Fleet fixes (security assessment F1–F5, F17) — Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Fix the six M3 findings so the fleet milestone does what its spec promises. No new features.

Spec: docs/superpowers/specs/2026-10-19-tines-fleet-fixes.md (draft v1). Findings assessed in THREAT_MODEL.md at 3b1a644. Host hardening (F10–F12) and 1.0 core hardening (F6/F8/F9/F13) are separate specs, out of scope here.

Architecture: F1 is a core behaviour change (ack eligibility). F17 touches both hosts (tines, tines-ros2). F4+F5 rewrite the tines-store log format (v1: header, CRC32C, sync markers, boot counter, durable releases, clock marker, exclusive lock, 0600 perms). F2 gives the tines service a poll loop. F3 rewrites tines-bt (SeqPacket framing, role assignment, NodeId binding, Contact/Lost, multi-peer) and adds core frame_sender.

Global Constraints

tines-core invariants unchanged: #![no_std], no I/O, no panic on untrusted input, Addr ↔ NodeId mapping stays in the transport.
F1 must keep the fleet sim properties green, plus add the full-store custody property.
No robots run tines yet → no migration; logs are wiped (1.0 spec D5).
TDD per AGENTS.md: each finding gets a failing regression test first.
Gate: sh scripts/ci.sh (fmt → clippy -D warnings → doc → test → no_std). tines-ros2 stays excluded from the default gate.

Review Focus

F1: a store-full (Err) receive must NOT be acked — addressed or broadcast — or custody is released for a message nobody kept. → Task 1.
F4: first_seq must be monotonic across reboots (boot counter), and released flags must survive a kill-without-flush. → Task 3.
F5: a corrupt middle record costs that record, not the rest of the log; only a torn tail truncates. → Task 3.
F3: inbound connections must bind to an advertised NodeId, and frame boundaries must survive the BLE stream. → Task 5.

Task 1: F1 — ack only what was kept (tines-core)

Files: tines-core/src/exchange.rs; test in tines-core/src/exchange.rs; sim property in tines-sim/tests/props.rs + a capped-store wrapper in tines-sim.

Interfaces: Exchange::accept enqueues a pending ack only when insert returns Ok (new or non-released duplicate). Err(_) (full/backend) → no ack, addressed or broadcast. No bounce record on Err (already true).

Step 1: failing test — a store returning Full: no Ack emitted; sender's copy stays unreleased.
Step 2: run, see it fail.
Step 3: implement (gate the ack enqueue on res.is_ok(); fix the accept comment "even an un-stored id").
Step 4: green.
Step 5: add the sim property (≥ 1 holder with a small-capacity store returning Full).
Step 6: commit — fix(core): ack only observations the store kept.

Task 2: F17 — one monotonic millisecond clock (tines, tines-ros2)

Files: tines/src/ipc.rs (+ main), tines-ros2/src/node.rs (doc).

Interfaces: HostClock (an Instant captured at process start; now() -> Tick in ms). Replaces now_ms() (which returns wall-clock seconds). LogStore::open takes now from this clock (0 at startup, correct by construction). Wall-clock only for observed_at.

Step 1: failing test — the service's tick advances in ms; an addressed obs with lifetime_ms = 1000 expires in ~1 s, not ~1000 s.
Step 2: run, see it fail.
Step 3: implement HostClock, swap now_ms() → now(), document the clock for TinesNode::poll.
Step 4: green.
Step 5: commit — fix(hosts): one monotonic millisecond clock.

Task 3: F4 + F5 — tines-store log format v1

Files: tines-store/src/log.rs, tines-store/src/lib.rs, tines-store/tests/persistence.rs.

Interfaces:

F4: persisted boot counter (open increments + fsyncs); first_seq() -> u64 = boot_count << 32; remove the insert-counting next_seq and Meta.next_seq; release appends Release { id } immediately (infallible; append error logged); flush appends Clock { tick } (age fold on load, saturating); both hosts seed Node::new from store.first_seq().
F5: log v1 — header "TINESLOG" ‖ format_version u16 ‖ reserved u16; record sync u32 ‖ len u32 ‖ crc32c u32 ‖ body; CRC over len ‖ body; write cap MAX_RECORD_BYTES; recovery skips bad records (scan for next sync, verify CRC) and truncates only a torn tail; ids recomputed from the decoded observation (drop stored id); exclusive File::try_lock; file mode 0600, parent dir 0700; header error names the fix.
Step 1: failing tests — reopen twice: first_seq strictly increases, no id collision; release + kill-without-flush + reopen survives; ages fold the clock marker; corrupt middle record: later records survive; torn tail truncated; oversized record refused at write; second open fails while locked; perms 0600.
Step 2: run, see them fail.
Step 3: implement F4 then F5 (one format change), TDD each.
Step 4: green (cargo test -p tines-store + full gate).
Step 5: commit — fix(store): log format v1 with durable releases and crash recovery.

Task 4: F2 — the service runs the exchange (tines)

Files: tines/src/main.rs, tines/src/ipc.rs (→ poll thread), tines/src/lib.rs.

Interfaces: Node behind a Mutex, shared by the IPC thread and a new exchange thread. Exchange thread: poll(now) until 0 or a per-iteration cap; sleep poll_interval_ms (default 20); on schedule trim(policy, now) + store.flush(). Lock poisoning → process exit non-zero. The loop is generic over Transport.

Step 1: failing test — two service instances over an in-memory transport: an observation through one's IPC is a belief through the other's.
Step 2: run, see it fail.
Step 3: implement the poll thread + trim/flush schedule + poison-exit.
Step 4: green.
Step 5: commit — fix(service): run the exchange on a poll loop.

Task 5: F3 — tines-bt framing, roles, binding, contact events

Files: tines-bt/src/transport.rs, tines-bt/src/adv.rs, tines-bt/src/lib.rs; tines-core/src/wire.rs (add pub fn frame_sender(bytes) -> Option<NodeId>).