Initial release: v0.1.0

Passphrase-based peer rendezvous for iroh-gossip swarms over the public
Mainline DHT. Two nodes that share a passphrase + application salt find
each other and join the same gossip topic — no bootstrap server, no
prior knowledge of peer addresses.

The algorithm is a clock-free variant of HyParView-style partition
healing on BEP 44 mutable items, with K-sharded slots, logical aging
with random-tie eviction, vouching of up to V neighbors at age 1, and
a two-layer AEAD record envelope. Full spec in PROTOCOL.md.

Ships with:

* 119 tests (unit / property / integration / doctest) all green
* 100% mutation-testing catch rate (cargo-mutants)
* cargo-fuzz harnesses for the parse surface
* Kani proofs of no-UB / no-panic on crypto::epoch_of and
  wire::decode_entries across their full symbolic input spaces
* Stateright distributed-system model: safety invariants S1 + S2
  proved exhaustively for N ≤ 6, K ≤ 3; liveness witness under weak
  fairness
* Miri green on the synchronous modules
* cargo-deny + cargo-audit clean
* criterion benches
* Full-matrix CI (Linux + macOS + Windows × stable + MSRV 1.93.0)
* Dedicated nightly lane for Miri / mutation / fuzz / Kani / Stateright

Pinned iroh 0.98.x. License MIT.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.cargo/mutants.toml

@@ -0,0 +1,41 @@
+# cargo-mutants configuration.
+# https://mutants.rs/reference.html
+
+# Use nextest for faster mutation runs.
+test_tool = "nextest"
+
+# Async tests + crypto work takes longer under mutation load.
+timeout_multiplier = 3.0
+
+# Skip paths that either can't be meaningfully mutated or are covered by
+# other tools:
+#   - sim_impl.rs: simulator is exercised via the simulator example, not
+#     unit tests; mutation scores would mislead.
+#   - dht/mainline.rs: covered only by the nightly mainline-live lane.
+#   - kani_proofs.rs: proof harnesses, NOT runtime code. They're gated on
+#     `#[cfg(kani)]` and only built by Kani itself; our test suite never
+#     touches them, so every mutation would "survive" trivially. Mutation
+#     testing of proof harnesses is a category error — the proofs verify
+#     invariants in the production code, not the other way around.
+#   - examples: not part of the library surface.
+#   - tests/*: the tests themselves.
+#   - benches: not on the hot path.
+exclude_globs = [
+    "src/sim_impl.rs",
+    "src/dht/mainline.rs",
+    "src/kani_proofs.rs",
+    "examples/**/*",
+    "tests/**/*",
+    "benches/**/*",
+]
+
+# Acceptable mutation classes: arithmetic, logical, comparison, return-value
+# substitution. Default set is fine.
+
+# Fail if any mutant survives on the algorithmic core after the full run.
+# Acceptance target (see PROTOCOL.md + CHANGELOG):
+#   * keys, wire, crypto, merge: ≥ 80% caught.
+#   * crate-wide: ≥ 70% caught (error-logging mutants in protocol.rs
+#     often survive without affecting correctness).
+
+# Run via `just mutants` locally; CI shards across jobs.