9, retains Bun's required 6.21 nested dependency. No application source changes planned.

Moving remaining Linux batches/gate to compute01, following both slot statuses: compute one queued vs dev-02 two queued. Exact launcher cargo 1.99.1 passed. New own VM worktree /home/claude/worktrees/J340; dev-02 target removed, so this job retains one Linux target. Previous same-host batch size/benchmark receipts remain on dev-02/perf VM. Node-types log node-types-major-check.log; quick/production build/audit/deny/hygiene/Nix cache/static/browser checks queued. Node runtime 24.21.0 → Nix-provided 26.13.0 LTS will be its own subsequent commit; Node 25/26 breaking changelogs saved and removed legacy APIs scanned against repository use.

**Mac baseline confirmed:** unmodified dev **af033d0b4**, its original Nix inputs and **cargo 1.99.0**, fails with the **same E0599 at logins.rs:437, SockFlag::SOCK_CLOEXEC** as the refreshed dependencies/cargo 1.99.1. Both complete guard logs attached. This is a pre-existing Darwin login compile defect, not a nix 0.31 regression (both versions have identical cfg guards). No login/auth source changes in this job. Focused updated desktop dependency check now queued under Mac lock, PID **87915**, `mac-desktop-final.log`; all earlier targets were removed before releasing their locks. TypeScript is pushed at **db97298d66** (full SHA available on branch). Next own atomic slice: **@types/node 22.20.5 → 26.6.6**, already resolved transitively; unifies the direct type package, moves its direct undici-types dependency to existing 8.9, retains Bun's required 6.21 nested dependency. No application source changes planned. Moving remaining Linux batches/gate to **compute01**, following both slot statuses: compute one queued vs dev-02 two queued. Exact launcher cargo **1.99.1** passed. New own VM worktree `/home/claude/worktrees/J340`; **dev-02 target removed**, so this job retains one Linux target. Previous same-host batch size/benchmark receipts remain on dev-02/perf VM. Node-types log `node-types-major-check.log`; quick/production build/audit/deny/hygiene/Nix cache/static/browser checks queued. Node runtime **24.21.0 → Nix-provided 26.13.0 LTS** will be its own subsequent commit; Node 25/26 breaking changelogs saved and removed legacy APIs scanned against repository use.

mac-baseline-check.log

15 KiB

mac-deps-check-red.log

20 KiB

kayg commented

2026-11-07 11:11:00 +00:00

Author

Owner

Updated native desktop dependencies PASS on the Mac with cargo 1.99.1, cargo check --locked -p infraternal-plugin-desktop --features desktop --bins, MAC_DESKTOP_DEPS_EXIT=0. ScreenCaptureKit stays 11.1.2, all final Rust requirements present. Its target was deleted before lock release (MAC_FOCUSED_TARGET_CLEANED). Full CLI guard remains blocked by the independently reproduced unmodified dev/cargo 1.99.0 SockFlag::SOCK_CLOEXEC Darwin error, whose before/after logs are attached above. No login/auth code change is included in J340. That baseline defect needs a separate platform/security review; estimate 2–4 hours.

Updated native desktop dependencies **PASS** on the Mac with **cargo 1.99.1**, `cargo check --locked -p infraternal-plugin-desktop --features desktop --bins`, `MAC_DESKTOP_DEPS_EXIT=0`. ScreenCaptureKit stays **11.1.2**, all final Rust requirements present. Its target was deleted before lock release (`MAC_FOCUSED_TARGET_CLEANED`). Full CLI guard remains blocked by the independently reproduced **unmodified dev/cargo 1.99.0** `SockFlag::SOCK_CLOEXEC` Darwin error, whose before/after logs are attached above. No login/auth code change is included in J340. That baseline defect needs a separate platform/security review; estimate 2–4 hours.

mac-desktop-final.log

1.2 KiB

kayg commented

2026-11-07 11:18:07 +00:00

Author

Owner

Final Rust audit receipt: 1,422 advisories checked against 553 lockfile entries. The only finding remains rsa 0.9.10, RUSTSEC-2023-0071 (Marvin timing side channel), no fixed release available, identical to baseline. cargo audit exits 1. The selected shipping graph does not select rsa (cargo tree -i rsa receipt recorded earlier); cargo-deny advisories pass. No advisory suppression was added. Raw fresh audit attached.

OpenSSL follow-up narrowing: inspecting OpenSSL_version native-build metadata on all three benchmark binaries (old bindings/original environment, fixed bindings/original environment, fixed bindings/refreshed environment) produces identical platform, normalized compiler label, build epoch and directory. The compiler label is intentionally “pinned musl toolchain”, so this metadata cannot identify actual native flags. No cheap supported feature/build-option mitigation has been established. The approved security update remains in its own commit; the refreshed Nix/Rust environment recovers the measured control-path cost (paired receipt already attached). Binding-source attribution remains a follow-up and does not block the batch.

Final Rust audit receipt: 1,422 advisories checked against 553 lockfile entries. The only finding remains **rsa 0.9.10, RUSTSEC-2023-0071 (Marvin timing side channel), no fixed release available**, identical to baseline. `cargo audit` exits 1. The selected shipping graph does not select rsa (`cargo tree -i rsa` receipt recorded earlier); cargo-deny advisories pass. No advisory suppression was added. Raw fresh audit attached. OpenSSL follow-up narrowing: inspecting `OpenSSL_version` native-build metadata on all three benchmark binaries (old bindings/original environment, fixed bindings/original environment, fixed bindings/refreshed environment) produces identical platform, normalized compiler label, build epoch and directory. The compiler label is intentionally “pinned musl toolchain”, so this metadata cannot identify actual native flags. No cheap supported feature/build-option mitigation has been established. The approved security update remains in its own commit; the refreshed Nix/Rust environment recovers the measured control-path cost (paired receipt already attached). Binding-source attribution remains a follow-up and does not block the batch.

audit-final.log

674 B

openssl-native-build-info.txt

431 B

kayg commented

2026-11-07 11:26:38 +00:00

Author

Owner

Crash-safety checkpoint: the Node-types candidate and updated Bun FOD hash are pushed as a temporary WIP commit on deps-refresh-340. Quick/typecheck, production build, audit (zero findings), deny, duplicate checks and normal/forced FOD rebuild have passed. npm package count 88→87, same license-expression set, zero metadata errors. Rust duplicates remain 53/59.

Cold static builds are still running on compute01, PID 3190374, log ~/.cache/codex-scratch/J340/evidence/node-types-major-check.log, sole target /home/claude/worktrees/J340/target. Browser tests and same-host clean-parent comparison follow. This checkpoint will be replaced with the verified atomic commit. No own work remains on the Mac or dev-02; their targets are removed. Next is the separate Node 26.13.0 LTS development-runtime commit, then the final gate and cleanup.

Crash-safety checkpoint: the Node-types candidate and updated Bun FOD hash are pushed as a temporary WIP commit on `deps-refresh-340`. Quick/typecheck, production build, audit (zero findings), deny, duplicate checks and normal/forced FOD rebuild have passed. npm package count 88→87, same license-expression set, zero metadata errors. Rust duplicates remain 53/59. Cold static builds are still running on compute01, PID **3190374**, log `~/.cache/codex-scratch/J340/evidence/node-types-major-check.log`, sole target `/home/claude/worktrees/J340/target`. Browser tests and same-host clean-parent comparison follow. This checkpoint will be replaced with the verified atomic commit. No own work remains on the Mac or dev-02; their targets are removed. Next is the separate Node 26.13.0 LTS development-runtime commit, then the final gate and cleanup.

kayg commented

2026-11-07 11:41:02 +00:00

Author

Owner

Final gate review found one additional ephemeral compiler pin outside the manifests/lockfiles: scripts/verify.d/ts.sh directly invokes bun x --package typescript@5.9.3. Update it to 7.0.2 as part of the existing TypeScript major slice, verifying the protocol's ES2022/ESNext/Bundler configuration with no parser source edits. If this needed a real parser migration, that part would be deferred under the security-surface rule. The correction will be folded into the TypeScript commit before the final gate; no extra compiler/library is introduced.

Current own Node-types cold aarch64 build is active, so this independent check waits for the same one-slot policy. Checkpoint remains pushed at 9493a8b31; sole target compute01 /home/claude/worktrees/J340/target.

Final gate review found one additional **ephemeral compiler pin outside the manifests/lockfiles**: `scripts/verify.d/ts.sh` directly invokes `bun x --package typescript@5.9.3`. Update it to **7.0.2** as part of the existing TypeScript major slice, verifying the protocol's ES2022/ESNext/Bundler configuration with no parser source edits. If this needed a real parser migration, that part would be deferred under the security-surface rule. The correction will be folded into the TypeScript commit before the final gate; no extra compiler/library is introduced. Current own Node-types cold aarch64 build is active, so this independent check waits for the same one-slot policy. Checkpoint remains pushed at 9493a8b31; sole target compute01 `/home/claude/worktrees/J340/target`.

kayg commented

2026-11-07 11:57:24 +00:00

Author

Owner

Node-types batch passed: quick/typecheck, production build, audit0, deny, FOD reproducibility, both statics and 2/2 browser tests (JS_MAJOR_CHECK_EXIT=0). Compute-host sizes 27928720 / 25093128 bytes differ slightly from earlier arm-host builds; the same-host clean-parent comparison will establish the types-only delta. It is queued on compute01, PID3966415, evidence/types-compare-protocol-check.log, with the explicit protocol compiler7 check. This comparison requires the host that built those binaries. Latest statuses: compute3queued/5busy, dev02nonequeued/1busy. Launcher cargo1.99.1 passed. Only one own queue entry/slot.

Crash-safety checkpoint e4c045fd4 preserves the remaining Node runtime and protocol compiler pins on the branch; temporary checkpoints will be replaced/split/folded before handoff. Sole target remains compute01 /home/claude/worktrees/J340/target; other own VM targets are removed.

New origin/dev 21b3c84ce includes #394 SSH install source/UI changes after the earlier docs-only update. Rebase before the final gate as required. Measure that rebased parent under Node24 before the Node26-only candidate, retaining a same-host byte comparison, so new inherited source changes are not misreported as dependency growth. No source edits to the inherited SSH/auth area are planned.

Node-types batch passed: quick/typecheck, production build, audit0, deny, FOD reproducibility, both statics and **2/2 browser tests** (`JS_MAJOR_CHECK_EXIT=0`). Compute-host sizes **27928720 / 25093128 bytes** differ slightly from earlier arm-host builds; the same-host clean-parent comparison will establish the types-only delta. It is queued on compute01, **PID3966415**, `evidence/types-compare-protocol-check.log`, with the explicit protocol compiler7 check. This comparison requires the host that built those binaries. Latest statuses: compute3queued/5busy, dev02nonequeued/1busy. Launcher cargo1.99.1 passed. Only one own queue entry/slot. Crash-safety checkpoint **e4c045fd4** preserves the remaining Node runtime and protocol compiler pins on the branch; temporary checkpoints will be replaced/split/folded before handoff. Sole target remains compute01 `/home/claude/worktrees/J340/target`; other own VM targets are removed. New `origin/dev` **21b3c84ce** includes #394 SSH install source/UI changes after the earlier docs-only update. Rebase before the final gate as required. Measure that rebased parent under Node24 before the Node26-only candidate, retaining a same-host byte comparison, so new inherited source changes are not misreported as dependency growth. No source edits to the inherited SSH/auth area are planned.

node-types-major-check.log

382 KiB

kayg commented

2026-11-07 12:00:04 +00:00

Author

Owner

Next isolated major slice: explicitly select Node 26.13.0 LTS (pkgs.nodejs_26) for development CLI shebangs, replacing the refreshed Nix input's default Node 24.21.0. Production remains compiled by Bun. Node 25.0/26.0 breaking release notes and 26.13 LTS notes are retained in evidence; the LTS release only changes release metadata from 26.12.1 and is maintained through April 2029.

Usage review: removed SlowBuffer/CallTracker/legacy stream modules/writeHeader/type-transform flag/old fs access constants are not used by repository JS; Python rmdir results are unrelated. No direct native Node addon ABI integration is shipped. Corepack is not used (Bun lockfiles). Node crypto/TLS API changes require no product-source migration because this is the tooling runtime, while product auth/transport are Rust/browser WebCrypto. Existing compiler and browser CLI checks will run under the new runtime; no foundational implementation is replaced.

This slice changes only flake.nix and will have its own quick, explicit tracer check/build/audit/outdated, browser-auth audit/outdated, deny/hygiene, cache reproducibility, both statics and browser tests. Static checks compare against the preceding same-host Node-types artifacts. Final full gate follows after the slice is committed.

Next isolated major slice: explicitly select **Node 26.13.0 LTS** (`pkgs.nodejs_26`) for development CLI shebangs, replacing the refreshed Nix input's default Node 24.21.0. Production remains compiled by Bun. Node 25.0/26.0 breaking release notes and 26.13 LTS notes are retained in evidence; the LTS release only changes release metadata from 26.12.1 and is maintained through April 2029. Usage review: removed SlowBuffer/CallTracker/legacy stream modules/writeHeader/type-transform flag/old fs access constants are not used by repository JS; Python `rmdir` results are unrelated. No direct native Node addon ABI integration is shipped. Corepack is not used (Bun lockfiles). Node crypto/TLS API changes require no product-source migration because this is the tooling runtime, while product auth/transport are Rust/browser WebCrypto. Existing compiler and browser CLI checks will run under the new runtime; no foundational implementation is replaced. This slice changes only flake.nix and will have its own quick, explicit tracer check/build/audit/outdated, browser-auth audit/outdated, deny/hygiene, cache reproducibility, both statics and browser tests. Static checks compare against the preceding same-host Node-types artifacts. Final full gate follows after the slice is committed.

types-compare-protocol-check.log

345 KiB

node-types-major-candidate-binary-sha.txt

239 B

node-types-major-parent-binary-sha.txt

239 B

final-rebase-range-diff.txt

1.9 KiB

kayg commented

2026-11-07 12:00:54 +00:00

Author

Owner

Node-types slice finalized; all temporary WIP/fixup commits removed. Current pushed rebased head 40722d64ce, base 21b3c84ced. Node-types commit 40722d64c; TypeScript commit 0394507dc now includes the verified ephemeral protocol compiler7 pin. Other twelve slices are unchanged in the range-diff attached in comment84469; the TypeScript commit differs only by that additional compiler invocation.

Same-host clean-parent comparison PASS, both static binaries byte-identical: 27928720 / 25093128 B, Node-types delta 0/0. Protocol compiler7 check PASS without parser source edits. Quick, cargo-deny, license/duplicate snapshot and the prior production/build/audit/cache/static/browser checks all pass; npm count88→87, same license-expression set, Rust53/59. Raw receipts and both SHA lists attached in84469; batch log84461.

Rebased parent then Node26 runtime checks are queued serially on compute01 with the same target and exact Nix launcher (cargo1.99.1 passed). Latest statuses: compute2queued/5busy, dev02onequeued/onebusy; compute has the warm target for same-host x86 execution and artifact comparisons. Baseline and candidate are measured separately, not overlapping. Log ~/.cache/codex-scratch/J340/evidence/node-runtime-major-check.log. Full gate follows, no merge/deployment.

Node-types slice finalized; all temporary WIP/fixup commits removed. Current pushed rebased head **40722d64ce88b754cdb5e961509c12cbd537ee8a**, base **21b3c84ceddd571e1580f679009860e32b37beb9**. Node-types commit **40722d64c**; TypeScript commit **0394507dc** now includes the verified ephemeral protocol compiler7 pin. Other twelve slices are unchanged in the range-diff attached in comment84469; the TypeScript commit differs only by that additional compiler invocation. Same-host clean-parent comparison **PASS**, both static binaries byte-identical: **27928720 / 25093128 B**, Node-types delta **0/0**. Protocol compiler7 check **PASS** without parser source edits. Quick, cargo-deny, license/duplicate snapshot and the prior production/build/audit/cache/static/browser checks all pass; npm count88→87, same license-expression set, Rust53/59. Raw receipts and both SHA lists attached in84469; batch log84461. Rebased parent then Node26 runtime checks are queued serially on compute01 with the same target and exact Nix launcher (cargo1.99.1 passed). Latest statuses: compute2queued/5busy, dev02onequeued/onebusy; compute has the warm target for same-host x86 execution and artifact comparisons. Baseline and candidate are measured separately, not overlapping. Log `~/.cache/codex-scratch/J340/evidence/node-runtime-major-check.log`. Full gate follows, no merge/deployment.

kayg commented

2026-11-07 12:25:56 +00:00

Author

Owner

Crash-safety checkpoint d9b5f3852 preserves the one-line Node26 LTS selection. It will be amended to the verified maintenance commit after the active checks; no WIP remains at final handoff.

Compute01 PID4097750, ~/.cache/codex-scratch/J340/evidence/node-runtime-major-check.log, sole target /home/claude/worktrees/J340/target. The rebased-parent quick check completed workspace clippy and is compiling the selected unit-test binaries, including updated dependencies combined with #394. The cold native OpenSSL build used three compiler workers and progressed normally. No dependency API migration or gate failure has appeared.

Next in the same serial slot run: parent static measurements, then Node26-only quick/build/audit/cache/static/browser checks and SHA comparison. Final full gate follows as a separate run. All previous Node-types and protocol-compiler checks are complete and attached in84469/84474. No own work/target on dev-02 or Mac. No merge/deployment.

Crash-safety checkpoint **d9b5f3852** preserves the one-line Node26 LTS selection. It will be amended to the verified maintenance commit after the active checks; no WIP remains at final handoff. Compute01 **PID4097750**, `~/.cache/codex-scratch/J340/evidence/node-runtime-major-check.log`, sole target `/home/claude/worktrees/J340/target`. The rebased-parent quick check completed workspace clippy and is compiling the selected unit-test binaries, including updated dependencies combined with #394. The cold native OpenSSL build used three compiler workers and progressed normally. No dependency API migration or gate failure has appeared. Next in the same serial slot run: parent static measurements, then Node26-only quick/build/audit/cache/static/browser checks and SHA comparison. Final full gate follows as a separate run. All previous Node-types and protocol-compiler checks are complete and attached in84469/84474. No own work/target on dev-02 or Mac. No merge/deployment.

kayg commented

2026-11-07 12:35:38 +00:00

Author

Owner

Rebased-parent quick failed in one proxy fixture: supervisor_tests::the_parent_death_signal_survives_the_credential_drop, supervisor_tests.rs:879, spawn probe: Os { code:26, kind:ExecutableFileBusy, message:"Text file busy" }. Proxy result 122 passed / 1 failed; workspace clippy and preceding quick rows passed. No Node26 runtime change had been applied remotely yet. Complete failed quick log attached.

The proxy test and supervisor source are identical to origin/dev21b3c84ce (git diff empty). The failure occurs at OS process spawn, before the parent-death-signal assertion. Hypothesis: transient fixture executable contention under parallel test processes; an inherited writable file descriptor across concurrent fork/pre-exec is one possible cause, not yet proven. No security-source or test-source fix is being made in this dependency job.

Focused failing-case and full proxy-suite reruns are queued with RUST_TEST_THREADS=1, followed by the parent/Node checks if they pass. One own queue/slot only, compute PID292894, log evidence/node-runtime-major-retry.log. This controls cross-test concurrency; tests' internal concurrency scenarios are unchanged. Preserve/report the initial red result. A repeatable candidate failure would require a proper baseline comparison; no baseline-failure claim is made yet.

Expanded full JS lockfile inventory (91 version rows / 86 names, zero lookup errors) found additional compatible transitive patch/minor updates beyond the direct-manifest inventory, mainly optional Next/React peers from the font package. These will get a separate atomic maintenance commit after Node26. Current npm direct pins are latest; parent-constrained nanoid/undici series must remain within their declared ranges. Raw full lockfile table attached; final table will be regenerated after the compatible refresh.

Rebased-parent quick **failed** in one proxy fixture: `supervisor_tests::the_parent_death_signal_survives_the_credential_drop`, `supervisor_tests.rs:879`, `spawn probe: Os { code:26, kind:ExecutableFileBusy, message:"Text file busy" }`. Proxy result **122 passed / 1 failed**; workspace clippy and preceding quick rows passed. No Node26 runtime change had been applied remotely yet. Complete failed quick log attached. The proxy test and supervisor source are **identical to origin/dev21b3c84ce** (`git diff` empty). The failure occurs at OS process spawn, before the parent-death-signal assertion. Hypothesis: transient fixture executable contention under parallel test processes; an inherited writable file descriptor across concurrent fork/pre-exec is one possible cause, not yet proven. No security-source or test-source fix is being made in this dependency job. Focused failing-case and full proxy-suite reruns are queued with **RUST_TEST_THREADS=1**, followed by the parent/Node checks if they pass. One own queue/slot only, compute PID**292894**, log `evidence/node-runtime-major-retry.log`. This controls cross-test concurrency; tests' internal concurrency scenarios are unchanged. Preserve/report the initial red result. A repeatable candidate failure would require a proper baseline comparison; no baseline-failure claim is made yet. Expanded **full JS lockfile** inventory (91 version rows / 86 names, zero lookup errors) found additional compatible transitive patch/minor updates beyond the direct-manifest inventory, mainly optional Next/React peers from the font package. These will get a separate atomic maintenance commit after Node26. Current npm direct pins are latest; parent-constrained nanoid/undici series must remain within their declared ranges. Raw full lockfile table attached; final table will be regenerated after the compatible refresh.

rebased-parent-first-quick.log

126 KiB

js-lock-inventory-final.md

6.9 KiB

kayg commented

2026-11-07 12:51:07 +00:00

Author

Owner

J340 continuation: recovered pushed head d9b5f3852, prior receipts and active serial Node runtime retry PID292894 on compute01. The approved OpenSSL security commit is already present at 136c6b417, including paired latency/RSS and upstream fixes. No repeat approval needed.

Full-lockfile scratch resolution also established that bun-types1.4.4 declares undici-types:"*"; its nested6.21 entry can reuse the already selected8.9 declarations. Frozen install passed for this isolated candidate. Next separate major commit will remove the stale duplicate after compiler/build/browser/license/cache/static validation; Undici7/8 breaking release notes are retained for usage review. Only declarations change, no Undici runtime implementation is introduced. Compatible transitive patches follow as another batch. Current sole target remains /home/claude/worktrees/J340/target.

J340 continuation: recovered pushed head d9b5f3852, prior receipts and active serial Node runtime retry PID292894 on compute01. The approved OpenSSL security commit is already present at 136c6b417, including paired latency/RSS and upstream fixes. No repeat approval needed. Full-lockfile scratch resolution also established that bun-types1.4.4 declares undici-types:"*"; its nested6.21 entry can reuse the already selected8.9 declarations. Frozen install passed for this isolated candidate. Next separate major commit will remove the stale duplicate after compiler/build/browser/license/cache/static validation; Undici7/8 breaking release notes are retained for usage review. Only declarations change, no Undici runtime implementation is introduced. Compatible transitive patches follow as another batch. Current sole target remains /home/claude/worktrees/J340/target.

kayg commented

2026-11-07 13:04:23 +00:00

Author

Owner

The focused proxy fixture rerun passes (1/1), then the complete proxy library suite passes (123/123) with RUST_TEST_THREADS=1, PROXY_SERIAL_CHECK_EXIT=0. The same serial run has proceeded through the rebased-parent quick check, with more than 1,400 passing tests so far. No proxy/auth code or test changes. This is evidence that continuing the dependency validation is reasonable, not proof of the ETXTBSY root cause; the initial red receipt remains attached in84537.

The Node-only quick check uses VERIFY_QUICK_BASE=40722d64ce88b754cdb5e961509c12cbd537ee8a (its immediate parent), so that one-line runtime batch is scoped correctly. Parent quick already covers the complete rebased dependency range; final verify fast will cover the whole branch. Active log: compute01 ~/.cache/codex-scratch/J340/evidence/node-runtime-major-retry.log. Sole target unchanged; no own work on other VMs.

The focused proxy fixture rerun passes (1/1), then the complete proxy library suite passes (123/123) with RUST_TEST_THREADS=1, PROXY_SERIAL_CHECK_EXIT=0. The same serial run has proceeded through the rebased-parent quick check, with more than 1,400 passing tests so far. No proxy/auth code or test changes. This is evidence that continuing the dependency validation is reasonable, not proof of the ETXTBSY root cause; the initial red receipt remains attached in84537. The Node-only quick check uses VERIFY_QUICK_BASE=40722d64ce88b754cdb5e961509c12cbd537ee8a (its immediate parent), so that one-line runtime batch is scoped correctly. Parent quick already covers the complete rebased dependency range; final verify fast will cover the whole branch. Active log: compute01 ~/.cache/codex-scratch/J340/evidence/node-runtime-major-retry.log. Sole target unchanged; no own work on other VMs.

kayg commented

2026-11-07 13:23:04 +00:00

Author

Owner

Auxiliary rebased-parent quick ended FAIL(124) at its unchanged 1500s unit-test row timeout under RUST_TEST_THREADS=1. It had recorded 2213 passing test lines, including focused proxy1/1 and full proxy123/123, with no assertion failure in this attempt. It timed out near the end of server websocket writer tests. Full raw log attached. Do not describe this quick as passing. Globally serializing the complete workspace was too slow for the gate's existing wall-time limit; no timeout/test/source/gate policy is changed.

Plan adjustment: retain this complete diagnostic; avoid repeating that auxiliary whole-branch parent quick before a tooling-only batch. The Node24 parent step now measures its two statics directly. The Node26 batch still runs its required quick against immediate parent40722d64c, plus explicit tracer check/build/audits/deny/cache/statics/browser checks. Final verify fast runs the entire branch with four test workers within the unchanged gate limits. The complete earlier dependency batches already have their own passing quick receipts; this is not a substitute for the final full gate.

Both statuses checked: compute5busy/5queued, dev02onebusy/onequeued, but the only job target and required same-host x86 comparison are on compute01. Exact launcher cargo1.99.1 passed. Parent static+Node26 serial checks queued on compute01, log evidence/node-runtime-static-and-check.log. No other own queued/active work; no targets on dev02/Mac. No security-source workaround.

Auxiliary rebased-parent quick ended **FAIL(124)** at its unchanged **1500s unit-test row timeout** under RUST_TEST_THREADS=1. It had recorded **2213 passing test lines**, including focused proxy1/1 and full proxy123/123, with no assertion failure in this attempt. It timed out near the end of server websocket writer tests. Full raw log attached. Do not describe this quick as passing. Globally serializing the complete workspace was too slow for the gate's existing wall-time limit; no timeout/test/source/gate policy is changed. Plan adjustment: retain this complete diagnostic; avoid repeating that auxiliary whole-branch parent quick before a tooling-only batch. The Node24 parent step now measures its two statics directly. The Node26 batch still runs its required quick against immediate parent40722d64c, plus explicit tracer check/build/audits/deny/cache/statics/browser checks. **Final verify fast runs the entire branch with four test workers** within the unchanged gate limits. The complete earlier dependency batches already have their own passing quick receipts; this is not a substitute for the final full gate. Both statuses checked: compute5busy/5queued, dev02onebusy/onequeued, but the only job target and required same-host x86 comparison are on compute01. Exact launcher cargo1.99.1 passed. Parent static+Node26 serial checks queued on compute01, log `evidence/node-runtime-static-and-check.log`. No other own queued/active work; no targets on dev02/Mac. No security-source workaround.

node-runtime-major-retry.log

244 KiB

kayg commented

2026-11-07 13:45:31 +00:00

Author

Owner

Nonblocking OpenSSL binding-pair source narrowing while waiting for the build slot:

Compared all changed Rust source files in openssl 0.10.81→0.10.82 and openssl-sys 0.9.117→0.9.118. Complete upstream-source diff attached.
A lexical comparison of 15 named public-method groups used by the certificate builder/probe (including X509/CSR sign, verify, public_key, field setters, extension append/context and ASN.1 serial/time helpers) reports all text-identical. Both crates' complete Cargo feature maps are also identical. The attached JSON explicitly limits this check: it is source text, not generated assembly or exhaustive macro expansion.
The timed remote_ca_bench loop uses X509Req/leaf direct verify; it does not instantiate X509StoreContext, so the newly added X509_STORE_CTX cleanup setters are not a direct call-site explanation for this particular probe. New reference-count checks are in owned clones/to_owned; the timed builder passes borrowed issuer/key references. This does not prove those checks have zero code-generation effect.
build-script additions principally extend LibreSSL 4.4 / OpenSSL 4.1 detection; the shipped vendored engine remains the existing 3.6 line. No newly exposed supported feature toggle was found that could explain/recover the old-environment cost while preserving fixes. Backend-switch features are outside this job's authorization and were not tried.

The useful measured mitigation remains the already-planned Nix/Rust environment refresh: p50 medians 296 / 353 / 296 µs and p99 312 / 375 / 316 µs for original/fixed-old-env/fixed-new-env, with identical 5300 KiB retained RSS. These source observations narrow obvious direct API-body explanations but do not attribute the regression to a specific binding, native object or compiler/layout effect. Further per-binding/generated-code profiling stays a follow-up and does not block the approved security batch.

Nonblocking OpenSSL binding-pair source narrowing while waiting for the build slot: - Compared all changed Rust source files in openssl 0.10.81→0.10.82 and openssl-sys 0.9.117→0.9.118. Complete upstream-source diff attached. - A lexical comparison of **15 named public-method groups** used by the certificate builder/probe (including X509/CSR sign, verify, public_key, field setters, extension append/context and ASN.1 serial/time helpers) reports **all text-identical**. Both crates' complete Cargo feature maps are also identical. The attached JSON explicitly limits this check: it is source text, not generated assembly or exhaustive macro expansion. - The timed remote_ca_bench loop uses X509Req/leaf direct verify; it does **not** instantiate X509StoreContext, so the newly added X509_STORE_CTX cleanup setters are not a direct call-site explanation for this particular probe. New reference-count checks are in owned clones/to_owned; the timed builder passes borrowed issuer/key references. This does not prove those checks have zero code-generation effect. - build-script additions principally extend LibreSSL 4.4 / OpenSSL 4.1 detection; the shipped vendored engine remains the existing 3.6 line. No newly exposed supported feature toggle was found that could explain/recover the old-environment cost while preserving fixes. Backend-switch features are outside this job's authorization and were not tried. The useful measured mitigation remains the already-planned Nix/Rust environment refresh: p50 medians 296 / 353 / 296 µs and p99 312 / 375 / 316 µs for original/fixed-old-env/fixed-new-env, with identical 5300 KiB retained RSS. These source observations narrow obvious direct API-body explanations but do not attribute the regression to a specific binding, native object or compiler/layout effect. Further per-binding/generated-code profiling stays a follow-up and does not block the approved security batch.

openssl-timed-method-source-check.json

3.5 KiB

openssl-binding-source-diff.patch

67 KiB

kayg commented

2026-11-07 13:52:30 +00:00

Author

Owner

J340 queue heartbeat: static-control + Node26 checks remain queued on compute01, actual build-slot PID 893973, roughly 30 minutes in queue. Log ~/.cache/codex-scratch/J340/evidence/node-runtime-static-and-check.log; sole warm target /home/claude/worktrees/J340/target. No duplicate own queue entry, old test process, or work on other VMs. The required same-host x86 artifact comparison is why this run remains on compute01.

