feat(daemon): changed_since USN-delta RPC + nightly-CI fixes + full dependency refresh - #600
Merged
Merged
Conversation
…emon surface The daemon owns live volume access and the journal loops; this RPC lets any client ask it the incremental question directly — which files changed on this drive since my cursor — answered from the NTFS USN journal instead of a full index or MFT sweep. Cursor contract (uffs-client::protocol::response_journal): a cursor is (journal_id, usn). Bootstrap, a recreated journal, or a wrapped cursor come back complete=false with a fresh cursor and zero fabricated delta — the caller must run its own full pass before trusting deltas again. A valid cursor gets the aggregated per-FRS delta, paged by a bounded journal read (truncated=true → continue from next_usn). - uffs-mft: read_usn_journal_bounded (batch-aligned resume cursor, exhaustion flag); read_usn_journal now a thin uncapped wrapper - uffs-daemon: changed_since handler on the blocking pool; strict param validation (missing drive is rejected, never defaulted to bootstrap); 262,144-record per-call cap - uffs-client: ChangedSinceParams/Response wire types + changed_since() sync method, with round-trip and defaults tests - uffs-cli: read-only probe `uffs --daemon changed-since <DRIVE> [--journal-id N --since-usn N --max-records N]` (exempt from the elevation gate) so the capability is field-testable in two commands; parse tests included - docs: daemon.md command table + changed-since section First consumer: uffs-content watermark jobs (delta enumeration against the resident daemon + targeted snapshot record reads) — lands with the uffs-products pin bump after this ships.
cargo update -p h2 (0.4.15 -> 0.4.18); 0.4.18 is covered by the existing trusted-publisher vet record (seanmonstar, safe-to-deploy) and imports.lock records the crates.io publisher proof — no exemption added. cargo deny advisories ok, cargo vet succeeded.
The gate was red on a clean tree — five lossy conversions feeding decisions had landed since the rule (masked by the pipeline's resumable step cache). Each gets the remedy the data deserves, not a blanket exemption: - watchdog status_snapshot: STRICT parse — the payload is JSON (UTF-8 by spec) from our own binary; invalid UTF-8 now reads as unknown instead of replacement characters feeding the JSON parse - resident gui_domain (macOS): STRICT parse — the uid feeds a launchctl target; fail loudly rather than aim at a lossy-mangled domain - resident watchdog_running: AUDIT-OK(bytes) — ASCII needle survives lossy byte-exact; strict parse of tasklist's console-codepage output would false-negative and double-spawn the watchdog - resident run_tool error text: AUDIT-OK(bytes) — display-only stderr - system_status process scan: AUDIT-OK(bytes) — ASCII CSV fields with per-line strict parses; whole-buffer strict would discard the entire scan over one console-codepage byte
Scheduled weekly refresh of supply-chain/imports.lock from upstream audit sources (Mozilla, Google, Bytecode Alliance, ISRG, Zcash). See .github/workflows/cargo-vet-refresh.yml for rationale and docs/architecture/security/ supply-chain-posture.md for the full supply-chain posture.
Bumps the github-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...ff2f1c6) Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...ff2f1c6) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
The 2026-08-17 Tier 2 nightly fuzzer crashed parse_record on a 98-byte
record whose final attribute header is cut mid-field: the $FILE_NAME
value-offset read at bytes 20..22 of the attribute sliced past the end
of the buffer ('range end index 100 out of range for slice of length
98', crash-202ec813…). Same latent hazard in parse_data_attribute_full's
resident value-length read (bytes 16..20).
Both now slice with get() and treat truncation as the malformed-record
path, matching parse_standard_info_full's existing hardening. The crash
input is committed as a fuzz corpus seed (replayed by every nightly) and
as a unit regression test, which was verified to panic without the fix
and pass with it.
Part of #597 (the workflow-failing half; the cargo-mutants job in that
run is advisory by design, pending its documented baseline).
… mutants run The 2026-08-17 advisory cargo-mutants run showed six surviving mutations in decrypt_cache's size-gate arithmetic (192:19 < → ==/<=, 192:36 + → -, 228:44 + → -, 255:46 + → -, 256:19 < → >). Each now has a boundary-shaped test asserting the SPECIFIC behavior that distinguishes the real operator from its mutation: - a buffer of exactly the 44-byte v1 minimum passes the size gate (fails later at GCM auth, never 'too short') - under-minimum v1/v2 buffers are rejected BY the size gates, with their messages — not by later header parses - a one-byte-truncated real ciphertext reports 'truncated' - trailing bytes after a valid ciphertext still decrypt (exact slices) Verified with a scoped local run: crypto.rs now 37 mutants tested, 35 caught, 2 unviable, zero missed. Also gitignores local mutants.out artifacts. Part of the #597 triage.
