| Filename | Latest commit message | Latest commit date |
|---|---|---|
db65d20be0
`cargo audit` over all 47 workspace lockfiles reported 142 vulnerability instances. The dangerous ones were not exotic: the S2 executor was pinned to wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379 (9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole job is to execute untrusted guest code, so a sandbox-escape class defect there is not a dependency hygiene matter — it is the confinement claim itself. wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight advisories names as patched (50.0.0 exists but no advisory lists it as fixed, so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the constant is attested into the mechanism commitment under SPEC §7.9, so leaving it stale would attest confinement to a runtime that did not run. The crate's own `wasmtime_version_matches_the_lockfile` test enforces that pairing. The rest are semver-compatible bumps carrying no API change: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto 0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch 0.9.20, rtrb 0.3.5. Not fixed here, and deliberately so rather than silently: zip (>=9.0.0), hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all semver-major moves, three of them transitive, so each needs its dependent assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all. Co-Authored-By: Claude Opus 5 <[email protected]> |
||
| .. | ||
| tests | ||
| Cargo.lock | ||
| Cargo.toml | ||
| README.md | ||
transport-moqt — CommunicationOS transport binding (the last federation layer)
A consumer binding showing a Joule Code collaboration's committed coding
operations carried over CommunicationOS's MoQT transport — the network wire
layer left deferred by spec/collab.md §2.
It closes the loop on the federation stack. The other three layers are already
built and tested in joule-code-collab:
BFT consensus (LockstepCluster), FROST threshold authorization (protected),
and MLS group keying (tests/mls_keying.rs). This example adds the transport.
What it demonstrates
The whole stack, end to end, in one in-process test:
BFT consensus (LockstepCluster) → committed, op_id-ordered coding ops
→ published as MoQT objects over CommunicationOS's transport (inv-moq)
→ each object carries a real Ed25519 / BLAKE3 signed receipt
→ a subscriber receives every op, verifies the signed receipts against the
publisher's key, and recovers the original SignedOp intact
A second test shows the ownerless-trust property: a subscriber that requires receipts rejects a group whose signed receipt does not chain to a trusted publisher key — no central authority decides who is authentic.
The transport
The carrier is inv-moq —
joulesperbit's MoQT (Media over QUIC Transport) wire protocol plus its JWP
receipt extension, the CommunicationOS broadcast-media transport. It exposes
Publisher / Subscriber / GroupHandle / Relay traits with object-level
signed provenance and joule receipts.
The test drives inv-moq through its MockFabric, which runs the real
publish/subscribe/receipt machinery in-process — real Ed25519 signatures, real
BLAKE3 merkle receipts — with no QUIC and no network. inv-moq's quic
feature is the real-wire path (quinn/rustls); the trait surface is identical, so
this binding moves to the network by swapping the fabric, not the code.
This is a standalone workspace (path-deps inv-moq from joulesperbit and the
joule-code-* crates), so the standard's reference library stays free of a
joulesperbit dependency — the same discipline as examples/l3-jouleclaw.
Run
cargo test
Expected:
test untrusted_publisher_is_rejected ... ok
test committed_ops_replicate_over_communicationos_moqt_with_signed_receipts ... ok