Repository navigation
VPS services, deep-audit fixes, perf work, terminal setup bundles - #25
Merged
Merged
Conversation
…nd symlink backups
Phase I instrumentation: benches and seams only. New criterion benches across runner, status, audit, proxy, monitor, the toride dashboard crate, ssh doctor/exec/upload, registry, apps, fail2ban, harden, ufw-kit, tailscale, service, and installer, plus harness/decl updates to existing benches (ssh config, authorized-keys, known-hosts, mise, backup) and fixture data (conntrack dump, dep11 catalog, homebrew cask index, self-signed cert). Bench-only seams added so the benches run without host state: - toride-audit: IntegrityManager::with_binary pins an explicit aide binary so a FakeRunner can drive integrity ops without aide - toride-fail2ban: CountingRunner::with_client_status and doctor_all_spawn_report_with_jails for canned per-jail spawn counts - toride-status: root-parameterized read_hwmon_fans_at/_voltages_at and SystemStatus::read_sensors/_static_info/_sensor_snapshot - ufw-kit: Ufw::with_runner_and_status_ttl runner injection
…registry findings Foundations Phase I round 3: closes 18 registry items (foundations-0, 1, 2, 3, 5, 6, 7, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 20). toride-runner: pre-0.2.0 API shape work across spec, output, output mode, redact, policy, display, discovery, error, and both runners; FakeRunner contract extensions; doc-table rewrite in lib.rs; parity and streaming test updates; redact/capture bench updates. toride-fs: atomic-write contract rewrite with perms/fsync semantics and expanded tests; lock and expand hardening with new test modules. toride-diagnostic-types: helper and report findings work with added coverage. Dependent adaptations for the runner API changes: toride-service manager, toride-fail2ban report, and the toride-ssh facade (lib, exec, upload, vps tests, README). Cargo.lock is listed by the round but is gitignored (.gitignore:26) and untracked in this repo, so nothing was staged for it.
…g, and key registry findings ssh-core-config-key Phase I round 3: the complete cumulative change set for the area (round 1 implementation plus the round 2 bench-gate fix), closing 28 registry items plus the round-2 gate fix. toride-ssh-core: host/paths/privilege/runner/types work; the undo module is removed (src/undo.rs deleted, pub mod undo dropped from lib.rs) and the crate doc updated. toride-ssh-config: ast/cache/directives/editor/managed/parse/resolve/ sshd rework with expanded per-module tests, README refresh, and [lib] bench = false so criterion baselines stop reaching the libtest harness (the round 2 gate fix). toride-ssh-key: generate/install/inventory/repair work with tests. Dependent adaptations: agent client, certificate lib, doctor local/ remote, known-hosts scan, ssh integration tests, and the facade's ssh_convert. 43 files: 42 modified, 1 deleted. 2192 insertions, 1623 deletions.
…nd facade registry findings vps-surfaces Phase I round 3: the complete cumulative change set for the area (round 1 implementation plus the round 2 bench-gate repairs), closing 11 registry items (vps-surfaces-0, 2, 3, 4, 5, 6, 7, 8, 10, 13, 15). toride-ssh-exec: argv-disciplined remote execution work in src/lib.rs with README and exec_run_overhead bench updates, and [lib] bench = false so criterion's baseline flags stop reaching the libtest harness. toride-ssh-upload: SFTP batch upload work in src/lib.rs with README and upload_stage_overhead bench updates, and the same [lib] bench = false gate repair. Facade: toride-ssh workspace manifest and src/lib.rs expose the exec and upload subsystems; integration and VPS test surfaces extended. CI: the publish crate list gains toride-ssh-exec and toride-ssh-upload, and a new toride-ssh-features job clippy-tests the exec-only and upload-only feature sets. 13 files, 1187 insertions, 228 deletions.
…nd facade registry findings vps-surfaces round 4 audit fix: the facade docs overclaimed the runner-injection guarantee. SshManager::with_cli_runner's testing guarantee now lists only keys, agent, doctor, and known-hosts; the certificate subsystem takes no runner and spawns real ssh-keygen via toride_ssh_core::runner::ssh_keygen whatever runner the manager carries. Corrected in the facade rustdoc (src/lib.rs, with_cli_runner and the crate-level testing note) and the workspace README. Docs only: 2 files, +19/-12. No behavior change.
