nordisk/edda
Commits
1c537a3845f5Merge htool/kcov into main (lane HTOOL-KCOV, Heimdall tooling plan steps 2 + 5 vetoes): kernel coverage <row> --run <suite> (kernel.coverage=gcov DEV probe kernel, refused for release/signed media; gcov counters read out of a memsave of the VM kernel image; executed / never / unmeasured per CONFIG_* with the stages), candidates with coverage + protect list, kernel veto <row> CONFIG_X (one per run, full rerun, applied/refused receipt; syscall join refusals), kernel vetoes <row>. lib 857/0, all targets greene4785c68df28Merge remote-tracking branch 'origin/main' into htool/kcov4538cfbce047Merge holxfp/forwarded-2026-11-01 into main (lane HOL-DOCFIND, Holger 3.1.1): estate-front 0.3.4, the front writes x-forwarded-proto (https) and x-forwarded-host (the name asked for) and drops every forwarded header a client sent (x-forwarded-proto/-host/-port/-prefix/-for, x-real-ip, forwarded), so a primary that trusts the front (Holger ron_trusted_proxies) never writes a client's links (RED 1235c58, GREEN 948ad7a). Gate (oden ci4, merged tree): estate-front 71/71 + 2, clippy -D warnings estate-front all targets all features (no-deps; appliance-pid1 type_complexity is not this lane's), cargo metadata --locked; Gunnar crates/gunnar-front 75 lib + all its tests green and clippy -D warnings with this edda (its lock follows: estate-front 0.3.4); Holger holger-estate-front estate_links_say_https_through_the_front 2/2464d38b5bc90Merge remote-tracking branch 'origin/main' into holxfp/forwarded-2026-11-01c8aad7d9fdafMerge htool/ui into main (lane HTOOL-UI, Heimdall tooling plan step 4): the review in the Build Thing UI6f1784af81bfhtool/kcov: the gcov probe also turns RANDOMIZE_MEMORY off (it depends on RANDOMIZE_BASE; the build canary refused it on oden)abdaeb127cdbhtool/kcov: kernel.coverage rides KernelDecision (the forge donor path lands it) and is never read as an on|off toggleaa4876c1903fGREEN: KernelNeeds, CallNeed, OptionNeed, Caller, NoCaller are Deserialize, so a saved kernel needs <row> --json reads back (dwarves tune show joins it per call); syscall_join 10/1055527780f2a9RED: the kernel needs document reads back (KernelNeeds is Deserialize)6df23adde583Merge edda main 9cca0a7 (join + tune + gate approvals) into htool/kcov; kernel veto runs the syscall join (a veto that takes a measured call is refused by name)948ad7a6e96cestate-front 0.3.4: GREEN the front writes x-forwarded-proto and x-forwarded-host, and drops every forwarded header a client sent (HOL-DOCFIND)9cca0a73056fMerge htool/gate-approval into main (lane HEIM-TOOLING): the drift gate checks approvalsa1b7948996d0GREEN: measure gate holds a reviewed row to approved.toml (a changed reviewed file fails, named with the approval date); an unreviewed row passes with "not reviewed yet"; nornir-build-thing lib 837/8372f38e249c980RED: the drift gate holds a reviewed row to its approval (approved.toml) and names an unreviewed onef1117c887bb1Merge local edda main of lane HTOOL-TUNE (dwarves tune: gen, drivers, approval) into main of HTOOL-JOIN7ce08d24259aMerge htool/join into main (lane HTOOL-JOIN, Heimdall tooling plan step 3): nornir-build-thing syscall_join — syscall -> CONFIG map off the composed kernel tree (cached per version), kernel needs <row>, what-if/candidates refuse a drop that would ENOSYS a measured call by name (near-miss warns), --json nornir.kernel-needs/1, nornir.kernel-what-if/1, nornir.kernel-candidates/1; lib 823/8232ac33f273af3Merge htool/tune into main (lane HTOOL-TUNE, Heimdall tooling plan): nornir-build-thing measure --gen (regenerate from the probe