From 7b40686def985eecac6c87088be4f155a03a4eb5 Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Sun, 27 Sep 2026 22:53:19 -0700 Subject: [PATCH] memoryd: depend on roncho 1.0.0 (M5c-1 task 00) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The owner's Honcho client, blocking, with TLS: default features off, feature tls. It adds only itself to the lock file (checksum a5ccccc2…, as checked against crates.io in review). cargo deny passes. The dependency and the egress to rift are documented; the egress table also lists the design model's probe of rift in a throwaway workspace. Co-Authored-By: Claude Opus 5.5 (1M context) --- Cargo.lock | 16 ++++++++++++++++ Cargo.toml | 1 + crates/memoryd/Cargo.toml | 1 + docs/dependencies.md | 1 + docs/egress.md | 2 ++ 5 files changed, 21 insertions(+) diff --git a/Cargo.lock b/Cargo.lock index acbc223..83f73f6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -239,6 +239,7 @@ name = "memoryd" version = "0.1.0" dependencies = [ "bxcore", + "roncho", "rusqlite", "serde", "serde_json", @@ -295,6 +296,21 @@ dependencies = [ "windows-sys 0.52.0", ] +[[package]] +name = "roncho" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a5ccccc22910c51737352c2f0967c7aa40712a0afa7dc740f21354d8daf42e40" +dependencies = [ + "rustls", + "rustls-native-certs", + "serde", + "serde_json", + "thiserror", + "toml", + "zeroize", +] + [[package]] name = "rsqlite-vfs" version = "0.1.1" diff --git a/Cargo.toml b/Cargo.toml index 276d119..93c6386 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -30,4 +30,5 @@ rustls = { version = "0.23.45", default-features = false, features = ["ring", "s rustls-native-certs = "0.8.4" zeroize = "1.9.0" rusqlite = { version = "0.40.2", features = ["bundled"] } +roncho = { version = "1.0.0", default-features = false, features = ["tls"] } diff --git a/crates/memoryd/Cargo.toml b/crates/memoryd/Cargo.toml index 3505eee..629bca8 100644 --- a/crates/memoryd/Cargo.toml +++ b/crates/memoryd/Cargo.toml @@ -10,6 +10,7 @@ workspace = true [dependencies] bxcore.workspace = true +roncho.workspace = true rusqlite.workspace = true serde.workspace = true serde_json.workspace = true diff --git a/docs/dependencies.md b/docs/dependencies.md index 8237339..9808fc6 100644 --- a/docs/dependencies.md +++ b/docs/dependencies.md @@ -13,6 +13,7 @@ Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it. | `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. | | `zeroize` | 1.9.0 | `bxcore`, feature `secrets` (enabled by `gatewayd`; never by `loopd`) | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. | | `rusqlite` | 0.40.2 | `memoryd` from M5a | The full-text index (`index/memory.sqlite3`, FTS5), disposable and rebuilt from files. Feature `bundled`: `libsqlite3-sys` compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: `libsqlite3-sys` (MIT; build: `cc`, `pkg-config`, `vcpkg`), `hashlink`, `hashbrown`, `foldhash` (Zlib, added to `deny.toml` for it), `fallible-iterator`, `fallible-streaming-iterator`, `smallvec`, `bitflags`. MIT. | +| `roncho` | 1.0.0 | `memoryd` from M5c | The owner's Honcho client (`docs/specs/2026-09-25-roncho-requirements.md`). `default-features = false`, feature `tls` (which implies `blocking`): a blocking client over `std::net`, no async runtime; TLS through `rustls`, already a dependency of `gatewayd`. It adds only itself to the lock file: `serde`, `serde_json`, `thiserror`, `toml`, `zeroize` and the TLS crates are already there. Checked against its requirements on 2026-09-27 (every client built with `.without_config_file()`, spec M5c section 6). Apache-2.0. | ## Ported code diff --git a/docs/egress.md b/docs/egress.md index 2c3198d..bc7a3a9 100644 --- a/docs/egress.md +++ b/docs/egress.md @@ -11,6 +11,8 @@ allowed. | Run time (M2a) | `inferproxy` | the `llama-server` router on the host (`straylight:11434`) | Every inference request `loopd` makes, forwarded byte for byte | | Run time (M3b) | `brokerd`'s egress proxy container, for one `http_fetch` call | only the hosts the call's grant names, on port 443, at public addresses | The tool's HTTPS request, end to end; the proxy sees only the host name | | Run time (M4a) | `gatewayd` | the owner's Mattermost at `https://straylight.scylla-hammerhead.ts.net` (tailnet) | REST calls and one WebSocket: the owner's messages in, Boxmaker's answers out. Mattermost stores messages unencrypted in its database; the server is the owner's | +| Run time (M5c) | `memoryd`, through `roncho` | the owner's Honcho at `[honcho] url` (rift: `http://rift.scylla-hammerhead.ts.net:8000`, tailnet) | Finished turns (the speaker's message and the final reply), conclusions mirroring trusted memory writes and untrusted notes, deletions of those conclusions; from M5c-2, searches and dialectic questions. Nothing from a `secret` session or above `private`. Honcho runs its own models on the owner's hosts to derive conclusions (none on the fleet workspace); its server counts telemetry events but sends none (`telemetry_events_emitted_total`, 0 on 2026-09-27) | +| Development (M5c) | the design model, planning M5c-1 | rift's Honcho | Recording real responses for the tests' fake server, in the throwaway workspace `boxmaker-plan-probe` only, deleted afterwards | The two run-time rows for M2a and M3b were missing until 2026-09-23; they were added with the M4a spec.