…egistry findings fail2ban Phase I round 3: the complete cumulative change set for the area (round 1 implementation plus the round 2 [lib] bench = false gate repair), closing 26 registry items (fail2ban-0 through 7, 9, 10, 11, 14 through 19, 21, 22, 23, 24, 26, 31, 34, 35, 36). Standalone ban engine (ruling 3): detector scan rework with a decoy log fixture and detector_scan bench, doctor rework with spawn oracle updates, store persistence, jail/firewall/manager/cli/service layers, error consolidation, snapshot and proptest regression updates, and the long-stranded spawn_oracle.rs delta from the foundations rounds. This also captures the new lib.test.rs and the proptest regression seeds, which were untracked and would otherwise never be committed. 56 files, 12704 insertions, 1425 deletions.
…gistry findings observers Phase I round 3: the complete cumulative change set for the area (round 1 implementation plus the round 2 bench-gate repairs), closing 32 registry items (observers-0 through 24, 27 through 31, 35, 36). toride-status: sysinfo becomes the only metrics backend — the backend-alternative feature set is removed; capabilities, collector, daemon, doctor, privacy, ssh, system, units, and error reworked; the stale src/mod.rs shim and the five legacy toride__status__* snapshots are deleted (snapshot module renamed to toride_status); [lib] bench = false so criterion owns cargo bench. toride-monitor: alert/anomaly/conntrack/ports/parse/spec rework, serde rc feature, port_query bench update, bench = false. toride-updates: apt/dnf client and schedule work, bench = false. 48 files: 42 modified, 6 deleted. 1865 insertions, 2110 deletions.
… registry findings safety-state Phase I round 3: the complete cumulative change set for the area (round 1 implementation plus the round 2 bench-gate repairs), closing 27 registry items (safety-state-0 through 22, 25, 26, 27) and the round-2 mechanical gate repair. toride-backup: borg/restic client and parse rework, restore paths, schedule and systemd unit generation rework (systemd.rs substantially rewritten), spec/cli/config/doctor/error/report updates, parse_kernels bench update, [lib] bench = false. toride-audit: integrity, doctor, and parse rework with the integrity_status bench update, [lib] bench = false. toride-cloud: aws/gcp client and detect rework with cli/error/render updates riding the same area. 29 files, 2748 insertions, 1764 deletions.
… registry findings safety-state round 4 audit fix: the facade consumer side of the integrity TTL. The dashboard collector now caches AIDE integrity status for 300s, matching IntegrityManager::DEFAULT_STATUS_TTL, instead of re-running aide --check (a full monitored-filesystem re-hash that takes minutes on a real host) on every 2s refresh tick. Doctor findings keep their existing TTL; the collector docs now state both. 1 file, +240/-75.
compat-workspace Phase I round 1: the cross-cutting compatibility and workspace pass, closing 13 registry items (compat-8, 10, 12, 14, 20, 24, 26, 28, 30, install-state-15, workspace-regex, workspace-readme- pins, workspace-em-dash). Repo-wide mechanical dash/filler pass per ruling 1 across the facade (convert/data modules, UI screens, widgets, theme, shell), installer, mise, registry sources, backup/audit/cloud, proxy, harden, tailscale, users, ufw-kit, service ledger, ssh core/exec (new exec runner seam), and the runner/fs READMEs; workspace lints and README pins; docs publishing and runner-remaining-work updates. Removes stale CI workflow backups and the superseded publish script: .github/workflows/ci.yml.bk, release.yml.bk, release.yml.disabled, and scripts/publish-crates.sh are deleted. 206 files: 199 modified, 3 added (ufw-kit ssh_runner, ssh-exec runner, service ledger), 4 deleted. 5877 insertions, 3036 deletions.
…ce registry findings compat-workspace round 2: companion closure for commit 58e432f (auditor blocker). The mechanical pass had left sibling files of the touched crates uncommitted; this lands them. toride-apps: full crate pass (backends, detect, manifest, plan, runner, status, store, tests) plus its bench harness files; ufw-kit: the remainder of the crate (client/command/doctor/framework/iptables/ nat/nft/presets/rule/spec/status with tests and snapshots); proxy: cli/config/diff/parse/render/report/service plus the new site_links module; ssh authorized-keys remainder with fixtures oracle; registry and tailscale manifest/bench updates; facade data modules, status collector, test env, ssh diagnostics tab, and tooltip widget; fs atomic/lib and installer error cleanups. 105 files: 103 modified, 2 added (proxy site_links, ssh diagnostics tab). 4587 insertions, 2243 deletions.
