public_api.rs imported only spec §3's original list (S15). It now also
probes WallClockStore, Node::set_wall_clock, Node::peer_time_estimate and
Node::flush (decision H), the Node method signatures, the NodeEvent shape
and the public wire constants, and names nothing §3 makes private
(Frame, WireError, local constants).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decision K (spec §5): the local capacities and timings are defaults that
will become configuration, so they are `pub(crate)`. The wire constants
stay public.
- MAX_PEERS, SUMMARY_INTERVAL_MS, REASSEMBLY_TIMEOUT_MS, SEND_QUEUE_CAP,
MIN_MTU, EVENT_QUEUE_CAP, DROP_TABLE_CAP, BCAST_SENT_CAP, ACK_BUFFER_CAP
and PEER_IDLE_MS are now `pub(crate)`; a compile_fail doctest pins it.
- MIN_MTU's doc claimed it was the floor below which a fragment has no
room. It is only the frag sweep's lower bound (BLE ATT's 23). The real
floors are now stated on `Transport::mtu` and pinned by
`consts::tests::mtu_floors`: 85 to carry every valid observation, 66 to
fragment at all, 35 for an Ack, 26 for a summary.
- tines-bt caps live connections with its own MAX_PEERS (8).
- tines-sim's props mirror MAX_PEERS/SEND_QUEUE_CAP, checked against core
through the hidden `conformance` module; the fuzz twin reads it there.
- node.rs: drain_events' rustdoc no longer links the now-private consts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Spec §3 (decision D-b) lists `Frame` and `WireError` as private; lib.rs
re-exported both. Only `frame_sender` stays public.
- The pinned vectors in tests/vectors.rs now compile in-crate as a
`#[cfg(test)] #[path]` module (autotests = false keeps Cargo from also
building them as an integration test). Every golden vector now checks
`encode() == GOLDEN` as well as the decode, and new literal vectors pin a
trailing-byte rejection and an addressed Obs with a nonzero age and an
`observed_at`.
- A `#[doc(hidden)]` `conformance` module (behind the `conformance`
feature) gives the fuzz harness byte-level frame encoders/decoders and
core's local limits without exposing `Frame`. The fuzz_twin test target
now requires `conformance`, which scripts/ci.sh enables.
- compile_fail doctests pin that `Frame`/`WireError` are unreachable.
- Remove the THROWAWAY gen_missing_golden_vectors test and fix stale
wire.rs comments about the version/tag byte offsets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both hosts open LogStore with plausible_wall_ms(PLAUSIBLE_WALL_MS), so a
forged out-of-range peer estimate is dropped before the store picks the
latest and can't hide an honest one (decision J, review B3). Un-ignores
latest_estimate_wins_over_smallest_age now that the store returns the
latest estimate, and adds forged_estimate_does_not_hide_an_honest_one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Spec §9 decision J: an estimate outside the plausibility bounds doesn't
count. A max-based peer_time_estimate always returned a forged
observed_at = u64::MAX, which the host then rejected, so it never saw
the honest estimates and stayed quarantined.
LogStoreBuilder::plausible_wall_ms(floor..=ceiling) sets the range
(default unbounded, so behaviour is unchanged when unset), and
peer_time_estimate filters candidates against it before taking the
max. The WallClockStore signature is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Store::flush and Node::flush: the §4 contract (durability point, time
anchor, harmless twice, earlier now clamped, Err(Backend) leaves the
store usable, application decides when). No "infallible" or
"duplicate custodian" wording.
- WallClockStore and Node::set_wall_clock / peer_time_estimate: define
quarantine generically, a second set_wall_clock is a no-op returning
the first report, peer time is unauthenticated until 1.1.
- Observation::age_ms: a lower bound that every holder advances; use
observed_at for absolute time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
idempotent_flush now also checks that an earlier `now` is clamped (no
age moves), that a flush never ages an observation inserted after its
`now`, that a release survives a flush, and that the store accepts
inserts afterwards. Durability itself needs a restart, which the
std-free suite can't do; tines-store tests it through the trait.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review findings B1, B2, S2, S3, B3 (store sites), decision I, J and L.
- B1: the clock-marker flush is now the `Store::flush` impl, so
`Node::flush` writes the marker and fsyncs. The inherent
`LogStore::flush` is gone (calls resolve to the trait method).
- B2 / decision I: `open` (after the tick fold) and `set_wall_clock`
(after the wall fold) rewrite the log as a snapshot: header, Boot,
every live Obs at its current age with stored_at = now, a Release
for every released id still held, and a closing Clock marker (no
wall at open, wall_now after the fold). Temp file beside the log,
fsync, rename, fsync dir. Every stored_at on disk is then in the
current boot's ticks, so lineage survives any number of reboots, and
an expiry or floor from the fold survives a later reboot. A leftover
temp file from an interrupted snapshot is removed on open.