Branch is unchanged at crash-safe WIP d9b5f3852, remote parent 40722d64c intentionally stays Node24 until the comparison wrapper switches it. After success: amend the verified Node-only commit, then the isolated undici-types declaration dedup and compatible transitive JS batches, each atomic; final full verify fast with four test workers and unchanged limits, then cleanup/handoff. No merge/deployment. The additional OpenSSL source narrowing is attached in84647 and is explicitly nonblocking.

J340 queue heartbeat: static-control + Node26 checks remain queued on compute01, actual build-slot PID **893973**, roughly 30 minutes in queue. Log `~/.cache/codex-scratch/J340/evidence/node-runtime-static-and-check.log`; sole warm target `/home/claude/worktrees/J340/target`. No duplicate own queue entry, old test process, or work on other VMs. The required same-host x86 artifact comparison is why this run remains on compute01. Branch is unchanged at crash-safe WIP **d9b5f3852**, remote parent **40722d64c** intentionally stays Node24 until the comparison wrapper switches it. After success: amend the verified Node-only commit, then the isolated undici-types declaration dedup and compatible transitive JS batches, each atomic; final full `verify fast` with four test workers and unchanged limits, then cleanup/handoff. No merge/deployment. The additional OpenSSL source narrowing is attached in84647 and is explicitly nonblocking.

kayg commented

2026-11-07 14:23:30 +00:00

Author

Owner

J340 queue heartbeat: one hour waiting, still one waiter ahead of PID 893973 on compute01. No own build/test has started since the diagnostic timeout. Current log remains evidence/node-runtime-static-and-check.log; sole warm target /home/claude/worktrees/J340/target. The machine is CPU-busy (read-only check load~52) but has ~51GiB available memory and ample disk; no infrastructure setting or other job was touched. All work remains through build-slot.

Head remains crash-safe WIP d9b5f3852, to be amended only after the Node batch passes. Final code/lockfile scope is unchanged. Additional follow-up source evidence is attached in84647; the next work remains Node runtime, isolated HTTP declaration dedup, compatible transitive JS updates, full final gate, cleanup. No merge/deployment.

J340 queue heartbeat: **one hour waiting**, still one waiter ahead of PID **893973** on compute01. No own build/test has started since the diagnostic timeout. Current log remains `evidence/node-runtime-static-and-check.log`; sole warm target `/home/claude/worktrees/J340/target`. The machine is CPU-busy (read-only check load~52) but has ~51GiB available memory and ample disk; no infrastructure setting or other job was touched. All work remains through build-slot. Head remains crash-safe WIP **d9b5f3852**, to be amended only after the Node batch passes. Final code/lockfile scope is unchanged. Additional follow-up source evidence is attached in84647; the next work remains Node runtime, isolated HTTP declaration dedup, compatible transitive JS updates, full final gate, cleanup. No merge/deployment.

queue-environment-readonly.txt

450 B

kayg commented

2026-11-07 14:36:57 +00:00

Author

Owner

Fresh origin/dev is 6b1bdb81b3, containing the owner's separate Mac login fix 2c8fe3630. That resolves the baseline SOCK_CLOEXEC compile defect J340 had reported. It changes no Linux behavior apart from source wrapping; no J340 security-source workaround is introduced.

While compute01 remains queued, started the native default CLI + desktop feature release compile guard, scripts/macos-build-check --check, on the Mac under the shared lockf -k /tmp/mac-bench.lock. PID 64859; log ~/.cache/codex-scratch/J340/evidence/mac-final-rebased-check.log. Exact Nix launcher cargo 1.99.1 passed; ~23GiB free before the check. Three compiler workers, incremental/dev/test debug off; EXIT trap deletes the sole own Mac target before releasing the lock.

Native candidate is the current dependency branch d9b5f3852 plus an uncommitted application of the exact already-merged owner commit2c8fe3630. The final branch will inherit it by rebase before final verify fast. Source/Cargo SHA receipts will be compared to that final rebased tree; this temporary composition is explicit, not claimed as a final head check yet. Remaining JS lockfile batches do not change the Rust closure. Linux still has only its queued job and one warm target; no second Linux slot is held.

Fresh origin/dev is **6b1bdb81b3d8eb90716643e7d1bd03f61ce37827**, containing the owner's separate Mac login fix **2c8fe3630**. That resolves the baseline SOCK_CLOEXEC compile defect J340 had reported. It changes no Linux behavior apart from source wrapping; no J340 security-source workaround is introduced. While compute01 remains queued, started the native **default CLI + desktop feature release compile guard**, `scripts/macos-build-check --check`, on the Mac under the shared `lockf -k /tmp/mac-bench.lock`. PID **64859**; log `~/.cache/codex-scratch/J340/evidence/mac-final-rebased-check.log`. Exact Nix launcher cargo **1.99.1** passed; ~23GiB free before the check. Three compiler workers, incremental/dev/test debug off; EXIT trap deletes the sole own Mac target before releasing the lock. Native candidate is the current dependency branch **d9b5f3852** plus an uncommitted application of the exact already-merged owner commit2c8fe3630. The final branch will inherit it by rebase before final `verify fast`. Source/Cargo SHA receipts will be compared to that final rebased tree; this temporary composition is explicit, not claimed as a final head check yet. Remaining JS lockfile batches do not change the Rust closure. Linux still has only its queued job and one warm target; no second Linux slot is held.

kayg commented

2026-11-07 14:47:35 +00:00

Author

Owner

Native full compile guard PASS with refreshed dependencies and the exact already-merged owner Mac login fix 2c8fe3630:

macos-build-check --check: PASS
MAC_FINAL_CHECK_EXIT=0
MAC_GUARD_TARGET_CLEANED

Default CLI release compile completed in 4m 59s; desktop-feature release compile in 4m 24s. Raw complete log and six Rust/source/toolchain input SHA-256s attached. Both feature selections use Rust 1.99.1 and the final dependency lock; ScreenCaptureKit remains 11.1.2. No J340 login/auth workaround. Earlier baseline failure remains historical evidence, not an unresolved blocker now that dev includes the owner's fix.

The process has exited and its own target was deleted before shared-lock release. Native candidate composition is explicitly d9b5f3852 plus exact owner commit 2c8fe3630, as in comment 84725. Final rebase before the full Linux gate will inherit 6b1bdb81b; input digests will then be compared before claiming this qualifies the final branch. No own Mac work is still running.

Native full compile guard **PASS** with refreshed dependencies and the exact already-merged owner Mac login fix `2c8fe3630`: ``` macos-build-check --check: PASS MAC_FINAL_CHECK_EXIT=0 MAC_GUARD_TARGET_CLEANED ``` Default CLI release compile completed in 4m 59s; desktop-feature release compile in 4m 24s. Raw complete log and six Rust/source/toolchain input SHA-256s attached. Both feature selections use Rust 1.99.1 and the final dependency lock; ScreenCaptureKit remains 11.1.2. No J340 login/auth workaround. Earlier baseline failure remains historical evidence, **not an unresolved blocker now that dev includes the owner's fix**. The process has exited and its own target was deleted before shared-lock release. Native candidate composition is explicitly `d9b5f3852` plus exact owner commit `2c8fe3630`, as in comment 84725. Final rebase before the full Linux gate will inherit `6b1bdb81b`; input digests will then be compared before claiming this qualifies the final branch. No own Mac work is still running.

mac-final-rebased-check.log

22 KiB

mac-final-rust-input-sha.txt

522 B

kayg commented

2026-11-07 14:56:44 +00:00

Author

Owner

Node 26 LTS batch finalized and pushed as 01f0fbf333. Temporary WIP removed. Only flake.nix changed; Node 26.13.0 replaces the development shell's default 24.21.0. Required quick is scoped to immediate parent 40722d64c; explicit tracer check/build, both Bun audits/outdated, deny/hygiene, forced Nix cache rebuild, static checks, and 3/3 browser cases pass. Raw full successful batch log attached, ending NODE_RUNTIME_CHECK_EXIT=0.

Both statics are byte-identical to their freshly measured same-host Node 24 parent: 27,933,744 B x86 / 25,096,184 B aarch64, Node-only delta 0/0. SHA files attached. Relative to the previous same-host Node-types artifacts, inherited #394 dev code adds +5024 / +3056 B; that is separated from this dependency batch. Rust duplicate counts remain 53 names / 59 excess, no new license expressions; Bun audits have zero findings.

Next short serial slot run will validate and individually commit/push the isolated undici-types 6.21 → existing 8.9 declaration dedup, then compatible transitive JS updates. It asserts unchanged Rust inputs, frozen installs, same npm license-expression set, no metadata errors, package count 86, both static SHA comparisons and existing browser cases before each commit. Stages stop on failure, including push rejection. No security/parser source migration.

Both statuses checked: compute01 has 4 queued but the sole warm target and required same-host x86 execution/comparison; dev02 is below its 40G admission floor at 38G and cannot admit a new job. Exact launcher cargo 1.99.1 passed. Next log evidence/js-final-batches.log. Full final gate remains separate, after rebasing onto the newly merged Mac fix dev 6b1bdb81b. Mac full native guards already pass with that exact fix (84737), target deleted.

Node 26 LTS batch finalized and pushed as **01f0fbf3337a4f054ea4955e27cbb9d6336a87cf**. Temporary WIP removed. Only flake.nix changed; Node 26.13.0 replaces the development shell's default 24.21.0. Required quick is scoped to immediate parent `40722d64c`; explicit tracer check/build, both Bun audits/outdated, deny/hygiene, forced Nix cache rebuild, static checks, and **3/3 browser cases** pass. Raw full successful batch log attached, ending `NODE_RUNTIME_CHECK_EXIT=0`. Both statics are **byte-identical** to their freshly measured same-host Node 24 parent: **27,933,744 B x86 / 25,096,184 B aarch64**, Node-only delta **0/0**. SHA files attached. Relative to the previous same-host Node-types artifacts, inherited #394 dev code adds **+5024 / +3056 B**; that is separated from this dependency batch. Rust duplicate counts remain **53 names / 59 excess**, no new license expressions; Bun audits have zero findings. Next short serial slot run will validate and individually commit/push the isolated undici-types 6.21 → existing 8.9 declaration dedup, then compatible transitive JS updates. It asserts unchanged Rust inputs, frozen installs, same npm license-expression set, no metadata errors, package count 86, both static SHA comparisons and existing browser cases before each commit. Stages stop on failure, including push rejection. No security/parser source migration. Both statuses checked: compute01 has 4 queued but the sole warm target and required same-host x86 execution/comparison; dev02 is below its 40G admission floor at 38G and cannot admit a new job. Exact launcher cargo 1.99.1 passed. Next log `evidence/js-final-batches.log`. Full final gate remains separate, after rebasing onto the newly merged Mac fix dev `6b1bdb81b`. Mac full native guards already pass with that exact fix (84737), target deleted.

node-runtime-static-and-check.log

358 KiB

node-runtime-major-binary-sha.txt

239 B

node-runtime-parent-binary-sha.txt

239 B

node-runtime-parent-binary-size.txt

125 B

kayg commented

2026-11-07 14:59:48 +00:00

Author

Owner

Fresh CI availability check confirms the same deferral: repository runner infraternal-dev, version v13.2.0, is still offline. Sanitized runner-status API receipt attached. No runner settings or services were changed.

CI image Node 22 → 26, checkout v4 → v7.0.1, and cache v4 → v6.1.0 remain separate runner-online work (estimate half a day). The new action-runtime/ESM behavior still lacks real workflow execution proof. Development Node 26.13.0 is separately validated and committed; this does not certify the offline CI runner/container.

Fresh CI availability check confirms the same deferral: repository runner **infraternal-dev**, version **v13.2.0**, is still **offline**. Sanitized runner-status API receipt attached. No runner settings or services were changed. CI image Node 22 → 26, checkout v4 → v7.0.1, and cache v4 → v6.1.0 remain separate runner-online work (estimate half a day). The new action-runtime/ESM behavior still lacks real workflow execution proof. Development Node 26.13.0 is separately validated and committed; this does not certify the offline CI runner/container.

ci-runners-final-public.json

106 B

kayg commented

2026-11-07 15:25:38 +00:00

Author

Owner

J340 continuation: verified clean control head 01f0fbf3337a4f054ea4955e27cbb9d6336a87cf and the sole queued compute01 run, PID 3613166, for the two remaining JS batches. It has waited about 29 minutes; no batch has started or been committed yet. Log: /home/claude/.cache/codex-scratch/J340/evidence/js-final-batches.log.

Both slot statuses checked again: compute01 has five occupied slots; dev-02 has 37G free, below its 40G admission floor, so its free slot cannot admit work. Keeping one queued run on compute01. Its script validates and pushes each batch separately and stops on any failed check or push. No source changes or new background runs during this wait.

Next: consume both batch receipts, rebase onto current dev 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827, compare all native inputs to the passing Mac snapshot, then run the final full gate. OpenSSL owner decision remains implemented in its separate security commit; the recorded narrowing follow-up does not block this work.

J340 continuation: verified clean control head `01f0fbf3337a4f054ea4955e27cbb9d6336a87cf` and the sole queued compute01 run, PID `3613166`, for the two remaining JS batches. It has waited about 29 minutes; no batch has started or been committed yet. Log: `/home/claude/.cache/codex-scratch/J340/evidence/js-final-batches.log`. Both slot statuses checked again: compute01 has five occupied slots; dev-02 has 37G free, below its 40G admission floor, so its free slot cannot admit work. Keeping one queued run on compute01. Its script validates and pushes each batch separately and stops on any failed check or push. No source changes or new background runs during this wait. Next: consume both batch receipts, rebase onto current dev `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`, compare all native inputs to the passing Mac snapshot, then run the final full gate. OpenSSL owner decision remains implemented in its separate security commit; the recorded narrowing follow-up does not block this work.

kayg commented

2026-11-07 15:37:48 +00:00

Author

Owner

J340 queue update: dev-02 became admissible (76G free, one free slot), so I stopped the still-queued compute01 PID 3613166, verified it exited and left clean head 01f0fbf3337a4f054ea4955e27cbb9d6336a87cf, and moved the final JS batches to dev-02. No queued compute01 batch had started or committed.

Exact dev-02 launcher preflight passed: nix develop /home/claude/worktrees/J340 -c cargo --version → cargo 1.99.1 (5f94df478 2026-08-27). New sole build-slot PID 435641 acquired the slot immediately. It first builds both parent static binaries at the same source head, then runs the unchanged per-batch validation/commit/push sequence. This establishes new same-host SHA/size controls rather than attributing cross-host artifact differences to dependency declarations.

Log: /home/claude/.cache/codex-scratch/J340/evidence/js-final-batches-dev02.log; runner: js-dev02-parent-and-batches.sh. One own target on dev-02, incremental disabled, three build jobs. The compute01 target remains available pending final gate selection, subject to the host's normal idle reaper.

J340 queue update: dev-02 became admissible (76G free, one free slot), so I stopped the still-queued compute01 PID `3613166`, verified it exited and left clean head `01f0fbf3337a4f054ea4955e27cbb9d6336a87cf`, and moved the final JS batches to dev-02. No queued compute01 batch had started or committed. Exact dev-02 launcher preflight passed: `nix develop /home/claude/worktrees/J340 -c cargo --version` → `cargo 1.99.1 (5f94df478 2026-08-27)`. New sole build-slot PID `435641` acquired the slot immediately. It first builds both parent static binaries at the same source head, then runs the unchanged per-batch validation/commit/push sequence. This establishes new same-host SHA/size controls rather than attributing cross-host artifact differences to dependency declarations. Log: `/home/claude/.cache/codex-scratch/J340/evidence/js-final-batches-dev02.log`; runner: `js-dev02-parent-and-batches.sh`. One own target on dev-02, incremental disabled, three build jobs. The compute01 target remains available pending final gate selection, subject to the host's normal idle reaper.

kayg commented

2026-11-07 15:48:35 +00:00

Author

Owner

HTTP declarations major batch passed and pushed separately: original head 4900123b2, retained unchanged after final dev rebase as 7ee600107.

Removed Bun's stale nested undici-types 6.21.0 alias, reusing the already-selected 8.9.0; no Undici runtime, HTTP parser, security source, or forced override was introduced. Bun's wildcard declaration dependency permits this; Node declarations retain their ~8.9.0 bound. Reviewed Undici 7/8 breaking changes against usage: no direct dispatcher/interceptor imports or runtime migration in this tree.

Scoped verify quick, production build, zero-finding Bun audit (86 packages), deny, Nix dependency cache rebuild and forced reproducibility rebuild, both static checks, and both font-picker browser cases passed. Rust duplicates 53/59 → 53/59, no new license expressions. npm entries 87 → 86, no missing license metadata, identical expression set.

Same-host dev-02 parent and candidate are byte-identical: x86 27,933,232 B, aarch64 25,093,240 B, batch delta 0/0. Cross-host absolute differences are not attributed to this batch. Full raw log and SHA/size receipts attached; JS_REMAINING_CHECK_EXIT=0 and JS_BATCH_COMMITTED=undici-types-major recorded.

HTTP declarations major batch passed and pushed separately: original head `4900123b2`, retained unchanged after final dev rebase as `7ee600107`. Removed Bun's stale nested `undici-types 6.21.0` alias, reusing the already-selected `8.9.0`; no Undici runtime, HTTP parser, security source, or forced override was introduced. Bun's wildcard declaration dependency permits this; Node declarations retain their `~8.9.0` bound. Reviewed Undici 7/8 breaking changes against usage: no direct dispatcher/interceptor imports or runtime migration in this tree. Scoped `verify quick`, production build, zero-finding Bun audit (86 packages), deny, Nix dependency cache rebuild and forced reproducibility rebuild, both static checks, and both font-picker browser cases passed. Rust duplicates **53/59 → 53/59**, no new license expressions. npm entries **87 → 86**, no missing license metadata, identical expression set. Same-host dev-02 parent and candidate are byte-identical: x86 **27,933,232 B**, aarch64 **25,093,240 B**, batch delta **0/0**. Cross-host absolute differences are not attributed to this batch. Full raw log and SHA/size receipts attached; `JS_REMAINING_CHECK_EXIT=0` and `JS_BATCH_COMMITTED=undici-types-major` recorded.

js-final-batches-dev02.log

733 KiB

undici-types-major-binary-size.txt

125 B

undici-types-major-binary-sha.txt

239 B

kayg commented

2026-11-07 15:48:36 +00:00

Author

Owner

Compatible JS transitive batch passed and pushed separately: original head 934a47368, retained unchanged after final dev rebase as df9f92f86.

Refreshed Next to 16.4.5, React to 19.3.1, tslib to 2.9.1 and compatible browser/support data. Scoped verify quick, production build, zero-finding Bun audit (86 packages), deny, Nix dependency cache rebuild and forced rebuild, both statics and both font-picker browser cases passed. Rust duplicates 53/59 → 53/59, npm entries 86 → 86, no new license expressions or missing metadata.

Both statics remain byte-identical to the immediate parent: x86 27,933,232 B, aarch64 25,093,240 B, delta 0/0. Full raw batch log and SHA/size receipts attached. JS_FINAL_BATCHES_EXIT=0; no own batch process remains.

Regenerated full JS lock inventory: 90 version rows / 86 names / zero lookup failures. The remaining gaps are parent-constrained: Next exactly pins @swc/helpers 0.5.23, postcss 8.5.23, styled-jsx 5.1.6; postcss retains nanoid 3; Node declarations require undici-types ~8.9.0. No overrides added. The earlier claim that Bun itself required undici 6 was incorrect: removing its stale wildcard resolution safely deduplicated it.

Final dev rebase inherits only the owner's Mac socket fix. All 16/16 commits compare equal in range-diff. Branch now pushed at df9f92f863bd7109031424f8a0c7022509a06ce3, based on dev 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827. Native-input comparison and final full gate follow.

Compatible JS transitive batch passed and pushed separately: original head `934a47368`, retained unchanged after final dev rebase as `df9f92f86`. Refreshed Next to 16.4.5, React to 19.3.1, tslib to 2.9.1 and compatible browser/support data. Scoped `verify quick`, production build, zero-finding Bun audit (86 packages), deny, Nix dependency cache rebuild and forced rebuild, both statics and both font-picker browser cases passed. Rust duplicates **53/59 → 53/59**, npm entries **86 → 86**, no new license expressions or missing metadata. Both statics remain byte-identical to the immediate parent: x86 **27,933,232 B**, aarch64 **25,093,240 B**, delta **0/0**. Full raw batch log and SHA/size receipts attached. `JS_FINAL_BATCHES_EXIT=0`; no own batch process remains. Regenerated full JS lock inventory: **90 version rows / 86 names / zero lookup failures**. The remaining gaps are parent-constrained: Next exactly pins `@swc/helpers 0.5.23`, `postcss 8.5.23`, `styled-jsx 5.1.6`; postcss retains nanoid 3; Node declarations require undici-types `~8.9.0`. No overrides added. The earlier claim that Bun itself required undici 6 was incorrect: removing its stale wildcard resolution safely deduplicated it. Final dev rebase inherits only the owner's Mac socket fix. All **16/16** commits compare equal in range-diff. Branch now pushed at `df9f92f863bd7109031424f8a0c7022509a06ce3`, based on dev `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`. Native-input comparison and final full gate follow.

js-transitive-minor-binary-size.txt

125 B

js-transitive-minor-binary-sha.txt

239 B

js-lock-inventory-final.md

6.8 KiB

final-rebase-range-diff.txt

1.4 KiB

kayg commented

2026-11-07 15:51:04 +00:00

Author

Owner

Final full gate queued on rebased/pushed head df9f92f863bd7109031424f8a0c7022509a06ce3, based on current dev 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827. Both VM statuses checked: compute01 has seven queued jobs; dev-02 has only one active quick check, no earlier queue and 72G free. Exact dev-02 Nix/Cargo launcher passes (cargo 1.99.1). Sole heavy run PID 531781; log /home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast.log.

The full gate uses three build jobs, no incremental/debug artifacts, four test workers, and unchanged gate limits. I will retain the explicit VERIFY_FAST_EXIT marker and verbatim gate summary.

Mac proof is now matched to the final native tree: 1,229 / 1,229 tracked native input files, zero differences against the passing default-CLI and desktop-feature release compile guards (84737). Full two manifests and comparison attached. The temporary checked composition and final branch have identical native inputs; head/root metadata is deliberately excluded from the file-content comparison.

Mac target is already absent, no own Mac build is pending. A brief final checkout sync could not acquire the shared lock because another job currently holds it; I will retry while the Linux gate runs, without disturbing the lock holder.

Final full gate queued on rebased/pushed head `df9f92f863bd7109031424f8a0c7022509a06ce3`, based on current dev `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`. Both VM statuses checked: compute01 has seven queued jobs; dev-02 has only one active quick check, no earlier queue and 72G free. Exact dev-02 Nix/Cargo launcher passes (cargo 1.99.1). Sole heavy run PID `531781`; log `/home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast.log`. The full gate uses three build jobs, no incremental/debug artifacts, four test workers, and unchanged gate limits. I will retain the explicit `VERIFY_FAST_EXIT` marker and verbatim gate summary. Mac proof is now matched to the final native tree: **1,229 / 1,229 tracked native input files, zero differences** against the passing default-CLI and desktop-feature release compile guards (84737). Full two manifests and comparison attached. The temporary checked composition and final branch have identical native inputs; head/root metadata is deliberately excluded from the file-content comparison. Mac target is already absent, no own Mac build is pending. A brief final checkout sync could not acquire the shared lock because another job currently holds it; I will retry while the Linux gate runs, without disturbing the lock holder.

mac-final-input-comparison.txt

94 B

mac-final-native-inputs.json

146 KiB

final-native-inputs.json

146 KiB

kayg commented

2026-11-07 16:14:59 +00:00

Author

Owner

Final-head dev-02 verify fast exited 1 on df9f92f863bd7109031424f8a0c7022509a06ce3. This is a failed gate, not a pass. Full raw log and host receipts attached.

Three failed rows:

test FAIL (101): streaming::decoded_image_and_hash_advance_before_the_transfer_tail_is_released at crates/plugins/ssh/tests/install/streaming.rs:114: 30s bounded wait, hashed=false, no staged bytes, input progress 237568 / expected 624481. 106 other tests in that binary passed. Cause not yet attributed to a dependency or host.
shim process-per-user FAIL (101): pty::descriptor_allowlist_tests::the_listing_fallback_marks_descriptors_above_the_limit at pty.rs:1608: child spawn returns EMFILE. 216 others passed. Host soft/hard descriptor limits: 1024 / 1048576; the fixture deliberately lowers its child limit to 64. Cause not yet proved.
privileged integration FAIL (1): 18/101 namespace cases fail. All four absolute /usr/sbin/{iptables-nft,ip6tables-nft,iptables-nft-restore,ip6tables-nft-restore} executables are absent on dev-02 and present on compute01. The unchanged firewall implementation requires them; nft itself is installed. The common brief already warns of this host gap. No host package, gate or test changes made.

Clippy, deny, static builds and the remaining Rust gate rows passed. Final dev-02 static sizes 27,933,232 / 25,093,240 B, identical to both JS batch controls before the Mac-only rebase fix. The gate stops before its final JS stage on Rust failure.

My progress-tail reading missed the SSH and shim failures before the final table; the earlier workspace-pass progress statement is withdrawn. The raw summary is authoritative.

Next, focused reproductions on unmodified dev 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827, with its original Nix inputs and cargo 1.99.0, for the SSH streaming fixture and full process-per-user shim suite. No baseline pass/failure claimed yet. Then the final gate will move to compute01, whose firewall tools exist. Branch remains unchanged; native Mac guards and exact 1229-file proof remain valid.

Final-head dev-02 `verify fast` exited **1** on `df9f92f863bd7109031424f8a0c7022509a06ce3`. This is a failed gate, not a pass. Full raw log and host receipts attached. Three failed rows: - `test FAIL (101)`: `streaming::decoded_image_and_hash_advance_before_the_transfer_tail_is_released` at `crates/plugins/ssh/tests/install/streaming.rs:114`: 30s bounded wait, hashed=false, no staged bytes, input progress 237568 / expected 624481. 106 other tests in that binary passed. Cause not yet attributed to a dependency or host. - `shim process-per-user FAIL (101)`: `pty::descriptor_allowlist_tests::the_listing_fallback_marks_descriptors_above_the_limit` at pty.rs:1608: child spawn returns EMFILE. 216 others passed. Host soft/hard descriptor limits: 1024 / 1048576; the fixture deliberately lowers its child limit to 64. Cause not yet proved. - `privileged integration FAIL (1)`: 18/101 namespace cases fail. All four absolute `/usr/sbin/{iptables-nft,ip6tables-nft,iptables-nft-restore,ip6tables-nft-restore}` executables are absent on dev-02 and present on compute01. The unchanged firewall implementation requires them; nft itself is installed. The common brief already warns of this host gap. No host package, gate or test changes made. Clippy, deny, static builds and the remaining Rust gate rows passed. Final dev-02 static sizes **27,933,232 / 25,093,240 B**, identical to both JS batch controls before the Mac-only rebase fix. The gate stops before its final JS stage on Rust failure. My progress-tail reading missed the SSH and shim failures before the final table; the earlier workspace-pass progress statement is withdrawn. The raw summary is authoritative. Next, focused reproductions on **unmodified dev `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`**, with its original Nix inputs and cargo **1.99.0**, for the SSH streaming fixture and full process-per-user shim suite. No baseline pass/failure claimed yet. Then the final gate will move to compute01, whose firewall tools exist. Branch remains unchanged; native Mac guards and exact 1229-file proof remain valid.

final-verify-fast-dev02.log

703 KiB

dev02-firewall-environment.txt

496 B

compute01-firewall-environment.txt

438 B

final-dev02-binary-size.txt

181 B

mac-final-sync.log

949 B

kayg commented

2026-11-07 16:24:07 +00:00

Author

Owner

Baseline reproduction finished on unmodified dev 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827, with its original Cargo/flake locks, cargo 1.99.0, three build jobs and four test workers. Full raw receipt attached.

SSH streaming failure reproduced exactly: BASELINE_STREAMING_EXIT=101; the same 30s bounded timeout, hashed=false, input_progress=237568, staged_bytes=0, expected_bytes=624481. This establishes a baseline dev-02 failure with the original environment, not a refresh-only regression.
Shim PPU suite passed baseline: 217/217, 20 ignored, BASELINE_PPU_EXIT=0. The earlier final-head EMFILE is not reproduced here; no baseline-failure claim or root-cause claim for it. This remains an intermittent diagnostic pending the compute01 final gate.

Restored dev-02's own worktree clean to final head df9f92f863bd7109031424f8a0c7022509a06ce3. No code, test, gate, timeout, descriptor limit or host package changes.

Checked both slot statuses again and the exact compute01 launcher (cargo 1.99.1). Compute01 has the required absolute firewall tools; dev-02 lacks them. Sole final full-gate run is now queued on compute01, PID 713866, log /home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log. Same final branch and unchanged four-worker gate script. The earlier dev-02 full gate stays recorded as exit 1 in84835; this repeat is justified by the observed host gap and failed run, not described as a pass.