…ce registry findings compat-workspace round 3: land the uncommitted workspace em-dash sweep completions (auditor major finding on 58e432f/7b6c888). Root docs (CLAUDE.md, README.md), apps and registry CHANGELOGs, registry DESIGN and the six docs/survey files; the ssh data-subsystem crates the sweep had not covered (agent askpass/client/session, certificate ca/krl, core with the new fanout module, doctor with the registry module removal, forward control, key generate, known-hosts parse/scan with tests and manifests); tailscale parse/spec, users config, wireguard client, fail2ban manager tests and service, runner display, and the ufw-kit ensure_web_firewall example. 48 files: 46 modified, 1 added (core fanout), 1 deleted (doctor registry).
…ce registry findings compat-workspace round 4: ZERO-DIFF RECONCILIATION MARKER. This commit intentionally changes no files (--allow-empty). The round's items are verification, not implementation: reconciling the unclaimed cross-area implementations already carried by commits 58e432f, 7b6c888, and 9c3ca09 (system-domain-0/1/13, ssh-data-subsystems-0/1/2/13/14/18), and attaching the ssh-data-subsystems-11 remote_checks bench citation in the campaign registry (.zcode/workflow-drafts/phase1-registry.md, untracked). No repository paths changed this round; there is nothing to stage. The empty diff is the accurate record of that.
…findings Phase I foundations round 2: eliminate two unconditional full copies of captured command output on the real runners' success paths. - output: add decode_lossy, the crate-wide lossy-UTF-8 decode step with a zero-copy fast path -- String::from_utf8 hands the buffer back untouched when it is already valid, so from_utf8_lossy(..).into_owned() no longer duplicates every captured stream even when nothing needs replacing. All four decode sites in duct_runner and tokio_runner (uncapped, capped/finish_under_cap, and streaming) now use it. - display: add scrub_output_owned, the ownership-taking sibling of scrub_output used by the real runners: when spec.redact() is false the captured CommandOutput is returned as-is instead of paying a full clone of megabytes of stdout/stderr merely to scrub nothing. Under redaction the semantics are identical to scrub_output. duct_runner (both the plain and size-limited paths) and both tokio runners (plain and streaming) switch to it. New tests pin the contracts: decode_lossy preserves valid UTF-8 and replaces invalid bytes with U+FFFD, and scrub_output_owned agrees with scrub_output in both redact modes.
Phase I ssh-data-subsystems round 2, closing ssh-data-subsystems-11, -23, -26, -27, and -28. - known-hosts: detect_verify_host_key_dns is now the shared, public scanner -- it accepts the keyword value, keyword<TAB>value, and keyword=value separators ssh_config(5) allows, comparing case-insensitively without allocating a lowered copy of each line. toride-ssh-doctor drops its private twin of the scanner and DnsVerifyStatus and routes its VerifyHostKeyDNS check through the shared one; a new test pins the Keyword=value form end to end. - agent: session fan-out gains an injected verifier seam -- list_sessions_with(ssh_dir, verify) plus public VerifyFn and BoxedVerifyFuture types, re-exported from the crate root with the session module made public. The real list_sessions delegates with ssh -O check unchanged. A new criterion bench (session_fanout) binds 24 real Unix sockets and drives the fan-out with a fake verifier, asserting the MAX_CONCURRENT_CHECKS cap while timing the sweep; Cargo.toml registers the target (criterion dev-dep, harness = false, [lib] bench = false). Askpass doc comments tightened. - certificate: krl.rs documents the 10,000-entry serial-range expansion cap and its truncation warning. - benches: known-hosts, authorized-keys, and doctor remote_checks raise sample size to 100, measurement to 8s, warm-up to 1s, and set a 20% noise threshold matching the campaign's bench gate tolerance.
