harden: security fixes, durability, and repo hygiene #18

hugooconnor commented 2026年06月15日 01:37:11 +02:00

Hardens hence following a multi-agent review: security fixes, durability guarantees for concurrent plan mutation, repo hygiene, and contributor onboarding. All ten findings were source-verified (a couple of agent-flagged issues turned out to be false positives and were dropped).

Security

• identity: private keys now written 0o600; loading repairs loose perms on existing identity files in place
• storage: bootstrap peer hints validated as multiaddrs before caching (prevents registry poisoning by a malicious peer); replica_path rejects non-hex plan ids (path-traversal footgun)
• remote/client: capability tokens validated before URL-path interpolation

Durability & correctness

• lifecycle: P2P appends hold a PlanFileLock across the decrypt-append-reencrypt cycle — fixes silent lost updates when concurrent agents mutate the same plan. Local appends now lock + fsync, matching the spawn path.
• storage: replica writes are atomic (temp file + rename) so a crash mid-write can't corrupt a replica
• complete: uses the format-aware separator instead of a hardcoded SPL hyphen

Tests & CI

• identity: added unit tests (keygen, PKCS#8 round-trip, permissions) to a previously untested module
• perf: untimed warmup before the latency NFR measurement (first-exec OS overhead was masking the real ~60ms timing)
• ci: new release-build perf job so the NFR-007 bounds (binary size, latency) are actually enforced — debug builds relax them

Hygiene & docs

• .gitignore now covers binaries, tarballs, dist dirs, PDFs, scratch files
• main.rs: dropped misleading #[allow(dead_code)] on live modules; kept targeted item-level allows where warnings would otherwise fire (this surfaced that the auth SPAKE2 module is genuinely unwired)
• added CONTRIBUTING.md documenting the sibling spindle-rust checkout
• README: replaced stale Racket build steps with accurate Rust instructions
• archived docs-audit.md (v0.6.7) under reviews/

Verification

• cargo test: 984 passed, 0 failed, 12 ignored (P2P network tests)
• cargo test --release --test perf: passes
• cargo fmt --check and cargo clippy -- -D warnings: clean

🤖 Generated with Claude Code

Hardens hence following a multi-agent review: security fixes, durability guarantees for concurrent plan mutation, repo hygiene, and contributor onboarding. All ten findings were source-verified (a couple of agent-flagged issues turned out to be false positives and were dropped). ## Security - **identity**: private keys now written `0o600`; loading repairs loose perms on existing identity files in place - **storage**: bootstrap peer hints validated as multiaddrs before caching (prevents registry poisoning by a malicious peer); `replica_path` rejects non-hex plan ids (path-traversal footgun) - **remote/client**: capability tokens validated before URL-path interpolation ## Durability & correctness - **lifecycle**: P2P appends hold a `PlanFileLock` across the decrypt-append-reencrypt cycle — fixes silent lost updates when concurrent agents mutate the same plan. Local appends now lock + `fsync`, matching the spawn path. - **storage**: replica writes are atomic (temp file + rename) so a crash mid-write can't corrupt a replica - **complete**: uses the format-aware separator instead of a hardcoded SPL hyphen ## Tests & CI - **identity**: added unit tests (keygen, PKCS#8 round-trip, permissions) to a previously untested module - **perf**: untimed warmup before the latency NFR measurement (first-exec OS overhead was masking the real ~60ms timing) - **ci**: new release-build perf job so the NFR-007 bounds (binary size, latency) are actually enforced — debug builds relax them ## Hygiene & docs - `.gitignore` now covers binaries, tarballs, dist dirs, PDFs, scratch files - `main.rs`: dropped misleading `#[allow(dead_code)]` on live modules; kept targeted item-level allows where warnings would otherwise fire (this surfaced that the `auth` SPAKE2 module is genuinely unwired) - added `CONTRIBUTING.md` documenting the sibling `spindle-rust` checkout - README: replaced stale Racket build steps with accurate Rust instructions - archived `docs-audit.md` (v0.6.7) under `reviews/` ## Verification - `cargo test`: 984 passed, 0 failed, 12 ignored (P2P network tests) - `cargo test --release --test perf`: passes - `cargo fmt --check` and `cargo clippy -- -D warnings`: clean 🤖 Generated with [Claude Code](https://claude.com/claude-code)

This pull request can be merged automatically.

You are not authorized to merge this pull request.