Baseline reproduction finished on unmodified dev `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`, with its original Cargo/flake locks, cargo 1.99.0, three build jobs and four test workers. Full raw receipt attached. - **SSH streaming failure reproduced exactly**: `BASELINE_STREAMING_EXIT=101`; the same 30s bounded timeout, hashed=false, `input_progress=237568`, staged_bytes=0, expected_bytes=624481. This establishes a baseline dev-02 failure with the original environment, not a refresh-only regression. - **Shim PPU suite passed baseline: 217/217, 20 ignored**, `BASELINE_PPU_EXIT=0`. The earlier final-head EMFILE is not reproduced here; no baseline-failure claim or root-cause claim for it. This remains an intermittent diagnostic pending the compute01 final gate. Restored dev-02's own worktree clean to final head `df9f92f863bd7109031424f8a0c7022509a06ce3`. No code, test, gate, timeout, descriptor limit or host package changes. Checked both slot statuses again and the exact compute01 launcher (cargo 1.99.1). Compute01 has the required absolute firewall tools; dev-02 lacks them. Sole final full-gate run is now queued on compute01, PID `713866`, log `/home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log`. Same final branch and unchanged four-worker gate script. The earlier dev-02 full gate stays recorded as exit 1 in84835; this repeat is justified by the observed host gap and failed run, not described as a pass.

dev02-baseline-failures.log

33 KiB

kayg commented

2026-11-07 16:52:48 +00:00

Author

Owner

J340 checkpoint: branch remains clean and pushed at df9f92f863bd7109031424f8a0c7022509a06ce3. All 16 dependency batches are committed, with individual quick/deny/license/duplicate/static/browser receipts as applicable. No pending implementation edits.

The sole remaining run is compute01 full gate PID 713866, still queued after about 29 minutes. Latest live slot status has J340 second in the queue, one job ahead; the initial position-5 message in the log is stale. Log: /home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log. Gate script unchanged, jobs=3, incremental/debug disabled, four test workers.

Dev-02 and Mac worktrees are clean at the final head. Both targets have been removed; dev-02 process inventory is empty. Native Mac compile guards and 1229/1229 input-match evidence are attached84812; final Mac sync84835. Dev-02's failed full gate remains84835, exact original-environment SSH baseline reproduction plus baseline PPU 217/217 pass84844. No failure has been suppressed or recast as a pass.

I am waiting in this turn for compute01 admission/result, then will inspect the complete summary and any failures, save final sizes/hashes, clean its own target/processes and post the final inventory/deferrals/verbatim gate handoff. No merge, deployment, issue closure or PR.

J340 checkpoint: branch remains clean and pushed at `df9f92f863bd7109031424f8a0c7022509a06ce3`. All 16 dependency batches are committed, with individual quick/deny/license/duplicate/static/browser receipts as applicable. No pending implementation edits. The sole remaining run is compute01 full gate PID `713866`, still queued after about 29 minutes. Latest live slot status has J340 second in the queue, one job ahead; the initial position-5 message in the log is stale. Log: `/home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log`. Gate script unchanged, jobs=3, incremental/debug disabled, four test workers. Dev-02 and Mac worktrees are clean at the final head. Both targets have been removed; dev-02 process inventory is empty. Native Mac compile guards and 1229/1229 input-match evidence are attached84812; final Mac sync84835. Dev-02's failed full gate remains84835, exact original-environment SSH baseline reproduction plus baseline PPU 217/217 pass84844. No failure has been suppressed or recast as a pass. I am waiting in this turn for compute01 admission/result, then will inspect the complete summary and any failures, save final sizes/hashes, clean its own target/processes and post the final inventory/deferrals/verbatim gate handoff. No merge, deployment, issue closure or PR.

dev02-final-cleanup.log

24 B

kayg commented

2026-11-07 17:24:56 +00:00

Author

Owner

J340 final-gate checkpoint: sole compute01 PID 713866 acquired slot 2/5 after about 31 minutes queued and is now executing workspace tests after compilation/checking. Exact head/base remain df9f92f863bd7109031424f8a0c7022509a06ce3 / 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827. No final gate result claimed yet.

Live raw log: /home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log. Single target: /home/claude/worktrees/J340/target. Same three build jobs, incremental/debug disabled, four test workers, unchanged limits. I am waiting in this turn and will inspect the complete table/exit marker, not infer success from a tail.

All implementation commits are already pushed, branch clean. Dev-02/Mac checks and cleanup have finished; their targets are absent. Baseline SSH timeout is proved84844; earlier dev-02 full-gate failures84835 are preserved, including the unreproduced EMFILE. Final report has complete inventories, per-batch size/license/duplicate results and deferred estimates ready; it still awaits this gate's actual outcome and compute01 cleanup.

J340 final-gate checkpoint: sole compute01 PID `713866` acquired slot 2/5 after about 31 minutes queued and is now executing workspace tests after compilation/checking. Exact head/base remain `df9f92f863bd7109031424f8a0c7022509a06ce3` / `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`. No final gate result claimed yet. Live raw log: `/home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log`. Single target: `/home/claude/worktrees/J340/target`. Same three build jobs, incremental/debug disabled, four test workers, unchanged limits. I am waiting in this turn and will inspect the complete table/exit marker, not infer success from a tail. All implementation commits are already pushed, branch clean. Dev-02/Mac checks and cleanup have finished; their targets are absent. Baseline SSH timeout is proved84844; earlier dev-02 full-gate failures84835 are preserved, including the unreproduced EMFILE. Final report has complete inventories, per-batch size/license/duplicate results and deferred estimates ready; it still awaits this gate's actual outcome and compute01 cleanup.

kayg commented

2026-11-07 17:57:10 +00:00

Author

Owner

J340 continuation recovered the clean, pushed deps-refresh-340 head df9f92f863bd7109031424f8a0c7022509a06ce3; all 16 atomic dependency commits are present, including approved OpenSSL security commit d2a965b1d1d1b0476fc38ea96b9348298dd3d4ca.

The sole compute01 final gate remains active as PID 713866, raw artifact /home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log. Workspace test row finished (1955s), shim PPU row finished (262s), cargo-deny finished successfully, and privileged integration is compiling. No final gate pass is claimed before the complete table and VERIFY_FAST_EXIT marker. Both host slot statuses were checked again; no second build was queued. Target remains /home/claude/worktrees/J340/target; dev-02 and Mac target cleanup is already recorded above.

OpenSSL commit message verified: paired p50/p99 trials and retained-500 RSS, named memory-safety fixes, and explicit rare enrollment/rotation control-path tradeoff are present. Source-level follow-up remains documented84647; no unsupported feature toggle was applied. Remaining implementation work is complete; final gate receipt, final static sizes, cleanup and consolidated inventory report follow when this run ends. No merge or deployment.

J340 continuation recovered the clean, pushed `deps-refresh-340` head `df9f92f863bd7109031424f8a0c7022509a06ce3`; all 16 atomic dependency commits are present, including approved OpenSSL security commit `d2a965b1d1d1b0476fc38ea96b9348298dd3d4ca`. The sole compute01 final gate remains active as PID `713866`, raw artifact `/home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log`. Workspace test row finished (1955s), shim PPU row finished (262s), cargo-deny finished successfully, and privileged integration is compiling. No final gate pass is claimed before the complete table and `VERIFY_FAST_EXIT` marker. Both host slot statuses were checked again; no second build was queued. Target remains `/home/claude/worktrees/J340/target`; dev-02 and Mac target cleanup is already recorded above. OpenSSL commit message verified: paired p50/p99 trials and retained-500 RSS, named memory-safety fixes, and explicit rare enrollment/rotation control-path tradeoff are present. Source-level follow-up remains documented84647; no unsupported feature toggle was applied. Remaining implementation work is complete; final gate receipt, final static sizes, cleanup and consolidated inventory report follow when this run ends. No merge or deployment.

kayg commented

2026-11-07 18:26:17 +00:00

Author

Owner

J340 checkpoint: head remains clean/pushed df9f92f863bd7109031424f8a0c7022509a06ce3; no implementation edits or additional builds. Sole compute01 gate PID 713866 remains active. Workspace tests, shim PPU, cargo-deny, all 101 privileged integration cases, release-probe exclusion (272s), and nightly-fuzz reporter (10s) have completed successfully. The unchanged gate is now in its final static builds row; no overall PASS claimed until the summary/exit marker.

Live artifact: /home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log. Target: /home/claude/worktrees/J340/target. Compiler is active; no gate/timeouts/source changes. Dev-02/Mac own targets are already removed. After completion I will save the actual sizes/hashes, attach the full log and verbatim table with the consolidated inventories, remove the compute01 target, and hand off without merging/deploying.

J340 checkpoint: head remains clean/pushed `df9f92f863bd7109031424f8a0c7022509a06ce3`; no implementation edits or additional builds. Sole compute01 gate PID `713866` remains active. Workspace tests, shim PPU, cargo-deny, all 101 privileged integration cases, release-probe exclusion (272s), and nightly-fuzz reporter (10s) have completed successfully. The unchanged gate is now in its final `static builds` row; no overall PASS claimed until the summary/exit marker. Live artifact: `/home/claude/.cache/codex-scratch/J340/evidence/final-verify-fast-compute01.log`. Target: `/home/claude/worktrees/J340/target`. Compiler is active; no gate/timeouts/source changes. Dev-02/Mac own targets are already removed. After completion I will save the actual sizes/hashes, attach the full log and verbatim table with the consolidated inventories, remove the compute01 target, and hand off without merging/deploying.

kayg commented

2026-11-07 18:51:57 +00:00

Author

Owner

J340 dependency refresh, final handoff. Branch deps-refresh-340; head df9f92f863bd7109031424f8a0c7022509a06ce3. No merge/deployment; issue stays open for the orchestrator.

The 47 compatible Rust resolutions, JS patch/minor updates, approved OpenSSL security pair, Nix inputs/Rust patch, and individually reviewed safe majors are committed separately. libghostty-vt, native VT and Zig pins are untouched. Every batch has quick/deny/license/duplicate/static receipts on this issue. Full original/final/latest/semver Rust inventory is attached (470 registry names); the original complete inventory and corrected registry findings remain above. Parent-owned transitive major versions remain constrained rather than forcibly overridden.

batch	resulting version	x86 static delta, bytes	arm64 static delta, bytes
Rust compatible	47 resolutions, including Tokio 1.54.1	+112608	+74320
JS patch/minor	all direct patch/minor pins current	0	0
OpenSSL security	openssl 0.10.82 / openssl-sys 0.9.118	+2112	+5856
Nix / Rust patch	nixpkgs 6dadaf4375be; rust-overlay 74cebce67ef6; Rust 1.99.1; Bun 1.4.4	+544	+4480
ScreenCaptureKit compatible	11.1.2	0	0
nix major	0.31.3	+1312	-11456
Criterion major	0.8.2	0	0
alacritty_terminal major	0.26.0	0	0
tower-http major	0.7.1	+26368	+35760
vt100 major	0.18.1	0	0
rand major	0.10.3 (already transitive)	+768	-8448
TypeScript major	7.0.2	0	0
Node types major	26.6.6	0	0
Node development runtime major	26.13.0 LTS	0	0
Bun HTTP declarations major	undici-types 6.21 → existing 8.9	0	0
JS compatible transitives	Next 16.4.5, React 19.3.1, tslib 2.9.1 and support data	0	0

Dependency-only cumulative static delta on dev-02 before inherited dev rebases: +143712 / +100512 bytes, original 27779344 / 24988232 to 27923056 / 25088744. The first rebase separately inherits +5120 / +1952 bytes of dev code. Clean rebased parent and TypeScript candidate on dev-02 measured 27928176 / 25090696, byte-identical. Compute-host clean parent and Node-types candidate are also byte-identical, 27928720 / 25093128, delta 0/0 (comment84469). The host change adds 544 / 2432 relative to the earlier artifact recipe; that is not attributed to JS. Latest dev 21b3c84ce additionally inherits #394 SSH source/UI changes: same-host inherited #394 source delta +5024 / +3056 bytes. Final Node24 parent/Node26 comparison and absolute sizes: 27,933,744 / 25,096,184 bytes, byte-identical parent/candidate, delta 0/0 before the final Mac-fix rebase. The two remaining JS batches were then measured on dev-02 against a fresh same-host parent: 27,933,232 / 25,093,240 bytes, unchanged SHA-256 and 0/0 delta for each. Those cross-host absolute differences are not attributed to JS; raw receipts are attached84807/84808. Final rebased sizes: 27,933,744 bytes x86 / 25,096,184 bytes aarch64 on compute01; both stripped static artifacts pass ELF/linkage/production-trust checks. Actual final SHA-256 receipts are attached; no byte-identity claim is made across the final rebase or between hosts.

Rust duplicates improve 54 names / 60 excess versions → 53 / 59 at the nix major; every other batch preserves its starting count. No new duplicate versions or license expressions, no allowed-license expansion, no advisory suppressions. The npm declaration/license-set reports are attached per slice.

Advisories: all five original Bun findings are fixed; final Bun audits both zero findings (86 tracer / 4 browser-auth packages in the Node runtime receipt). Rust audit checks 1422 advisories / 553 lockfile entries and still exits 1 solely for rsa 0.9.10, RUSTSEC-2023-0071, no fixed version; identical baseline, absent from the selected shipping graph. Fresh raw receipt is attached in comment 84403. Cargo-deny passes.

Performance receipts are attached above: compatible Tokio/runtime/crypto trials overlap baseline. Approved OpenSSL p50/p99 medians 288/312 → 349/373 µs, RSS 5304 → 5304 KiB on rare enrollment/rotation operations; separate security commit records the memory-safety fixes and off-hot-path tradeoff. The planned Nix/Rust refresh recovers p50 296 → 353 → 296, p99 312 → 375 → 316, RSS 5300 throughout; exact binding/environment attribution remains a follow-up, no unsupported feature disabled. Native compiler metadata cannot distinguish the three environments (comment 84403). Additional source narrowing finds 15 named public-method groups used by the probe text-identical and unchanged feature maps; the new X509StoreContext cleanup is not directly invoked by this timed probe (comment 84647). This is not assembly/profiling attribution, and no new safe feature toggle was established.

Nonshipping terminal oracles: alacritty median 93.02 → 91.86 MB/s, RSS unchanged; vt100 46.24 → 38.62 MB/s, RSS 65848 → 15208 KiB, snapshot 79.86 → 50.92 µs, identical replay/cursor results and 31/31 real shim tests. The vt100 parse cost trades against lower memory and faster snapshots in the test oracle. Shipping terminal engine/pins are excluded. Tower/rand runtime and certificate trials overlap baseline.

Six DPR2 production screenshots (desktop, 393px and 375px, ink/paper) and eight browser tests qualify the TypeScript declaration fixes. Selected screenshots/checks/batch and clean-parent binary comparison are attached in comment 84363; visual approval belongs to the orchestrator. The separate ephemeral protocol compiler pin is also 7.0.2 and explicitly passes without parser edits (comment84469). Node-only slices do not alter product source. The protocol-pin correction was folded into the TypeScript commit earlier (range-diff84469). The final dev rebase preserves all 16 dependency commits unchanged (range-diff84808). Temporary WIP/fixup commits are absent.

Native Mac default CLI and desktop-feature release compile guards PASS with Rust 1.99.1 and the refreshed lock (MAC_FINAL_CHECK_EXIT=0, full log and input digests attached in comment 84737). The earlier SockFlag::SOCK_CLOEXEC failure was proved on baseline dev and fixed independently by the owner's commit 2c8fe3630, now inherited through dev 6b1bdb81b; no J340 login/auth workaround is included. Native input-digest match to final rebased Rust tree: PASS, 1,229/1,229 tracked native input files match; zero differing files. The completed build removed the Mac target and released its lock; there is no own Mac build process. Final worktree sync: PASS, clean checkout at final head; MAC_FINAL_SYNC_EXIT=0, MAC_TARGET_ABSENT; receipt attached.

GotaTun report only: shipped fork pin 84b7bb28e385d57dfb80493e78202898fad24d1e has upstream base 1d46b779f5e0743f30a13cc2c325b8114b901fb9 (0.10.2); upstream 16937ec6219afbece5aa69ece91f41e12d04d3c5 is 14 commits ahead, with 19 fork-only commits. Fork base unchanged. Vendored russh-sftp is already 3.0.1 latest; browser ghostty-web 0.5.0-rc.0 is ahead of npm stable 0.4.0. Zig 0.15.2→0.17.1 remains J339's scope. CI node:22-bookworm, checkout@v4 and cache@v4 remain deferred: latest Node 26, checkout v7.0.1/cache v6.1.0 require real runner proof; current runner is offline.

Other dependency	Original	Final	Latest observed	Remaining gap
nixpkgs unstable	885ba4d038f1	6dadaf4375be	6dadaf4375be	current rolling revision
rust-overlay	96a0986b0486	74cebce67ef6	74cebce67ef6	current rolling revision
Rust toolchain	1.99.0	1.99.1	1.99.1	current
Bun toolchain	inherited from original nixpkgs input	1.4.4	1.4.4	current
Node dev-shell runtime	24 series	26.13.0 LTS	26.13.0 LTS	current LTS
Zig	0.15.2	0.15.2	0.17.1	two breaking 0.x series; J339 scope
CI image	node:22-bookworm	node:22-bookworm	Node 26.13.0 LTS	major; offline runner blocks execution proof
CI checkout action	v4	v4	v7.0.1	major; offline runner
CI cache action	v4	v4	v6.1.0	major; offline runner
vendored russh	0.64.1 + audit patch	unchanged	0.65.1	breaking; separate SSH migration
vendored russh-sftp	3.0.1	3.0.1	3.0.1	current
browser ghostty-web	0.5.0-rc.0	unchanged	0.4.0 stable	ahead of stable; excluded native VT unchanged
GotaTun upstream base	0.10.2 / 1d46b779	unchanged	16937ec6	14 behind / 19 fork-only; report only

Deferred security migrations, duplicate-blocked updates and estimates follow in the attached deferred table. Final verify fast output is quoted verbatim below; raw full log attached. Cleanup and remaining execution state complete: compute01 process inventories before/after removal are empty and COMPUTE01_TARGET_CLEANED is recorded. Dev-02 records DEV02_TARGET_CLEANED; Mac records MAC_TARGET_ABSENT. All own background work is finished; logs and measurement receipts remain outside targets.

Diagnostic retries are preserved: the first auxiliary parent quick hit one ETXTBSY spawn failure in the unchanged proxy fixture (84537); a focused 1/1 plus complete 123/123 serial proxy rerun passed. Applying serial scheduling to the complete workspace then hit the unchanged 1500s unit-row timeout after 2213 passing lines (84611), without an assertion failure in that attempt. The final whole-branch gate uses four test workers within the existing limits. No fixture, security source, timeout or gate policy was changed; ETXTBSY attribution remains unproven.

Remaining JS parent constraints: current Next exactly selects @swc/helpers 0.5.23, postcss 8.5.23 and styled-jsx 5.1.6; postcss requires nanoid ^3.3.16; @types/node requires undici-types ~8.9.0. These remain within parent ranges rather than introducing overrides or duplicated major lines. Refreshed full lockfile inventory is attached and follows below.

The first final-head full gate on dev-02 failed (exit 1) in three rows; full raw log and final table are retained in84835. Privileged integration failed 18/101 cases; dev-02 lacks all four absolute iptables-nft/ip6tables-nft frontend/restore paths required by the unchanged implementation, while compute01 has them. The SSH streaming fixture also hit its bounded 30s wait with hashed=false, input progress 237568, staged bytes 0 and expected bytes 624481. A focused run on unmodified dev with its original Cargo/flake locks and Rust 1.99.0 reproduces that exact failure, proving a baseline dev-02 problem (84844). The shim PPU descriptor fallback test failed with EMFILE in the final-head run, but the complete baseline PPU suite passed 217/217, 20 ignored with the same four workers; that intermittent failure's cause is unproven. A progress-tail statement that workspace tests had passed was explicitly withdrawn when the full table exposed these failures. No test, limit, gate or host-package workaround was applied. Final compute01 gate outcome: PASS, VERIFY_FAST_EXIT=0, all 24 Rust gate rows including 101/101 privileged integration cases. Subsequent compiler/startup checks, tracer (655 tests), connection (104), terminal-query/write-slice (17), and protocol (50) Bun suites also report zero failures; stream differential covers 239 streams / 25,599 schedules with zero divergences and desktop rejection differential 1,376 cases with zero divergences.

Verbatim Rust gate table and final protocol-suite/exit excerpt follow. The complete unabridged scripts/verify fast log is attached as final-verify-fast-compute01.log.

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | PASS         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 50 pass
 0 fail
 77253 expect() calls
Ran 50 tests across 13 files. [17.50s]
VERIFY_FAST_EXIT=0

Full final Rust inventory (original/final/latest/semver gap):

