Mesh core slice 1: coordination, join, rules, rotation (D163–D167) #80
Closed
opened 2026-10-07 11:12:17 +00:00 by kayg
·
47 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#80
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Mesh core, slice 1 (D163–D167, grill #79). Backend only: no UI (D162/D167).
Scope: coordination in the server (addresses from 10.254.0.0/16 + ULA, public-key distribution, rule compilation from grants with deny by default), node join from the infraternal agent, silent 7-day key rotation, removal pushed to all peers, last-known-rules behaviour when the server is unreachable,
.internalname table,infraternal mesh status, API and MCP surface. The WireGuard data plane sits behind a backend trait; slice 1 ships a test backend plus the Linux kernel backend once the owner picks the netlink control library (#81 measures it).Performance every round (D167): rule propagation time, join time, rotation impact, memory and CPU per peer × expected peers (100, 1,000, 10,000), idle cost.
Starting slice 1 on mesh-core, base
ac03b1913b; only writer. Read #80 and all nine #79 comments plus repository contracts. Standalone crate only; no transport/kernel/UI wiring. Proposed additive contracts: peer views describe inbound initiation grants and outbound initiation grants separately, with established replies permitted by a stateful backend; key overlap is 120 seconds, expired only by explicit coordinator progress (server outage never expires local views); per-node desired rule version advances only when that view changes, so delivery markers compare acknowledged vs desired per-node versions. DNS table changes are separate shared deltas, not full tables in every peer update. ULA deployment ID is caller-supplied 40-bit random entropy, persisted once by slice 2. No crypto/netlink engine selection.Contract refinement from rotation review: a 120-second timer alone cannot guarantee continuity when a peer misses delivery. Retirement will require BOTH >=120 seconds and applied-view acknowledgements from every current peer. The rotating node must retain both local private keys until explicit retirement; disconnected resolvers/backends retain their last view indefinitely (D166). The future kernel backend must implement this overlap atomically; this crate specifies the requirement, not a netlink implementation. Reference full compiler is independent of indexed policy state.
Finding: the first generated-property run failed 2/8 tests. Explicit reproducer join_to_same_tag_grants_both_initiation_directions: a tag→same-tag arrow followed by joining another member omitted the destination-side ordered pair. Recorded failing tests before fix; source/destination incident expansion is now independent, without tag Cartesian expansion on join/tag edit. Evidence will land in crates/infraternal-mesh/tests/properties.rs; draft log records 6 passed, 2 failed. Running the fixed property suite now.
Proposed coordinator budgets for review (not changes to owner decisions): at 10,000 nodes/20 node arrows per node, single sparse arrow/remove/rotation p95 <1 ms server CPU; full compile <1 s CPU; coordinator RSS <256 MiB including indexed grants/cached views; one 10,000-peer view <4 MiB incremental RSS; address allocate and DNS lookup <1 us CPU each. Measure 5 full-compile samples/shape, 20 incremental samples; JSON byte size and nodes touched reported. Peak RSS includes fresh full-compile outputs. Host measurements under CPUWeight=10000, not pinned perf-VM CI promises. Checkpoint round trip now preserves inventory, allocation high-water mark, rules, per-node versions and public rotation overlaps; acknowledgements reset on restore. Found and reproduced version-overflow panic from a maximal checkpoint before fixing it with pre-mutation counter-capacity checks.
Gate environment finding: first scaffold fast run passed fmt/native fmt/clippy/deny but test failed because scripts/verify-agent-attach-credit.py creates target/ac without a parent; static build failed because .cargo/musl-cc.sh/.cargo/musl-ar.sh hard-code target/auth-tools despite CARGO_TARGET_DIR. Resolved without source changes: ignored worktree target symlink points to this job scratch target. Retrying full fast gate. Preliminary weighted 10k/20-arrow baseline: coordinator RSS 308,695,040 bytes (30,633 incremental bytes/node ×10,000), 419,918 cached peer entries. Replaced one tree allocation per directed pair with compact rule-ID vectors; fixed suite passes 10 tests plus private-key compile-fail check before final measurements.
