nordisk/Skidbladnir
Commits
48eb142897efMerge ossfsilver/gix-090 (lane OSSF-SILVER-CODE, row GIX-090): gix 0.90 (GHSA-q54r-jf2p-rfr2)19bc6f5a95c0gix 0.88 -> 0.90 (GHSA-q54r-jf2p-rfr2, lane OSSF-SILVER-CODE, row GIX-090)b57e65426b80Merge wgpsk3/link-psk-2026-10-30 into main (lane WG-PSK-3: the installer link (wg-installer) carries a pre-shared key): nordisk-pairing 0.5.29 — LinkSeed.psk, the link file and LinkKeys.psk, vm_link_spec and WgPath keyed with it; seeds and link files without one run as beforee50093d462d7link-psk (lane WG-PSK-3): guard — a box laid again from the kept bundle keeps the installer link's PSK (fresh_seed keeps it, the kept material dials with it, the bundle as the twin holds it). kept:: 8/0 (oden ci4)1c3fd7dc963bGREEN link-psk (lane WG-PSK-3): nordisk-pairing 0.5.29 — the seed check holds LinkSeed.psk to a 32-byte key (blank refused by name), the link file writes and reads the PSK (Material::link_file_with_psk / link_of), vm_link_spec keys the installer peer with it, WgPath's Tunn carries keys.psk and the process's link table tells engines apart by it. A seed or link file without one runs as before. oden ci4: nordisk-pairing --all-features lib + integration green (incl. the handshake matrix), default lib 211/0, workspace check --all-features --all-targets green; clippy: no finding in the changed lines5b23de29ab79RED link-psk (lane WG-PSK-3): the installer's WireGuard link (wg-installer) carries a pre-shared key — LinkSeed.psk (the seed renders and parses it, the check refuses a PSK that is not a 32-byte key by name), the link file and LinkKeys.psk (Material::link_file_with_psk), the VM's end (vm_link_spec: the installer peer carries it) and the installer's engine (WgPath: up only when both ends hold the same PSK). A seed and a link file from before carry none and run as before. Every literal in the crate gains psk: None. Stubs: 4 red (oden ci4, nordisk-pairing --all-features lib 239/4)516a8e26f4ccMerge wgpsk/main-2026-10-30 into main (lane WG-PSK): installer::mint_wg_psk; kept::moved gives a box laid again a fresh PSK, fed to it and the front (gate gunnar GREEN, receipt gunnar-gate-c72e2269ff15-2e4c32f47486-70115b7e0798)70115b7e0798GREEN wg-psk (lane WG-PSK): mint_wg_psk = 32 bytes from ring's SystemRandom, base64; kept::moved gives the box laid again a fresh PSK in its own feed and the front's (wg_psk / wg_psk.<role>), the re-admission feeds both ends and the kept bundle after it carries the key. nordisk-pairing lib (kept, installer-wireguard) 230/0, --all-features tests green but narrator's ticker test (fails on its own, untouched); clippy: no finding in the changed filesf91bffa9afc7RED wg-psk (lane WG-PSK): installer::mint_wg_psk is 32 fresh bytes from the OS generator; a box laid again (kept::moved, the front's recharge) gets a NEW pre-shared key and the front the same one (wg_psk / wg_psk.<box>), the standing box's link untouched, the kept bundle (the twin's copy) carries it; an estate kept with no PSK gets one for the moved box. mint_wg_psk is a stub and moved() feeds nothing: 2 red5efaf43466cenordisk-pairing 0.5.28: crates.io's 0.5.27 lacks RA4-13 and A32-8 (additive), the R5G publish row1f7b39928a79Merge fix/l17-old-home-words-2026-10-27 into main: L17 / A29-23 (Skidbladnir half), stale old-forge words and URLs of ours gone from the docs, a guard keeps them out. RED cb48739, GREEN 5a2bbbf (lane OX-EDDA)5a2bbbfae90bL17 / A29-23 GREEN: README-full links nornir on gunnar.rs, not the old forge (from ROWS-ETC 33d016b). docs guard and repository_home green, lockcheck greencb487398c24dL17 / A29-23 RED: the docs (README.md, .nornir/*.md) name no old home of ours (our organisations on the old forge, its pages host); the guard fails on the stale lines lefte1733bf3cca9Merge fix/a32-8-front-rollback-2026-10-27 