Rust crate	Original versions	Final versions	Latest stable	Remaining semver gap
adler2	2.0.1	2.0.1	2.0.1	current
aead	0.5.2, 0.6.1	0.5.2, 0.6.1	0.6.1	breaking, current
aes	0.8.4, 0.9.3	0.8.4, 0.9.4	0.9.4	breaking, current
aes-gcm	0.10.3, 0.11.1	0.10.3, 0.11.1	0.11.1	breaking, current
aho-corasick	1.1.5	1.1.5	1.1.5	current
alacritty_terminal	0.25.1	0.26.0	0.26.0	current
alloca	new	0.4.0	0.4.0	current
allocator-api2	0.2.21	0.2.21	0.4.0	breaking
android_system_properties	0.1.6	0.1.6	0.1.6	current
anes	0.1.6	0.1.6	0.2.1	breaking
anstream	1.0.0	1.0.0	1.0.0	current
anstyle	1.0.14	1.0.14	1.0.14	current
anstyle-parse	1.0.0	1.0.0	1.0.0	current
anstyle-query	1.1.5	1.1.5	1.1.5	current
anstyle-wincon	3.0.11	3.0.11	3.0.11	current
apple-cf	0.11.7	0.11.7	0.11.7	current
apple-metal	0.10.4	0.10.4	0.10.4	current
arbitrary	1.4.2	1.5.0	1.5.0	current
arc-swap	1.9.2	1.9.3	1.9.3	current
argon2	0.5.3, 0.6.0	0.5.3, 0.6.0	0.6.0	breaking, current
arrayvec	0.7.8	0.7.8	0.7.8	current
asn1-rs	0.6.2	0.6.2	0.7.2	breaking
asn1-rs-derive	0.5.1	0.5.1	0.7.0	breaking
asn1-rs-impl	0.2.0	0.2.0	0.3.0	breaking
atoi	2.0.0	2.0.0	3.1.1	breaking
atomic-waker	1.1.2	1.1.2	1.1.2	current
autocfg	1.5.1	1.5.1	1.5.1	current
axum	0.8.9	0.8.9	0.8.9	current
axum-core	0.5.6	0.5.6	0.5.6	current
axum-server	0.8.0	0.8.0	0.9.0	breaking
base16ct	1.0.0	1.0.0	1.0.0	current
base64	0.21.7, 0.22.1	0.21.7, 0.22.1	0.23.1	breaking
base64ct	1.8.3	1.8.3	1.8.3	current
base64urlsafedata	0.5.5	0.5.5	0.6.2	breaking
bcrypt-pbkdf	0.11.0	0.11.0	0.11.0	current
bip39	2.2.2	2.2.2	3.0.0	breaking
bitcoin_hashes	0.14.101	0.14.101	1.2.0	breaking
bitfield-struct	0.12.1	0.12.1	0.13.0	breaking
bitflags	2.13.2	2.13.2	2.13.2	current
blake2	0.10.6, 0.11.0	0.10.6, 0.11.0	0.11.0	breaking, current
block-buffer	0.10.4, 0.12.1	0.10.4, 0.12.1	0.12.1	breaking, current
block-padding	0.4.2	0.4.2	0.4.2	current
blowfish	0.10.0	0.10.0	0.10.0	current
bumpalo	3.20.3	3.20.3	3.20.3	current
byteorder	1.5.0	1.5.0	1.5.0	current
bytes	1.12.1	1.12.1	1.12.1	current
cast	0.3.0	0.3.0	0.3.0	current
cbc	0.2.1	0.2.1	0.2.1	current
cc	1.6.0	1.11.1	1.11.1	current
cfg-if	1.0.5	1.0.5	1.0.5	current
cfg_aliases	0.2.2	0.2.2	0.2.2	current
chacha20	0.9.1, 0.10.2	0.9.1, 0.10.2	0.10.2	breaking, current
chacha20poly1305	0.10.1	0.10.1	0.11.0	breaking
chrono	0.4.45	0.4.45	0.4.45	current
ciborium	0.2.2	0.2.2	0.2.2	current
ciborium-io	0.2.2	0.2.2	0.2.2	current
ciborium-ll	0.2.2	0.2.2	0.2.2	current
cipher	0.4.4, 0.5.2	0.4.4, 0.5.2	0.5.2	breaking, current
clap	4.6.7	4.6.7	4.6.7	current
clap_builder	4.6.7	4.6.7	4.6.7	current
clap_derive	4.6.7	4.6.7	4.6.7	current
clap_lex	1.1.1	1.1.1	1.1.1	current
cmov	0.5.4	0.5.4	0.5.4	current
colorchoice	1.0.5	1.0.5	1.0.5	current
combine	4.6.9	4.6.9	4.6.9	current
concurrent-queue	2.5.0	2.5.0	2.5.0	current
const-oid	0.9.6, 0.10.2	0.9.6, 0.10.2	0.10.2	breaking, current
constant_time_eq	0.4.2	0.4.2	0.6.1	breaking
core-foundation	0.10.1	0.10.1	0.10.1	current
core-foundation-sys	0.8.7	0.8.7	0.8.7	current
cpubits	0.1.1	0.1.1	0.1.1	current
cpufeatures	0.2.17, 0.3.1	0.2.17, 0.3.1	0.3.1	breaking, current
crc	3.4.0	3.4.0	3.4.0	current
crc-catalog	2.5.0	2.5.0	2.5.0	current
crc32fast	1.5.3	1.5.4	1.5.4	current
criterion	0.7.0	0.8.2	0.8.2	current
criterion-plot	0.6.0	0.8.2	0.8.2	current
critical-section	1.2.0	1.2.0	1.2.0	current
crossbeam-deque	0.8.8	0.8.8	0.8.8	current
crossbeam-epoch	0.9.21	0.9.21	0.9.21	current
crossbeam-queue	0.3.14	0.3.14	0.3.14	current
crossbeam-utils	0.8.23	0.8.23	0.8.23	current
crunchy	0.2.4	0.2.4	0.2.4	current
crypto-bigint	0.7.10	0.7.10	0.7.10	current
crypto-common	0.1.7, 0.2.2	0.1.7, 0.2.2	0.2.2	breaking, current
ctr	0.9.2, 0.10.1	0.9.2, 0.10.1	0.10.1	breaking, current
ctutils	0.4.7	0.4.8	0.4.8	current
cursor-icon	1.2.0	1.2.0	1.2.0	current
curve25519-dalek	4.1.3, 5.0.0	4.1.3, 5.0.0	5.0.0	breaking, current
curve25519-dalek-derive	0.1.1	0.1.1	0.1.1	current
dashmap	6.2.1	6.2.1	6.2.1	current
data-encoding	2.11.1	2.11.1	2.11.1	current
delegate	0.13.5	0.13.5	0.13.5	current
der	0.7.10, 0.8.3	0.7.10, 0.8.3	0.8.3	breaking, current
der-parser	9.0.0	9.0.0	10.0.0	breaking
deranged	0.5.8	0.5.9	0.5.9	current
des	0.9.0	0.9.0	0.9.0	current
digest	0.10.7, 0.11.3	0.10.7, 0.11.3	0.11.3	breaking, current
displaydoc	0.2.7	0.2.7	0.2.7	current
doom-fish-utils	0.4.3	0.4.3	0.4.3	current
dotenvy	0.15.7	0.15.7	0.15.7	current
duplicate	2.0.1	2.0.1	2.0.1	current
ecdsa	0.17.0	0.17.0	0.17.0	current
ed25519	3.0.0	3.0.0	3.0.0	current
ed25519-dalek	3.0.0	3.0.0	3.0.0	current
either	1.18.0	1.19.0	1.19.0	current
elliptic-curve	0.14.3	0.14.3	0.14.3	current
enum-as-inner	0.6.1	0.6.1	0.7.0	breaking
enum_dispatch	0.3.13	0.3.13	0.3.13	current
equivalent	1.0.2	1.0.3	1.0.3	current
errno	0.3.14	0.3.14	0.3.14	current
etcetera	0.8.0	0.8.0	0.11.0	breaking
event-listener	5.4.2	5.4.2	5.4.2	current
eyre	0.6.14	0.6.14	0.6.14	current
fastrand	2.5.0	2.5.0	2.5.0	current
ff	0.14.0	0.14.0	0.14.0	current
fiat-crypto	0.2.9, 0.3.0	0.2.9, 0.3.0	0.3.0	breaking, current
filetime	0.2.29	0.2.29	0.2.29	current
find-msvc-tools	0.1.14	0.1.15	0.1.15	current
flate2	1.1.10	1.1.11	1.1.11	current
flume	0.11.1	0.11.1	0.12.0	breaking
fnv	1.0.7	1.0.7	1.0.7	current
foldhash	0.1.5	0.1.5	0.2.0	breaking
foreign-types	0.3.2	0.3.2	0.5.0	breaking
foreign-types-shared	0.1.1	0.1.1	0.3.1	breaking
form_urlencoded	1.2.2	1.2.2	1.2.2	current
fs-err	3.3.2	3.3.2	3.3.2	current
futures	0.3.34	0.3.34	0.3.34	current
futures-channel	0.3.34	0.3.34	0.3.34	current
futures-core	0.3.34	0.3.34	0.3.34	current
futures-executor	0.3.34	0.3.34	0.3.34	current
futures-intrusive	0.5.0	0.5.0	0.5.0	current
futures-io	0.3.34	0.3.34	0.3.34	current
futures-macro	0.3.34	0.3.34	0.3.34	current
futures-sink	0.3.34	0.3.34	0.3.34	current
futures-task	0.3.34	0.3.34	0.3.34	current
futures-util	0.3.34	0.3.34	0.3.34	current
generic-array	0.14.7, 1.4.5	0.14.7, 1.4.5	1.4.5	breaking, current
getrandom	0.2.17, 0.3.4, 0.4.3	0.2.17, 0.3.4, 0.4.3	0.4.3	breaking, current
ghash	0.5.1, 0.6.0	0.5.1, 0.6.0	0.6.0	breaking, current
gloo-timers	0.4.0	0.4.0	0.4.0	current
group	0.14.0	0.14.0	0.14.0	current
h2	0.4.19	0.4.20	0.4.20	current
half	2.7.1	2.7.1	2.7.1	current
hashbrown	0.14.5, 0.15.5, 0.17.1	0.14.5, 0.15.5, 0.17.1	0.17.1	breaking, current
hashlink	0.10.0	0.10.0	0.12.2	breaking
heck	0.5.0	0.5.0	0.5.0	current
hermit-abi	0.5.3	0.5.3	0.5.3	current
hex	0.4.3	0.4.3	0.4.3	current
hex-conservative	0.2.3	0.2.3	1.3.0	breaking
hex-literal	1.1.0	1.1.0	1.1.0	current
hickory-proto	0.26.3	0.26.3	0.26.3	current
hkdf	0.12.4, 0.13.0	0.12.4, 0.13.0	0.13.0	breaking, current
hmac	0.12.1, 0.13.0	0.12.1, 0.13.0	0.13.0	breaking, current
home	0.5.12	0.5.12	0.5.12	current
http	1.5.0	1.5.0	1.5.0	current
http-body	1.1.0	1.1.0	1.1.0	current
http-body-util	0.1.5	0.1.5	0.1.5	current
http-range-header	0.4.2	0.4.2	1.0.0	breaking
httparse	1.10.1	1.10.1	1.10.1	current
httpdate	1.0.3	1.0.3	1.0.3	current
hybrid-array	0.4.15	0.4.15	0.4.15	current
hyper	1.11.1	1.12.0	1.12.0	current
hyper-util	0.1.21	0.1.21	0.1.21	current
iana-time-zone	0.1.65	0.1.65	0.1.65	current
iana-time-zone-haiku	0.1.2	0.1.2	0.1.2	current
icu_collections	2.3.0	2.4.0	2.4.0	current
icu_locale_core	2.3.0	2.4.0	2.4.0	current
icu_normalizer	2.3.0	2.4.0	2.4.0	current
icu_normalizer_data	2.3.0	2.4.0	2.4.0	current
icu_properties	2.3.0	2.4.0	2.4.0	current
icu_properties_data	2.3.0	2.4.0	2.4.0	current
icu_provider	2.3.1	2.4.0	2.4.0	current
idna	1.1.0	1.1.0	1.1.0	current
idna_adapter	1.2.2	1.2.2	1.2.2	current
indenter	0.3.4	0.3.4	0.3.4	current
indexmap	2.14.2	2.14.2	2.14.2	current
inout	0.1.4, 0.2.5	0.1.4, 0.2.5	0.2.5	breaking, current
int-enum	1.2.0	1.3.0	1.3.0	current
ip_network	0.4.1	0.4.1	0.4.1	current
ip_network_table	0.2.0	0.2.0	0.2.0	current
ip_network_table-deps-treebitmap	0.5.0	0.5.0	0.5.0	current
ipnet	2.12.2	2.12.2	2.12.2	current
ipnetwork	0.21.1	0.21.1	0.21.1	current
is_terminal_polyfill	1.70.2	1.70.2	1.70.2	current
itertools	0.13.0	0.13.0	0.15.0	breaking
itoa	1.0.18	1.0.18	1.0.18	current
jni	0.22.4	0.22.4	0.22.4	current
jni-macros	0.22.4	0.22.4	0.22.4	current
jni-sys	0.4.1	0.4.1	0.4.1	current
jni-sys-macros	0.4.1	0.4.1	0.4.1	current
jobserver	0.1.35	0.1.35	0.1.35	current
js-sys	0.3.107	0.3.107	0.3.107	current
keccak	0.2.2	0.2.2	0.2.2	current
kem	0.3.0	0.3.0	0.3.0	current
lazy_static	1.5.1	1.5.1	1.5.1	current
libc	0.2.190	0.2.191	0.2.191	current
libfuzzer-sys	0.4.13	0.4.13	0.4.13	current
libghostty-vt	0.2.2	0.2.2	0.2.2	current
libghostty-vt-sys	0.2.2	0.2.2	0.2.2	current
libm	0.2.16	0.2.16	0.2.16	current
libredox	0.1.25	0.1.25	0.2.0	breaking
libsqlite3-sys	0.30.1	0.30.1	0.39.1	breaking
linux-raw-sys	0.12.1	0.12.1	0.12.1	current
litemap	0.8.3	0.8.3	0.8.3	current
lock_api	0.4.14	0.4.14	0.5.0	breaking
log	0.4.34	0.4.35	0.4.35	current
lru-slab	0.1.3	0.1.3	0.1.3	current
matchers	0.2.0	0.2.0	0.2.0	current
matchit	0.8.4	0.8.4	0.9.2	breaking
md-5	0.10.6	0.10.6	0.11.0	breaking
md5	0.8.1	0.8.1	0.8.1	current
memchr	2.8.3	2.8.3	2.8.3	current
memoffset	0.9.1	0.9.1	0.9.1	current
mime	0.3.17	0.3.18	0.3.18	current
mime_guess	2.0.5	2.0.5	2.0.5	current
minimal-lexical	0.2.1	0.2.1	0.2.1	current
miniz_oxide	0.9.1	0.9.1	0.9.1	current
mio	1.2.4	1.2.4	1.2.4	current
miow	0.6.1	0.6.1	0.6.1	current
ml-kem	0.3.4	0.3.4	0.3.4	current
module-lattice	0.2.4	0.2.4	0.2.4	current
nix	0.30.1, 0.31.3	0.31.3	0.31.3	current
nom	7.1.3	7.1.3	8.0.0	breaking
nu-ansi-term	0.50.3	0.50.3	0.50.3	current
num-bigint	0.4.8, 0.5.1	0.4.8, 0.5.1	0.5.1	breaking, current
num-bigint-dig	0.8.6	0.8.6	0.9.1	breaking
num-conv	0.2.2	0.2.2	0.2.2	current
num-integer	0.1.47	0.1.47	0.1.47	current
num-iter	0.1.46	0.1.46	0.1.46	current
num-traits	0.2.19	0.2.19	0.2.19	current
oid-registry	0.7.1	0.7.1	0.8.1	breaking
once_cell	1.21.4	1.21.4	1.21.4	current
once_cell_polyfill	1.70.2	1.70.2	1.70.2	current
oorandom	11.1.5	11.1.5	11.1.5	current
opaque-debug	0.3.1	0.3.1	0.4.0	breaking
openssl	0.10.81	0.10.82	0.10.82	current
openssl-macros	0.1.1	0.1.1	0.1.1	current
openssl-src	300.6.1+3.6.3	300.6.1+3.6.3	400.0.2+4.0.3	breaking
openssl-sys	0.9.117	0.9.118	0.9.118	current
p256	0.14.0	0.14.0	0.14.0	current
p384	0.14.0	0.14.0	0.14.0	current
p521	0.14.0	0.14.0	0.14.0	current
page_size	new	0.6.0	0.6.0	current
pageant	0.2.5	0.2.5	0.2.5	current
parking	2.2.1	2.2.1	2.2.1	current
parking_lot	0.12.5	0.12.5	0.13.0	breaking
parking_lot_core	0.9.12	0.9.12	0.10.0	breaking
password-hash	0.5.0, 0.6.1	0.5.0, 0.6.1	0.6.1	breaking, current
pastey	0.1.1	0.1.1	0.2.3	breaking
pbkdf2	0.13.0	0.13.0	0.13.0	current
pem-rfc7468	0.7.0, 1.0.0	0.7.0, 1.0.0	1.0.0	breaking, current
percent-encoding	2.3.2	2.3.2	2.3.2	current
phc	0.6.1	0.6.1	0.6.1	current
pin-project-lite	0.2.17	0.2.17	0.2.17	current
piper	0.2.5	0.2.5	0.2.5	current
pkcs1	0.7.5	0.7.5	0.8.0	breaking
pkcs5	0.8.1	0.8.1	0.8.1	current
pkcs8	0.10.2, 0.11.0	0.10.2, 0.11.0	0.11.0	breaking, current
pkg-config	0.3.34	0.3.34	0.3.34	current
plain	0.2.3	0.2.3	0.2.3	current
plotters	0.3.7	0.3.7	0.3.7	current
plotters-backend	0.3.7	0.3.7	0.3.7	current
plotters-svg	0.3.7	0.3.7	0.3.7	current
polling	3.11.0	3.11.0	3.11.0	current
poly1305	0.8.0, 0.9.1	0.8.0, 0.9.1	0.9.1	breaking, current
polyval	0.6.2, 0.7.3	0.6.2, 0.7.3	0.7.3	breaking, current
portable-atomic	1.15.0	1.15.0	1.15.0	current
potential_utf	0.1.6	0.1.6	0.1.6	current
powerfmt	0.2.1	0.2.1	0.2.1	current
ppv-lite86	0.2.21	0.2.21	0.2.21	current
primefield	0.14.0	0.14.0	0.14.0	current
primeorder	0.14.0	0.14.0	0.14.0	current
proc-macro2	1.0.107	1.0.107	1.0.107	current
proc-macro2-diagnostics	0.10.1	0.11.0	0.11.0	current
qrcodegen	1.8.0	1.8.0	1.8.0	current
quinn	0.11.12	0.11.12	0.11.12	current
quinn-proto	0.11.19	0.11.19	0.11.19	current
quinn-udp	0.5.16	0.5.16	0.6.3	breaking
quote	1.0.47	1.0.47	1.0.47	current
r-efi	5.3.0, 6.0.0	5.3.0, 6.0.0	7.1.0	breaking
rand	0.8.8, 0.9.5, 0.10.3	0.8.8, 0.9.5, 0.10.3	0.10.3	breaking, current
rand_chacha	0.3.1, 0.9.0	0.3.1, 0.9.0	0.10.0	breaking
rand_core	0.6.4, 0.9.5, 0.10.1	0.6.4, 0.9.5, 0.10.1	0.10.1	breaking, current
rand_pcg	0.10.2	0.10.2	0.10.2	current
rayon	1.12.0	1.12.0	1.12.0	current
rayon-core	1.13.0	1.13.0	1.13.0	current
redox_syscall	0.5.18, 0.9.4	0.5.18, 0.9.5	0.9.5	breaking, current
regex	1.13.1	1.13.1	1.13.1	current
regex-automata	0.4.18	0.4.18	0.4.18	current
regex-syntax	0.8.11	0.8.11	0.8.11	current
rfc6979	0.6.0	0.6.0	0.6.0	current
ring	0.17.14	0.17.14	0.17.14	current
rsa	0.9.10	0.9.10	0.9.10	current
russh-cryptovec	0.62.0	0.62.0	0.62.0	current
russh-util	0.52.0	0.52.0	0.52.0	current
rustc-hash	2.1.3	2.1.3	2.1.3	current
rustc_version	0.4.1	0.4.1	0.4.1	current
rusticata-macros	4.1.0	4.1.0	5.0.0	breaking
rustix	1.1.5	1.1.6	1.1.6	current
rustix-openpty	0.2.0	0.2.0	0.2.0	current
rustls	0.23.46	0.23.46	0.23.46	current
rustls-pki-types	1.15.1	1.15.1	1.15.1	current
rustls-webpki	0.103.16	0.103.16	0.103.16	current
rustversion	1.0.23	1.0.23	1.0.23	current
ryu	1.0.23	1.0.23	1.0.23	current
salsa20	0.11.0	0.11.0	0.11.0	current
same-file	1.0.6	1.0.6	1.0.6	current
scopeguard	1.2.0	1.2.0	1.2.0	current
screencapturekit	11.0.0	11.1.2	11.1.2	current
scrypt	0.12.0	0.12.0	0.12.0	current
sec1	0.8.1	0.8.1	0.8.1	current
security-framework	3.7.0	3.7.0	3.7.0	current
security-framework-sys	2.17.0	2.17.0	2.17.0	current
semver	1.0.28	1.0.28	1.0.28	current
serde	1.0.229	1.0.229	1.0.229	current
serde_bytes	0.11.19	0.11.19	0.11.19	current
serde_cbor_2	0.13.0	0.13.0	0.13.0	current
serde_core	1.0.229	1.0.229	1.0.229	current
serde_derive	1.0.229	1.0.229	1.0.229	current
serde_json	1.0.151	1.0.154	1.0.154	current
serde_path_to_error	0.1.20	0.1.20	0.1.20	current
serde_urlencoded	0.7.1	0.7.1	0.7.1	current
serdect	0.4.3	0.4.3	0.4.3	current
sha1	0.10.7, 0.11.0	0.10.7, 0.11.0	0.11.0	breaking, current
sha2	0.10.9, 0.11.1	0.10.9, 0.11.1	0.11.1	breaking, current
sha3	0.12.0	0.12.0	0.12.0	current
shake	0.1.0	0.1.0	0.1.0	current
sharded-slab	0.1.7	0.1.7	0.1.7	current
shlex	2.0.1	2.0.1	2.0.1	current
signal-hook	0.3.18	0.4.6	0.4.6	current
signal-hook-registry	1.4.8	1.4.8	1.4.8	current
signature	2.2.0, 3.0.0	2.2.0, 3.0.0	3.0.0	breaking, current
simd-adler32	0.3.10	0.3.10	0.3.10	current
simd_cesu8	1.2.0	1.2.0	1.2.0	current
simdutf8	0.1.5	0.1.5	0.1.5	current
slab	0.4.12	0.4.12	0.4.12	current
smallvec	1.16.2	1.16.5	1.16.5	current
socket2	0.6.5	0.6.5	0.6.5	current
spin	0.9.9	0.9.9	0.12.3	breaking
spki	0.7.3, 0.8.1	0.7.3, 0.8.1	0.8.1	breaking, current
sponge-cursor	0.1.0	0.1.0	0.1.0	current
sqlx	0.8.6	0.8.6	0.9.0	breaking
sqlx-core	0.8.6	0.8.6	0.9.0	breaking
sqlx-macros	0.8.6	0.8.6	0.9.0	breaking
sqlx-macros-core	0.8.6	0.8.6	0.9.0	breaking
sqlx-mysql	0.8.6	0.8.6	0.9.0	breaking
sqlx-postgres	0.8.6	0.8.6	0.9.0	breaking
sqlx-sqlite	0.8.6	0.8.6	0.9.0	breaking
ssh-cipher	0.3.0	0.3.0	0.3.0	current
ssh-encoding	0.3.0	0.3.0	0.3.0	current
ssh-key	0.7.0-rc.11	0.7.0-rc.11	0.6.7	ahead
stable_deref_trait	1.2.1	1.2.1	1.2.1	current
stringprep	0.1.5	0.1.5	0.1.5	current
strsim	0.11.1	0.11.1	0.11.1	current
subtle	2.6.1	2.6.1	2.6.1	current
syn	2.0.119, 3.0.6	2.0.119, 3.0.9	3.0.9	breaking, current
sync_wrapper	1.0.2	1.0.2	1.0.2	current
synstructure	0.13.2, 0.14.0	0.13.2, 0.14.0	0.14.0	breaking, current
sysctl	0.7.1	0.7.1	0.7.1	current
tar	0.4.46	0.4.46	0.4.46	current
thiserror	1.0.69, 2.0.21	1.0.69, 2.0.21	2.0.21	breaking, current
thiserror-impl	1.0.69, 2.0.21	1.0.69, 2.0.21	2.0.21	breaking, current
thread_local	1.1.10	1.1.10	1.1.10	current
time	0.3.55	0.3.55	0.3.55	current
time-core	0.1.9	0.1.9	0.1.9	current
time-macros	0.2.32	0.2.32	0.2.32	current
tinystr	0.8.4	0.8.5	0.8.5	current
tinytemplate	1.2.1	1.2.1	1.2.1	current
tinyvec	1.13.3	1.13.3	1.13.3	current
tokio	1.53.3	1.54.1	1.54.1	current
tokio-macros	2.7.2	2.7.2	2.7.2	current
tokio-openssl	0.6.5	0.6.5	0.6.5	current
tokio-stream	0.1.19	0.1.19	0.1.19	current
tokio-tungstenite	0.29.0	0.29.0	0.30.0	breaking
tokio-util	0.7.19	0.7.20	0.7.20	current
tower	0.5.3	0.5.3	0.5.3	current
tower-http	0.6.11	0.7.1	0.7.1	current
tower-layer	0.3.3	0.3.3	0.3.3	current
tower-service	0.3.3	0.3.3	0.3.3	current
tracing	0.1.44	0.1.44	0.1.44	current
tracing-attributes	0.1.31	0.1.31	0.1.31	current
tracing-core	0.1.36	0.1.36	0.1.36	current
tracing-log	0.2.0	0.2.0	0.2.0	current
tracing-serde	0.2.0	0.2.0	0.2.0	current
tracing-subscriber	0.3.23	0.3.23	0.3.23	current
try-lock	0.2.5	0.2.5	0.2.5	current
tungstenite	0.29.0	0.29.0	0.30.0	breaking
typed-builder	0.21.2	0.21.2	0.23.2	breaking
typed-builder-macro	0.21.2	0.21.2	0.23.2	breaking
typenum	1.20.1	1.20.1	1.20.1	current
unicase	2.10.0	2.10.0	2.10.0	current
unicode-bidi	0.3.18	0.3.18	0.3.18	current
unicode-ident	1.0.26	1.0.27	1.0.27	current
unicode-normalization	0.1.25	0.1.26	0.1.26	current
unicode-properties	0.1.4	0.1.5	0.1.5	current
unicode-width	0.2.2	0.2.3	0.2.3	current
universal-hash	0.5.1, 0.6.1	0.5.1, 0.6.1	0.6.1	breaking, current
untrusted	0.9.0	0.9.0	0.9.0	current
url	2.5.8	2.5.8	2.5.8	current
utf8_iter	1.0.4	1.1.0	1.1.0	current
utf8parse	0.2.2	0.2.2	0.2.2	current
utf_types	new	1.0.0	1.0.0	current
uuid	1.27.0	1.29.1	1.29.1	current
valuable	0.1.1	0.1.1	0.1.1	current
vcpkg	0.2.15	0.2.15	0.2.15	current
version_check	0.9.5	0.9.5	0.9.5	current
vt100	0.16.2	0.18.1	0.18.1	current
vte	0.15.0	0.15.0	0.15.0	current
walkdir	2.5.0	2.5.0	2.5.0	current
want	0.3.2	0.3.2	0.3.2	current
wasi	0.11.1+wasi-snapshot-preview1	0.11.1+wasi-snapshot-preview1	0.14.7+wasi-0.2.4	breaking
wasip2	1.0.4+wasi-0.2.12	1.0.4+wasi-0.2.12	2.0.1+wasi-0.2.12	breaking
wasite	0.1.0	0.1.0	1.0.2	breaking
wasm-bindgen	0.2.130	0.2.130	0.2.130	current
wasm-bindgen-futures	0.4.80	0.4.80	0.4.80	current
wasm-bindgen-macro	0.2.130	0.2.130	0.2.130	current
wasm-bindgen-macro-support	0.2.130	0.2.130	0.2.130	current
wasm-bindgen-shared	0.2.130	0.2.130	0.2.130	current
web-sys	0.3.107	0.3.107	0.3.107	current
web-time	1.1.0	1.1.0	1.1.0	current
webauthn-attestation-ca	0.5.5	0.5.5	0.6.2	breaking
webauthn-rs	0.5.5	0.5.5	0.6.2	breaking
webauthn-rs-core	0.5.5	0.5.5	0.6.2	breaking
webauthn-rs-proto	0.5.5	0.5.5	0.6.2	breaking
whoami	1.6.1	1.6.1	2.1.3	breaking
winapi	new	0.3.9	0.3.9	current
winapi-i686-pc-windows-gnu	new	0.4.0	0.4.0	current
winapi-util	0.1.11	0.1.11	0.1.11	current
winapi-x86_64-pc-windows-gnu	new	0.4.0	0.4.0	current
windows	0.62.2	0.62.2	0.62.2	current
windows-collections	0.3.2	0.3.2	0.100.0	breaking
windows-core	0.62.2	0.62.2	0.100.0	breaking
windows-future	0.3.2	0.3.2	0.100.0	breaking
windows-implement	0.60.2	0.60.2	0.100.0	breaking
windows-interface	0.59.3	0.59.3	0.100.0	breaking
windows-link	0.2.1	0.2.1	0.100.0	breaking
windows-numerics	0.3.1	0.3.1	0.100.0	breaking
windows-result	0.4.1	0.4.1	0.100.0	breaking
windows-strings	0.5.1	0.5.1	0.100.0	breaking
windows-sys	0.48.0, 0.52.0, 0.59.0, 0.61.2	0.48.0, 0.52.0, 0.59.0, 0.61.2	0.61.2	breaking, current
windows-targets	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.5	breaking
windows-threading	0.2.1	0.2.1	0.100.0	breaking
windows_aarch64_gnullvm	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
windows_aarch64_msvc	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
windows_i686_gnu	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
windows_i686_gnullvm	0.52.6	0.52.6	0.53.1	breaking
windows_i686_msvc	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
windows_x86_64_gnu	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
windows_x86_64_gnullvm	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
windows_x86_64_msvc	0.48.5, 0.52.6	0.48.5, 0.52.6	0.53.1	breaking
wit-bindgen	0.57.1	0.57.1	0.63.0	breaking
wnaf	0.14.1	0.14.1	0.14.1	current
writeable	0.6.4	0.6.4	0.6.4	current
x25519-dalek	2.0.1	2.0.1	3.0.0	breaking
x509-parser	0.16.0	0.16.0	0.18.1	breaking
xattr	1.6.1	1.7.0	1.7.0	current
yoke	0.8.3	0.8.4	0.8.4	current
yoke-derive	0.8.4	0.8.4	0.8.4	current
zerocopy	0.8.60	0.8.63	0.8.63	current
zerocopy-derive	0.8.60	0.8.63	0.8.63	current
zerofrom	0.1.8	0.1.8	0.1.8	current
zerofrom-derive	0.1.8	0.1.8	0.1.8	current
zeroize	1.9.0	1.9.1	1.9.1	current
zeroize_derive	1.5.0	1.5.0	1.5.0	current
zerotrie	0.2.5	0.2.5	0.2.5	current
zerovec	0.11.8	0.11.9	0.11.9	current
zerovec-derive	0.11.6	0.11.7	0.11.7	current
zlib-rs	0.6.8	0.6.8	0.6.8	current
zmij	1.0.23	1.0.23	1.0.23	current

Final direct JS manifest inventory:

package	manifest	current pin	latest stable	semver gap
@scure/bip39	apps/tracer/package.json	2.4.0	2.4.0	current
geist	apps/tracer/package.json	1.9.2	1.9.2	current
@types/bun	apps/tracer/package.json	1.4.4	1.4.4	current
@types/node	apps/tracer/package.json	26.6.6	26.6.6	current
@types/ws	apps/tracer/package.json	8.18.2	8.18.2	current
playwright	apps/tracer/package.json	1.65.0	1.65.0	current
typescript	apps/tracer/package.json	7.0.2	7.0.2	current
ws	apps/tracer/package.json	8.22.1	8.22.1	current
(no external dependencies)	apps/tracer/vendor/ghostty-web/package.json	—	—	current
(no external dependencies)	packages/protocol/package.json	—	—	current
(no external dependencies)	packages/ui/package.json	—	—	current
playwright	scripts/browser-auth/package.json	1.65.0	1.65.0	current
@scure/bip39	scripts/browser-auth/package.json	2.4.0	2.4.0	current
typescript (ephemeral CLI pin)	scripts/verify.d/ts.sh	7.0.2	7.0.2	current

Final complete JS lockfile inventory:

JS lockfile	package	locked version	latest stable	semver gap
apps/tracer/bun.lock	@emnapi/runtime	1.11.3	1.11.3	current
apps/tracer/bun.lock	@img/colour	1.1.0	1.1.0	current
apps/tracer/bun.lock	@img/sharp-darwin-arm64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-darwin-x64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-freebsd-wasm32	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-libvips-darwin-arm64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-darwin-x64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linux-arm64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linux-arm	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linux-ppc64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linux-riscv64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linux-s390x	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linux-x64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linuxmusl-arm64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-libvips-linuxmusl-x64	1.3.4	1.3.4	current
apps/tracer/bun.lock	@img/sharp-linux-arm64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linux-arm	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linux-ppc64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linux-riscv64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linux-s390x	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linux-x64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linuxmusl-arm64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-linuxmusl-x64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-wasm32	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-webcontainers-wasm32	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-win32-arm64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-win32-ia32	0.35.5	0.35.5	current
apps/tracer/bun.lock	@img/sharp-win32-x64	0.35.5	0.35.5	current
apps/tracer/bun.lock	@next/env	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-darwin-arm64	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-darwin-x64	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-linux-arm64-gnu	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-linux-arm64-musl	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-linux-x64-gnu	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-linux-x64-musl	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-win32-arm64-msvc	16.4.5	16.4.5	current
apps/tracer/bun.lock	@next/swc-win32-x64-msvc	16.4.5	16.4.5	current
apps/tracer/bun.lock	@noble/hashes	2.4.0	2.4.0	current
apps/tracer/bun.lock	@scure/bip39	2.4.0	2.4.0	current
apps/tracer/bun.lock	@swc/helpers	0.5.23	0.5.24	patch
apps/tracer/bun.lock	@types/bun	1.4.4	1.4.4	current
apps/tracer/bun.lock	@types/node	26.6.6	26.6.6	current
apps/tracer/bun.lock	@types/ws	8.18.2	8.18.2	current
apps/tracer/bun.lock	@typescript/typescript-aix-ppc64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-darwin-arm64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-darwin-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-freebsd-arm64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-freebsd-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-arm64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-arm	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-loong64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-mips64el	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-ppc64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-riscv64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-s390x	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-linux-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-netbsd-arm64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-netbsd-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-openbsd-arm64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-openbsd-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-sunos-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-win32-arm64	7.0.2	7.0.2	current
apps/tracer/bun.lock	@typescript/typescript-win32-x64	7.0.2	7.0.2	current
apps/tracer/bun.lock	baseline-browser-mapping	2.11.35	2.11.35	current
apps/tracer/bun.lock	bun-types	1.4.4	1.4.4	current
apps/tracer/bun.lock	caniuse-lite	1.0.30001823	1.0.30001823	current
apps/tracer/bun.lock	client-only	0.0.1	0.0.1	current
apps/tracer/bun.lock	detect-libc	2.1.2	2.1.2	current
apps/tracer/bun.lock	geist	1.9.2	1.9.2	current
apps/tracer/bun.lock	nanoid	3.3.20	6.0.2	breaking
apps/tracer/bun.lock	next	16.4.5	16.4.5	current
apps/tracer/bun.lock	picocolors	1.1.1	1.1.1	current
apps/tracer/bun.lock	playwright-core	1.65.0	1.65.0	current
apps/tracer/bun.lock	playwright	1.65.0	1.65.0	current
apps/tracer/bun.lock	postcss	8.5.23	8.5.32	patch
apps/tracer/bun.lock	react-dom	19.3.1	19.3.1	current
apps/tracer/bun.lock	react	19.3.1	19.3.1	current
apps/tracer/bun.lock	scheduler	0.28.0	0.28.0	current
apps/tracer/bun.lock	semver	7.8.6	7.8.6	current
apps/tracer/bun.lock	sharp	0.35.5	0.35.5	current
apps/tracer/bun.lock	source-map-js	1.2.2	1.2.2	current
apps/tracer/bun.lock	styled-jsx	5.1.6	5.1.7	patch
apps/tracer/bun.lock	tslib	2.9.1	2.9.1	current
apps/tracer/bun.lock	typescript	7.0.2	7.0.2	current
apps/tracer/bun.lock	undici-types	8.9.0	8.12.4	minor
apps/tracer/bun.lock	ws	8.22.1	8.22.1	current
scripts/browser-auth/bun.lock	@noble/hashes	2.4.0	2.4.0	current
scripts/browser-auth/bun.lock	@scure/bip39	2.4.0	2.4.0	current
scripts/browser-auth/bun.lock	playwright-core	1.65.0	1.65.0	current
scripts/browser-auth/bun.lock	playwright	1.65.0	1.65.0	current

Deferred updates and separate-job estimates:

deferred update	evidence and reason	separate-job estimate
SQLx 0.8.6 → 0.9.0	`SqlSafeStr` query changes and SQLiteValue Send/Sync changes touch recovery/migration code	1–2 days
axum-server 0.8 → 0.9	TLS accept-service API changes touch server_tls and its integration tests	0.5–1 day
argon2 0.5 → 0.6	password-hash 0.6 removes SaltString, requiring auth API changes	0.5–1 day
bip39 2 → 3	generation API requires WordCount in auth recovery	0.5 day
hkdf 0.12 → 0.13 and sha2 0.10 → 0.11	coordinated digest-trait migration in auth oracle; independent major commits would not build	0.5–1 day
webauthn-rs 0.5.5 → 0.6.2	upstream changes its crypto backend from OpenSSL to RustCrypto; owner foundational choice required	1–2 days after decision
base64 0.22 → 0.23	adds a third version while SQLx/transport retain 0.21 and 0.22, violating the no-new-duplicates requirement	coordinate parent upgrades
tokio-tungstenite 0.29 → 0.30	adds a second tungstenite pair while Axum 0.8 retains 0.29	0.5 day after parent upgrade
vendored russh 0.64.1 → 0.65.1	SSH security surface and repository audit patch require a separate migration	about 1 day
Zig 0.15.2 → 0.17.1	coupled to excluded libghostty-vt build; J339 owns that slice	coordinate with J339
CI checkout v4 → v7, cache v4 → v6, Node 22 → 26	action majors require Node 24 runtime; current Forgejo runner is offline, so no real workflow proof is available	0.5 day with runner online
openssl-src 300.6.1+3.6.3 → 400.0.2+4.0.3	latest openssl-sys still requires vendored source 300.x; no binding override in this refresh	0.5–1 day after upstream vendoring support
GotaTun upstream base	report only: 14 upstream commits behind, 19 fork commits ahead at the shipped pin	separate owner-scoped fork job
aes-gcm 0.10.3 → 0.11.1	new hybrid-array nonce constructors require TryFrom changes at auth/tests.rs:191,219; deferred under the security-sensitive-code rule	1–2 hours