Phase I ssh-data-subsystems round 3, closing ssh-data-subsystems-26 (panic fixed) and ssh-data-subsystems-25 (seam plus bench landed). - known-hosts: config_directive_value compared the keyword prefix via str slicing, so a multi-byte line shorter in chars than the keyword but long enough in bytes could panic slicing at a non-char-boundary. The comparison now runs on byte slices with eq_ignore_ascii_case, and two tests pin multi-byte lines (a euro-sign line against VerifyHostKeyDNS, an emoji Host-ish line against find_user_known_hosts_file_in_config) being skipped, not panicking. - doctor: the agent-identity ssh-keygen -lf fan-out moves into probe_identity_fingerprints with public KeygenProbe and KeygenProbeFuture seam types, re-exported from the crate root; the real ssh_keygen_lf_probe keeps the spawn_blocking duct behavior and AgentIdentityCheck now routes through the extracted helper under the same MAX_CONCURRENT_CHECKS bound. A new criterion bench (local_checks) drives the fan-out with a sleeping fake probe over 24 key paths, asserting overlap and output ordering; Cargo.toml registers the target.
Phase I firewall round 1, closing firewall-0, -1, -2, -4, -6, -7, -8, -9, -10, -11, -12, -13, -14, -15, -16, -17, -18, -19, -20, -21, -22, -23, -24, -28, -30, -31, -32, -35, -37, -39, and -41. - command: CommandRunner gains a filesystem view (read_file, file_exists, file_metadata, list_dir) with a FileMetadata struct; DuctRunner implements it against the local filesystem and FakeRunner gains respond_file/respond_stat/respond_dir scripting plus an fs_scripted guard, so doctor checks no longer touch the host filesystem directly. - ssh_runner: the remote runner implements the same view over SSH -- cat for reads, stat output parsing with setuid masking, one-per-line directory listings -- with tests for each operation. - doctor: config, permission, ownership, boot-integration, and routing checks read ufw.conf, /etc/default/ufw, sysctl forwarding state, and file facts through the injected runner; doctor_all is now deterministic under a fully scripted filesystem (pinned by test). - docker: is_dokploy_installed and daemon-config reading join the installed-detection family, and check_routing takes the runner to read forwarding state instead of assuming it. - harden: create_backup_with_runtime records runtime sysctl values from a single read, restore_backup reapplies them, and the round trip is pinned by tests; profile/spec get small cleanups. - error/framework/iptables/nft/spec: drop divider-comment noise and stale inline comments.
Phase I firewall round 2 (toride-harden side), closing firewall-7, -8, -18, -21, -22, -24, and -32. - client: apply_params_with_options seeds current values with one sysctl -a read (read_all_map), skips the write for params already at their desired value, and snapshots pre-apply runtime values via create_backup_with_runtime so a restore rolls runtime values back too. status serves every spec parameter from the same single sysctl -a spawn, falling back to one per-key read only for keys the aggregate output lacks. diff filters the current side to the desired keys so unrelated kernel tunables stop rendering as removed. Tests pin the one-spawn status/apply behavior, the per-key fallback, and the filtered diff. - render: render_sysctl_conf and render_sysctl_d_dropin now validate their inputs and reject newline-injection in descriptions and invalid key/value pairs, instead of interpolating unchecked. - shm: is_shm_target matches exact mount targets instead of substrings, so a similarly named filesystem is not treated as a /dev/shm mount. - benches: status_spawn_count updated for the single-spawn status path; cli/config/kernel pick up the adjusted call signatures.
Phase I firewall round 3, closing the ufw-kit half of ruling-7: a CI gate for the non-default ssh feature. ci.yml gains a dedicated ufw-kit-features job that lints and tests the crate with --features ssh and with --all-features, so the SSH runner path exercised by the doctor filesystem view stays compiled and green in CI instead of rotting behind the default feature set. The same change gates toride-updates' non-default config feature. Round-2 closure verification: commit b79787d (toride-harden side, firewall-7/-8/-18/-21/-22/-24/-32) is already an ancestor of HEAD.
Phase I ssh-data-subsystems round 1. - core: new control_master module owning control-socket candidate collection (shared name/prefix matching, stat-based candidate filtering) so agent and forward stop duplicating directory scans; exported from the crate root - agent: list_sessions_with delegates candidate collection to the shared module inside spawn_blocking instead of scanning ~/.ssh and the temp dir inline on the reactor - forward: control list_sessions reuses the shared collector; tests slimmed to match (no more bespoke scan fixtures) - doctor: drop redundant remote-check hunks around host-key and authorized-principals probing - known-hosts/authorized-keys: small dead-code and parse cleanups
Phase I firewall round 1: prune redundant explanatory and regression comments from toride-harden backup/cli/spec and ufw-kit command/framework tests and the nft JSON-extraction tests (-132/+1).
