Wire the QUIC transport into a real mesh, and make attestation a signature

.cargo/mutants.toml

@@ -0,0 +1,44 @@
+# Mutation testing scope.
+#
+# Deliberately narrow. cargo-mutants rebuilds and reruns the suite for every
+# mutant, so cost scales with (mutants x suite time) and an unscoped run over
+# this workspace is hours of full-core load. The question worth paying for is
+# "do the tests actually catch a broken protocol", so only protocol code is
+# mutated. Demo, film and CLI plumbing are excluded: mutating them measures the
+# demo's test coverage, which nobody is relying on.
+
+examine_globs = [
+    "smesh-core/src/signal.rs",
+    "smesh-core/src/identity.rs",
+    "smesh-core/src/node.rs",
+    "smesh-runtime/src/mesh.rs",
+    "smesh-runtime/src/journal.rs",
+]
+
+exclude_globs = [
+    "smesh-cli/**",
+    "smesh-bounty/**",
+    "smesh-agent/**",
+    "film/**",
+    "reference/**",
+    "**/benches/**",
+]
+
+# Mutants inside a test are not interesting. `Debug` bodies are cosmetic, and
+# mutating them only ever reports that nobody asserts on debug output.
+exclude_re = [
+    "mod tests",
+    "impl Default",
+    "impl std::fmt::Debug",
+]
+
+# Known unkillable: this crate has `#[cfg(unix)]` / `#[cfg(not(unix))]` pairs
+# for filesystem permissions. Mutating the branch that is not compiled on this
+# platform can never be caught, and cargo-mutants cannot tell the two apart by
+# name. Treat a survivor in `write_private` or `reject_if_world_readable` as a
+# platform artifact rather than a coverage gap.
+
+# A mutant that makes the code hang must not hold a slot forever. Multiplier
+# over the measured baseline run.
+timeout_multiplier = 4.0
+minimum_test_timeout = 30

.github/workflows/ci.yml

@@ -0,0 +1,83 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Read-only by default: nothing here needs to write to the repository, and a
+# workflow that cannot push cannot be turned into one that does.
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -D warnings
+
+jobs:
+  test:
+    name: test and lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Format
+        # Scoped to the crates this workflow is responsible for. The older CLI
+        # modules predate it and are not reformatted as a side effect of CI.
+        run: cargo fmt -p smesh-core -p smesh-runtime -- --check
+
+      - name: Clippy
+        run: |
+          cargo clippy -p smesh-core --lib -- -D warnings
+          cargo clippy -p smesh-runtime --lib --tests -- -D warnings
+
+      - name: Test
+        run: cargo test --workspace
+
+      - name: Test again
+        # The mesh tests start real QUIC endpoints on real sockets and depend on
+        # timing. Running twice catches the flake that only shows up sometimes,
+        # which is the kind this suite is most likely to grow.
+        run: cargo test --workspace
+
+  demo:
+    name: analysis run end to end
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Build
+        run: cargo build --bin smesh
+
+      - name: Orchestrate five real processes and validate the journal
+        run: |
+          ./target/debug/smesh orchestrate --out runs/ci | tee /tmp/run.log
+
+          # The demo's whole claim is that the mesh separates cause from
+          # symptom from noise. Assert it rather than eyeballing the output.
+          grep -q "checkout-api          CONSENSUS" /tmp/run.log \
+            || { echo "::error::root cause did not reach consensus"; exit 1; }
+          grep -q "payments-api          no consensus (3/4" /tmp/run.log \
+            || { echo "::error::downstream casualty was miscounted"; exit 1; }
+          grep -q "journal is internally consistent and safe to replay" /tmp/run.log \
+            || { echo "::error::journal validation failed"; exit 1; }
+
+      - name: Upload the recorded run
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: analysis-run
+          path: runs/ci/
+          retention-days: 7