J340 dependency refresh, final handoff. Branch `deps-refresh-340`; head `df9f92f863bd7109031424f8a0c7022509a06ce3`. No merge/deployment; issue stays open for the orchestrator. The 47 compatible Rust resolutions, JS patch/minor updates, approved OpenSSL security pair, Nix inputs/Rust patch, and individually reviewed safe majors are committed separately. `libghostty-vt`, native VT and Zig pins are untouched. Every batch has quick/deny/license/duplicate/static receipts on this issue. Full original/final/latest/semver Rust inventory is attached (470 registry names); the original complete inventory and corrected registry findings remain above. Parent-owned transitive major versions remain constrained rather than forcibly overridden. | batch | resulting version | x86 static delta, bytes | arm64 static delta, bytes | |---|---|---:|---:| | Rust compatible | 47 resolutions, including Tokio 1.54.1 | +112608 | +74320 | | JS patch/minor | all direct patch/minor pins current | 0 | 0 | | OpenSSL security | openssl 0.10.82 / openssl-sys 0.9.118 | +2112 | +5856 | | Nix / Rust patch | nixpkgs 6dadaf4375be; rust-overlay 74cebce67ef6; Rust 1.99.1; Bun 1.4.4 | +544 | +4480 | | ScreenCaptureKit compatible | 11.1.2 | 0 | 0 | | nix major | 0.31.3 | +1312 | -11456 | | Criterion major | 0.8.2 | 0 | 0 | | alacritty_terminal major | 0.26.0 | 0 | 0 | | tower-http major | 0.7.1 | +26368 | +35760 | | vt100 major | 0.18.1 | 0 | 0 | | rand major | 0.10.3 (already transitive) | +768 | -8448 | | TypeScript major | 7.0.2 | 0 | 0 | | Node types major | 26.6.6 | 0 | 0 | | Node development runtime major | 26.13.0 LTS | 0 | 0 | | Bun HTTP declarations major | undici-types 6.21 → existing 8.9 | 0 | 0 | | JS compatible transitives | Next 16.4.5, React 19.3.1, tslib 2.9.1 and support data | 0 | 0 | Dependency-only cumulative static delta on dev-02 before inherited dev rebases: **+143712 / +100512 bytes**, original **27779344 / 24988232** to **27923056 / 25088744**. The first rebase separately inherits **+5120 / +1952** bytes of dev code. Clean rebased parent and TypeScript candidate on dev-02 measured **27928176 / 25090696**, byte-identical. Compute-host clean parent and Node-types candidate are also byte-identical, **27928720 / 25093128**, delta **0/0** (comment84469). The host change adds **544 / 2432** relative to the earlier artifact recipe; that is not attributed to JS. Latest dev **21b3c84ce** additionally inherits #394 SSH source/UI changes: same-host inherited #394 source delta **+5024 / +3056 bytes**. Final Node24 parent/Node26 comparison and absolute sizes: **27,933,744 / 25,096,184 bytes**, byte-identical parent/candidate, delta **0/0** before the final Mac-fix rebase. The two remaining JS batches were then measured on dev-02 against a fresh same-host parent: **27,933,232 / 25,093,240 bytes**, unchanged SHA-256 and **0/0** delta for each. Those cross-host absolute differences are not attributed to JS; raw receipts are attached84807/84808. Final rebased sizes: **27,933,744 bytes x86 / 25,096,184 bytes aarch64** on compute01; both stripped static artifacts pass ELF/linkage/production-trust checks. Actual final SHA-256 receipts are attached; no byte-identity claim is made across the final rebase or between hosts. Rust duplicates improve **54 names / 60 excess versions → 53 / 59** at the nix major; every other batch preserves its starting count. No new duplicate versions or license expressions, no allowed-license expansion, no advisory suppressions. The npm declaration/license-set reports are attached per slice. Advisories: all five original Bun findings are fixed; final Bun audits both zero findings (86 tracer / 4 browser-auth packages in the Node runtime receipt). Rust audit checks 1422 advisories / 553 lockfile entries and still exits 1 solely for **rsa 0.9.10, RUSTSEC-2023-0071**, no fixed version; identical baseline, absent from the selected shipping graph. Fresh raw receipt is attached in comment 84403. Cargo-deny passes. Performance receipts are attached above: compatible Tokio/runtime/crypto trials overlap baseline. Approved OpenSSL p50/p99 medians **288/312 → 349/373 µs**, RSS **5304 → 5304 KiB** on rare enrollment/rotation operations; separate security commit records the memory-safety fixes and off-hot-path tradeoff. The planned Nix/Rust refresh recovers p50 **296 → 353 → 296**, p99 **312 → 375 → 316**, RSS **5300** throughout; exact binding/environment attribution remains a follow-up, no unsupported feature disabled. Native compiler metadata cannot distinguish the three environments (comment 84403). Additional source narrowing finds 15 named public-method groups used by the probe text-identical and unchanged feature maps; the new X509StoreContext cleanup is not directly invoked by this timed probe (comment 84647). This is not assembly/profiling attribution, and no new safe feature toggle was established. Nonshipping terminal oracles: alacritty median **93.02 → 91.86 MB/s**, RSS unchanged; vt100 **46.24 → 38.62 MB/s**, RSS **65848 → 15208 KiB**, snapshot **79.86 → 50.92 µs**, identical replay/cursor results and 31/31 real shim tests. The vt100 parse cost trades against lower memory and faster snapshots in the test oracle. Shipping terminal engine/pins are excluded. Tower/rand runtime and certificate trials overlap baseline. Six DPR2 production screenshots (desktop, 393px and 375px, ink/paper) and eight browser tests qualify the TypeScript declaration fixes. Selected screenshots/checks/batch and clean-parent binary comparison are attached in comment 84363; visual approval belongs to the orchestrator. The separate ephemeral protocol compiler pin is also 7.0.2 and explicitly passes without parser edits (comment84469). Node-only slices do not alter product source. The protocol-pin correction was folded into the TypeScript commit earlier (range-diff84469). The final dev rebase preserves all 16 dependency commits unchanged (range-diff84808). Temporary WIP/fixup commits are absent. Native Mac default CLI and desktop-feature release compile guards **PASS** with Rust 1.99.1 and the refreshed lock (`MAC_FINAL_CHECK_EXIT=0`, full log and input digests attached in comment 84737). The earlier `SockFlag::SOCK_CLOEXEC` failure was proved on baseline dev and fixed independently by the owner's commit `2c8fe3630`, now inherited through dev `6b1bdb81b`; no J340 login/auth workaround is included. Native input-digest match to final rebased Rust tree: **PASS, 1,229/1,229 tracked native input files match; zero differing files**. The completed build removed the Mac target and released its lock; there is no own Mac build process. Final worktree sync: **PASS, clean checkout at final head; `MAC_FINAL_SYNC_EXIT=0`, `MAC_TARGET_ABSENT`; receipt attached**. GotaTun report only: shipped fork pin 84b7bb28e385d57dfb80493e78202898fad24d1e has upstream base 1d46b779f5e0743f30a13cc2c325b8114b901fb9 (0.10.2); upstream 16937ec6219afbece5aa69ece91f41e12d04d3c5 is **14 commits ahead**, with **19 fork-only commits**. Fork base unchanged. Vendored russh-sftp is already 3.0.1 latest; browser ghostty-web 0.5.0-rc.0 is ahead of npm stable 0.4.0. Zig 0.15.2→0.17.1 remains J339's scope. CI node:22-bookworm, checkout@v4 and cache@v4 remain deferred: latest Node 26, checkout v7.0.1/cache v6.1.0 require real runner proof; current runner is offline. | Other dependency | Original | Final | Latest observed | Remaining gap | |---|---|---|---|---| | nixpkgs unstable | 885ba4d038f1 | 6dadaf4375be | 6dadaf4375be | current rolling revision | | rust-overlay | 96a0986b0486 | 74cebce67ef6 | 74cebce67ef6 | current rolling revision | | Rust toolchain | 1.99.0 | 1.99.1 | 1.99.1 | current | | Bun toolchain | inherited from original nixpkgs input | 1.4.4 | 1.4.4 | current | | Node dev-shell runtime | 24 series | 26.13.0 LTS | 26.13.0 LTS | current LTS | | Zig | 0.15.2 | 0.15.2 | 0.17.1 | two breaking 0.x series; J339 scope | | CI image | node:22-bookworm | node:22-bookworm | Node 26.13.0 LTS | major; offline runner blocks execution proof | | CI checkout action | v4 | v4 | v7.0.1 | major; offline runner | | CI cache action | v4 | v4 | v6.1.0 | major; offline runner | | vendored russh | 0.64.1 + audit patch | unchanged | 0.65.1 | breaking; separate SSH migration | | vendored russh-sftp | 3.0.1 | 3.0.1 | 3.0.1 | current | | browser ghostty-web | 0.5.0-rc.0 | unchanged | 0.4.0 stable | ahead of stable; excluded native VT unchanged | | GotaTun upstream base | 0.10.2 / 1d46b779 | unchanged | 16937ec6 | 14 behind / 19 fork-only; report only | Deferred security migrations, duplicate-blocked updates and estimates follow in the attached deferred table. Final `verify fast` output is quoted verbatim below; raw full log attached. Cleanup and remaining execution state **complete**: compute01 process inventories before/after removal are empty and `COMPUTE01_TARGET_CLEANED` is recorded. Dev-02 records `DEV02_TARGET_CLEANED`; Mac records `MAC_TARGET_ABSENT`. All own background work is finished; logs and measurement receipts remain outside targets. Diagnostic retries are preserved: the first auxiliary parent quick hit one ETXTBSY spawn failure in the unchanged proxy fixture (84537); a focused 1/1 plus complete 123/123 serial proxy rerun passed. Applying serial scheduling to the complete workspace then hit the unchanged 1500s unit-row timeout after 2213 passing lines (84611), without an assertion failure in that attempt. The final whole-branch gate uses four test workers within the existing limits. No fixture, security source, timeout or gate policy was changed; ETXTBSY attribution remains unproven. Remaining JS parent constraints: current Next exactly selects @swc/helpers 0.5.23, postcss 8.5.23 and styled-jsx 5.1.6; postcss requires nanoid ^3.3.16; @types/node requires undici-types ~8.9.0. These remain within parent ranges rather than introducing overrides or duplicated major lines. Refreshed full lockfile inventory is attached and follows below. The first final-head full gate on dev-02 **failed (exit 1)** in three rows; full raw log and final table are retained in84835. Privileged integration failed 18/101 cases; dev-02 lacks all four absolute iptables-nft/ip6tables-nft frontend/restore paths required by the unchanged implementation, while compute01 has them. The SSH streaming fixture also hit its bounded 30s wait with hashed=false, input progress 237568, staged bytes 0 and expected bytes 624481. A focused run on **unmodified dev with its original Cargo/flake locks and Rust 1.99.0 reproduces that exact failure**, proving a baseline dev-02 problem (84844). The shim PPU descriptor fallback test failed with EMFILE in the final-head run, but the complete baseline PPU suite passed **217/217, 20 ignored** with the same four workers; that intermittent failure's cause is unproven. A progress-tail statement that workspace tests had passed was explicitly withdrawn when the full table exposed these failures. No test, limit, gate or host-package workaround was applied. Final compute01 gate outcome: **PASS, `VERIFY_FAST_EXIT=0`**, all 24 Rust gate rows including 101/101 privileged integration cases. Subsequent compiler/startup checks, tracer (655 tests), connection (104), terminal-query/write-slice (17), and protocol (50) Bun suites also report zero failures; stream differential covers 239 streams / 25,599 schedules with zero divergences and desktop rejection differential 1,376 cases with zero divergences. Verbatim Rust gate table and final protocol-suite/exit excerpt follow. The complete unabridged `scripts/verify fast` log is attached as `final-verify-fast-compute01.log`. ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | PASS | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ 50 pass 0 fail 77253 expect() calls Ran 50 tests across 13 files. [17.50s] VERIFY_FAST_EXIT=0 ``` Full final Rust inventory (original/final/latest/semver gap): | Rust crate | Original versions | Final versions | Latest stable | Remaining semver gap | |---|---|---|---|---| | adler2 | 2.0.1 | 2.0.1 | 2.0.1 | current | | aead | 0.5.2, 0.6.1 | 0.5.2, 0.6.1 | 0.6.1 | breaking, current | | aes | 0.8.4, 0.9.3 | 0.8.4, 0.9.4 | 0.9.4 | breaking, current | | aes-gcm | 0.10.3, 0.11.1 | 0.10.3, 0.11.1 | 0.11.1 | breaking, current | | aho-corasick | 1.1.5 | 1.1.5 | 1.1.5 | current | | alacritty_terminal | 0.25.1 | 0.26.0 | 0.26.0 | current | | alloca | new | 0.4.0 | 0.4.0 | current | | allocator-api2 | 0.2.21 | 0.2.21 | 0.4.0 | breaking | | android_system_properties | 0.1.6 | 0.1.6 | 0.1.6 | current | | anes | 0.1.6 | 0.1.6 | 0.2.1 | breaking | | anstream | 1.0.0 | 1.0.0 | 1.0.0 | current | | anstyle | 1.0.14 | 1.0.14 | 1.0.14 | current | | anstyle-parse | 1.0.0 | 1.0.0 | 1.0.0 | current | | anstyle-query | 1.1.5 | 1.1.5 | 1.1.5 | current | | anstyle-wincon | 3.0.11 | 3.0.11 | 3.0.11 | current | | apple-cf | 0.11.7 | 0.11.7 | 0.11.7 | current | | apple-metal | 0.10.4 | 0.10.4 | 0.10.4 | current | | arbitrary | 1.4.2 | 1.5.0 | 1.5.0 | current | | arc-swap | 1.9.2 | 1.9.3 | 1.9.3 | current | | argon2 | 0.5.3, 0.6.0 | 0.5.3, 0.6.0 | 0.6.0 | breaking, current | | arrayvec | 0.7.8 | 0.7.8 | 0.7.8 | current | | asn1-rs | 0.6.2 | 0.6.2 | 0.7.2 | breaking | | asn1-rs-derive | 0.5.1 | 0.5.1 | 0.7.0 | breaking | | asn1-rs-impl | 0.2.0 | 0.2.0 | 0.3.0 | breaking | | atoi | 2.0.0 | 2.0.0 | 3.1.1 | breaking | | atomic-waker | 1.1.2 | 1.1.2 | 1.1.2 | current | | autocfg | 1.5.1 | 1.5.1 | 1.5.1 | current | | axum | 0.8.9 | 0.8.9 | 0.8.9 | current | | axum-core | 0.5.6 | 0.5.6 | 0.5.6 | current | | axum-server | 0.8.0 | 0.8.0 | 0.9.0 | breaking | | base16ct | 1.0.0 | 1.0.0 | 1.0.0 | current | | base64 | 0.21.7, 0.22.1 | 0.21.7, 0.22.1 | 0.23.1 | breaking | | base64ct | 1.8.3 | 1.8.3 | 1.8.3 | current | | base64urlsafedata | 0.5.5 | 0.5.5 | 0.6.2 | breaking | | bcrypt-pbkdf | 0.11.0 | 0.11.0 | 0.11.0 | current | | bip39 | 2.2.2 | 2.2.2 | 3.0.0 | breaking | | bitcoin_hashes | 0.14.101 | 0.14.101 | 1.2.0 | breaking | | bitfield-struct | 0.12.1 | 0.12.1 | 0.13.0 | breaking | | bitflags | 2.13.2 | 2.13.2 | 2.13.2 | current | | blake2 | 0.10.6, 0.11.0 | 0.10.6, 0.11.0 | 0.11.0 | breaking, current | | block-buffer | 0.10.4, 0.12.1 | 0.10.4, 0.12.1 | 0.12.1 | breaking, current | | block-padding | 0.4.2 | 0.4.2 | 0.4.2 | current | | blowfish | 0.10.0 | 0.10.0 | 0.10.0 | current | | bumpalo | 3.20.3 | 3.20.3 | 3.20.3 | current | | byteorder | 1.5.0 | 1.5.0 | 1.5.0 | current | | bytes | 1.12.1 | 1.12.1 | 1.12.1 | current | | cast | 0.3.0 | 0.3.0 | 0.3.0 | current | | cbc | 0.2.1 | 0.2.1 | 0.2.1 | current | | cc | 1.6.0 | 1.11.1 | 1.11.1 | current | | cfg-if | 1.0.5 | 1.0.5 | 1.0.5 | current | | cfg_aliases | 0.2.2 | 0.2.2 | 0.2.2 | current | | chacha20 | 0.9.1, 0.10.2 | 0.9.1, 0.10.2 | 0.10.2 | breaking, current | | chacha20poly1305 | 0.10.1 | 0.10.1 | 0.11.0 | breaking | | chrono | 0.4.45 | 0.4.45 | 0.4.45 | current | | ciborium | 0.2.2 | 0.2.2 | 0.2.2 | current | | ciborium-io | 0.2.2 | 0.2.2 | 0.2.2 | current | | ciborium-ll | 0.2.2 | 0.2.2 | 0.2.2 | current | | cipher | 0.4.4, 0.5.2 | 0.4.4, 0.5.2 | 0.5.2 | breaking, current | | clap | 4.6.7 | 4.6.7 | 4.6.7 | current | | clap_builder | 4.6.7 | 4.6.7 | 4.6.7 | current | | clap_derive | 4.6.7 | 4.6.7 | 4.6.7 | current | | clap_lex | 1.1.1 | 1.1.1 | 1.1.1 | current | | cmov | 0.5.4 | 0.5.4 | 0.5.4 | current | | colorchoice | 1.0.5 | 1.0.5 | 1.0.5 | current | | combine | 4.6.9 | 4.6.9 | 4.6.9 | current | | concurrent-queue | 2.5.0 | 2.5.0 | 2.5.0 | current | | const-oid | 0.9.6, 0.10.2 | 0.9.6, 0.10.2 | 0.10.2 | breaking, current | | constant_time_eq | 0.4.2 | 0.4.2 | 0.6.1 | breaking | | core-foundation | 0.10.1 | 0.10.1 | 0.10.1 | current | | core-foundation-sys | 0.8.7 | 0.8.7 | 0.8.7 | current | | cpubits | 0.1.1 | 0.1.1 | 0.1.1 | current | | cpufeatures | 0.2.17, 0.3.1 | 0.2.17, 0.3.1 | 0.3.1 | breaking, current | | crc | 3.4.0 | 3.4.0 | 3.4.0 | current | | crc-catalog | 2.5.0 | 2.5.0 | 2.5.0 | current | | crc32fast | 1.5.3 | 1.5.4 | 1.5.4 | current | | criterion | 0.7.0 | 0.8.2 | 0.8.2 | current | | criterion-plot | 0.6.0 | 0.8.2 | 0.8.2 | current | | critical-section | 1.2.0 | 1.2.0 | 1.2.0 | current | | crossbeam-deque | 0.8.8 | 0.8.8 | 0.8.8 | current | | crossbeam-epoch | 0.9.21 | 0.9.21 | 0.9.21 | current | | crossbeam-queue | 0.3.14 | 0.3.14 | 0.3.14 | current | | crossbeam-utils | 0.8.23 | 0.8.23 | 0.8.23 | current | | crunchy | 0.2.4 | 0.2.4 | 0.2.4 | current | | crypto-bigint | 0.7.10 | 0.7.10 | 0.7.10 | current | | crypto-common | 0.1.7, 0.2.2 | 0.1.7, 0.2.2 | 0.2.2 | breaking, current | | ctr | 0.9.2, 0.10.1 | 0.9.2, 0.10.1 | 0.10.1 | breaking, current | | ctutils | 0.4.7 | 0.4.8 | 0.4.8 | current | | cursor-icon | 1.2.0 | 1.2.0 | 1.2.0 | current | | curve25519-dalek | 4.1.3, 5.0.0 | 4.1.3, 5.0.0 | 5.0.0 | breaking, current | | curve25519-dalek-derive | 0.1.1 | 0.1.1 | 0.1.1 | current | | dashmap | 6.2.1 | 6.2.1 | 6.2.1 | current | | data-encoding | 2.11.1 | 2.11.1 | 2.11.1 | current | | delegate | 0.13.5 | 0.13.5 | 0.13.5 | current | | der | 0.7.10, 0.8.3 | 0.7.10, 0.8.3 | 0.8.3 | breaking, current | | der-parser | 9.0.0 | 9.0.0 | 10.0.0 | breaking | | deranged | 0.5.8 | 0.5.9 | 0.5.9 | current | | des | 0.9.0 | 0.9.0 | 0.9.0 | current | | digest | 0.10.7, 0.11.3 | 0.10.7, 0.11.3 | 0.11.3 | breaking, current | | displaydoc | 0.2.7 | 0.2.7 | 0.2.7 | current | | doom-fish-utils | 0.4.3 | 0.4.3 | 0.4.3 | current | | dotenvy | 0.15.7 | 0.15.7 | 0.15.7 | current | | duplicate | 2.0.1 | 2.0.1 | 2.0.1 | current | | ecdsa | 0.17.0 | 0.17.0 | 0.17.0 | current | | ed25519 | 3.0.0 | 3.0.0 | 3.0.0 | current | | ed25519-dalek | 3.0.0 | 3.0.0 | 3.0.0 | current | | either | 1.18.0 | 1.19.0 | 1.19.0 | current | | elliptic-curve | 0.14.3 | 0.14.3 | 0.14.3 | current | | enum-as-inner | 0.6.1 | 0.6.1 | 0.7.0 | breaking | | enum_dispatch | 0.3.13 | 0.3.13 | 0.3.13 | current | | equivalent | 1.0.2 | 1.0.3 | 1.0.3 | current | | errno | 0.3.14 | 0.3.14 | 0.3.14 | current | | etcetera | 0.8.0 | 0.8.0 | 0.11.0 | breaking | | event-listener | 5.4.2 | 5.4.2 | 5.4.2 | current | | eyre | 0.6.14 | 0.6.14 | 0.6.14 | current | | fastrand | 2.5.0 | 2.5.0 | 2.5.0 | current | | ff | 0.14.0 | 0.14.0 | 0.14.0 | current | | fiat-crypto | 0.2.9, 0.3.0 | 0.2.9, 0.3.0 | 0.3.0 | breaking, current | | filetime | 0.2.29 | 0.2.29 | 0.2.29 | current | | find-msvc-tools | 0.1.14 | 0.1.15 | 0.1.15 | current | | flate2 | 1.1.10 | 1.1.11 | 1.1.11 | current | | flume | 0.11.1 | 0.11.1 | 0.12.0 | breaking | | fnv | 1.0.7 | 1.0.7 | 1.0.7 | current | | foldhash | 0.1.5 | 0.1.5 | 0.2.0 | breaking | | foreign-types | 0.3.2 | 0.3.2 | 0.5.0 | breaking | | foreign-types-shared | 0.1.1 | 0.1.1 | 0.3.1 | breaking | | form_urlencoded | 1.2.2 | 1.2.2 | 1.2.2 | current | | fs-err | 3.3.2 | 3.3.2 | 3.3.2 | current | | futures | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-channel | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-core | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-executor | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-intrusive | 0.5.0 | 0.5.0 | 0.5.0 | current | | futures-io | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-macro | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-sink | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-task | 0.3.34 | 0.3.34 | 0.3.34 | current | | futures-util | 0.3.34 | 0.3.34 | 0.3.34 | current | | generic-array | 0.14.7, 1.4.5 | 0.14.7, 1.4.5 | 1.4.5 | breaking, current | | getrandom | 0.2.17, 0.3.4, 0.4.3 | 0.2.17, 0.3.4, 0.4.3 | 0.4.3 | breaking, current | | ghash | 0.5.1, 0.6.0 | 0.5.1, 0.6.0 | 0.6.0 | breaking, current | | gloo-timers | 0.4.0 | 0.4.0 | 0.4.0 | current | | group | 0.14.0 | 0.14.0 | 0.14.0 | current | | h2 | 0.4.19 | 0.4.20 | 0.4.20 | current | | half | 2.7.1 | 2.7.1 | 2.7.1 | current | | hashbrown | 0.14.5, 0.15.5, 0.17.1 | 0.14.5, 0.15.5, 0.17.1 | 0.17.1 | breaking, current | | hashlink | 0.10.0 | 0.10.0 | 0.12.2 | breaking | | heck | 0.5.0 | 0.5.0 | 0.5.0 | current | | hermit-abi | 0.5.3 | 0.5.3 | 0.5.3 | current | | hex | 0.4.3 | 0.4.3 | 0.4.3 | current | | hex-conservative | 0.2.3 | 0.2.3 | 1.3.0 | breaking | | hex-literal | 1.1.0 | 1.1.0 | 1.1.0 | current | | hickory-proto | 0.26.3 | 0.26.3 | 0.26.3 | current | | hkdf | 0.12.4, 0.13.0 | 0.12.4, 0.13.0 | 0.13.0 | breaking, current | | hmac | 0.12.1, 0.13.0 | 0.12.1, 0.13.0 | 0.13.0 | breaking, current | | home | 0.5.12 | 0.5.12 | 0.5.12 | current | | http | 1.5.0 | 1.5.0 | 1.5.0 | current | | http-body | 1.1.0 | 1.1.0 | 1.1.0 | current | | http-body-util | 0.1.5 | 0.1.5 | 0.1.5 | current | | http-range-header | 0.4.2 | 0.4.2 | 1.0.0 | breaking | | httparse | 1.10.1 | 1.10.1 | 1.10.1 | current | | httpdate | 1.0.3 | 1.0.3 | 1.0.3 | current | | hybrid-array | 0.4.15 | 0.4.15 | 0.4.15 | current | | hyper | 1.11.1 | 1.12.0 | 1.12.0 | current | | hyper-util | 0.1.21 | 0.1.21 | 0.1.21 | current | | iana-time-zone | 0.1.65 | 0.1.65 | 0.1.65 | current | | iana-time-zone-haiku | 0.1.2 | 0.1.2 | 0.1.2 | current | | icu_collections | 2.3.0 | 2.4.0 | 2.4.0 | current | | icu_locale_core | 2.3.0 | 2.4.0 | 2.4.0 | current | | icu_normalizer | 2.3.0 | 2.4.0 | 2.4.0 | current | | icu_normalizer_data | 2.3.0 | 2.4.0 | 2.4.0 | current | | icu_properties | 2.3.0 | 2.4.0 | 2.4.0 | current | | icu_properties_data | 2.3.0 | 2.4.0 | 2.4.0 | current | | icu_provider | 2.3.1 | 2.4.0 | 2.4.0 | current | | idna | 1.1.0 | 1.1.0 | 1.1.0 | current | | idna_adapter | 1.2.2 | 1.2.2 | 1.2.2 | current | | indenter | 0.3.4 | 0.3.4 | 0.3.4 | current | | indexmap | 2.14.2 | 2.14.2 | 2.14.2 | current | | inout | 0.1.4, 0.2.5 | 0.1.4, 0.2.5 | 0.2.5 | breaking, current | | int-enum | 1.2.0 | 1.3.0 | 1.3.0 | current | | ip_network | 0.4.1 | 0.4.1 | 0.4.1 | current | | ip_network_table | 0.2.0 | 0.2.0 | 0.2.0 | current | | ip_network_table-deps-treebitmap | 0.5.0 | 0.5.0 | 0.5.0 | current | | ipnet | 2.12.2 | 2.12.2 | 2.12.2 | current | | ipnetwork | 0.21.1 | 0.21.1 | 0.21.1 | current | | is_terminal_polyfill | 1.70.2 | 1.70.2 | 1.70.2 | current | | itertools | 0.13.0 | 0.13.0 | 0.15.0 | breaking | | itoa | 1.0.18 | 1.0.18 | 1.0.18 | current | | jni | 0.22.4 | 0.22.4 | 0.22.4 | current | | jni-macros | 0.22.4 | 0.22.4 | 0.22.4 | current | | jni-sys | 0.4.1 | 0.4.1 | 0.4.1 | current | | jni-sys-macros | 0.4.1 | 0.4.1 | 0.4.1 | current | | jobserver | 0.1.35 | 0.1.35 | 0.1.35 | current | | js-sys | 0.3.107 | 0.3.107 | 0.3.107 | current | | keccak | 0.2.2 | 0.2.2 | 0.2.2 | current | | kem | 0.3.0 | 0.3.0 | 0.3.0 | current | | lazy_static | 1.5.1 | 1.5.1 | 1.5.1 | current | | libc | 0.2.190 | 0.2.191 | 0.2.191 | current | | libfuzzer-sys | 0.4.13 | 0.4.13 | 0.4.13 | current | | libghostty-vt | 0.2.2 | 0.2.2 | 0.2.2 | current | | libghostty-vt-sys | 0.2.2 | 0.2.2 | 0.2.2 | current | | libm | 0.2.16 | 0.2.16 | 0.2.16 | current | | libredox | 0.1.25 | 0.1.25 | 0.2.0 | breaking | | libsqlite3-sys | 0.30.1 | 0.30.1 | 0.39.1 | breaking | | linux-raw-sys | 0.12.1 | 0.12.1 | 0.12.1 | current | | litemap | 0.8.3 | 0.8.3 | 0.8.3 | current | | lock_api | 0.4.14 | 0.4.14 | 0.5.0 | breaking | | log | 0.4.34 | 0.4.35 | 0.4.35 | current | | lru-slab | 0.1.3 | 0.1.3 | 0.1.3 | current | | matchers | 0.2.0 | 0.2.0 | 0.2.0 | current | | matchit | 0.8.4 | 0.8.4 | 0.9.2 | breaking | | md-5 | 0.10.6 | 0.10.6 | 0.11.0 | breaking | | md5 | 0.8.1 | 0.8.1 | 0.8.1 | current | | memchr | 2.8.3 | 2.8.3 | 2.8.3 | current | | memoffset | 0.9.1 | 0.9.1 | 0.9.1 | current | | mime | 0.3.17 | 0.3.18 | 0.3.18 | current | | mime_guess | 2.0.5 | 2.0.5 | 2.0.5 | current | | minimal-lexical | 0.2.1 | 0.2.1 | 0.2.1 | current | | miniz_oxide | 0.9.1 | 0.9.1 | 0.9.1 | current | | mio | 1.2.4 | 1.2.4 | 1.2.4 | current | | miow | 0.6.1 | 0.6.1 | 0.6.1 | current | | ml-kem | 0.3.4 | 0.3.4 | 0.3.4 | current | | module-lattice | 0.2.4 | 0.2.4 | 0.2.4 | current | | nix | 0.30.1, 0.31.3 | 0.31.3 | 0.31.3 | current | | nom | 7.1.3 | 7.1.3 | 8.0.0 | breaking | | nu-ansi-term | 0.50.3 | 0.50.3 | 0.50.3 | current | | num-bigint | 0.4.8, 0.5.1 | 0.4.8, 0.5.1 | 0.5.1 | breaking, current | | num-bigint-dig | 0.8.6 | 0.8.6 | 0.9.1 | breaking | | num-conv | 0.2.2 | 0.2.2 | 0.2.2 | current | | num-integer | 0.1.47 | 0.1.47 | 0.1.47 | current | | num-iter | 0.1.46 | 0.1.46 | 0.1.46 | current | | num-traits | 0.2.19 | 0.2.19 | 0.2.19 | current | | oid-registry | 0.7.1 | 0.7.1 | 0.8.1 | breaking | | once_cell | 1.21.4 | 1.21.4 | 1.21.4 | current | | once_cell_polyfill | 1.70.2 | 1.70.2 | 1.70.2 | current | | oorandom | 11.1.5 | 11.1.5 | 11.1.5 | current | | opaque-debug | 0.3.1 | 0.3.1 | 0.4.0 | breaking | | openssl | 0.10.81 | 0.10.82 | 0.10.82 | current | | openssl-macros | 0.1.1 | 0.1.1 | 0.1.1 | current | | openssl-src | 300.6.1+3.6.3 | 300.6.1+3.6.3 | 400.0.2+4.0.3 | breaking | | openssl-sys | 0.9.117 | 0.9.118 | 0.9.118 | current | | p256 | 0.14.0 | 0.14.0 | 0.14.0 | current | | p384 | 0.14.0 | 0.14.0 | 0.14.0 | current | | p521 | 0.14.0 | 0.14.0 | 0.14.0 | current | | page_size | new | 0.6.0 | 0.6.0 | current | | pageant | 0.2.5 | 0.2.5 | 0.2.5 | current | | parking | 2.2.1 | 2.2.1 | 2.2.1 | current | | parking_lot | 0.12.5 | 0.12.5 | 0.13.0 | breaking | | parking_lot_core | 0.9.12 | 0.9.12 | 0.10.0 | breaking | | password-hash | 0.5.0, 0.6.1 | 0.5.0, 0.6.1 | 0.6.1 | breaking, current | | pastey | 0.1.1 | 0.1.1 | 0.2.3 | breaking | | pbkdf2 | 0.13.0 | 0.13.0 | 0.13.0 | current | | pem-rfc7468 | 0.7.0, 1.0.0 | 0.7.0, 1.0.0 | 1.0.0 | breaking, current | | percent-encoding | 2.3.2 | 2.3.2 | 2.3.2 | current | | phc | 0.6.1 | 0.6.1 | 0.6.1 | current | | pin-project-lite | 0.2.17 | 0.2.17 | 0.2.17 | current | | piper | 0.2.5 | 0.2.5 | 0.2.5 | current | | pkcs1 | 0.7.5 | 0.7.5 | 0.8.0 | breaking | | pkcs5 | 0.8.1 | 0.8.1 | 0.8.1 | current | | pkcs8 | 0.10.2, 0.11.0 | 0.10.2, 0.11.0 | 0.11.0 | breaking, current | | pkg-config | 0.3.34 | 0.3.34 | 0.3.34 | current | | plain | 0.2.3 | 0.2.3 | 0.2.3 | current | | plotters | 0.3.7 | 0.3.7 | 0.3.7 | current | | plotters-backend | 0.3.7 | 0.3.7 | 0.3.7 | current | | plotters-svg | 0.3.7 | 0.3.7 | 0.3.7 | current | | polling | 3.11.0 | 3.11.0 | 3.11.0 | current | | poly1305 | 0.8.0, 0.9.1 | 0.8.0, 0.9.1 | 0.9.1 | breaking, current | | polyval | 0.6.2, 0.7.3 | 0.6.2, 0.7.3 | 0.7.3 | breaking, current | | portable-atomic | 1.15.0 | 1.15.0 | 1.15.0 | current | | potential_utf | 0.1.6 | 0.1.6 | 0.1.6 | current | | powerfmt | 0.2.1 | 0.2.1 | 0.2.1 | current | | ppv-lite86 | 0.2.21 | 0.2.21 | 0.2.21 | current | | primefield | 0.14.0 | 0.14.0 | 0.14.0 | current | | primeorder | 0.14.0 | 0.14.0 | 0.14.0 | current | | proc-macro2 | 1.0.107 | 1.0.107 | 1.0.107 | current | | proc-macro2-diagnostics | 0.10.1 | 0.11.0 | 0.11.0 | current | | qrcodegen | 1.8.0 | 1.8.0 | 1.8.0 | current | | quinn | 0.11.12 | 0.11.12 | 0.11.12 | current | | quinn-proto | 0.11.19 | 0.11.19 | 0.11.19 | current | | quinn-udp | 0.5.16 | 0.5.16 | 0.6.3 | breaking | | quote | 1.0.47 | 1.0.47 | 1.0.47 | current | | r-efi | 5.3.0, 6.0.0 | 5.3.0, 6.0.0 | 7.1.0 | breaking | | rand | 0.8.8, 0.9.5, 0.10.3 | 0.8.8, 0.9.5, 0.10.3 | 0.10.3 | breaking, current | | rand_chacha | 0.3.1, 0.9.0 | 0.3.1, 0.9.0 | 0.10.0 | breaking | | rand_core | 0.6.4, 0.9.5, 0.10.1 | 0.6.4, 0.9.5, 0.10.1 | 0.10.1 | breaking, current | | rand_pcg | 0.10.2 | 0.10.2 | 0.10.2 | current | | rayon | 1.12.0 | 1.12.0 | 1.12.0 | current | | rayon-core | 1.13.0 | 1.13.0 | 1.13.0 | current | | redox_syscall | 0.5.18, 0.9.4 | 0.5.18, 0.9.5 | 0.9.5 | breaking, current | | regex | 1.13.1 | 1.13.1 | 1.13.1 | current | | regex-automata | 0.4.18 | 0.4.18 | 0.4.18 | current | | regex-syntax | 0.8.11 | 0.8.11 | 0.8.11 | current | | rfc6979 | 0.6.0 | 0.6.0 | 0.6.0 | current | | ring | 0.17.14 | 0.17.14 | 0.17.14 | current | | rsa | 0.9.10 | 0.9.10 | 0.9.10 | current | | russh-cryptovec | 0.62.0 | 0.62.0 | 0.62.0 | current | | russh-util | 0.52.0 | 0.52.0 | 0.52.0 | current | | rustc-hash | 2.1.3 | 2.1.3 | 2.1.3 | current | | rustc_version | 0.4.1 | 0.4.1 | 0.4.1 | current | | rusticata-macros | 4.1.0 | 4.1.0 | 5.0.0 | breaking | | rustix | 1.1.5 | 1.1.6 | 1.1.6 | current | | rustix-openpty | 0.2.0 | 0.2.0 | 0.2.0 | current | | rustls | 0.23.46 | 0.23.46 | 0.23.46 | current | | rustls-pki-types | 1.15.1 | 1.15.1 | 1.15.1 | current | | rustls-webpki | 0.103.16 | 0.103.16 | 0.103.16 | current | | rustversion | 1.0.23 | 1.0.23 | 1.0.23 | current | | ryu | 1.0.23 | 1.0.23 | 1.0.23 | current | | salsa20 | 0.11.0 | 0.11.0 | 0.11.0 | current | | same-file | 1.0.6 | 1.0.6 | 1.0.6 | current | | scopeguard | 1.2.0 | 1.2.0 | 1.2.0 | current | | screencapturekit | 11.0.0 | 11.1.2 | 11.1.2 | current | | scrypt | 0.12.0 | 0.12.0 | 0.12.0 | current | | sec1 | 0.8.1 | 0.8.1 | 0.8.1 | current | | security-framework | 3.7.0 | 3.7.0 | 3.7.0 | current | | security-framework-sys | 2.17.0 | 2.17.0 | 2.17.0 | current | | semver | 1.0.28 | 1.0.28 | 1.0.28 | current | | serde | 1.0.229 | 1.0.229 | 1.0.229 | current | | serde_bytes | 0.11.19 | 0.11.19 | 0.11.19 | current | | serde_cbor_2 | 0.13.0 | 0.13.0 | 0.13.0 | current | | serde_core | 1.0.229 | 1.0.229 | 1.0.229 | current | | serde_derive | 1.0.229 | 1.0.229 | 1.0.229 | current | | serde_json | 1.0.151 | 1.0.154 | 1.0.154 | current | | serde_path_to_error | 0.1.20 | 0.1.20 | 0.1.20 | current | | serde_urlencoded | 0.7.1 | 0.7.1 | 0.7.1 | current | | serdect | 0.4.3 | 0.4.3 | 0.4.3 | current | | sha1 | 0.10.7, 0.11.0 | 0.10.7, 0.11.0 | 0.11.0 | breaking, current | | sha2 | 0.10.9, 0.11.1 | 0.10.9, 0.11.1 | 0.11.1 | breaking, current | | sha3 | 0.12.0 | 0.12.0 | 0.12.0 | current | | shake | 0.1.0 | 0.1.0 | 0.1.0 | current | | sharded-slab | 0.1.7 | 0.1.7 | 0.1.7 | current | | shlex | 2.0.1 | 2.0.1 | 2.0.1 | current | | signal-hook | 0.3.18 | 0.4.6 | 0.4.6 | current | | signal-hook-registry | 1.4.8 | 1.4.8 | 1.4.8 | current | | signature | 2.2.0, 3.0.0 | 2.2.0, 3.0.0 | 3.0.0 | breaking, current | | simd-adler32 | 0.3.10 | 0.3.10 | 0.3.10 | current | | simd_cesu8 | 1.2.0 | 1.2.0 | 1.2.0 | current | | simdutf8 | 0.1.5 | 0.1.5 | 0.1.5 | current | | slab | 0.4.12 | 0.4.12 | 0.4.12 | current | | smallvec | 1.16.2 | 1.16.5 | 1.16.5 | current | | socket2 | 0.6.5 | 0.6.5 | 0.6.5 | current | | spin | 0.9.9 | 0.9.9 | 0.12.3 | breaking | | spki | 0.7.3, 0.8.1 | 0.7.3, 0.8.1 | 0.8.1 | breaking, current | | sponge-cursor | 0.1.0 | 0.1.0 | 0.1.0 | current | | sqlx | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | sqlx-core | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | sqlx-macros | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | sqlx-macros-core | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | sqlx-mysql | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | sqlx-postgres | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | sqlx-sqlite | 0.8.6 | 0.8.6 | 0.9.0 | breaking | | ssh-cipher | 0.3.0 | 0.3.0 | 0.3.0 | current | | ssh-encoding | 0.3.0 | 0.3.0 | 0.3.0 | current | | ssh-key | 0.7.0-rc.11 | 0.7.0-rc.11 | 0.6.7 | ahead | | stable_deref_trait | 1.2.1 | 1.2.1 | 1.2.1 | current | | stringprep | 0.1.5 | 0.1.5 | 0.1.5 | current | | strsim | 0.11.1 | 0.11.1 | 0.11.1 | current | | subtle | 2.6.1 | 2.6.1 | 2.6.1 | current | | syn | 2.0.119, 3.0.6 | 2.0.119, 3.0.9 | 3.0.9 | breaking, current | | sync_wrapper | 1.0.2 | 1.0.2 | 1.0.2 | current | | synstructure | 0.13.2, 0.14.0 | 0.13.2, 0.14.0 | 0.14.0 | breaking, current | | sysctl | 0.7.1 | 0.7.1 | 0.7.1 | current | | tar | 0.4.46 | 0.4.46 | 0.4.46 | current | | thiserror | 1.0.69, 2.0.21 | 1.0.69, 2.0.21 | 2.0.21 | breaking, current | | thiserror-impl | 1.0.69, 2.0.21 | 1.0.69, 2.0.21 | 2.0.21 | breaking, current | | thread_local | 1.1.10 | 1.1.10 | 1.1.10 | current | | time | 0.3.55 | 0.3.55 | 0.3.55 | current | | time-core | 0.1.9 | 0.1.9 | 0.1.9 | current | | time-macros | 0.2.32 | 0.2.32 | 0.2.32 | current | | tinystr | 0.8.4 | 0.8.5 | 0.8.5 | current | | tinytemplate | 1.2.1 | 1.2.1 | 1.2.1 | current | | tinyvec | 1.13.3 | 1.13.3 | 1.13.3 | current | | tokio | 1.53.3 | 1.54.1 | 1.54.1 | current | | tokio-macros | 2.7.2 | 2.7.2 | 2.7.2 | current | | tokio-openssl | 0.6.5 | 0.6.5 | 0.6.5 | current | | tokio-stream | 0.1.19 | 0.1.19 | 0.1.19 | current | | tokio-tungstenite | 0.29.0 | 0.29.0 | 0.30.0 | breaking | | tokio-util | 0.7.19 | 0.7.20 | 0.7.20 | current | | tower | 0.5.3 | 0.5.3 | 0.5.3 | current | | tower-http | 0.6.11 | 0.7.1 | 0.7.1 | current | | tower-layer | 0.3.3 | 0.3.3 | 0.3.3 | current | | tower-service | 0.3.3 | 0.3.3 | 0.3.3 | current | | tracing | 0.1.44 | 0.1.44 | 0.1.44 | current | | tracing-attributes | 0.1.31 | 0.1.31 | 0.1.31 | current | | tracing-core | 0.1.36 | 0.1.36 | 0.1.36 | current | | tracing-log | 0.2.0 | 0.2.0 | 0.2.0 | current | | tracing-serde | 0.2.0 | 0.2.0 | 0.2.0 | current | | tracing-subscriber | 0.3.23 | 0.3.23 | 0.3.23 | current | | try-lock | 0.2.5 | 0.2.5 | 0.2.5 | current | | tungstenite | 0.29.0 | 0.29.0 | 0.30.0 | breaking | | typed-builder | 0.21.2 | 0.21.2 | 0.23.2 | breaking | | typed-builder-macro | 0.21.2 | 0.21.2 | 0.23.2 | breaking | | typenum | 1.20.1 | 1.20.1 | 1.20.1 | current | | unicase | 2.10.0 | 2.10.0 | 2.10.0 | current | | unicode-bidi | 0.3.18 | 0.3.18 | 0.3.18 | current | | unicode-ident | 1.0.26 | 1.0.27 | 1.0.27 | current | | unicode-normalization | 0.1.25 | 0.1.26 | 0.1.26 | current | | unicode-properties | 0.1.4 | 0.1.5 | 0.1.5 | current | | unicode-width | 0.2.2 | 0.2.3 | 0.2.3 | current | | universal-hash | 0.5.1, 0.6.1 | 0.5.1, 0.6.1 | 0.6.1 | breaking, current | | untrusted | 0.9.0 | 0.9.0 | 0.9.0 | current | | url | 2.5.8 | 2.5.8 | 2.5.8 | current | | utf8_iter | 1.0.4 | 1.1.0 | 1.1.0 | current | | utf8parse | 0.2.2 | 0.2.2 | 0.2.2 | current | | utf_types | new | 1.0.0 | 1.0.0 | current | | uuid | 1.27.0 | 1.29.1 | 1.29.1 | current | | valuable | 0.1.1 | 0.1.1 | 0.1.1 | current | | vcpkg | 0.2.15 | 0.2.15 | 0.2.15 | current | | version_check | 0.9.5 | 0.9.5 | 0.9.5 | current | | vt100 | 0.16.2 | 0.18.1 | 0.18.1 | current | | vte | 0.15.0 | 0.15.0 | 0.15.0 | current | | walkdir | 2.5.0 | 2.5.0 | 2.5.0 | current | | want | 0.3.2 | 0.3.2 | 0.3.2 | current | | wasi | 0.11.1+wasi-snapshot-preview1 | 0.11.1+wasi-snapshot-preview1 | 0.14.7+wasi-0.2.4 | breaking | | wasip2 | 1.0.4+wasi-0.2.12 | 1.0.4+wasi-0.2.12 | 2.0.1+wasi-0.2.12 | breaking | | wasite | 0.1.0 | 0.1.0 | 1.0.2 | breaking | | wasm-bindgen | 0.2.130 | 0.2.130 | 0.2.130 | current | | wasm-bindgen-futures | 0.4.80 | 0.4.80 | 0.4.80 | current | | wasm-bindgen-macro | 0.2.130 | 0.2.130 | 0.2.130 | current | | wasm-bindgen-macro-support | 0.2.130 | 0.2.130 | 0.2.130 | current | | wasm-bindgen-shared | 0.2.130 | 0.2.130 | 0.2.130 | current | | web-sys | 0.3.107 | 0.3.107 | 0.3.107 | current | | web-time | 1.1.0 | 1.1.0 | 1.1.0 | current | | webauthn-attestation-ca | 0.5.5 | 0.5.5 | 0.6.2 | breaking | | webauthn-rs | 0.5.5 | 0.5.5 | 0.6.2 | breaking | | webauthn-rs-core | 0.5.5 | 0.5.5 | 0.6.2 | breaking | | webauthn-rs-proto | 0.5.5 | 0.5.5 | 0.6.2 | breaking | | whoami | 1.6.1 | 1.6.1 | 2.1.3 | breaking | | winapi | new | 0.3.9 | 0.3.9 | current | | winapi-i686-pc-windows-gnu | new | 0.4.0 | 0.4.0 | current | | winapi-util | 0.1.11 | 0.1.11 | 0.1.11 | current | | winapi-x86_64-pc-windows-gnu | new | 0.4.0 | 0.4.0 | current | | windows | 0.62.2 | 0.62.2 | 0.62.2 | current | | windows-collections | 0.3.2 | 0.3.2 | 0.100.0 | breaking | | windows-core | 0.62.2 | 0.62.2 | 0.100.0 | breaking | | windows-future | 0.3.2 | 0.3.2 | 0.100.0 | breaking | | windows-implement | 0.60.2 | 0.60.2 | 0.100.0 | breaking | | windows-interface | 0.59.3 | 0.59.3 | 0.100.0 | breaking | | windows-link | 0.2.1 | 0.2.1 | 0.100.0 | breaking | | windows-numerics | 0.3.1 | 0.3.1 | 0.100.0 | breaking | | windows-result | 0.4.1 | 0.4.1 | 0.100.0 | breaking | | windows-strings | 0.5.1 | 0.5.1 | 0.100.0 | breaking | | windows-sys | 0.48.0, 0.52.0, 0.59.0, 0.61.2 | 0.48.0, 0.52.0, 0.59.0, 0.61.2 | 0.61.2 | breaking, current | | windows-targets | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.5 | breaking | | windows-threading | 0.2.1 | 0.2.1 | 0.100.0 | breaking | | windows_aarch64_gnullvm | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | windows_aarch64_msvc | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | windows_i686_gnu | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | windows_i686_gnullvm | 0.52.6 | 0.52.6 | 0.53.1 | breaking | | windows_i686_msvc | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | windows_x86_64_gnu | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | windows_x86_64_gnullvm | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | windows_x86_64_msvc | 0.48.5, 0.52.6 | 0.48.5, 0.52.6 | 0.53.1 | breaking | | wit-bindgen | 0.57.1 | 0.57.1 | 0.63.0 | breaking | | wnaf | 0.14.1 | 0.14.1 | 0.14.1 | current | | writeable | 0.6.4 | 0.6.4 | 0.6.4 | current | | x25519-dalek | 2.0.1 | 2.0.1 | 3.0.0 | breaking | | x509-parser | 0.16.0 | 0.16.0 | 0.18.1 | breaking | | xattr | 1.6.1 | 1.7.0 | 1.7.0 | current | | yoke | 0.8.3 | 0.8.4 | 0.8.4 | current | | yoke-derive | 0.8.4 | 0.8.4 | 0.8.4 | current | | zerocopy | 0.8.60 | 0.8.63 | 0.8.63 | current | | zerocopy-derive | 0.8.60 | 0.8.63 | 0.8.63 | current | | zerofrom | 0.1.8 | 0.1.8 | 0.1.8 | current | | zerofrom-derive | 0.1.8 | 0.1.8 | 0.1.8 | current | | zeroize | 1.9.0 | 1.9.1 | 1.9.1 | current | | zeroize_derive | 1.5.0 | 1.5.0 | 1.5.0 | current | | zerotrie | 0.2.5 | 0.2.5 | 0.2.5 | current | | zerovec | 0.11.8 | 0.11.9 | 0.11.9 | current | | zerovec-derive | 0.11.6 | 0.11.7 | 0.11.7 | current | | zlib-rs | 0.6.8 | 0.6.8 | 0.6.8 | current | | zmij | 1.0.23 | 1.0.23 | 1.0.23 | current | Final direct JS manifest inventory: | package | manifest | current pin | latest stable | semver gap | |---|---|---|---|---| | @scure/bip39 | apps/tracer/package.json | 2.4.0 | 2.4.0 | current | | geist | apps/tracer/package.json | 1.9.2 | 1.9.2 | current | | @types/bun | apps/tracer/package.json | 1.4.4 | 1.4.4 | current | | @types/node | apps/tracer/package.json | 26.6.6 | 26.6.6 | current | | @types/ws | apps/tracer/package.json | 8.18.2 | 8.18.2 | current | | playwright | apps/tracer/package.json | 1.65.0 | 1.65.0 | current | | typescript | apps/tracer/package.json | 7.0.2 | 7.0.2 | current | | ws | apps/tracer/package.json | 8.22.1 | 8.22.1 | current | | (no external dependencies) | apps/tracer/vendor/ghostty-web/package.json | — | — | current | | (no external dependencies) | packages/protocol/package.json | — | — | current | | (no external dependencies) | packages/ui/package.json | — | — | current | | playwright | scripts/browser-auth/package.json | 1.65.0 | 1.65.0 | current | | @scure/bip39 | scripts/browser-auth/package.json | 2.4.0 | 2.4.0 | current | | typescript (ephemeral CLI pin) | scripts/verify.d/ts.sh | 7.0.2 | 7.0.2 | current | Final complete JS lockfile inventory: | JS lockfile | package | locked version | latest stable | semver gap | |---|---|---|---|---| | apps/tracer/bun.lock | @emnapi/runtime | 1.11.3 | 1.11.3 | current | | apps/tracer/bun.lock | @img/colour | 1.1.0 | 1.1.0 | current | | apps/tracer/bun.lock | @img/sharp-darwin-arm64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-darwin-x64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-freebsd-wasm32 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-libvips-darwin-arm64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-darwin-x64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linux-arm64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linux-arm | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linux-ppc64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linux-riscv64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linux-s390x | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linux-x64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linuxmusl-arm64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-libvips-linuxmusl-x64 | 1.3.4 | 1.3.4 | current | | apps/tracer/bun.lock | @img/sharp-linux-arm64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linux-arm | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linux-ppc64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linux-riscv64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linux-s390x | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linux-x64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linuxmusl-arm64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-linuxmusl-x64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-wasm32 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-webcontainers-wasm32 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-win32-arm64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-win32-ia32 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @img/sharp-win32-x64 | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | @next/env | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-darwin-arm64 | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-darwin-x64 | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-linux-arm64-gnu | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-linux-arm64-musl | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-linux-x64-gnu | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-linux-x64-musl | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-win32-arm64-msvc | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @next/swc-win32-x64-msvc | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | @noble/hashes | 2.4.0 | 2.4.0 | current | | apps/tracer/bun.lock | @scure/bip39 | 2.4.0 | 2.4.0 | current | | apps/tracer/bun.lock | @swc/helpers | 0.5.23 | 0.5.24 | patch | | apps/tracer/bun.lock | @types/bun | 1.4.4 | 1.4.4 | current | | apps/tracer/bun.lock | @types/node | 26.6.6 | 26.6.6 | current | | apps/tracer/bun.lock | @types/ws | 8.18.2 | 8.18.2 | current | | apps/tracer/bun.lock | @typescript/typescript-aix-ppc64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-darwin-arm64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-darwin-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-freebsd-arm64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-freebsd-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-arm64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-arm | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-loong64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-mips64el | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-ppc64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-riscv64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-s390x | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-linux-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-netbsd-arm64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-netbsd-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-openbsd-arm64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-openbsd-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-sunos-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-win32-arm64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | @typescript/typescript-win32-x64 | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | baseline-browser-mapping | 2.11.35 | 2.11.35 | current | | apps/tracer/bun.lock | bun-types | 1.4.4 | 1.4.4 | current | | apps/tracer/bun.lock | caniuse-lite | 1.0.30001823 | 1.0.30001823 | current | | apps/tracer/bun.lock | client-only | 0.0.1 | 0.0.1 | current | | apps/tracer/bun.lock | detect-libc | 2.1.2 | 2.1.2 | current | | apps/tracer/bun.lock | geist | 1.9.2 | 1.9.2 | current | | apps/tracer/bun.lock | nanoid | 3.3.20 | 6.0.2 | breaking | | apps/tracer/bun.lock | next | 16.4.5 | 16.4.5 | current | | apps/tracer/bun.lock | picocolors | 1.1.1 | 1.1.1 | current | | apps/tracer/bun.lock | playwright-core | 1.65.0 | 1.65.0 | current | | apps/tracer/bun.lock | playwright | 1.65.0 | 1.65.0 | current | | apps/tracer/bun.lock | postcss | 8.5.23 | 8.5.32 | patch | | apps/tracer/bun.lock | react-dom | 19.3.1 | 19.3.1 | current | | apps/tracer/bun.lock | react | 19.3.1 | 19.3.1 | current | | apps/tracer/bun.lock | scheduler | 0.28.0 | 0.28.0 | current | | apps/tracer/bun.lock | semver | 7.8.6 | 7.8.6 | current | | apps/tracer/bun.lock | sharp | 0.35.5 | 0.35.5 | current | | apps/tracer/bun.lock | source-map-js | 1.2.2 | 1.2.2 | current | | apps/tracer/bun.lock | styled-jsx | 5.1.6 | 5.1.7 | patch | | apps/tracer/bun.lock | tslib | 2.9.1 | 2.9.1 | current | | apps/tracer/bun.lock | typescript | 7.0.2 | 7.0.2 | current | | apps/tracer/bun.lock | undici-types | 8.9.0 | 8.12.4 | minor | | apps/tracer/bun.lock | ws | 8.22.1 | 8.22.1 | current | | scripts/browser-auth/bun.lock | @noble/hashes | 2.4.0 | 2.4.0 | current | | scripts/browser-auth/bun.lock | @scure/bip39 | 2.4.0 | 2.4.0 | current | | scripts/browser-auth/bun.lock | playwright-core | 1.65.0 | 1.65.0 | current | | scripts/browser-auth/bun.lock | playwright | 1.65.0 | 1.65.0 | current | Deferred updates and separate-job estimates: | deferred update | evidence and reason | separate-job estimate | | --- | --- | --- | | SQLx 0.8.6 → 0.9.0 | `SqlSafeStr` query changes and SQLiteValue Send/Sync changes touch recovery/migration code | 1–2 days | | axum-server 0.8 → 0.9 | TLS accept-service API changes touch server_tls and its integration tests | 0.5–1 day | | argon2 0.5 → 0.6 | password-hash 0.6 removes SaltString, requiring auth API changes | 0.5–1 day | | bip39 2 → 3 | generation API requires WordCount in auth recovery | 0.5 day | | hkdf 0.12 → 0.13 and sha2 0.10 → 0.11 | coordinated digest-trait migration in auth oracle; independent major commits would not build | 0.5–1 day | | webauthn-rs 0.5.5 → 0.6.2 | upstream changes its crypto backend from OpenSSL to RustCrypto; owner foundational choice required | 1–2 days after decision | | base64 0.22 → 0.23 | adds a third version while SQLx/transport retain 0.21 and 0.22, violating the no-new-duplicates requirement | coordinate parent upgrades | | tokio-tungstenite 0.29 → 0.30 | adds a second tungstenite pair while Axum 0.8 retains 0.29 | 0.5 day after parent upgrade | | vendored russh 0.64.1 → 0.65.1 | SSH security surface and repository audit patch require a separate migration | about 1 day | | Zig 0.15.2 → 0.17.1 | coupled to excluded libghostty-vt build; J339 owns that slice | coordinate with J339 | | CI checkout v4 → v7, cache v4 → v6, Node 22 → 26 | action majors require Node 24 runtime; current Forgejo runner is offline, so no real workflow proof is available | 0.5 day with runner online | | openssl-src 300.6.1+3.6.3 → 400.0.2+4.0.3 | latest openssl-sys still requires vendored source 300.x; no binding override in this refresh | 0.5–1 day after upstream vendoring support | | GotaTun upstream base | report only: 14 upstream commits behind, 19 fork commits ahead at the shipped pin | separate owner-scoped fork job | | aes-gcm 0.10.3 → 0.11.1 | new hybrid-array nonce constructors require TryFrom changes at auth/tests.rs:191,219; deferred under the security-sensitive-code rule | 1–2 hours |