- Lock across the rename: the snapshot's temp file is created 0600 and
locked before it is renamed over the log, so the file at the path is
always locked by the live store. An opener that locked a file a
snapshot just replaced detects it (dev/inode check) and retries.
- S2: the known-downtime fold adds downtime minus the ticks the open
fold counted minus (now - open_tick), once, not per-entry
now - stored_at, so a flush before trust no longer double-counts.
- S3: flush and set_wall_clock clamp `now` to the time anchor (the
latest tick the store has seen); stored_at never moves backwards.
- B3: the derived marker wall and the expiry `lifetime + 1` saturate.
- Decision J: peer_time_estimate returns the latest estimate among
non-quarantined observations with observed_at; rustdoc says peer
time is unauthenticated.
- Decision L: trim rustdoc states quarantined entries are exempt from
every rule; tested.
- A header torn while the log was first created (shorter than the
header, starting with the magic) opens as a new log; any other short
file is still refused and left alone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The host crates ship breaking changes (log format v2, flush and
set_wall_clock, the tines::serve signature, tines-core 1) that can't go
out as the already-released 0.3.0 (1.0 review S13). tines-core stays
1.0.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- S4: TinesNode::trust_system_clock(now) and trust_wall_clock(wall, now)
give a ROS2-only fleet a local trusted-time source, with the same
plausibility bounds as the service (tines::trust).
- Decision J: poll collects peer estimates for a window (default 10 s,
set_peer_time_window_ms) from the first plausible one and adopts the
latest, once; implausible estimates (B3) are never adopted.
- S5: adoption goes through tines::trust::adopt_wall_clock, which flushes
the store right after set_wall_clock.
- has_trusted_time() reports whether a wall time was adopted.
The `ros2` feature is outside the default gate; the shared logic is
tested in `tines`, and these methods were type-checked against it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- B3: HostClock::wall_ms saturates. New `tines::trust` module: wall times
outside WALL_FLOOR_MS (2026-01-01Z) ..= WALL_CEILING_MS (+100 years) are
never adopted, from a peer or the system clock.
- Decision J: `serve` takes `peer_time_window_ms`; PeerTimeWindow opens on
the first plausible estimate, keeps the latest (advanced by ticks), and
adopts once when the window closes. The scan stops once trusted.
- S5: adopt_wall_clock flushes right after set_wall_clock.
- S6: `trusted_clock` accepts only "system", Config denies unknown fields,
an implausible system clock is logged and left to the peer path, and the
docs say to order the unit after time-sync.target. New config key
`peer_time_window_ms` (default 10000).
- Tests: the observed_at and time_from_peer tests now run the host's own
logic through `serve`; smallest_age_wins is replaced by window and
latest-estimate tests (the latter ignored until the store returns the
latest estimate); forged u64::MAX and below-floor estimates aren't
adopted and don't panic the host.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The drop table now empties on drain, keys included. Before, after 32
distinct (addr, reason) pairs every later drop went to the overflow
slot until reboot. The overflow slot's reason is documented as that of
the first drop to overflow since the last drain (review S7).
- F9's receive-side check accepts a summary at least
SUMMARY_INTERVAL_MS / 2 after the last one acted on, so an on-time
summary measured at 1999 ms isn't ignored (decision L, review D-f).
- DropReason::IdentityChanged loses its variant-level non_exhaustive,
which made it unmatchable outside the crate; the enum keeps its own.
- Stale comments: drain_events is used by Node (drop the dead_code
allow), and NodeEvent drops are this node's, not the peer's.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reassembler decoded with postcard::from_bytes, which accepts
trailing bytes. It now uses take_from_bytes and rejects a non-empty
remainder, as Frame::decode does (spec §10 F13).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The idle check ran only in on_frame and only for the peer that just
sent, so a peer that went quiet, or never sent (contact-only), held its
slot forever: eight spoofed addresses locked out every newcomer
(review S1).
Peers now record when their contact started (added_at), and idle peers
(now - last_inbound.unwrap_or(added_at) > PEER_IDLE_MS) are swept as if
Lost before a peer is added and at the top of next_frame. A peer that
resumes after its idle window is an implicit new contact: its frame is
processed rather than silently dropped. A repeat Contact restarts the
idle clock.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- remove_peer purges only the removed peer's pending acks, not every
peer's (review S9, F13).
- bcast_sent records for an address are dropped when its contact starts
or ends, and a broadcast whose send fails has its record undone, so a
broadcast Ack is accepted only for this contact's dispatched frames
(review S10).