into main: A32-8, the front's own live stage that rolls back is reported failed [update-rolled-back] once, never staged again on every look. RED 12a75f6, GREEN d07c8ee (from ROWS-ETC de016b7). nordisk-pairing lib 218 passed, lockcheck green (lane OX-EDDA)d07c8ee02d56A32-8 GREEN: the front's own stage that rolls back is reported failed with [update-rolled-back] on its next look (a marker left for this release on a Live step is the rollback: the marker spent, nothing staged), not staged again on every look (fix from ROWS-ETC de016b7). nordisk-pairing lib 218 passed (frontside-update, kept); clippy adds nothing12a75f6a49f4A32-8 RED: the front's own stage that rolls back is reported failed on the next look, not staged again (test from ROWS-ETC de016b7; nordisk-pairing frontside::update 1 of 21 fails: the next look stages the same release again)12f07b9380c8Merge fix/ra4-13-egress-per-peer-2026-10-27 into main: RA4-13, the egress door caps one peer at 16 of its 64 slots, cuts a dripped head at one 30 s deadline, closes a tunnel idle 300 s both ways, and says a refusal once per minute. RED 96100ec. nordisk-pairing lib 217 passed, lockcheck green9f6f0b9e9239GREEN: the egress door holds one peer to PER_PEER (16) of its MAX_CONNS (64), reads the whole request head within one HEAD_DEADLINE (30 s), closes a tunnel silent both ways for IDLE (300 s) and says at most one line per SAY_EVERY (60 s), counting the rest (RA4-13). Slots/Slot/Limits/Said/serve_with are new and additive; serve and serve_capped keep their shapes. nordisk-pairing lib 217 passed, egress 12/12 three runs; clippy adds nothing (the 4 left are on main in redact.rs and recharge.rs)96100ec7893eRED: one peer with 64 connections does not block a second; a dripped head is cut at one deadline; an idle tunnel is closed; a refusal is said once per window (RA4-13; the door keeps one count and per-read timeouts here, so 5 of 12 egress tests fail)b5c1fda5a408Merge v2/a32-jobs-2026-10-26 into main: A32-14 for nordisk-pairing, the egress door carries at most MAX_CONNS (64) connections at once (one thread each; one over is 503 REFUSED [egress-full]); nordisk-pairing lib 202 passed, fast holger and fast gunnar green with it as their sibling71e926344d9eGREEN: the egress door carries at most MAX_CONNS (64) connections at once, one short thread each; one over is answered 503 REFUSED [egress-full] and closed, and a slot is given back when its connection ends or its thread never starts (A32-14; nordisk-pairing lib 202 passed)ee89f6341dd0RED: the egress door holds at most its cap of connections (one thread each); one over is refused by name, and a slot frees when a connection ends (A32-14; 1 test, 0/1)cefc7634dbeaMerge chore/b4-versions-2026-10-26 into main (B4 version bumps for the second publish)a16072146140skidbladnir 0.2.3 (the root now names skidbladnir-systemd; 0.2.2 is published) and jera ^0.2.1 (its jera feature names jera/runners) (B4)93adbfbb624cMerge feat/b4-systemd-split-2026-10-26 into main (B4): skidbladnir-systemd, the systemd lifecycle on its own crate, re-exported at the old paths; the jera feature names jera/runners34f0996785aaMerge main into feat/b4-systemd-split-2026-10-268f839e70dd75Merge v2/a3-monetize-0.3.0-2026-10-26 into main (A3: monetize's one crates.io line 0.3.0, nordisk-pairing 0.5.27, the publish prep)2e154e02cf8aMerge remote-tracking branch 'origin/main' into v2/a3-monetize-0.3.0-2026-10-2683396b8aaab8Merge fix/a5a7-2026-10-26 into main: A5 the shared MemSink never says a line read back from the front's own log (the nested readmit: flood on gunnar.rs); nordisk-pairing lib 221/0, workspace 256/0/28f1436c30e79The jera feature names jera/runners: the machine backend boots through jera's container and vm runners (B4)f53c4286e382skidbladnir-systemd: the cross-backend