…egistry findings fail2ban-11: detector_scan and jail_scan_burst criterion groups now set noise_threshold(0.20) to match the campaign gate — only >= 20% deltas count as regressions (idle-host swings ~10%, fsync drift with writeback state). Also drop the not-yet-implemented service-manager feature bullet from the service docs.
…egistry findings fail2ban-16: CidrSet::insert/remove convert IPv4-mapped IPv6 blocks to their IPv4 equivalent with the prefix translated by the 96-bit mapped offset (::ffff:10.0.0.0/120 stores as 10.0.0.0/24); a mapped block whose prefix is shorter than /96 spans non-mapped addresses and is skipped with a warning. Previously the address was normalized but the prefix kept its v6 scale, so mapped CIDRs compared at the wrong granularity. Tests cover insert/remove symmetry and the jail ignore-ips mapped-CIDR path.
…egistry findings fail2ban-21: unify name validation behind types::name_rejection — non-empty, no leading dash, no whitespace, no "..", no shell metacharacters — and enforce the one rule set at every fail2ban-client operand boundary (client methods, lib facade, doctor scope) so spec-validated and raw names cannot drift. spec::validate_name now delegates instead of carrying its own copy. Tests cover the shared rules at each boundary.
…ate registry findings Steadier bench measurement and the batched detector API: both source_search and detect_sweep raise sample size to 100, measurement time to 5s, and warm-up to 3s; detect_sweep's oracle and sweep loops move from per-tool detect() calls to detector.detect_many() so the bench measures the sweep path it claims to.
…ate registry findings install-state-35: align the mise tool surface with the runner's current CommandSpec and quiet the installer/mise benches for baseline-driven measurement. - mise: command specs emit `--json` instead of `--output=json`; instable snapshot expectations refreshed for the flag and the new redact_flags field; section banner comments pruned across src - installer/mise Cargo.toml: [lib] bench = false so the implicit lib bench target stops rejecting criterion flags like `--baseline` - registry benches: alias_merge and dep11_parse measurement tuning - fixtures and README brought in line with the above
…ate registry findings install-state-27: `mise current <tool>` prints only the bare version, so list_active_with with a tool operand now parses the bare form and labels the row with the requested tool name instead of parsing `<tool> <version>` lines (which never match). Empty output yields no rows; both output forms tested. install-state-28: stop passing the prefix filter as a positional operand to `mise ls` — mise's operand is an exact tool lookup that rejects partial names — and filter rows crate-side over the full --json listing instead.
Phase I observers round 1: PortQuery::process_name lowercases the needle once at build time so matches() stops re-lowering it on every call; docs state the stored-needle contract and a regression test pins it.
…gistry findings observers-11/22/28/30: - status: read_static_info memoizes the reboot-invariant probes (kernel version, hostname, physical core count) for the process lifetime — struct assembly extracted into build_static_info, and read_static_info_uncached keeps the per-call probe path for benches and tests that measure it; collect_cycle bench adapted - monitor: new detect_full_report criterion bench (registered, harness = false); ss_parse bench adjustments; banner comments pruned from ports.rs; anomaly severity reason wording tightened - updates: schedule.rs banner comments pruned
…gistry findings observers-4: add parse_dnf_check_security for `dnf check-update --security` output — every listed name.arch evr repo row is a security advisory, so the pair is (total, total). The inline updates client and the dnf backend now call it instead of parse_dnf_check, whose security-substring heuristic never matches real --security listings (plain repo columns, no advisory prefix) and previously forced a call-site (total, total) kludge in dnf.rs. parse_dnf_check docs state the split; tests cover real-shaped column output at both layers.