.github/workflows/verify.yml

@@ -0,0 +1,109 @@
+name: Deep verification
+
+# Deliberately not on every push. These layers are expensive, and a slow
+# required check is one people learn to ignore. They run nightly and on demand,
+# and they report rather than block.
+on:
+  schedule:
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+    inputs:
+      dst_seeds:
+        description: "Simulation seeds to sweep"
+        default: "2000"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deep-verification
+  cancel-in-progress: true
+
+jobs:
+  simulation:
+    name: deterministic simulation soak
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Sweep seeds
+        # Every seed is a different delivery order, delay pattern and set of
+        # relay coin flips. A failure names the seed, which is the whole point:
+        # it reproduces exactly rather than being described.
+        env:
+          SMESH_DST_SEEDS: ${{ inputs.dst_seeds || '2000' }}
+        run: cargo test -p smesh-core --test dst --release
+
+  model:
+    name: model checking
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+
+      - name: Check the gossip spec
+        # Two workers and a 2GB heap, not "auto". TLC will take every core and
+        # grow until the kernel stops it, and this model is small enough that
+        # needing more would mean the model is wrong.
+        env:
+          VERIFY_JOBS: "2"
+          TLC_HEAP: "2g"
+          VERIFY_TIMEOUT: "600"
+        run: ./verify/tla.sh
+
+  mutation:
+    name: mutation testing
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-mutants
+        run: cargo install cargo-mutants --locked
+
+      - name: Mutate the protocol
+        # Scope is in .cargo/mutants.toml: protocol crates only. Two jobs, not
+        # one per core — the runner has two, and oversubscribing a rebuild-per-
+        # mutant workload makes it slower, not faster.
+        run: cargo mutants --jobs 2 --no-shuffle --output target/mutants
+        continue-on-error: true
+
+      - name: Report survivors
+        if: always()
+        run: |
+          python3 - <<'PY'
+          import json, pathlib, sys
+          p = pathlib.Path("target/mutants/mutants.out/outcomes.json")
+          if not p.exists():
+              print("no outcomes produced"); sys.exit(0)
+          d = json.loads(p.read_text())
+          missed = [o for o in d["outcomes"] if o.get("summary") == "MissedMutant"]
+          print(f"{len(d['outcomes'])} mutants, {len(missed)} survived\n")
+          for o in missed:
+              m = o["scenario"]["Mutant"]
+              print(f"  survived: {m['file']}:{m['function']['function_name']}")
+          print("\nA survivor means the tests would not notice that change.")
+          print("Known artifact: cfg(not(unix)) branches cannot run on this platform.")
+          PY
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: mutation-outcomes
+          path: target/mutants/mutants.out/outcomes.json
+          retention-days: 14

.gitignore

@@ -63,3 +63,18 @@ owasp-results.json
 adjudication-report.html
 adjudication-results.json
 smesh-demo.mp4
+
+# Recorded mesh runs (journals + merged timelines)
+runs/
+
+
+# Rendered film output (large, regenerable)
+film/out/
+film/src/audio/
+film/src/frames/
+film/src/node_modules/
+
+# TLC is fetched on demand by verify/tla.sh
+verify/tla/tla2tools.jar
+verify/tla/states/
+verify/tla/*.old

Cargo.toml

@@ -32,6 +32,7 @@ async-trait = "0.1"
 
 # Crypto
 sha2 = "0.10"
+ed25519-dalek = { version = "2.1", features = ["rand_core", "serde", "pkcs8"] }
 rand = "0.8"
 uuid = { version = "1.6", features = ["v4", "serde"] }
 
@@ -50,7 +51,12 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 clap = { version = "4.4", features = ["derive"] }
 
 # HTTP (for OpenRouter / Claude APIs)
-reqwest = { version = "0.11", features = ["json"] }
+# rustls rather than native-tls: one less C dependency, and it is what makes a
+# fully static musl build possible. The QUIC layer already speaks rustls.
+reqwest = { version = "0.11", default-features = false, features = [
+    "json",
+    "rustls-tls",
+] }
 
 # Time
 chrono = { version = "0.4", features = ["serde"] }