…ll of it cargo update across the workspace: aes-gcm 0.11.1, blake3 1.8.7 (drops the arrayref dependency entirely), darling 0.24.1, either 1.18.0, fast-float2 0.2.4, the ICU4X 2.3 train (a provenance/soundness pass: Box transmutes replaced with into_raw/from_raw casts throughout), quinn-proto 0.11.17 (congestion-overflow + reassembler DoS hardening), rmcp 3.1.4 (secret redaction, response-id correlation, probe timeout), rustls-webpki 0.103.15, uuid 1.24.1, and friends. Every delta was reviewed and certified into supply-chain/audits.toml with concrete notes — 25 audits, zero new exemptions (the count went DOWN via the folded weekly import refresh). fast-float2's new GetAt indexing verified checked-by-default (the no-panic feature is not enabled anywhere in our tree). The one deliberate hold, re-verified today against 0.13.4: reqwest stays on 0.12 — 0.13 still routes system trust through rustls-platform-verifier (the ~63k-line Android JNI stack cargo-vet would audit for a target we never ship), and polars-io through 0.55.2 stays on the 0.12 line, so bumping would compile two reqwest/TLS stacks into the same binaries. Rationale refreshed in Cargo.toml. Vet-Reviewed-Diff: ref-cast-impl@1.0.26->1.0.27 Vet-Reviewed-Diff: darling_macro@0.24.0->0.24.1 Vet-Reviewed-Diff: rmcp-macros@3.1.2->3.1.4 Vet-Reviewed-Diff: libredox@0.1.19->0.1.20 Vet-Reviewed-Diff: zerovec-derive@0.11.5->0.11.6 Vet-Reviewed-Diff: uuid@1.24.0->1.24.1 Vet-Reviewed-Diff: rustls-webpki@0.103.14->0.103.15 Vet-Reviewed-Diff: ref-cast@1.0.26->1.0.27 Vet-Reviewed-Diff: potential_utf@0.1.5->0.1.6 Vet-Reviewed-Diff: aes-gcm@0.11.0->0.11.1 Vet-Reviewed-Diff: darling_core@0.24.0->0.24.1 Vet-Reviewed-Diff: darling@0.24.0->0.24.1 Vet-Reviewed-Diff: tinystr@0.8.3->0.8.4 Vet-Reviewed-Diff: litemap@0.8.2->0.8.3 Vet-Reviewed-Diff: zerotrie@0.2.4->0.2.5 Vet-Reviewed-Diff: pkg-config@0.3.33->0.3.34 Vet-Reviewed-Diff: either@1.17.0->1.18.0 Vet-Reviewed-Diff: blake3@1.8.6->1.8.7 Vet-Reviewed-Diff: fast-float2@0.2.3->0.2.4 Vet-Reviewed-Diff: quinn-proto@0.11.16->0.11.17 Vet-Reviewed-Diff: writeable@0.6.3->0.6.4 Vet-Reviewed-Diff: icu_collections@2.2.0->2.3.0 Vet-Reviewed-Diff: icu_normalizer_data@2.2.0->2.3.0 Vet-Reviewed-Diff: icu_locale_core@2.2.0->2.3.0 Vet-Reviewed-Diff: icu_provider@2.2.0->2.3.1 Vet-Reviewed-Diff: zerovec@0.11.6->0.11.8 Vet-Reviewed-Diff: icu_properties@2.2.0->2.3.0 Vet-Reviewed-Diff: icu_properties_data@2.2.0->2.3.0 Vet-Reviewed-Diff: icu_normalizer@2.2.0->2.3.0 Vet-Reviewed-Diff: rmcp@3.1.2->3.1.4
This was referenced Aug 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR carries
The feature:
changed_since— USN-journal delta as first-class daemon surfaceThe daemon owns live volume access and the journal loops; this RPC lets any client ask which files changed on this drive since my cursor, answered from the NTFS USN journal instead of a full index or MFT sweep. Honest cursor contract: bootstrap / recreated journal / wrapped cursor come back
complete: falsewith a fresh cursor and zero fabricated delta. Bounded paging (read_usn_journal_bounded, batch-aligned resume cursor). Read-only operator probe:uffs --daemon changed-since <DRIVE>. First consumer: uffs-content watermark jobs (delta enumeration + targeted snapshot record reads), landing with the products pin bump after this ships.Nightly-CI triage (#597)
parse_recordpanicked on a truncated attribute header (range end index 100 out of range for slice of length 98). Both unguarded slice sites inattribute_helpers.rsnow bounds-check viaget(); the crash input is committed as a fuzz corpus seed and a unit regression test (verified to panic without the fix).Security & supply chain
from_utf8_lossy-feeding-a-decision sites remediated (2 strict-parse fixes, 3 documentedAUDIT-OK(bytes)); the anti-pattern gate is green on a clean tree again.audits.toml(concrete notes per crate; zero new exemptions — the exemption count went down). Folds the weekly vet-import refresh (chore(security): weekly cargo-vet import refresh #598) and the GH-Actions bumps (ci(deps): bump the github-actions group with 2 updates #599).Validation
just gofully green (2458 tests), workspace-widecargo xwin clippy -D warningsclean for x86_64-pc-windows-msvc, cargo deny/audit/vet all passing, vet audit-discipline gate exit 0 over the whole range.Closes #597
Supersedes #598
Supersedes #599