Second fast attempt hit an unrelated base fixture failure: saturated_terminal_queues_preserve_every_byte_and_daemon_liveness, scripts/verify-agent-queues.py:26 attach received terminal shim disconnected (load 34.81/27.91/20.68). No existing crate/script changed. Weighted retry (CPUWeight=10000, four test threads, job-local short fixture root) has passed workspace tests and deny; awaiting first aarch64 static build. Independent fuzz graph now passes advisories/bans/licenses/sources. Preliminary standalone view: 314 bytes/peer ×10,000 = 3,141,632 incremental RSS bytes. Preliminary server rotation: ~15 ms CPU, 9,999 nodes touched, 3,667,641 JSON bytes; unlike sparse degree-41 updates, full fanout does not meet a universal 1 ms target. Proposed full-fanout budget: 50 ms CPU, combined coordinator+fresh-compile peak <512 MiB, pending final release-profile matrix.
Self-review finding: checkpoint_after_suffix_change_restores_without_reallocating_addresses failed with InvalidCheckpoint (0 passed, 1 failed) after rename + suffix change. Allocation held the original MeshSettings, while restore incorrectly compared DNS/rotation metadata as well as address settings. Added the failing regression before restricting checkpoint compatibility to IPv4 range + ULA ID. DNS changes now restore without reallocating addresses; all allocator settings are still independently validated. Evidence paths: crates/infraternal-mesh/src/coordinator/checkpoint.rs and tests/properties.rs.
Completed scaffold:
a68a6d7486. Add an AGPL-3.0-only workspace member with existing serde/thiserror dependencies. Keep transport, crypto and device engines outside this crate instead of depending on the server or infraternal agent crates (D163/D167). Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Completed model:
9b2c2983d7. Define public identity, tags and validated deployment defaults (D163/D165/D166). Private node-side key material has redacted Debug and no serde/clone; a compile-fail check rejects serialization instead of relying on log discipline. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Completed address:
9b50b03fe3. Allocate monotonic stable dual-stack host addresses and validate allocation checkpoints (D165). Return all explicit route conflicts instead of changing the IPv4 range or recycling removed addresses. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Completed names:
957a9998f4. Maintain suffix-scoped host records with atomic rename/suffix deltas (D165). Reject invalid or duplicate names before mutation instead of letting names overwrite another node. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Completed rules:
1002c7a01c. Represent directional node/tag arrow grants, protocol/port unions and stage-2 user rejection (D164/D154). Preserve deny-by-default and stateful reply semantics instead of making routing itself a permission grant. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Contract finding after the rules step (
1002c7a): omitted_arrow_ports_default_to_all_services fails with missing field ports (0 passed, 1 failed). D164 requires all services by default for a newly granted arrow. Proposed additive correction: omitted arrow port restriction deserializes as All; TrafficPolicy::default remains None for compiled views. Dedicated regression and atomic fix queued after module commits; no deny-by-default relaxation without an arrow. Names957a999and rules1002c7aeach passed the complete fast gate.Completed view:
272851b8d9. Specify serializable per-node peer snapshots and minimal diffs with applied-version checks (D164/D166). Reject wrong-target and stale updates before mutation instead of accepting unordered policy delivery. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).View committed as
272851bafter full fast pass. Coordinator first gate passed clippy/deny/static builds but hit an unchanged VT fixture deadline: unaffordable_repaints_park_until_sufficient_credit, t1-gate-faithful-1; stderr says detached initial producer must finish (12 MiB output, 5-second deadline in scripts/verify-vt-credit.py:30). Retrying the coordinator gate; no existing test/crate changes and no coordinator commit until it passes.Completed coordinator:
a298ab7baa. Index endpoint rules and incident directed grants; emit only changed peers for join/removal/arrows/tags/rotation (D163–D166). Compact rule-ID vectors avoid 83.7 MB of per-pair tree overhead at 200k arrows. Key retirement requires 120 seconds plus applied-view acknowledgements; retain both keys during outages instead of timer-only retirement. Check version capacity before mutation. Full compilation independently rebuilds grant policy for reference and reconnect. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Completed backend:
148b9acbf6. Expose peer-diff application and handshake/transfer stats through a device-independent Backend with a memory implementation (D163/D167). Status includes unknown/direct/relayed paths and applied/desired versions. Require atomic stateful filtering and logical key overlap; defer all kernel/netlink implementation to owner decisions from #81. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Coordinator
a298ab7and backend148b9acpassed complete fast gates. Edge finding: unrepresentable_rotation_overlap_rejects_before_mutation fails (0 passed, 1 failed) for now_secs=u64::MAX. Saturating deadline arithmetic accepts a replacement but makes a same-clock retirement eligible, violating the minimum 120-second overlap. Dedicated failing regression recorded; atomic fix will reject unrepresentable deadlines before key/view mutation. Benchmark example now returns errors instead of unwrap outside tests; production dependency scope remains serde/thiserror.Completed checkpoint:
899a9e6e9e. Persist only canonical public inputs, monotonic allocation history, desired versions and key overlaps (D165/D166). Validate and rebuild indices on restore; reset acknowledgements instead of trusting persisted delivery or changing addresses on coordinator restart. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Checkpoint
899a9e6passed complete fast. Property commit gate passed fmt/clippy/deny/static but hit another unchanged terminal fixture: repeated_tiny_credit_pauses_preserve_shell_progress, scripts/verify-agent-snapshot.py:48 count/cursor assertion (5 review tests passed, 1 failed). Retrying the full gate before committing tests. Mesh test source remains 14 focused/property cases plus the private-key compile-fail; no existing crate or fixture modifications.Properties step retry: unchanged crates/infraternal/tests/vt_reconnect.rs:20 timed out in snapshot_limits_never_close_live_reconnect (34.66s). Mesh tests pass independently. Complete fast gate retried with serial test execution to reduce competing fixture load; no existing crate changes.
Serial-test retry still hit an unchanged base fixture: crates/infraternal/tests/vt_credit.rs:22, t1-gate-approximate-16384 (25.14s). Host load 32.25/30.17/27.07 on 8 cores. Mesh not wired into this binary. Retrying full gate under required CPUWeight=10000; no skipped tests or fixture edits.
Completed properties:
7b893d6b80. Exercise 10,000 seeded mutations against independent fresh compilation; check 30,000 unique address pairs, all 65,535 ports for protocol-specific unions, key removal, delayed overlap retirement, checkpoint restoration, names, status and minimal targeting. Same-tag join and maximal-version regressions failed before their fixes (D40/D164–D167). Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Properties committed
7b893d6after full scripts/verify fast passed. Benchmark-clock gate hit unchanged scripts/agent_fixture.py:138 / crates/infraternal/tests/agent_daemon.rs:18: terminal open refused, 5.70s; mesh not wired into binary. Retrying the full gate under CPUWeight=10000 without skips or fixture changes.bench-clock full-gate attempt 1 hit the unchanged base terminal fixture:
Full gate retried under CPUWeight=10000 without skips or existing-crate edits. Load: 25.45 27.76 27.01 14/1398 3585927
Fuzz validation finding: first direct nightly ASAN build omitted -Cpasses=sancov-module; libFuzzer reported no interesting inputs/no coverage counters. Its 20,000 runs are excluded from evidence. Rebuilt using the coverage pass documented by libfuzzer-sys; final evidence must include counters/coverage and use final code.