evidence), [[driver]] workload drivers (corpus runs as <driver>/<run>; served-driver fields carried as data, contract agreed with HEIM-APP), approved.toml with approval_status and approve, the [[build]] lines named on an unbuilt binary; measure 57/5718c80eae2017Merge remote-tracking branch 'local/main' into htool/tune39cdec484a2cMerge remote-tracking branch 'local/main' into htool/joinb7866648dc42htool/kcov: README — the coverage half and row vetoes with receipts1235c58755f1RED estate-front: the front overwrites the forwarded headers and never passes the client's (HOL-DOCFIND)2dac59ee78f8nornir-build-thing syscall_join GREEN: kernel needs names partly-measured programs (runs waiting for the VM) apart from unmeasured ones; candidates print a bare (0) when nothing is vetoed06c0416db073nornir-build-thing syscall_join: RED a program measured with runs still waiting for the VM is named apart from one not measured at all4b8304c75ce4htool/kcov: GREEN — the kernel coverage half and row vetoes with receipts8c8bfab8c87bMerge htool/gate into main (lane HEIM-TOOLING, Heimdall tooling plan step 6): measure gate — the drift gate over every profiled row, [[build]] lines in measure.toml, --json nornir.measure.gate/v1; nornir-build-thing measure 44/44af4e9102756dhtool/kcov: RED — the kernel coverage half and row vetoes with receipts (tests over stubs)57cec873020cnornir-build-thing syscall_join GREEN: syscall -> CONFIG map off the composed tree (table, SYSCALL_DEFINE, Makefile + #ifdef gates, COND_SYSCALL stubs; cached per version), kernel needs <row>, what-if/candidates refuse a drop that would ENOSYS a measured call by name (near-miss warns), --json (nornir.kernel-needs/1, nornir.kernel-what-if/1, nornir.kernel-candidates/1), README746ffab5b658nornir-build-thing measure: ApprovalStatus.exists (the row has an approved.toml), RED assert + GREEN870e3f1effc4nornir-build-thing syscall_join: RED tests for the syscall <-> kernel option join (map off the tree, kernel needs, what-if/candidates veto by measured call, JSON)733f503279dbMerge htool/gate into htool/tune: the row build line is the gate's [[build]] cargo lines; rows come from rows_with_profiles040a33c9333dnornir-build-thing measure: GREEN — --gen regenerates from the probe evidence, [[driver]] workload drivers (corpus runs as <driver>/<run>; served drivers carried as data for the caller), rows(), the row build line on an unbuilt binary, approved.toml with approval_status and approve0c762a4de37bGREEN: measure gate --build + [[build]] in measure.toml (cargo build lines only, CARGO_TARGET_DIR = {target})c9cffda9453dRED: measure gate --build — a row's [[build]] cargo lines run before its check; a failed build refuses only that row; a build line must be cargo build27254cacb286GREEN: measure gate (Heimdall tooling plan step 6): every row with .nornir/profiles/<row>/measure.toml checked by the external heimdall check, only checks, per-row refusals, --json reportf2097587b69fRED: measure gate — the drift gate checks every profiled row, names row/program/call/test, refuses a row without hiding the others, JSON nornir.measure.gate/v1645dbeff86efnornir-build-thing measure: RED tests for gen (no probe), workload drivers, rows, the build line and approval (approved.toml, approval_status)82bbc28e7f15Merge bump/nornir-identity-0.2.4 into main: nornir-identity 0.2.4 (lock follows; metadata --locked green)3a9682f28ae5nornir-identity 0.2.4: the signature is checked before the counter (GUN-FIELD-TEST ddec35b5), for crates.ioddec35b55879Merge fix/gunfield-replayed-counter-named-2026-10-31 into main (lane GUN-FIELD-TEST): nornir-identity