- A repeat Contact for a known peer starts a new contact: it resets the
F6 pin and the per-contact bounce and receipt records (spec §10 F6).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Core re-checks dest when building the summary Bloom filter, rebuilding
a peer's broadcast send queue, and emitting a broadcast, so a store
whose for_each_broadcast_id yields addressed ids can't leak them into a
summary or forward them (expired) as broadcasts (review S11).
Adds UnfilteredStore, a test store whose iterators yield every held id,
released and broadcast ones included, pinning spec §4's 'core never
trusts a backend's filtering' for custody, acks and summaries (B8).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
I: LogStore snapshots the log at the end of open and after the
set_wall_clock fold, so fold results and age lineage survive reboots.
J: hosts adopt the latest peer time estimate within a short window,
bounded, once per run.
K: local constants become pub(crate); only wire constants stay public.
L: quarantined entries are exempt from the count trims; the F9 summary
rate limit accepts at SUMMARY_INTERVAL_MS / 2; Observation.sig stays a
public field and §2's wording is corrected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Record the public 1.0 API that 941a7ce introduced in place of the revived
store_mut backdoor: the opt-in WallClockStore trait (FoldReport,
set_wall_clock, peer_time_estimate) and Node::set_wall_clock /
Node::peer_time_estimate, bounded on S: WallClockStore. Updates §3's
public table and Node method list and §9's fold and time-from-peers
text; core still never interprets wall time.
Also split the drain_events sentence into its own §3 bullet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Task 10b reached LogStore::set_wall_clock through a general Node::store_mut.
Kyle: replace it with a narrower accessor. A WallClockStore trait (set_wall_clock
+ peer_time_estimate, implemented only by LogStore) now backs Node::set_wall_clock
and Node::peer_time_estimate, so no &mut Store escapes the facade.
The workspace build pulls in bluer -> dbus -> libdbus-sys, which links
against the system D-Bus library. The ubuntu-latest runner has pkg-config
but not dbus-1.pc, so libdbus-sys's build script fails. Install the
libdbus-1-dev headers (matching Dockerfile.ros2) before running the gate.
The store opens before trusted time. Observations already in the log
are quarantined (not summarised, offered, believed or age-trimmed;
addressed ones report released) until LogStore::set_wall_clock runs the
downtime fold. Trusted time comes from the robot's RTC/GPS, else a
peer's observed_at + age_ms (smallest age wins), else the robot's own
fail-safe. Supersedes "don't open the store until trusted time".
Plan: Task 10 rewritten (quarantine, set_wall_clock, FoldReport,
derived marker wall time); new Task 10b (host trusted-time state
machine, time from peers, observed_at).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- F: Store::flush(now) with a no-op default; Node::flush(now) replaces
Node::store_mut. The caller's now anchors ages (fixes LogStore's stale
clock marker, F18).
- G: age_ms is documented as a lower bound. Robots are assumed to have a
trusted wall clock (RTC or GPS); LogStore adds power-off time on open
from a wall-clock flush marker. Unknown downtime expires held addressed
messages and floors held broadcasts' age at unknown_downtime_age_ms.
Hosts set observed_at.
- AGENTS.md: specs and plans change only to record decisions Kyle has
discussed and agreed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- README: custody chain and receipts replace epidemic forwarding; Ack
frame; running on a robot (host crates, current limits); security;
crate layout, constants and reading list.
- AGENTS.md: current spec list, receipt constraints and review focus
7-8, first_seq rule, constants, host crates and the ros2 gate.
- THREAT_MODEL.md: re-checked at 89041ea. F1, F2, F5, F17 fixed; F3
(single configured peer) and F4 partly fixed; new F18 (no scheduled
flush, stale clock marker).
- CHANGELOG: Unreleased section for the fleet milestone and fixes.
- tines-bt README: single-peer limit; manual BLE check not yet recorded.
- tines service rustdoc: oversized-frame behaviour, JSON tagging, clock.
- 1.0 spec: approved (2026-10-20), including §10 and the adversarial
fuzz mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Exchange::accept enqueued a pending ack whenever
!(duplicate && addressed && released) held, even when the backend
store.insert returned Err (store full / backend error). On Err the
released flag computed to false, so an ack was still enqueued: a
receiver that did not keep the message acked it. For an addressed
offer that releases the sender's custody for a message nobody holds;
for a broadcast it fires a false confidence event at the sender.
Gate the ack enqueue on res.is_ok(): enqueue only when the store
actually retained the observation. The existing released-holder
exception still applies among kept copies. No bounce is recorded on
Err (already the case).
Adds a unit test exercising a capped store (StoreError::Full) for
both a broadcast and an addressed offer, and a tines-sim property
that drives custody with CappedStore-backed nodes and asserts the
"at least one holder" invariant still holds when stores fill.
kyleandClaude Opus 5.5