… registry findings safety-state-8/9: an `aide --check` that aborts on its own error (config error, unreadable database — exit 17) must not read as a clean pass. The status verdict now combines the parsed change evidence with the exit status: detected changes keep a known count and a false verdict; a non-zero exit with no change evidence means the check never completed, so file_count is None, last_check_passed is Some(false), and the one-line status gains a "check failed" segment. A check that could not run at all is "not verified" (count unknown) rather than conditionally true. parse_aide_check docs now state that passed only means "this text shows no changes" and the caller must consult the exit status. Tests cover errored, clean, and change-detected checks via the with_binary seam.
tui-5/12/13: - monitor data: MonitorCollector re-ships the cached Arc<MonitorDataBundle> by refcount when both tiers are fresh and re-ships a degraded bundle within a new 4s FAILURE_RETRY_TTL instead of paying bundle reconstruction on every refresh tick; poll() returns the shared Arc and the cadence oracle covers degraded-bundle reship behavior - app: dashboard set_*_data setters now report whether content changed, so needs_redraw is set only on real changes - dashboard: change-detecting setters plus module card and layout rework; panel/card widget API updates and sidebar additions with tests
tui-12: frame-parity tests for the dashboard panel caches. A cache-hit frame must be pixel-identical to the cache-miss frame (asserted on every row below the header, which carries the logo shimmer and disk/net spinners that advance with wall-clock time), repeated hits must stay identical, and input-driven frames off primed caches (focus change, status change) must equal fresh-screen renders.
compat-8/10/12/14/20/24/26/28/30, install-state-15, workspace-regex/readme-pins/em-dash: - workspace: drop crossterm/ratatui from workspace.dependencies, pin serde non-optional where the feature gate was vestigial, [lib] bench = false for cargo-bench flag passthrough - tui data: ProxyCollector delivers an Arc<ProxyDataBundle> via a named ProxyOutcome channel payload - style: replace em-dashes with plain punctuation in workspace comments (Cargo.toml profiles, check_plan_citations.sh, logs screen, virt_detect) - registry DESIGN.md, publish workflow, cargo-dist config, and the dep11-synthetic fixture brought in line
…ce registry findings Round-2 auditor finding: toride-tailscale's serde dependency is used under the client feature, so declare it optional and gate it with dep:serde on client — the registry-consistent pattern the finding itself cites.
…ce registry findings
Round-3 auditor finding (owner-authorized carry, with attribution):
committed HEAD did not compile — the ProxyOutcome consumer change in
toride_proxy_data.rs expected the CertExpiryReader producer that
still lived uncommitted in toride-proxy's certs_parse.rs. This
carries that producer: CertExpiryReader::{new, openssl_present,
read}, a dependency-free PEM -> DER -> ASN.1 leaf not-after parser
(base64 decoder, DER TLV reader, UTCTime/GeneralizedTime) that
falls back to `openssl x509 -enddate` only when the parse fails,
and tests for the decode/time vectors.
…ce registry findings Round-4 auditor findings: the root README's toride-apps dependency snippet still pinned 0.1 while 0.2 is current (a 0.x caret never crosses 0.1 to 0.2, so the stale snippet never resolves to the new release) — bumped to 0.2; and docs/publishing.md lacked the README-pin half of the release checklist, so the two-halves clause (machine-checked PUBLISH_ORDER plus the README/crate-README version snippets) is now spelled out ahead of the per-crate state machine.
terminal-1: terminal-mux bundle — tmux distro rows x4, zellij via cargo, GNU screen distro rows x4 condition-gated on the missing screen binary; evaluation/routing/presence-gating tests. terminal-2: terminal-emulators bundle — alacritty distro x4 (verified Debian/Ubuntu/Fedora coverage), kitty x4 with the kitten alias, wezterm on Arch, ghostty on Ubuntu+Arch with exact-pointer Manual rows for Debian/Fedora, foot x4 Wayland-only; Debian evaluation and backend-routing tests. terminal-3: registry test extensions — 10-bundle integrity, unique ids, FOSS default picks, non-empty binaries, every Install routing valid — and the setup-screen snapshots move to 9 bundles / 38 suggestions.
