The nightly workflow has failed every run since it was added. Fix the
four distinct issues so it can actually exercise the slow checks:
- cargo-mutants: drop bogus `--in-diff-base ""` flag (never existed in
cargo-mutants; v27 rejects it).
- fuzz smoke: pin `--target x86_64-unknown-linux-gnu`. Binstall ships a
musl-static cargo-fuzz binary whose default target inherits its own
triple, and libfuzzer's sanitizer is incompatible with `crt-static`.
- miri: move multi-module filters after `--`. `cargo test` only accepts
one TESTNAME positional; libtest accepts multiple substring filters.
- stateright random_large: add `target_state_count(1_000_000)` so the
simulation actually terminates instead of looping past the 30 min CI
timeout. The comment already claimed "up to 10⁶ states".
Also refreshes fuzz/Cargo.lock, regenerated by the local verification
build (was stale vs. parent deps).
RUSTSEC-2026-0119 (hickory-proto O(n²) name-compression DoS) and
RUSTSEC-2026-0120 (hickory-net NSEC3 unbounded loop / OOM) both fire
against hickory 0.26.0-beta.4. Fixed upstream in hickory 0.26.1, but
iroh 0.98.2 hard-pins hickory-resolver = "=0.26.0-beta.4" so we
can't bump transitively. Unblock once iroh releases a version that
relaxes the pin.
Bot was generating mostly-wrong upgrade PRs that don't understand the
crypto stack's transitive pinning constraints. We'll bump deps by hand
when there's reason to.
mainline 6.1.2 loosened its digest pin, unblocking hkdf 0.13 (which
needs digest 0.11). sha2 stays on the prerelease '=0.11.0-rc.5' to
match iroh-base's hard-pin; can drop the '=' once iroh-base relaxes.
HKDF-SHA256 KAT (keys_hkdf_kat_passphrase_abc_app_test_v1_k3) passes
byte-for-byte, so on-wire/on-disk key material is unchanged.
Updates the pinning rationale comment in Cargo.toml accordingly.
Passphrase-based peer rendezvous for iroh-gossip swarms over the public
Mainline DHT. Two nodes that share a passphrase + application salt find
each other and join the same gossip topic — no bootstrap server, no
prior knowledge of peer addresses.
The algorithm is a clock-free variant of HyParView-style partition
healing on BEP 44 mutable items, with K-sharded slots, logical aging
with random-tie eviction, vouching of up to V neighbors at age 1, and
a two-layer AEAD record envelope. Full spec in PROTOCOL.md.
Ships with:
* 119 tests (unit / property / integration / doctest) all green
* 100% mutation-testing catch rate (cargo-mutants)
* cargo-fuzz harnesses for the parse surface
* Kani proofs of no-UB / no-panic on crypto::epoch_of and
wire::decode_entries across their full symbolic input spaces
* Stateright distributed-system model: safety invariants S1 + S2
proved exhaustively for N ≤ 6, K ≤ 3; liveness witness under weak
fairness
* Miri green on the synchronous modules
* cargo-deny + cargo-audit clean
* criterion benches
* Full-matrix CI (Linux + macOS + Windows × stable + MSRV 1.93.0)
* Dedicated nightly lane for Miri / mutation / fuzz / Kani / Stateright
Pinned iroh 0.98.x. License MIT.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
swaits