final-verify-fast-compute01.log

973 KiB

final-verify-fast-summary.txt

1.3 KiB

final-compute01-binary-size.txt

125 B

final-compute01-binary-sha.txt

239 B

compute01-final-cleanup.log

31 B

kayg commented

2026-11-07 18:57:15 +00:00

Author

Owner

J358 independent review started: deps-refresh-340 @ df9f92f863 against origin/dev (current 027a3a78b6). Own detached review worktree infraternal-j358. Plan (~90 minutes active work plus VM queue): read all issue evidence and OpenSSL approval; audit every major against call sites; independently check licences/RSA reachability and size attribution; inspect existing paired perf receipts (rerun only missing probes); run frozen tracer typecheck and one browser spec on dev-02. No code edits, merges, pushes or deployments; reviewer-specific common-brief rule means no redundant quick/fast gate.

J358 independent review started: deps-refresh-340 @ df9f92f863bd7109031424f8a0c7022509a06ce3 against origin/dev (current 027a3a78b6b104b010ceca829b818bd37ff693a1). Own detached review worktree infraternal-j358. Plan (~90 minutes active work plus VM queue): read all issue evidence and OpenSSL approval; audit every major against call sites; independently check licences/RSA reachability and size attribution; inspect existing paired perf receipts (rerun only missing probes); run frozen tracer typecheck and one browser spec on dev-02. No code edits, merges, pushes or deployments; reviewer-specific common-brief rule means no redundant quick/fast gate.

kayg commented

2026-11-07 19:04:29 +00:00

Author

Owner

J358 review checkpoint: independent dev-02 frozen install, cargo deny check licenses, all-target/default+all-feature rsa reverse trees, tracer typecheck and both font-picker.spec.ts cases passed (J358_FOCUSED_EXIT=0). Artifacts: dev-02 ~/.cache/codex-scratch/J358/evidence/{focused.log,js-license-registry.json,js-licenses.log}. Independent registry review of both Bun locks: 68 baseline versus 86 final unique packages, same license-expression set, zero missing/error metadata. Remaining size evidence gap: +112608 B x86/+74320 B arm is still attributed only to the 47-resolution compatible batch. Source/feature diff identifies ICU data/runtime growth and unchanged feature selections, but cannot assign linked bytes to a crate or prove a removable >30 KB contributor. I will flag this explicitly if it remains unattributed. Existing perf receipts cover Tokio, Ed25519/OpenSSL and terminal oracles; AES-CTR used by vendored SSH is not exercised by remote_ca_bench or the existing ring-only cipher benchmark. Building a minimal isolated probe for the same Ctr128BE<Aes128/Aes256> types, both old/new AES and native/software backends, before a short nonblocking perf-lock run. No repository changes.

kayg referenced this issue

2026-11-07 19:05:14 +00:00

Head-to-head: infraternal mesh vs NetBird/Tailscale, infraternal sessions vs tmux/Zellij #260

kayg referenced this issue

2026-11-07 19:13:13 +00:00

Head-to-head: infraternal mesh vs NetBird/Tailscale, infraternal sessions vs tmux/Zellij #260

kayg commented

2026-11-07 19:15:12 +00:00

Author

Owner

J358 independent review: REQUEST CHANGES on deps-refresh-340 at df9f92f863.