Completed bench-clock:
fac4e928a5. Reuse the existing workspace nix wrapper as a benchmark-only dependency to measure process CPU independently of loaded-host wall time (D167). Avoid unsafe clock FFI or a new timing engine; production mesh dependencies stay serde and thiserror. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Completed benchmarks:
93d42f9dd1. Add fresh-process 100/1k/10k × 1/5/20 arrow measurements with CPU/wall time, peak/current RSS, JSON diff bytes, join/allocation/lookup cost and standalone 10k-peer memory (D167). Weight all benchmark processes at 10000; report server rotation fanout separately instead of extrapolating sparse-node latency. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).default-arrow full-gate attempt 1 hit the unchanged base terminal fixture:
Full gate retried under CPUWeight=10000 without skips or existing-crate edits. Load: 32.11 23.16 23.35 34/1376 3711277
default-arrow full-gate attempt 2 hit the unchanged base terminal fixture:
Full gate retried under CPUWeight=10000 without skips or existing-crate edits. Load: 38.12 26.98 24.62 87/1699 3742521
Completed default-arrow:
0416534ff0. The omitted ports regression failed with missing field ports. D164 grants all services for a newly created arrow unless ports are specified; preserve TrafficPolicy::default as None so compiled views remain deny by default. Reject changing the compiled policy default because that would broaden access. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).rotation-clock full-gate attempt 1 hit the unchanged base terminal fixture:
Full gate retried under CPUWeight=10000 without skips or existing-crate edits. Load: 41.04 34.17 29.05 37/1440 3840882
Completed rotation-clock:
15e4e32345. The maximal-clock regression failed because saturating addition accepted an overlap shorter than 120 seconds. Check the deadline before mutating identity or peer state, preserving old views on rejection (D166). Reject saturation because key retirement must always honor the minimum overlap. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Final production-source benchmark findings (
15e4e32), CPUWeight=10000, infraternal-dev Intel i9-9900K 3.60GHz, 8 CPUs; one-minute loads 25.88–26.41. Raw paths: crates/infraternal-mesh/evidence/2026-10-07/*.log; reproduction crates/infraternal-mesh/measure.sh.Coordinator incremental RSS 222,609,408 B (~22,261 B/node ×10,000); 419,918 cached peer entries. Standalone 10,000-peer view delta 3,141,632 B (~314 B/peer ×10,000). Allocation 113–161 ns CPU; hot-name lookup 127–185 ns CPU in 20-arrow scale processes. All proposed measured-topology budgets met: sparse p95<1ms, full<1s CPU, coordinator<256MiB, view<4MiB, combined peak<512MiB, allocation/lookup<1us, server rotation p95<50ms. Universal <1ms is NOT met for server fanout (22.911ms p95, 9,999 view recipients plus local-key instruction, up to 3,667,641 JSON B). Dense tags/port sets/kernel/network costs not covered. JSON encoding is outside CPU interval; raw wall times are retained. Scope/topology/profile details are in crate docs.
Completed fuzz-deps:
22c79c00ba. Add a separately locked AGPL fuzz package using the existing repository libfuzzer-sys approach (D40). Keep instrumentation out of production dependencies and avoid a transport parser or new engine. The standalone dependency/license gate passes. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Final production-code ASAN/coverage-guided fuzz run passed 20,000 executions. #20000 DONE cov: 6485 ft: 26123 corp: 871/226Kb lim: 824 exec/s: 281 rss: 445Mb
Input cap 4096 bytes, run max_len 1024; settings/routes/checkpoint/arrow/diff JSON plus 64-operation lifecycle sequences against independent full compilation. The earlier uninstrumented run remains excluded.
Completed fuzz-target:
b59e69bd30. Validate settings, discovered routes, checkpoints, arrows and diffs; compare generated membership/tag/rule/key operations with independent fresh compilation (D40/D164–D167). #20000 DONE cov: 6485 ft: 26123 corp: 871/226Kb lim: 824 exec/s: 281 rss: 445Mb under ASAN with coverage counters. Reject an uninstrumented pass as evidence; no transport parser or kernel engine is added. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Author review completed against PROCESS §2 / D40 and mesh contracts: canonical dual-stack/checkpoint validation; private/public separation (redacted Debug + compile-fail serde test); directed stateful grant unions; stale-version atomic rejection; allocation/name stability; membership/key retirement and indefinite outage retention; license/scope checks; sparse/fanout scale costs. Standalone fuzz Clippy initially rejected chunks_exact(4) at fuzz_targets/mesh.rs:44; as_chunks::<4>() now passes with zero warnings. Final target
b59e69bhas a green full gate and 20,000 ASAN coverage-guided executions (6,485 edges, 26,123 features, 71s). Docs preserve 1,222 synthetic corpus inputs and raw evidence; real kernel packet filtering/continuity remains for #81/slice 2 and independent review remains the next process step. No foundational engine chosen; existing-crate changes limited to workspace/lock metadata.Documentation gate found Clippy doc_markdown errors at README.md:172/173/175 (underscored metric labels missing backticks); all workspace tests, fmt, cargo-deny and static builds passed. Labels now use plain action names, preserving all numbers/raw logs. No production-code change. Rerun standalone mesh Clippy and complete fast gate before docs commit.