registry tests run against the root's renderer_for; doc examples name the new crate (B4)38397b7ac23cA3: nordisk-twin's `tokio` feature turns on tokio's macros (net.rs uses tokio::select!)906bc0d55e78GREEN: skidbladnir-systemd, the systemd lifecycle on its own; skidbladnir re-exports it at the old paths (B4, A31 7.5)0e656324c23bA3: nordisk-pairing 0.5.27 (what landed after the published 0.5.26)d6960349df3eTEST: the systemd lifecycle is its own small crate, skidbladnir-systemd, re-exported at the old paths (B4, A31 7.5)a259f0fe7bf4GREEN: the shared MemSink never says its own lines again: kept::is_echo knows a sink line (readmit <vm>: or readmit:) behind any log stamp, and a box line that is one is dropped; 50 rounds over the front's own log say 3 lines (nordisk-pairing lib 221/0, one unit test for is_echo)fd414416d796RED: a front's re-admission reads its own boot log back, where fd 2 captured what its sink said, and says it again one level deeper on each read (gunnar.rs: 1.9 M nested readmit: lines); over 50 rounds the sink says 150 lines, nested 50 deep, for 3 (kept 4 passed, 1 failed)a7abb7bbe23bMerge v2/p4-rest-2026-10-25 into int/train-B-2026-10-25 (merge train B)5aade8d2e661Merge v2/p4c-shared-2026-10-25 into int/train-B-2026-10-25 (merge train B)7888fd165057Merge fix/oci-r1-2026-10-25 into int/train-B-2026-10-25 (merge train B)6df0b62445a0GREEN: a front's re-admissions say each line once, process-wide (kept::ReadmitLog: a line, a narration or a secret offer once, a status again only when it changes, bounded at 20000); every front re-admits through kept::MemSink (nordisk-pairing 208/0)6ac8860cfc43RED: a front's re-admissions say each line ONCE (gunnar.rs 2026-10-25: 1.9 M nested readmit lines in the front's log ring): kept::ReadmitLog, process-wide, and the one MemSink every front re-admits through; a loop of 50 rounds says 6 lines (kept 2 passed, 2 failed)3331871bbcbeMerge remote-tracking branch 'origin/main' into v2/p4c-shared-2026-10-25d4f78cb74424GREEN: the shared update step re-admits boxes left at their open install listener first, and together, then reads the box again (moved from Gunnar's front, gunnar.rs 2026-10-25; every product's since T16); kept::readmit_together for every front; Hands::readmit refuses by name where no bundle is kept (nordisk-pairing 206/0)bfabb5787c69GREEN: the probe rows build in probe/, their detached workspace (manifest_dir)1d8776789fe2RED: the shared update step re-admits boxes left at their open install listener first and together (Gunnar's 2026-10-25 field fix, for every product's front, T16): Gunnar's five cases, the default refusal, kept::readmit_together, and the step over the real door (nordisk-pairing 197 passed, 9 failed)9ad48ddbf6c4TEST: the build-tree refusal runs everywhere; the live install half is its own #[ignore] test7a457f0871f0TEST (RED): every cargo row names a package of the workspace it builds in4fc391fc54b2Merge v2/m18-jobs-2026-10-25 into main: A28 M18, nordisk-pairing's raw threads: a std-only duty (nordisk_pairing::duty, a jera job's contract: listed, a panicked round an ALERT and the next one runs, stopped at once at stop()/stop_all(), Round::After for a backoff); the kept boot log, the narrator's ticks and the pairing loop (run again after a panic, its doors kept on its thread) are duties; the threads that stay say why (nordisk-pairing 186/0; Holger paired + front and monetize root, shop-pairing, front, estate-side build green against it)b0976706b672P4c: the front's mesh probe (feature mesh-probe, off by default), the paired links' renewal schedule and steps (feature front-renew, off by default), the re-admission of a lost box (feature kept) and the box's renewing half are nordisk-pairing's, from Holger's copies with their tests (A28 M11); nordisk-pairing stays 0.5.26