names the person on a refused login whose passkey signed a counter that did not grow (a cloned authenticator or a replay), as 0.2.1 did; RA5-29 unchanged (a bad signature names nobody). RED 573ec503, GREEN e3bf2c9d. nornir-identity tests green (conformance 24/24), clippy -D warnings clean; Gunnar enterprise 12/12 with it via a local [patch] (red 0/1 on 0.2.3). NOT published (owner publishes; needs a 0.2.4 bump)e3bf2c9d4ef5GREEN a_replayed_counter_names_the_person_whose_passkey_signed (GUN-FIELD-TEST): login_finish verifies the signature with the counter left out, names the person once their passkey signed (RA5-29 unchanged), then applies the counter rule (counter_fits, A34-31) itself, so a cloned authenticator or a replay is refused as before and lands in that person's account audit. nornir-identity tests 24/24 conformance, clippy -D warnings clean573ec503989eRED a_replayed_counter_names_the_person_whose_passkey_signed (GUN-FIELD-TEST): a counter that did not grow is checked inside the signature check, so 0.2.3 names nobody for a cloned authenticator whose signature verified with the person's key; Gunnar's enterprise test lost the refused login in bob's account audit (0.2.1 had it)72138a2c2aacMerge replayguard/2026-10-31 into main (lane GUN-REPLAY-GUARD): nornir-auth-sshsig 0.1.2, the replay guard per key and exact to its window. Held until issued_at + MAX_CLOCK_SKEW_MS by a min-heap (0.1.1 forgot a future-dated credential five minutes early: a replay hole); per key 524 288, pool 1 048 576 + a 1/8 reserve with a 4 096 floor per key; keyed 64-bit hashes, 40 B per entry, 46 MiB at the ceiling. RED 194b115 (6 of 8 red on 0.1.1), GREEN e221bc5. replay_burst 9/9, lib 5/5, clippy clean; gunnar-grpc 36/36 test binaries green on it via a local [patch]. NOT published (owner publishes)e221bc5206c2GREEN: nornir-auth-sshsig 0.1.2, the replay guard per key and exact to its window (GUN-REPLAY-GUARD)194b11561fb2RED: nornir-auth-sshsig replay guard under a burst, a replay and a flood (GUN-REPLAY-GUARD)30537f6510d0fmt: nornir-auth-sshsig lib.rs (rustfmt --edition 2021 on the one file GUN-REPLAY-GUARD touches; no code change)f631610e64caMerge measure1/syscalls into main (Heimdall tooling plan phase 1, tunnr 1.2): nornir-build-thing measure — measure syscalls <row> [--check] runs a row's programs under the EXTERNAL heimdall tool (nordisk-heimdall-cli 0.2.0, pinned by version + sha256; process boundary, never linked), writes the seccomp profiles + evidence beside the row, and --check fails on drift naming the call and the test. 21 unit tests on a fake tool; real run on tunnr rusternetes-node / -aya (dwarf, privileged rootless podman)6b3161628295nornir-build-thing measure: rust_table = false — a row whose repo does not link Heimdall keeps only .json/.oci.json (the tool's .rs carries Heimdall's AGPL header); check does not ask for the absent .rs; verb output names the runs, calls, near-miss, profile paths and the check line32b667a058e1nornir-build-thing measure: GREEN — measure syscalls <row> [--check]: the row's programs run under the external heimdall tool (process boundary, never linked; pinned by version + sha256, a missing tool is one line with the install command), profiles + evidence beside the row, drift named by call and test5f79e4e29698nornir-build-thing measure: RED — measure syscalls <row> [--check] tests against a fake heimdall tool (Heimdall tooling plan phase 1, tunnr 1.2)d90f8f0907fdMerge ossfsilver/fg-same-name into main (lane OSSF-SILVER-CODE): two first-party packages of one name resolve as two (CI-RED's nornir_matches_its_oracle_exactly)