Completed docs-evidence:
37469fd3b0. Document inventory binding, persisted ULA/allocation, directed stateful filters, per-node delivery versions, ordered DNS, acknowledged 120-second overlap and indefinite outage retention, plus planned CLI/API/MCP (D40/D123/N2/D163–D167). Publish the nine weighted scale shapes, incremental fanout/memory budgets and final 20k ASAN coverage/corpus evidence. Reject a universal 1ms fanout claim or treating an in-memory backend as kernel packet-continuity proof; #81/slice 2 must prove the real backend. Full scripts/verify fast passed (fmt, native fmt, clippy, workspace tests, cargo-deny, both static builds and TypeScript gates).Final scripts/verify fast, HEAD
37469fd3b0, exit 0. Complete output verbatim, part 1/4:Final scripts/verify fast, HEAD
37469fd3b0, exit 0. Complete output verbatim, part 2/4:Final scripts/verify fast, HEAD
37469fd3b0, exit 0. Complete output verbatim, part 3/4:Final scripts/verify fast, HEAD
37469fd3b0, exit 0. Complete output verbatim, part 4/4:Completed mesh core slice 1 on mesh-core. HEAD
37469fd3b0; 17 atomic commits fromac03b1913b, each gated before commit. Final scripts/verify fast exit 0 on this committed HEAD; complete output quoted verbatim in 4 preceding parts. No existing crate integration, UI, kernel backend, engine choice, push or deployment.16 regression/property tests + private-key compile-fail doctest pass; 10,000 generated mutations and 30,000 address pairs. Final ASAN coverage-guided fuzz: 20,000 executions, 6,485 edges, 26,123 features, 71s. Author PROCESS/D40 review complete.
Weighted 10k nodes/20-arrow results: full compile CPU median 285.967ms/max 348.001ms; coordinator RSS 214.40MiB (~22,261B/node ×10k incremental); combined peak 363.33MiB; view 314B/peer ×10k (~3MiB). Sparse CPU p95: arrow 9.526us (2 view recipients, 685–687 JSON B), removal 45.181us (41, 3,945–3,946B), key rotation 36.517us (41, 15,695B plus local instruction). Server rotation p95 22.911ms (9,999 plus local instruction, up to 3,667,641 JSON B); universal 1ms budget not met for fanout, separate <50ms CPU proposal met. Allocation 113–161ns CPU; hot lookup 127–185ns CPU in 20-arrow scale processes. Machine/load/topology/profile and all nine shape tables: crates/infraternal-mesh/README.md and evidence/2026-10-07/. All proposed measured-topology budgets met; dense tags/port-set storage/kernel/network costs remain outside these results.
How to review: read crate README integration contracts/planned commands; cargo test --locked -p infraternal-mesh; reproduce weighted evidence with crates/infraternal-mesh/measure.sh and retained synthetic fuzz corpus. Independent review follows PROCESS; #81/slice 2 must prove real packet filtering and key-overlap continuity before wiring. Issue stays open.
Merged into dev at
9c62448(standalone crate, not wired). scripts/verify fast after the merge: exit 0; Rust 6/6 PASS, static size within budget, TS 7/7, browser 2/2. Slice 2 (wiring into the server and infraternal agent, CLI/API/MCP) follows #78 and relay mode per D170.kayg referenced this issue2026-10-28 17:53:56 +00:00
Closed by the orchestrator during the 2026-11-09 night housekeeping (owner order: "close stale prs/issues"). The work has landed on dev, and the latest note here is a finish or merge note (J387 inventory on #436). Reopen if anything is still missing.