TUI area close-out: finish the collector migration and land the early-carried tailscale producer. - toride data modules (fail2ban, logs, ssh, tools, audit, cloud, harden, mise, tailscale, updates, users, wireguard, ufw-kit): collectors re-ship cached Arc<Bundle> by refcount on TTL hits instead of re-collecting, matching the monitor/proxy pattern; poll() returns the shared Arc - toride-tailscale: producer half of system-domain-31 — TailscaleClient::status_and_topology with a new models module (landed early because the tui consumer references it; owning area finished gates-red with no active round), plus api/client/ error/report/service/status/tailnet and status_parse bench updates - toride README, collector_cache_hit bench, and the setup-bundles plan updated to match
Final landing sweep for finished areas: the remaining straggler files from toride-proxy (backup/caddy/client/config/doctor/nginx*/ render/waf plus the cert_scan/diff_blocks/site_apply benches), toride-service free_functions, toride-users (backup/capture/client/ lib/password/service/sudo/user), and toride-wireguard (backup/cli/ config/key/parse/render/spec/validate). With these landed, the committed tree carries every code change the audit sweep produced; only non-code dirt (web lockfile, ignore file) stays uncommitted.
hmziqrs
approved these changes
Nov 2, 2026
…raded-host caching CI on PR 25: unused unix binding in known-hosts on Windows, ungated Linux hwmon bench fixtures on macOS, an auditd doctor test that assumes Linux, an ungated unix-ffi forward test on Windows, and two mise collector tests whose degraded branches assumed degraded bundles are never cached; the collector caches completed derivations regardless so ticks stop re-polling. Verified locally plus a mise-absent PATH run of the mise-data suite.
Round two on PR 25: the spawn oracle's jail-list test now pins fail2ban-client through a new Doctor::with_client_bin seam instead of PATH discovery, so the counted logpath fetches happen on hosts without a Fail2Ban install (verified locally with the client absent); the linux-shaped action env tests and the sh -c unban-marker test are linux-gated; rollback_writable carries its non-unix unused_self expectation; and the ssh-agent session_fanout bench gains a non-unix stub main so Windows check finds one.
Round three on PR 25: the client-bin seam now lives on the Doctor struct and client_bin returns it before PATH discovery, because run() clears the per-run cache and had been wiping the previous cache-based pin (local runs kept passing via /usr/bin/fail2ban-client, CI has none). rollback_writable carries both non-unix expectations (unused_self and the metadata unused_variables it actually needed). The two symlink-walking verify tests in toride-backup are unix-gated for the Windows check leg.
…or the agent bench Round four on PR 25: check_regex gated its per-jail failregex and datepattern fetches on a second PATH discovery (fail2ban-regex) that CI hosts lack, so the oracle moved the client pin onto a general with_binary(name, path) seam covering every binary the Doctor discovers; the oracle test pins the client and regex tools. The ssh-agent session_fanout bench body now lives in a cfg(unix) module with a criterion_main re-export and a non-unix stub main, so Windows clippy compiles only the stub instead of erroring on eleven unix-only items.
…ed comments Flash-audited against the code-comments skill, verified categories only: before/after narration sentences and campaign-item id references (compat-28, safety-state-9, F15, tui-13/14, ssh-data-subsystems-24) trimmed from kept docs; two over-length inline blocks and decorative banners deleted; thirteen restating-next-line one-liners removed. Private-item rustdoc intentionally untouched per the house-style ruling; the compat-28-probe string literal untouched as code. Comment-only: fmt, clippy -D warnings, and tests green for every touched crate.
hmziqrs
approved these changes
Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
VPS services, deep-audit fixes, perf work, terminal setup bundles
What this is
Three campaigns in one branch, 55 commits on top of 033e969:
terminal-mux(tmux, zellij, GNU screen) andterminal-emulators(alacritty, kitty, wezterm, ghostty, foot), with availability verified per distro family against packaging sources.Headline changes
Match allandfinal, top-level directives, comma-separatedHostpatterns, and the spaced=separator parse per documented OpenSSH behavior; CRLF handling and its docs now agree; an unclosed managed marker no longer deletes user config to EOF..pubcompanion path derives by appending, not extension replacement (nine sites).upload_manybatches one handshake per batch; ConnectTimeout is set.Verification
cargo fmt --all --check,cargo clippy --workspace --all-targets -- -D warnings,cargo test --workspace, the toride-ssh feature matrix,scripts/test-publish-state.sh, and the publish-order membership check all exit 0 at HEAD.Known opens
Rulings applied
missing_errors_docstays on. 3. The fail2ban standalone engine is documented; gating is decided at the next minor. 4. The VPS action ledger is a serde record in toride-service. 5. All pre-0.2.0 API shape changes were taken while the semver window was open. 6. toride-ssh-upload is documented unix-only; Windows support is deferred. 7. The SshRunner adapter is built. 8. Setup bundles gained typed Unit and Firewall action variants; execution wiring follows.