No P0/P1 correctness, security, licence or format regression established. Two P2 evidence/performance findings remain below; neither asks to revert the approved OpenSSL safety update or applies a removed size cap. No merge, push, deployment, repository edit or issue closure performed.

Compared the 16 dependency commits with their merge base 6b1bdb81b3d8eb90716643e7d1bd03f61ce37827; fetched origin/dev is now 027a3a78b6b104b010ceca829b818bd37ff693a1. This review qualifies the requested head, not a future merge result. Read the common brief, repository contract/process/architecture/decisions and all 90 author comments, including final report 85376 and the OpenSSL decision 84031.

Findings

P2-1: the largest size increase remains unattributed below the batch level. 5e0338370 adds 112,608 B x86 / 74,320 B arm64, most of the dependency-only 143,712 / 100,512 B total. The final handoff identifies 47 resolutions, not which linked crates/functions/data cause that increase. My independent crate/feature diff identifies substantial source growth in Tokio and ICU, but source bytes are not linked bytes: Tokio Rust sources +221,872 B; ICU property data sources +120,892 B; ICU properties +101,281 B; ICU collections +70,089 B. Build-only cc sources also grow, illustrating why source counts cannot establish shipping attribution. The inspected Tokio/ICU/AES/flate2/uuid feature selections are unchanged; ICU compiled data is needed by the current IDNA path, and no safe removable flag was established. Please retain a linked crate/data diff or same-source isolated size comparison, identify any contributor above roughly 30 KB and record its benefit or remove gratuitous features. I am not claiming any specific crate adds those source-byte amounts to the binary, or that the growth is proved avoidable. Evidence: attached crate-source-sizes.txt, features.txt, icu-crate-diff.txt; author's static receipts rust-compatible-isolated-static.log, final size table 85376.

The rest of the measured attribution is explicit: OpenSSL +2112/+5856, Nix/Rust +544/+4480, nix +1312/−11456, tower-http +26368/+35760, rand +768/−8448, all other slices 0/0. Tower's arm growth crosses 30 KB, but new conditional validators and corrected compressed/range responses provide a concrete functionality benefit; its fs feature has no separate ETag toggle. The final absolute compute01 sizes are 27,933,744 / 25,096,184 B; inherited dev and cross-host differences must remain separate from dependency deltas.

P2-2: the AES update has a short-buffer cost absent from the author's performance account. aes 0.9.3 → 0.9.4 is reachable through vendored SSH AES-CTR/CBC. remote_ca_bench ed25519 does not exercise it; the existing vendored cipher benchmark exercises ring-backed GCM/ChaCha rather than this changed AES implementation. I ran a focused probe using the actual Ctr128BE<Aes128/Aes256> types, pinned common dependencies, zeroize, Rust 1.99.1, x86 musl, opt-level 3/LTO/one codegen unit, default and forced-software backends. Three alternating old/new trials under perf-run completed with exit 0, zero steal, matching output fingerprints in every case.

Median of the three per-trial p50s, 256 calls per sample (25 samples):

backend / cipher	buffer	old ns per sample	new ns per sample	change
default AES-128-CTR	64 B	3938	4939	+25.4%
default AES-256-CTR	64 B	5130	6211	+21.1%; trial ranges overlap
software AES-128-CTR	64 B	75802	101611	+34.0%
software AES-256-CTR	64 B	102512	133591	+30.3%
default AES-128-CTR	16 KiB	617940	633128	+2.5%
default AES-256-CTR	16 KiB	898137	878490	−2.2%
software AES-128-CTR	16 KiB	19239666	14962738	−22.2%
software AES-256-CTR	16 KiB	25793488	19913782	−22.8%

The software short-buffer trial ranges are disjoint. Absolute added software cost is about 101/121 ns per 64-byte call, not a measured end-to-end keystroke delay. Upstream's compact-key storage and bulk improvement may justify this; source inspection shows 0.9.4 stores RoundKeys<MinWord> and constructs native round keys in each encrypt/decrypt closure, versus stored RoundKeys<NativeWord> in 0.9.3. Please record this tradeoff and its per-session memory benefit/acceptance rather than asserting certificate timings cover the crypto refresh. No foundation/backend replacement is proposed. Evidence: attached aes-perf.log, aes-initial-measured.rs, aes-build-pinned.log, aes-soft-source.txt; perf VM ~/.cache/codex-scratch/J358/evidence/perf-run-20261107T*.{before,after}.txt. Perf windows announced/released on #260 (85390, 85393, 85487). This is a narrow primitive comparison, not an SSH session benchmark, ARM measurement or timing test assertion. Optional longer-sample confirmation was interrupted after admission; no result from that attempt is used.

P3-1: correct the tower-http coverage claim / add focused HTTP cases. Comment 84204 says new ETag/conditional/multipart-range handling is covered by existing web_assets tests. Those three tests check encodings/HEAD, SPA cache policy and framing headers; they never issue If-Match/If-None-Match/Range requests. The case-insensitive Vary assertion is correct. Follow up with focused conditional/416 and trailing-slash/fallback checks, or qualify the report. This is a coverage gap, not a demonstrated HTTP security defect. Evidence: crates/infraternal-server/src/web_assets_tests.rs, attached upstream major changelog and review notes.

Major migration and security review

update	breaking changes checked against actual use
nix 0.30 → 0.31	SigHandler equality removed; callers install/match handlers, not compare them. Reactor uses epoll; retaining unknown flags replaces a panic and existing `.contains()` checks remain valid. No credential/SSH implementation migration.
Criterion 0.7 → 0.8 / criterion-plot 0.6 → 0.8	removed async-std support unused; wire_codec uses synchronous group/main API. Layout randomisation affects measurement harness only. Existing actual `--bench` before/after receipts inspected.
alacritty_terminal 0.25 → 0.26 / signal-hook 0.3 → 0.4	ChildExit now carries ExitStatus; vt_compare uses VoidListener and no PTY creation. Signal-hook OwnedFd pipe change stays inside this nonshipping oracle dependency; no repository low_level::pipe caller.
tower-http 0.6 → 0.7	only fs/default-empty features used. Default TokioBackend retained; ETags/preconditions, multipart errors, file trailing-slash rejection and precompressed Vary are real HTTP behavior changes. Auth/redirect/compression middleware breaking changes are not enabled/used. SPA fallback and outer security-header middleware remain. See P3-1.
vt100 0.16 → 0.18	NonZeroU16 and UTF-8 String snapshots migrated correctly at fixed 60×200 constructors/replay. Resize/scrollback/IL-DL behavior changes affect test oracle; no dynamic resize call at these sites. Native shipping VT pins unchanged.
rand 0.9 → 0.10	auth/enrollment/recovery/CA callers use random scalars/byte arrays. Removed Rng/OsRng/reseeding APIs and serialized RNG state unused. Thread RNG remains the default; upstream states the StdRng implementation change retains output. No auth source or stored/wire format migration.
TypeScript 5.9 → 7, including 6 removals	explicit ES2022/ESNext/Bundler/strict/noEmit and explicit types in both tsconfigs; no compiler API imports or removed legacy resolver/baseUrl use. Bun still emits production assets. Hidden-state Boolean coercions preserve intent; WebSocket spy annotation is erased. Protocol compiler pin is also updated.
Node 24 → 26 / Node declarations 22 → 26	reviewed Node 25/26 removals and grep of call sites: no SlowBuffer, old stream internals, writeHeader, Corepack, removed crypto options or type-transform flags. Tooling runtime only; product TLS/auth remains Rust/browser code. Native addon runtime is not introduced into product. CI image/actions remain deferred.
undici-types 6 → 8	declarations only, no runtime migration; no direct dispatcher/interceptor/legacy handler use. Existing Bun wildcard and Node ~8.9 bounds permit dedup.
transitive proc-macro2-diagnostics 0.10 → 0.11	source/manifest diff: syn 3 API and removal of coloured/default-nightly diagnostics; no direct repository API caller, build-time only. Parent derives compile in author gate; no wire/database format change identified.

OpenSSL stays its own d2a965b1d security commit. Decision 84031 accepts safety fixes for OOB/UAF/double-free with the rare certificate-operation cost. I inspected the raw zero-steal three-way receipt: old/fixed-old-env/fixed-new-env certificate p50 296/353/296 µs, p99 312/375/316 µs, retained RSS about 5300 KiB. Supported environment refresh recovers the measured cost. No unsupported flag or foundational backend swap; source-level attribution remains explicitly unproved and nonblocking per the decision. Deferred WebAuthn/TLS/auth/SQLx/SSH majors remain deferred. No changed protocol encoding, database schema/migration or persistent RNG format identified.

Licences and RSA

Independent dev-02 cargo deny check licenses: licenses ok. No allowlist expansion. Independently resolved licence metadata for every unique package/version from both baseline/final Bun locks: 68 → 86 unique packages, no new licence expressions, zero metadata errors/missing licences. Newly added native TypeScript packages are Apache-2.0. Existing JS font/libvips/data expressions include OFL/LGPL/CC-BY/0BSD; these predate this change and are not the Rust deny allowlist. Evidence: attached focused.log, js-license-registry.json, js-licenses.log.

rsa 0.9.10 remains lockfile-only in selected graphs: independently ran cargo tree --locked --target all -i rsa, also with workspace --all-features, and reverse sqlx-mysql tree: all nothing to print. Cargo.lock's dependency edge is the inactive sqlx-mysql → rsa; workspace SQLx disables defaults and selects SQLite. Vendored SSH has an optional rsa declaration, but the product selects default-features=false, features=["ring"]; RSA private-key algorithm branches are cfg-gated. No selected code path performs private-key operations through the affected rsa crate that an attacker can time. This does not claim no other library can ever verify/sign RSA. Recommend accept and document the inactive advisory, keep suppression-free audit visibility, and require reassessment before enabling SQLx MySQL or russh/rsa; do not force lockfile surgery or a foundation replacement. Existing audit exit 1 is accurately retained in 84403/85376.

Verification and cleanup

Independent dev-02 run at exact head: frozen install, licences, RSA trees, bun run check, production build and bun x playwright test test/font-picker.spec.ts --workers=1:

licenses ok
  2 passed (23.0s)
J358_FOCUSED_EXIT=0

Port 5358/5359 fixture processes exited, review worktrees clean; both own Linux targets absent, no own running build/test/perf process. Measurements/logs are retained outside targets. No review-code edits; reviewer-specific common brief prohibits quick/fast reruns. I inspected the author's raw compute01 gate summary and final exit marker. The following is author evidence, verbatim from 85376, not a gate run by J358:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | PASS         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 50 pass
 0 fail
 77253 expect() calls
Ran 50 tests across 13 files. [17.50s]
VERIFY_FAST_EXIT=0

Verdict: REQUEST CHANGES. Head: df9f92f863. No P1; requested P2 follow-up is attribution and explicit crypto tradeoff evidence, not a size-cap rejection.

Attachment note: source files, source diffs, build log, interrupted-confirmation record and upstream HTTP changelog are inside j358-review-sources.zip; the main result logs/metadata are attached separately. The completed timing probe is aes-initial-measured.rs; the longer-sample source/build was interrupted and contributes no measurement.

J358 independent review: **REQUEST CHANGES** on `deps-refresh-340` at **df9f92f863bd7109031424f8a0c7022509a06ce3**. No P0/P1 correctness, security, licence or format regression established. Two P2 evidence/performance findings remain below; neither asks to revert the approved OpenSSL safety update or applies a removed size cap. No merge, push, deployment, repository edit or issue closure performed. Compared the 16 dependency commits with their merge base `6b1bdb81b3d8eb90716643e7d1bd03f61ce37827`; fetched origin/dev is now `027a3a78b6b104b010ceca829b818bd37ff693a1`. This review qualifies the requested head, not a future merge result. Read the common brief, repository contract/process/architecture/decisions and all 90 author comments, including final report 85376 and the OpenSSL decision 84031. ### Findings **P2-1: the largest size increase remains unattributed below the batch level.** `5e0338370` adds **112,608 B x86 / 74,320 B arm64**, most of the dependency-only **143,712 / 100,512 B** total. The final handoff identifies 47 resolutions, not which linked crates/functions/data cause that increase. My independent crate/feature diff identifies substantial source growth in Tokio and ICU, but source bytes are not linked bytes: Tokio Rust sources +221,872 B; ICU property data sources +120,892 B; ICU properties +101,281 B; ICU collections +70,089 B. Build-only cc sources also grow, illustrating why source counts cannot establish shipping attribution. The inspected Tokio/ICU/AES/flate2/uuid feature selections are unchanged; ICU compiled data is needed by the current IDNA path, and no safe removable flag was established. Please retain a linked crate/data diff or same-source isolated size comparison, identify any contributor above roughly 30 KB and record its benefit or remove gratuitous features. I am **not** claiming any specific crate adds those source-byte amounts to the binary, or that the growth is proved avoidable. Evidence: attached `crate-source-sizes.txt`, `features.txt`, `icu-crate-diff.txt`; author's static receipts `rust-compatible-isolated-static.log`, final size table 85376. The rest of the measured attribution is explicit: OpenSSL **+2112/+5856**, Nix/Rust **+544/+4480**, nix **+1312/−11456**, tower-http **+26368/+35760**, rand **+768/−8448**, all other slices **0/0**. Tower's arm growth crosses 30 KB, but new conditional validators and corrected compressed/range responses provide a concrete functionality benefit; its `fs` feature has no separate ETag toggle. The final absolute compute01 sizes are **27,933,744 / 25,096,184 B**; inherited dev and cross-host differences must remain separate from dependency deltas. **P2-2: the AES update has a short-buffer cost absent from the author's performance account.** `aes 0.9.3 → 0.9.4` is reachable through vendored SSH AES-CTR/CBC. `remote_ca_bench ed25519` does not exercise it; the existing vendored cipher benchmark exercises ring-backed GCM/ChaCha rather than this changed AES implementation. I ran a focused probe using the actual `Ctr128BE<Aes128/Aes256>` types, pinned common dependencies, `zeroize`, Rust 1.99.1, x86 musl, opt-level 3/LTO/one codegen unit, default and forced-software backends. Three alternating old/new trials under perf-run completed with **exit 0, zero steal**, matching output fingerprints in every case. Median of the three per-trial p50s, **256 calls per sample** (25 samples): | backend / cipher | buffer | old ns per sample | new ns per sample | change | |---|---:|---:|---:|---:| | default AES-128-CTR | 64 B | 3938 | 4939 | +25.4% | | default AES-256-CTR | 64 B | 5130 | 6211 | +21.1%; trial ranges overlap | | software AES-128-CTR | 64 B | 75802 | 101611 | +34.0% | | software AES-256-CTR | 64 B | 102512 | 133591 | +30.3% | | default AES-128-CTR | 16 KiB | 617940 | 633128 | +2.5% | | default AES-256-CTR | 16 KiB | 898137 | 878490 | −2.2% | | software AES-128-CTR | 16 KiB | 19239666 | 14962738 | −22.2% | | software AES-256-CTR | 16 KiB | 25793488 | 19913782 | −22.8% | The software short-buffer trial ranges are disjoint. Absolute added software cost is about **101/121 ns per 64-byte call**, not a measured end-to-end keystroke delay. Upstream's compact-key storage and bulk improvement may justify this; source inspection shows 0.9.4 stores `RoundKeys<MinWord>` and constructs native round keys in each encrypt/decrypt closure, versus stored `RoundKeys<NativeWord>` in 0.9.3. Please record this tradeoff and its per-session memory benefit/acceptance rather than asserting certificate timings cover the crypto refresh. No foundation/backend replacement is proposed. Evidence: attached `aes-perf.log`, `aes-initial-measured.rs`, `aes-build-pinned.log`, `aes-soft-source.txt`; perf VM `~/.cache/codex-scratch/J358/evidence/perf-run-20261107T*.{before,after}.txt`. Perf windows announced/released on #260 (85390, 85393, 85487). This is a narrow primitive comparison, not an SSH session benchmark, ARM measurement or timing test assertion. Optional longer-sample confirmation was interrupted after admission; **no result from that attempt is used**. **P3-1: correct the tower-http coverage claim / add focused HTTP cases.** Comment 84204 says new ETag/conditional/multipart-range handling is covered by existing web_assets tests. Those three tests check encodings/HEAD, SPA cache policy and framing headers; they never issue If-Match/If-None-Match/Range requests. The case-insensitive Vary assertion is correct. Follow up with focused conditional/416 and trailing-slash/fallback checks, or qualify the report. This is a coverage gap, not a demonstrated HTTP security defect. Evidence: `crates/infraternal-server/src/web_assets_tests.rs`, attached upstream major changelog and review notes. ### Major migration and security review | update | breaking changes checked against actual use | |---|---| | nix 0.30 → 0.31 | SigHandler equality removed; callers install/match handlers, not compare them. Reactor uses epoll; retaining unknown flags replaces a panic and existing `.contains()` checks remain valid. No credential/SSH implementation migration. | | Criterion 0.7 → 0.8 / criterion-plot 0.6 → 0.8 | removed async-std support unused; wire_codec uses synchronous group/main API. Layout randomisation affects measurement harness only. Existing actual `--bench` before/after receipts inspected. | | alacritty_terminal 0.25 → 0.26 / signal-hook 0.3 → 0.4 | ChildExit now carries ExitStatus; vt_compare uses VoidListener and no PTY creation. Signal-hook OwnedFd pipe change stays inside this nonshipping oracle dependency; no repository low_level::pipe caller. | | tower-http 0.6 → 0.7 | only fs/default-empty features used. Default TokioBackend retained; ETags/preconditions, multipart errors, file trailing-slash rejection and precompressed Vary are real HTTP behavior changes. Auth/redirect/compression middleware breaking changes are not enabled/used. SPA fallback and outer security-header middleware remain. See P3-1. | | vt100 0.16 → 0.18 | NonZeroU16 and UTF-8 String snapshots migrated correctly at fixed 60×200 constructors/replay. Resize/scrollback/IL-DL behavior changes affect test oracle; no dynamic resize call at these sites. Native shipping VT pins unchanged. | | rand 0.9 → 0.10 | auth/enrollment/recovery/CA callers use random scalars/byte arrays. Removed Rng/OsRng/reseeding APIs and serialized RNG state unused. Thread RNG remains the default; upstream states the StdRng implementation change retains output. No auth source or stored/wire format migration. | | TypeScript 5.9 → 7, including 6 removals | explicit ES2022/ESNext/Bundler/strict/noEmit and explicit types in both tsconfigs; no compiler API imports or removed legacy resolver/baseUrl use. Bun still emits production assets. Hidden-state Boolean coercions preserve intent; WebSocket spy annotation is erased. Protocol compiler pin is also updated. | | Node 24 → 26 / Node declarations 22 → 26 | reviewed Node 25/26 removals and grep of call sites: no SlowBuffer, old stream internals, writeHeader, Corepack, removed crypto options or type-transform flags. Tooling runtime only; product TLS/auth remains Rust/browser code. Native addon runtime is not introduced into product. CI image/actions remain deferred. | | undici-types 6 → 8 | declarations only, no runtime migration; no direct dispatcher/interceptor/legacy handler use. Existing Bun wildcard and Node ~8.9 bounds permit dedup. | | transitive proc-macro2-diagnostics 0.10 → 0.11 | source/manifest diff: syn 3 API and removal of coloured/default-nightly diagnostics; no direct repository API caller, build-time only. Parent derives compile in author gate; no wire/database format change identified. | OpenSSL stays its own `d2a965b1d` security commit. Decision 84031 accepts safety fixes for OOB/UAF/double-free with the rare certificate-operation cost. I inspected the raw zero-steal three-way receipt: old/fixed-old-env/fixed-new-env certificate p50 **296/353/296 µs**, p99 **312/375/316 µs**, retained RSS about **5300 KiB**. Supported environment refresh recovers the measured cost. No unsupported flag or foundational backend swap; source-level attribution remains explicitly unproved and nonblocking per the decision. Deferred WebAuthn/TLS/auth/SQLx/SSH majors remain deferred. No changed protocol encoding, database schema/migration or persistent RNG format identified. ### Licences and RSA Independent dev-02 `cargo deny check licenses`: **`licenses ok`**. No allowlist expansion. Independently resolved licence metadata for every unique package/version from both baseline/final Bun locks: **68 → 86 unique packages**, **no new licence expressions, zero metadata errors/missing licences**. Newly added native TypeScript packages are Apache-2.0. Existing JS font/libvips/data expressions include OFL/LGPL/CC-BY/0BSD; these predate this change and are not the Rust deny allowlist. Evidence: attached `focused.log`, `js-license-registry.json`, `js-licenses.log`. `rsa 0.9.10` remains lockfile-only in selected graphs: independently ran `cargo tree --locked --target all -i rsa`, also with workspace `--all-features`, and reverse sqlx-mysql tree: all **nothing to print**. Cargo.lock's dependency edge is the inactive `sqlx-mysql → rsa`; workspace SQLx disables defaults and selects SQLite. Vendored SSH has an optional rsa declaration, but the product selects `default-features=false, features=["ring"]`; RSA private-key algorithm branches are cfg-gated. **No selected code path performs private-key operations through the affected rsa crate that an attacker can time.** This does not claim no other library can ever verify/sign RSA. Recommend **accept and document the inactive advisory**, keep suppression-free audit visibility, and require reassessment before enabling SQLx MySQL or russh/rsa; do not force lockfile surgery or a foundation replacement. Existing audit exit 1 is accurately retained in 84403/85376. ### Verification and cleanup Independent dev-02 run at exact head: frozen install, licences, RSA trees, `bun run check`, production build and `bun x playwright test test/font-picker.spec.ts --workers=1`: ```text licenses ok 2 passed (23.0s) J358_FOCUSED_EXIT=0 ``` Port 5358/5359 fixture processes exited, review worktrees clean; both own Linux targets absent, no own running build/test/perf process. Measurements/logs are retained outside targets. No review-code edits; reviewer-specific common brief prohibits quick/fast reruns. I inspected the author's raw compute01 gate summary and final exit marker. The following is **author evidence**, verbatim from 85376, not a gate run by J358: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | PASS | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ 50 pass 0 fail 77253 expect() calls Ran 50 tests across 13 files. [17.50s] VERIFY_FAST_EXIT=0 ``` Verdict: REQUEST CHANGES. Head: df9f92f863bd7109031424f8a0c7022509a06ce3. No P1; requested P2 follow-up is attribution and explicit crypto tradeoff evidence, not a size-cap rejection. Attachment note: source files, source diffs, build log, interrupted-confirmation record and upstream HTTP changelog are inside **j358-review-sources.zip**; the main result logs/metadata are attached separately. The completed timing probe is `aes-initial-measured.rs`; the longer-sample source/build was interrupted and contributes no measurement.

focused.log

4.2 KiB

js-license-registry.json

11 KiB

js-licenses.log

4.2 KiB

crate-source-sizes.txt

1.8 KiB

features.txt

960 B

icu-crate-diff.txt

6.3 KiB

aes-perf.log

5.8 KiB

j358-review-sources.zip

17 KiB

kayg commented

2026-11-07 19:19:31 +00:00

Author

Owner

J340 addressing J358 review85489 and the orchestrator follow-up. Rebased FIRST onto current origin/dev 6ffe37e067d8fa7b090ea83c21b84b77937f76d9, including J346; all 16 dependency commits replay unchanged (range-diff attached). Branch deps-refresh-340, current pushed head 62af9b1f3373f681c2050530943c188f19612e13. Original reviewed head remains df9f92f863bd7109031424f8a0c7022509a06ce3.

Plan / estimate: (1) retain before/after linked symbols and ELF sections for original compatible-resolution commit 5e0338370 and its parent under the same static release recipe, for x86 and aarch64; attribute contributors around 30 KB or larger and check their upstream benefit, pin back gratuitous growth if demonstrated; (2) prove current AES reachability after J346 and, if retained, repeat short-buffer old/new measurements under perf-run; (3) record conclusions in the relevant maintenance commit/follow-up and run quick as needed, then full verify fast on compute01; (4) post head, raw results and cleanup. Estimate 4–6 hours including serial static builds and the cold full gate, plus any queue delay.

Initial source finding: J346 excludes CBC transport factories and AES-128-GCM behind extra-ciphers, but the AES-128/192/256 CTR factories and their registry entries are still unconditional. Product russh disables defaults and selects ring; this removes CBC factories but does not by itself remove the updated Rust AES CTR code. Symbol/reachability evidence and a short-buffer measurement will follow; the certificate benchmark is not AES evidence.

Artifacts remain under ~/.cache/codex-scratch/J340/evidence/; one target per host/job, at most one build slot. No merge/deploy; approved OpenSSL fixes remain included.

J340 addressing J358 review85489 and the orchestrator follow-up. Rebased FIRST onto current `origin/dev` `6ffe37e067d8fa7b090ea83c21b84b77937f76d9`, including J346; all 16 dependency commits replay unchanged (range-diff attached). Branch `deps-refresh-340`, current pushed head `62af9b1f3373f681c2050530943c188f19612e13`. Original reviewed head remains `df9f92f863bd7109031424f8a0c7022509a06ce3`. Plan / estimate: (1) retain before/after linked symbols and ELF sections for original compatible-resolution commit `5e0338370` and its parent under the same static release recipe, for x86 and aarch64; attribute contributors around 30 KB or larger and check their upstream benefit, pin back gratuitous growth if demonstrated; (2) prove current AES reachability after J346 and, if retained, repeat short-buffer old/new measurements under perf-run; (3) record conclusions in the relevant maintenance commit/follow-up and run quick as needed, then full verify fast on compute01; (4) post head, raw results and cleanup. Estimate 4–6 hours including serial static builds and the cold full gate, plus any queue delay. Initial source finding: J346 excludes CBC transport factories and AES-128-GCM behind `extra-ciphers`, but the AES-128/192/256 CTR factories and their registry entries are still unconditional. Product russh disables defaults and selects `ring`; this removes CBC factories but does not by itself remove the updated Rust AES CTR code. Symbol/reachability evidence and a short-buffer measurement will follow; the certificate benchmark is not AES evidence. Artifacts remain under `~/.cache/codex-scratch/J340/evidence/`; one target per host/job, at most one build slot. No merge/deploy; approved OpenSSL fixes remain included.

j358-rebase-range-diff.txt

1.4 KiB

kayg commented

2026-11-07 19:29:43 +00:00

Author

Owner

J358 P2-2: rebase-first source and selected-graph check confirms AES remains reachable. On rebased head 62af9b1f3373f681c2050530943c188f19612e13, J346 excludes AES-CBC factories behind extra-ciphers; default-off russh selects ring. It still registers AES-128/192/256-CTR unconditionally, and the mesh's existing unchanged offer explicitly includes all three CTR variants (mesh_algorithms.rs:mesh_transport_offer_is_unchanged). aes 0.9.4 also remains selected through SSH key decoding. CBC transport exclusion does not make the AES update dead code.

Repeated focused measurement using the same Ctr128BE<Aes128/Aes256> types, AES zeroize, x86 musl, Rust 1.99.1, release opt3/LTO/one CGU. All 12 non-AES dependency entries are identical between versions (attached). Three alternating old/new trials, 25 samples each, 4096 calls per sample for 64-byte buffers, 256 for 16-KiB buffers. perf-run exit0; zero steal; output fingerprints match across versions and backends. Raw log, source, common dependency receipt and perf guards attached.

Forced-software 64-byte median p50 cost rises 302.264→396.505 ns/call (+31.18%, +94.241 ns) for AES-128 and 403.061→523.098 (+29.78%, +120.037 ns) for AES-256. Software 16-KiB times improve 19.67% / 22.08%. Default-backend long-batch 64-byte medians are 15.688→15.329 / 20.294→19.424 ns/call; this does not invalidate J358's shorter 256-call default-backend result (+25.4% / +21.1%, overlapping AES-256 trial ranges). Batch length/code generation and warm-path differences remain qualifications; the reproducible forced-software short-buffer tradeoff is acknowledged, not hidden by certificate timings.

Concrete benefit: default-dispatched CTR state shrinks 752→400 B (AES-128) and 1008→528 B (AES-256) per direction. Two directions save 704/960 B per SSH session, or 35,200/48,000 B at 50 sessions, for those objects only. Forced-software state shrinks 752→224 / 1008→288 B; two directions save 1056/1440 B per session, 52,800/72,000 B at 50 sessions. These are size_of state counts, not measured total session RSS. Upstream 0.9.4 explicitly changes software round keys to a compact representation. Retain the patch for this memory benefit and faster software bulk transfers, while recording the approximately 0.1 µs software short-buffer cost in the maintenance commit. No backend/algorithm/factory change is proposed.

P3 qualification: the earlier assertion that the existing web-assets tests cover new ETag/precondition/multipart-range behavior was too broad. They cover encoding/HEAD, SPA cache policy and framing headers, not If-Match/If-None-Match/Range. This report does not claim focused HTTP coverage; J358's suggested cases remain follow-up coverage work. No HTTP implementation or security change is included in this P2 response.

Historical linked-size run initially failed before linking because the separate static recipe requires scripts/auth-toolchain first; the missing pinned Zig path is explicit in the retained failed log. The retry now runs that existing bootstrap and is compiling the exact historical before revision. No repository workaround or toolchain swap.

J358 P2-2: rebase-first source and selected-graph check confirms AES remains reachable. On rebased head `62af9b1f3373f681c2050530943c188f19612e13`, J346 excludes AES-CBC factories behind `extra-ciphers`; default-off `russh` selects `ring`. It still registers AES-128/192/256-CTR unconditionally, and the mesh's existing unchanged offer explicitly includes all three CTR variants (`mesh_algorithms.rs:mesh_transport_offer_is_unchanged`). `aes 0.9.4` also remains selected through SSH key decoding. CBC transport exclusion does not make the AES update dead code. Repeated focused measurement using the same `Ctr128BE<Aes128/Aes256>` types, AES `zeroize`, x86 musl, Rust 1.99.1, release opt3/LTO/one CGU. All 12 non-AES dependency entries are identical between versions (attached). Three alternating old/new trials, 25 samples each, **4096 calls per sample for 64-byte buffers**, 256 for 16-KiB buffers. perf-run exit0; zero steal; output fingerprints match across versions and backends. Raw log, source, common dependency receipt and perf guards attached. Forced-software 64-byte median p50 cost rises **302.264→396.505 ns/call (+31.18%, +94.241 ns)** for AES-128 and **403.061→523.098 (+29.78%, +120.037 ns)** for AES-256. Software 16-KiB times improve **19.67% / 22.08%**. Default-backend long-batch 64-byte medians are **15.688→15.329 / 20.294→19.424 ns/call**; this does **not** invalidate J358's shorter 256-call default-backend result (+25.4% / +21.1%, overlapping AES-256 trial ranges). Batch length/code generation and warm-path differences remain qualifications; the reproducible forced-software short-buffer tradeoff is acknowledged, not hidden by certificate timings. Concrete benefit: default-dispatched CTR state shrinks **752→400 B (AES-128)** and **1008→528 B (AES-256)** per direction. Two directions save **704/960 B per SSH session**, or **35,200/48,000 B at 50 sessions**, for those objects only. Forced-software state shrinks **752→224 / 1008→288 B**; two directions save **1056/1440 B per session**, **52,800/72,000 B at 50 sessions**. These are `size_of` state counts, not measured total session RSS. Upstream 0.9.4 explicitly changes software round keys to a compact representation. Retain the patch for this memory benefit and faster software bulk transfers, while recording the approximately 0.1 µs software short-buffer cost in the maintenance commit. No backend/algorithm/factory change is proposed. P3 qualification: the earlier assertion that the existing web-assets tests cover new ETag/precondition/multipart-range behavior was too broad. They cover encoding/HEAD, SPA cache policy and framing headers, not If-Match/If-None-Match/Range. This report does not claim focused HTTP coverage; J358's suggested cases remain follow-up coverage work. No HTTP implementation or security change is included in this P2 response. Historical linked-size run initially failed before linking because the separate static recipe requires `scripts/auth-toolchain` first; the missing pinned Zig path is explicit in the retained failed log. The retry now runs that existing bootstrap and is compiling the exact historical before revision. No repository workaround or toolchain swap.

j358-aes-perf.log

7.1 KiB

kayg commented

2026-11-07 19:29:59 +00:00

Author

Owner

Receipt continuation for85501: Forgejo accepts the Rust probe source inside this ZIP (direct .rs upload was refused). Includes probe source, identical-common-dependency proof, raw per-trial summary data, state sizes, perf guards, and the rebased selected AES dependency graph. The raw timing log is already attached85501.

Receipt continuation for85501: Forgejo accepts the Rust probe source inside this ZIP (direct `.rs` upload was refused). Includes probe source, identical-common-dependency proof, raw per-trial summary data, state sizes, perf guards, and the rebased selected AES dependency graph. The raw timing log is already attached85501.

j358-aes-receipts.zip

7.1 KiB

kayg commented

2026-11-07 19:55:00 +00:00

Author

Owner

J340 checkpoint, no repository code changes since the clean rebase/push at 62af9b1f3373f681c2050530943c188f19612e13. AES P2 measurement/source/state receipts posted85501/85502; commit-message recording waits for linked attribution so both findings are recorded together before the final gate.

Completed the exact historical x86 before static release compile (20m00s), retaining full symbols/ELF sections. Remaining before-arm and after-x86/arm work is running in the sole compute01 slot as PID 4167980; one target /home/claude/worktrees/J340/target, raw log ~/.cache/codex-scratch/J340/evidence/j358-linked-build.log. The script skips the finished x86 receipt rather than recompiling it. No linked-size delta claimed before the after artifacts exist.

Setup failures are retained separately: j358-linked-bootstrap-failed.log (omitted existing auth-toolchain bootstrap; now fixed), j358-linked-zig-strip-failed.log (Zig objcopy strip-all is unimplemented), and j358-linked-strip-path-stopped.log (my unverified LLVM wrapper path; stopped by SIGINT to the recorded own Cargo PID). The corrected actual LLVM strip executable was located with command-v and version checked; it strips analysis copies only. Both sides retain identical opt3/LTO/one-CGU/static/unwind settings, with symbols retained for attribution. Build success and symbol extraction from the first artifact are preserved. No repository/toolchain-policy workaround, foundational replacement, merge or deployment.

J340 checkpoint, no repository code changes since the clean rebase/push at `62af9b1f3373f681c2050530943c188f19612e13`. AES P2 measurement/source/state receipts posted85501/85502; commit-message recording waits for linked attribution so both findings are recorded together before the final gate. Completed the exact historical **x86 before** static release compile (20m00s), retaining full symbols/ELF sections. Remaining before-arm and after-x86/arm work is running in the sole compute01 slot as PID `4167980`; one target `/home/claude/worktrees/J340/target`, raw log `~/.cache/codex-scratch/J340/evidence/j358-linked-build.log`. The script skips the finished x86 receipt rather than recompiling it. No linked-size delta claimed before the after artifacts exist. Setup failures are retained separately: `j358-linked-bootstrap-failed.log` (omitted existing auth-toolchain bootstrap; now fixed), `j358-linked-zig-strip-failed.log` (Zig objcopy strip-all is unimplemented), and `j358-linked-strip-path-stopped.log` (my unverified LLVM wrapper path; stopped by SIGINT to the recorded own Cargo PID). The corrected actual LLVM strip executable was located with command-v and version checked; it strips analysis copies only. Both sides retain identical opt3/LTO/one-CGU/static/unwind settings, with symbols retained for attribution. Build success and symbol extraction from the first artifact are preserved. No repository/toolchain-policy workaround, foundational replacement, merge or deployment.

kayg commented

2026-11-07 20:23:39 +00:00

Author

Owner

J340 progress: both exact historical BEFORE static artifacts are complete: x86 27,805,496 B, arm64 25,001,264 B, measured with the same LLVM strip tool on symbol-retaining release builds. AFTER 5e0338370 x86 is in final application LTO; arm64 follows. Sole own driver remains compute01 PID4167980, single target /home/claude/worktrees/J340/target, raw log ~/.cache/codex-scratch/J340/evidence/j358-linked-build.log. All symbols and ELF section receipts are outside target. No pin or product changes made while measurement is pending; branch still 62af9b1f3373f681c2050530943c188f19612e13.

AES reachability/performance/state finding and raw receipts remain85501/85502. Current origin/dev still6ffe37e06. Remaining: actual linked attribution and benefits, commit-message evidence, compute01 final verify fast, final head/report. No merge/deploy.

J340 progress: both exact historical BEFORE static artifacts are complete: x86 **27,805,496 B**, arm64 **25,001,264 B**, measured with the same LLVM strip tool on symbol-retaining release builds. AFTER `5e0338370` x86 is in final application LTO; arm64 follows. Sole own driver remains compute01 PID4167980, single target `/home/claude/worktrees/J340/target`, raw log `~/.cache/codex-scratch/J340/evidence/j358-linked-build.log`. All symbols and ELF section receipts are outside target. No pin or product changes made while measurement is pending; branch still `62af9b1f3373f681c2050530943c188f19612e13`. AES reachability/performance/state finding and raw receipts remain85501/85502. Current origin/dev still6ffe37e06. Remaining: actual linked attribution and benefits, commit-message evidence, compute01 final verify fast, final head/report. No merge/deploy.

kayg commented

2026-11-07 20:38:02 +00:00

Author

Owner

J340 addresses J358 P2-1 with an actual linked-symbol/ELF diff for original commit 5e0338370f02797f0d5c7516d9c3f2d96f376512 against parent 6b1bdb81b. Both targets completed exit0. Raw nm -S -C --defined-only, section/size tables, hashes, driver and diff scripts are attached as a ZIP. No source-size inference.

Recipe: each revision's Rust1.99.0, existing auth-toolchain/static-cargo, static musl, release opt3/LTO/one CGU/unwind. Only attribution override is CARGO_PROFILE_RELEASE_STRIP=false; symbols are captured and both analysis copies are stripped with the same LLVM21.1.8 tool. Consequently these analysis totals do not reproduce the earlier default-strip shipping receipt (+112,608/+74,320 B), which remains a separate measurement.

analysis artifact	before B	after B	delta B
x86_64	27,805,496	27,903,768	+98,272
aarch64	25,001,264	25,077,312	+76,048
x86 `.text`	21,210,924	21,289,068	+78,144
arm64 `.text`	17,893,372	17,940,860	+47,488
x86 `.rodata`	2,164,208	2,180,592	+16,384
arm64 `.rodata`	2,489,352	2,513,928	+24,576

Every named owner above1KB in either direction and the largest changed symbols appear in the attached Markdown/JSON. The largest positive owners are below; none has >=30KB net growth on either target.

linked namespace	x86 delta B	arm64 delta B
Core generic/drop glue	+17,376	+8,096
russh	+15,179	+12,428
mesh product callers	+14,976	-1,312
Tokio	+11,671	+8,388
rustls	+11,183	+9,708
Hyper	+7,064	+6,152
GotaTun callers	+5,660	+2,920
ssh_key	+4,948	+2,548
h2 (text+named data)	+4,548	+2,800
crc32fast (text+named data)	under1KB	+8,212
AES direct namespace	-1,517	+2,388
ICU named code, all namespaces	+106	+104

This is ownership after linking, not isolated causal version attribution: LTO moves generic/inlined code into caller namespaces. rustls, russh, mesh and GotaTun source versions do not change in this commit. In particular, the growth in russh contains AES128/192/256-CTR apply_keystream monomorphizations (+5560/+5320/+5560 B x86 and +3964/+3852/+3956 B arm64); direct AES code also has offsets. ICU data may be in unnamed constants, but the entire read-only section grows only16KB/24KB. The source-size suspicion does not establish a30KB ICU contribution. Unwind/relocation/alignment section differences are retained in j358-section-diff.md; unnamed constant ownership remains unassigned rather than guessed.

Benefits retained: Tokio1.54.1 includes shutdown-bit/readiness-tick preservation, interrupted-I/O retries, copy_buf flush/cooperation, blocking-worker hang fixes and the timer-handle rollback. Our networking, timers and blocking workers use this runtime. ICU2.4 supplies Unicode18 data and normalizer soundness fixes (upstream8628), plus collection correctness fixes; this supports hostname/IDNA handling, without claiming our exact caller was exploitable. AES0.9.4 supplies the measured compact-state/bulk-software benefits in85501/85502. These changes have needed correctness or memory benefits. No demonstrated gratuitous large contributor supports a pin-back, so no versions were pinned back. No foundational library/backend replaced.

P2-2: after rebase onto6ffe37e06/J346, CBC factories are excluded by default but AES128/192/256-CTR are still offered and reachable. Forced-software64B p50 increases94/120ns per AES128/AES256 call, while16KiB software time improves19.67%/22.08% and default-dispatched duplex state saves704/960B per session. Existing85501/85502 contain paired raw results, source, dependencies and perf guards. The compatible maintenance commit now records both findings, including J358's shorter-batch default-backend slowdown qualification.

Reworded maintenance commit 5dbe50dda; final pushed head 5288f65690d77ee6aae9b9c4eea68266fdb1b6de, branch deps-refresh-340, unchanged product tree. Current dev is still6ffe37e06. Both VM slots checked, exact Cargo launcher passed (1.99.1), and requested compute01 verify fast is running as PID476927, log ~/.cache/codex-scratch/J340/evidence/j358-final-verify-fast.log, jobs3/incremental0. This is a progress finding, not a gate pass. No merge/deploy.

J340 addresses J358 P2-1 with an actual linked-symbol/ELF diff for original commit `5e0338370f02797f0d5c7516d9c3f2d96f376512` against parent `6b1bdb81b`. Both targets completed exit0. Raw `nm -S -C --defined-only`, section/size tables, hashes, driver and diff scripts are attached as a ZIP. No source-size inference. Recipe: each revision's Rust1.99.0, existing auth-toolchain/static-cargo, static musl, release opt3/LTO/one CGU/unwind. Only attribution override is `CARGO_PROFILE_RELEASE_STRIP=false`; symbols are captured and both analysis copies are stripped with the same LLVM21.1.8 tool. Consequently these analysis totals **do not reproduce** the earlier default-strip shipping receipt (+112,608/+74,320 B), which remains a separate measurement. | analysis artifact | before B | after B | delta B | |---|---:|---:|---:| | x86_64 | 27,805,496 | 27,903,768 | +98,272 | | aarch64 | 25,001,264 | 25,077,312 | +76,048 | | x86 `.text` | 21,210,924 | 21,289,068 | +78,144 | | arm64 `.text` | 17,893,372 | 17,940,860 | +47,488 | | x86 `.rodata` | 2,164,208 | 2,180,592 | +16,384 | | arm64 `.rodata` | 2,489,352 | 2,513,928 | +24,576 | Every named owner above1KB in either direction and the largest changed symbols appear in the attached Markdown/JSON. The largest positive owners are below; **none has >=30KB net growth on either target**. | linked namespace | x86 delta B | arm64 delta B | |---|---:|---:| | Core generic/drop glue | +17,376 | +8,096 | | russh | +15,179 | +12,428 | | mesh product callers | +14,976 | -1,312 | | Tokio | +11,671 | +8,388 | | rustls | +11,183 | +9,708 | | Hyper | +7,064 | +6,152 | | GotaTun callers | +5,660 | +2,920 | | ssh_key | +4,948 | +2,548 | | h2 (text+named data) | +4,548 | +2,800 | | crc32fast (text+named data) | under1KB | +8,212 | | AES direct namespace | -1,517 | +2,388 | | ICU named code, all namespaces | +106 | +104 | This is ownership after linking, **not isolated causal version attribution**: LTO moves generic/inlined code into caller namespaces. rustls, russh, mesh and GotaTun source versions do not change in this commit. In particular, the growth in russh contains AES128/192/256-CTR `apply_keystream` monomorphizations (+5560/+5320/+5560 B x86 and +3964/+3852/+3956 B arm64); direct AES code also has offsets. ICU data may be in unnamed constants, but the entire read-only section grows only16KB/24KB. The source-size suspicion does not establish a30KB ICU contribution. Unwind/relocation/alignment section differences are retained in `j358-section-diff.md`; unnamed constant ownership remains unassigned rather than guessed. Benefits retained: Tokio1.54.1 includes shutdown-bit/readiness-tick preservation, interrupted-I/O retries, copy_buf flush/cooperation, blocking-worker hang fixes and the timer-handle rollback. Our networking, timers and blocking workers use this runtime. ICU2.4 supplies Unicode18 data and normalizer soundness fixes (upstream8628), plus collection correctness fixes; this supports hostname/IDNA handling, without claiming our exact caller was exploitable. AES0.9.4 supplies the measured compact-state/bulk-software benefits in85501/85502. These changes have needed correctness or memory benefits. No demonstrated gratuitous large contributor supports a pin-back, so **no versions were pinned back**. No foundational library/backend replaced. P2-2: after rebase onto6ffe37e06/J346, CBC factories are excluded by default but AES128/192/256-CTR are still offered and reachable. Forced-software64B p50 increases94/120ns per AES128/AES256 call, while16KiB software time improves19.67%/22.08% and default-dispatched duplex state saves704/960B per session. Existing85501/85502 contain paired raw results, source, dependencies and perf guards. The compatible maintenance commit now records both findings, including J358's shorter-batch default-backend slowdown qualification. Reworded maintenance commit `5dbe50dda`; final pushed head **`5288f65690d77ee6aae9b9c4eea68266fdb1b6de`**, branch `deps-refresh-340`, unchanged product tree. Current dev is still6ffe37e06. Both VM slots checked, exact Cargo launcher passed (1.99.1), and requested compute01 `verify fast` is running as PID476927, log `~/.cache/codex-scratch/J340/evidence/j358-final-verify-fast.log`, jobs3/incremental0. This is a progress finding, not a gate pass. No merge/deploy.

j358-linked-receipts.zip

4 MiB

kayg commented

2026-11-07 21:05:39 +00:00

Author

Owner

J340 final-gate checkpoint: pushed head 5288f65690d77ee6aae9b9c4eea68266fdb1b6de remains clean; product tree unchanged by follow-up. Linked-size raw receipts and P2 conclusions are attached85686; AES receipts85501/85502. verify fast is active on compute01, sole own driver PID476927, one target /home/claude/worktrees/J340/target, raw log ~/.cache/codex-scratch/J340/evidence/j358-final-verify-fast.log.

Formatting/vendoring/migration, CLI compile-out, Clippy, and fixture/component checks have passed. Workspace binaries built and tests are executing; completed groups currently report zero failures, but the workspace row and remaining privileged/static/frontend rows are still pending. No gate pass claimed from a progress tail. I am waiting in the foreground, then will attach the complete result, sizes/hashes and cleanup receipt. No additional dependency changes or pins; no merge/deploy.

J340 final-gate checkpoint: pushed head `5288f65690d77ee6aae9b9c4eea68266fdb1b6de` remains clean; product tree unchanged by follow-up. Linked-size raw receipts and P2 conclusions are attached85686; AES receipts85501/85502. `verify fast` is active on compute01, sole own driver PID476927, one target `/home/claude/worktrees/J340/target`, raw log `~/.cache/codex-scratch/J340/evidence/j358-final-verify-fast.log`. Formatting/vendoring/migration, CLI compile-out, Clippy, and fixture/component checks have passed. Workspace binaries built and tests are executing; completed groups currently report zero failures, but the workspace row and remaining privileged/static/frontend rows are still pending. No gate pass claimed from a progress tail. I am waiting in the foreground, then will attach the complete result, sizes/hashes and cleanup receipt. No additional dependency changes or pins; no merge/deploy.

kayg commented

2026-11-07 21:19:02 +00:00

Author

Owner

J340 final compute01 gate finding: full workspace row passed (1292s), but dedicated shim process-per-user row failed 1/243 cases: session::user_host::tests::exhausted_pool_drains_live_ptys_during_random_session_churn, user_host.rs:1520, type_and_drain(...key...) returned3 bytes where the assertion expects1. Row result222 passed/1failed/20ignored. Gate is still running its remaining rows; it will be reported red unless independently resolved. Cargo-deny passed afterward.

The test/helper source is unchanged against current origin/dev6ffe37e06. It writes a character, polls once, drains one session turn, then writes DEL and repeats. A possible explanation is PTY erase-echo fragmentation across turns (a three-byte echo is consistent with the erase sequence), but this is a hypothesis, not baseline proof or a dependency-exoneration claim. After this gate releases its sole slot I will run the focused case on the final tree and unmodified current dev with its original lock/toolchain, preserving every result. No fixture, assertion, sleep, timeout, gate policy or product code changed.

Raw failure remains ~/.cache/codex-scratch/J340/evidence/j358-final-verify-fast.log lines6732–6748, active driver476927. Head unchanged5288f65690d77ee6aae9b9c4eea68266fdb1b6de; linked/AES findings85686 and85501/85502 unchanged.

J340 final compute01 gate finding: full workspace row passed (1292s), but dedicated `shim process-per-user` row failed **1/243** cases: `session::user_host::tests::exhausted_pool_drains_live_ptys_during_random_session_churn`, user_host.rs:1520, `type_and_drain(...key...)` returned3 bytes where the assertion expects1. Row result222 passed/1failed/20ignored. Gate is still running its remaining rows; it will be reported red unless independently resolved. Cargo-deny passed afterward. The test/helper source is unchanged against current origin/dev6ffe37e06. It writes a character, polls once, drains one session turn, then writes DEL and repeats. A possible explanation is PTY erase-echo fragmentation across turns (a three-byte echo is consistent with the erase sequence), but **this is a hypothesis, not baseline proof or a dependency-exoneration claim**. After this gate releases its sole slot I will run the focused case on the final tree and unmodified current dev with its original lock/toolchain, preserving every result. No fixture, assertion, sleep, timeout, gate policy or product code changed. Raw failure remains `~/.cache/codex-scratch/J340/evidence/j358-final-verify-fast.log` lines6732–6748, active driver476927. Head unchanged5288f65690d77ee6aae9b9c4eea68266fdb1b6de; linked/AES findings85686 and85501/85502 unchanged.

kayg commented

2026-11-07 21:51:11 +00:00

Author

Owner

J340 follow-up handoff for J35885489. Branch deps-refresh-340, pushed head 5288f65690d77ee6aae9b9c4eea68266fdb1b6de; base 6ffe37e067d8fa7b090ea83c21b84b77937f76d9, including J346. Rebased FIRST; all16 dependency slices retained. Compatible-maintenance commit is now 5dbe50dda, reworded to record linked-size attribution and the AES trade-off. No dependency resolutions/product source changed in this follow-up, no pins rolled back, no merge/deploy/issue closure.

P2-1 attribution: exact original 5e0338370 parent/commit symbol and ELF section diff is attached85686, including raw symbols, sections, sizes, hashes and scripts. No named crate namespace contributes30KB net growth on either architecture. Largest x86 changes: Core glue+17,376B, russh+15,179B, mesh callers+14,976B, Tokio+11,671B, rustls+11,183B. Arm leaders: russh+12,428B, rustls+9,708B, Tokio+8,388B, crc32fast+8,212B. ICU named code is only+106/+104B; all read-only-section growth is16,384/24,576B. Inlined/generic ownership is not isolated causal version attribution: unchanged source also changes in callers. Retain Tokio readiness/shutdown/interrupt/blocking-hang fixes and ICU normalizer soundness/current Unicode data; no demonstrated gratuitous large contributor supports a pin-back.

receipt	x86_64 B	arm64 B
original batch shipping delta	+112,608	+74,320
historical symbol-retaining/LLVM-stripped analysis delta	+98,272	+76,048
final rebased shipping static size	27,799,920	24,985,872

The analysis pair retains symbols before applying the same LLVM strip to both; it does not reproduce the earlier default-strip size delta. The final absolute sizes include inherited dev/J346 changes and are not substituted for the historical batch attribution. Raw size/SHA receipts attached.

P2-2 AES: J346 removes default CBC factories but leaves all AES128/192/256-CTR factories offered/reachable. Three paired perf trials and selected-graph/source/state receipts are attached85501/85502. Software64B p50 AES128/AES256 rises302.264→396.505 /403.061→523.098ns per call (+94/+120ns); software16KiB time improves19.67%/22.08%. Default duplex state saves704/960B per session (35,200/48,000B at50 sessions; object sizes, not RSS). Retained patch and trade-off are explicit in the commit, including the qualification that our long-batch default-backend result does not disprove J358's shorter-batch slowdown. No backend/factory/algorithm replacement.

Gate remains RED: the requested compute01 scripts/verify fast completed VERIFY_FAST_EXIT=1. All23 other Rust rows passed, including full workspace tests (1292s), cargo-deny, privileged integration101/101, and both static builds. The sole failing row is shim process-per-user:222 passed/1failed/20ignored, at unchanged user_host.rs:1520, where exhausted_pool_drains_live_ptys_during_random_session_churn drained3 bytes while expecting1. Subsequent frontend/protocol checks were not reached by this run; no fresh pass is claimed for them. Complete raw gate log attached; table quoted verbatim below.

Baseline reproduction established: using unmodified dev6ffe37e06, original Cargo.lock, Rust1.99.0, nix0.30.1, and the same unchanged test-source SHA c2d8dcfc25a82fbe85e137936bf74cd844945080ec7bbc4c42937bc6baa56bcd, the same assertion failed at baseline direct-repeat trial483 (drained5 vs1). Exact input hashes, build/cargo version, binary hashes and raw run logs are in the attached comparison ZIP. Both baseline and final whole-suite reruns separately passed223/223 with20ignored; initial100 focused baseline trials passed, while the candidate reproduced at focused trial5 (4 vs1) and the direct candidate run reproduced at trial1 (3 vs1, equivalent assertion at1540).

This proves the assertion can fail before these updates. It does not establish its root cause, rule out dependency/compiler effects on frequency, or measure comparative failure rates. PTY echo fragmentation is still a hypothesis. No assertion/sleep/timeout, fixture, gate or production workaround was changed; no rerun-until-green claim. Recommend a separate bounded PTY fixture investigation (roughly1–2h including syscall evidence and a deterministic fix/review). The orchestrator should treat this head's full gate as failed pending that disposition.

The full dependency inventory/current/latest/semver table, batch receipts, advisories and deferred migrations in prior final report85376 remain unchanged. Duplicates remain54 names/60 excess→53/59 overall; no new license expression or allowed-list expansion. The existing unfixed rsa advisory and deferred security migrations remain listed there; no advisory suppression added. Approved OpenSSL security commit and measured off-hot-path cost retained. libghostty-vt untouched.

Cleanup complete: J358_TARGET_CLEANED, empty own process inventory [], remote clean checkout at final head. All own foreground/background work finished; evidence retained outside target on compute01 and under /home/kayg/.cache/codex-scratch/J340/evidence/. Cleanup log attached.

Verbatim final Rust table / exit (full unabridged command log attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | FAIL (101)   |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | PASS         |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
VERIFY_FAST_EXIT=1

J340 follow-up handoff for J35885489. Branch **`deps-refresh-340`**, pushed head **`5288f65690d77ee6aae9b9c4eea68266fdb1b6de`**; base **`6ffe37e067d8fa7b090ea83c21b84b77937f76d9`**, including J346. Rebased FIRST; all16 dependency slices retained. Compatible-maintenance commit is now `5dbe50dda`, reworded to record linked-size attribution and the AES trade-off. No dependency resolutions/product source changed in this follow-up, no pins rolled back, no merge/deploy/issue closure. **P2-1 attribution:** exact original `5e0338370` parent/commit symbol and ELF section diff is attached85686, including raw symbols, sections, sizes, hashes and scripts. No named crate namespace contributes30KB net growth on either architecture. Largest x86 changes: Core glue+17,376B, russh+15,179B, mesh callers+14,976B, Tokio+11,671B, rustls+11,183B. Arm leaders: russh+12,428B, rustls+9,708B, Tokio+8,388B, crc32fast+8,212B. ICU named code is only+106/+104B; all read-only-section growth is16,384/24,576B. Inlined/generic ownership is not isolated causal version attribution: unchanged source also changes in callers. Retain Tokio readiness/shutdown/interrupt/blocking-hang fixes and ICU normalizer soundness/current Unicode data; no demonstrated gratuitous large contributor supports a pin-back. | receipt | x86_64 B | arm64 B | |---|---:|---:| | original batch shipping delta | +112,608 | +74,320 | | historical symbol-retaining/LLVM-stripped analysis delta | +98,272 | +76,048 | | final rebased shipping static size | 27,799,920 | 24,985,872 | The analysis pair retains symbols before applying the same LLVM strip to both; it does not reproduce the earlier default-strip size delta. The final absolute sizes include inherited dev/J346 changes and are not substituted for the historical batch attribution. Raw size/SHA receipts attached. **P2-2 AES:** J346 removes default CBC factories but leaves all AES128/192/256-CTR factories offered/reachable. Three paired perf trials and selected-graph/source/state receipts are attached85501/85502. Software64B p50 AES128/AES256 rises302.264→396.505 /403.061→523.098ns per call (+94/+120ns); software16KiB time improves19.67%/22.08%. Default duplex state saves704/960B per session (35,200/48,000B at50 sessions; object sizes, not RSS). Retained patch and trade-off are explicit in the commit, including the qualification that our long-batch default-backend result does not disprove J358's shorter-batch slowdown. No backend/factory/algorithm replacement. **Gate remains RED:** the requested compute01 `scripts/verify fast` completed **`VERIFY_FAST_EXIT=1`**. All23 other Rust rows passed, including full workspace tests (1292s), cargo-deny, privileged integration101/101, and both static builds. The sole failing row is `shim process-per-user`:222 passed/1failed/20ignored, at unchanged `user_host.rs:1520`, where `exhausted_pool_drains_live_ptys_during_random_session_churn` drained3 bytes while expecting1. Subsequent frontend/protocol checks were not reached by this run; no fresh pass is claimed for them. Complete raw gate log attached; table quoted verbatim below. **Baseline reproduction established:** using unmodified dev6ffe37e06, original Cargo.lock, Rust1.99.0, nix0.30.1, and the same unchanged test-source SHA `c2d8dcfc25a82fbe85e137936bf74cd844945080ec7bbc4c42937bc6baa56bcd`, the same assertion failed at baseline direct-repeat trial483 (drained5 vs1). Exact input hashes, build/cargo version, binary hashes and raw run logs are in the attached comparison ZIP. Both baseline and final whole-suite reruns separately passed223/223 with20ignored; initial100 focused baseline trials passed, while the candidate reproduced at focused trial5 (4 vs1) and the direct candidate run reproduced at trial1 (3 vs1, equivalent assertion at1540). This proves the assertion can fail before these updates. It does **not** establish its root cause, rule out dependency/compiler effects on frequency, or measure comparative failure rates. PTY echo fragmentation is still a hypothesis. No assertion/sleep/timeout, fixture, gate or production workaround was changed; no rerun-until-green claim. Recommend a separate bounded PTY fixture investigation (roughly1–2h including syscall evidence and a deterministic fix/review). The orchestrator should treat this head's full gate as failed pending that disposition. The full dependency inventory/current/latest/semver table, batch receipts, advisories and deferred migrations in prior final report85376 remain unchanged. Duplicates remain54 names/60 excess→53/59 overall; no new license expression or allowed-list expansion. The existing unfixed rsa advisory and deferred security migrations remain listed there; no advisory suppression added. Approved OpenSSL security commit and measured off-hot-path cost retained. libghostty-vt untouched. Cleanup complete: `J358_TARGET_CLEANED`, empty own process inventory `[]`, remote clean checkout at final head. All own foreground/background work finished; evidence retained outside target on compute01 and under `/home/kayg/.cache/codex-scratch/J340/evidence/`. Cleanup log attached. Verbatim final Rust table / exit (full unabridged command log attached): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | FAIL (101) | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | PASS | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ VERIFY_FAST_EXIT=1 ```

j358-final-verify-fast.log

874 KiB

j358-shim-comparison-receipts.zip

23 KiB

j358-final-binary-size.txt

196 B

j358-final-binary-sha.txt

295 B

j358-cleanup.log

96 B

kayg referenced this issue

2026-11-08 14:24:16 +00:00