CI run log: rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5

{
  "request": "trigger",
  "version": 1,
  "event_type": "patch",
  "repository": {
    "id": "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5",
    "name": "heartwood",
    "description": "Radicle Heartwood Protocol & Stack",
    "private": false,
    "default_branch": "master",
    "delegates": [
      "did:key:z6MksFqXN3Yhqk8pTJdUGLwATkRfQvwZXPqR2qMEhbS9wzpT",
      "did:key:z6MktaNvN1KVFMkSRAiN4qK5yvX1zuEEaseeX5sffhzPZRZW",
      "did:key:z6MkireRatUThvd3qzfKht1S44wpm4FEWSSa4PRMTSQZ3voM",
      "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz"
    ]
  },
  "action": "Updated",
  "patch": {
    "id": "35de0506bf37acacd082fe029186a5db2b43c8dc",
    "author": {
      "id": "did:key:z6MktBiMxUQ8SP1cRWhnTVxVwM8ijac6M9P1T3BDxaeVnqjh",
      "alias": "fred-surface-win"
    },
    "title": "cli: keep node running after terminal closes on windows",
    "state": {
      "status": "open",
      "conflicts": []
    },
    "before": "6ba619f9a636fecfe5f30b36ebb6b8c06774d5cb",
    "after": "a40472d45140a54a7b336a11d1b227acae66f371",
    "commits": [
      "a40472d45140a54a7b336a11d1b227acae66f371",
      "41e908e59c1b7f05b9b0fd67e894f8d6f989502f"
    ],
    "target": "6ba619f9a636fecfe5f30b36ebb6b8c06774d5cb",
    "labels": [],
    "assignees": [],
    "revisions": [
      {
        "id": "35de0506bf37acacd082fe029186a5db2b43c8dc",
        "author": {
          "id": "did:key:z6MktBiMxUQ8SP1cRWhnTVxVwM8ijac6M9P1T3BDxaeVnqjh",
          "alias": "fred-surface-win"
        },
        "description": "This change adds support for keeping the node running as a true\nbackground process. By default, detached processes like that would\ncreate a temporary console when they themselves fork a command like\ngit.",
        "base": "90aaec1c9eee77a0beebece48f460c1424c1c8bd",
        "oid": "d234e7d24cc62ae06a6c802c596260ebb995ceb1",
        "timestamp": 1784381453
      },
      {
        "id": "b907eede3fb1562219d4692526016f7b8979ed51",
        "author": {
          "id": "did:key:z6MktBiMxUQ8SP1cRWhnTVxVwM8ijac6M9P1T3BDxaeVnqjh",
          "alias": "fred-surface-win"
        },
        "description": "radicle/node/config: Document RateLimit fields\n\nThe documentation for `RateLimit::fill_rate` and `RateLimit::capacity`\nwere missing.\n\nAdd the documentation to help users decided on values based on how the\nrate limiting works.\n\n\nworkspace: Update snapbox to 1.2\n\n\ncli-test: Disable normalizing paths\n\nThe normalization of paths was converting valid `\\n` characters to `/n`.\nThis had not been noticed until codespell suggest the change of\n`/ndefined` to be `/undefined`.\n\nUse `Assert::normalize_paths(false)` to disable this behaviour.\n\n\nradicle-node: Prevent infinite connection loop on instant dial failure\n\nWhen a connection drops and the node attempts to reconnect within the\nsame second, the `last_attempt` timestamp written to the database is\nidentitcal to the `last_success` timestamp due to the Unix time (seconds)\nprecision loss.\n\nThe `maintain_connections` logic filters eligible peers using the\ncondition `last_success >= last_attempt`. Because the truncated\ntimestamps are equal, this evaluates to true, causing the node to\nbypass the `CONNECTION_RETRY_DELTA` backoff.\n\nIf the OS instantly rejects the dial attempt (e.g. `EHOSTUNREACH`),\nthe node synchronously queues another connection attempt. This traps\nthe reactor in an infinite `while` loop.\n\nChanging the condition to `last_success > last_attempt` ensures that a\nfailed attempt in the same second correctly evaluates to false, forcing\nthe node to respect the backoff timer and breaking the loop.\n\n\nradicle-node: Replace WAN routeable testing IPs with 198.18.0.0/15 private subnet\n\n\nradicle: Replace WAN routeable testing IPs with 198.18.0.0/15 private subnet\n\n\nradicle-cli: Add labels column to patch list\n\n\nradicle-cli: Fix broken test 'rad-cob-update'\n\nThe `rad_cob_update` test accidentally use the `rad-cob-log` file\ninstead of `rad-cob-log`.\n\nThis change fixes that, and updates the `rad-cob-update` example file\nto the latest patch show format.\n\n\ncob: Replace 'git2::Oid' -> 'git::raw::Oid'\n\n\nradicle/cob/patch: Extend MergeTarget\n\nExtend `enum MergeTarget` to include a new variant, `Branch`.\nThe intended use of this new variant is to allow a `Patch` to have a\ntarget branch other than the default branch.\n\nThe `Branch` variant holds a `TargetBranch` which, in turn, is ensured\nto be a `Qualified` reference that begins with `refs/heads`, i.e. a\nGit branch.\n\n\nremote-helper: Add 'patch.target' push option\n\nThe remote helper now supports the push option `patch.target`. This\nallows users to explicitly specify a target canonical reference when\nopening or updating a patch. For example, to open a patch that targets\nthe branch \"backport\", use:\n```\ngit push -o patch.target=refs/heads/backport\n```\n\nFurthermore, strict merge and revert isolation is now enforced:\npatches are only marked as merged or reverted if the commits are\npushed to the target branch of the patch explicitly.\n\n\nremote-helper: Introduce magic push ref 'refs/for/'\n\nIntroduces support for Gerrit-style magic push references via\n`refs/for/<branch>`. Pushing to this ref automatically extracts the\ntarget branch and opens a patch against it, bypassing the need for the\npush option `patch.target`. Example:\n\n```\n$ git push rad HEAD:refs/for/accepted\n```\n\nWill open a patch with its `patch.target` set to `refs/heads/accepted`.\n\n\nradicle-cli/terminal: Add patch target ref to rad patch show\n\n\ncli/examples: Introduce a suite of merge and revert tests for patch.target\n\n\nterm: Remove typing indication for passwords\n\n`inquire::PasswordDisplayMode::Masked` causes inquire to\nrender characters of the password text input marked as\ndifferent characters (asterisks).\n\nUsers reported that they would prefer password text input to not be\nrendered at all, i.e., have no indication of input. This is inquire's\ndefault, so remove the lines that set the display mode.\n\n\nradicle/cob: Include command name on spawn fail\n\nTo improve the ability to work out what went wrong, should an external\ncob helper not be found, report the command name if the spawn fails.\n\nSigned-off-by: Daniel Silverstone <dsilvers@digital-scurf.org>\nCo-authored-by: Lorenz Leutgeb <lorenz.leutgeb@radicle.dev>\n\n\ncli/examples: fix jj-init-colocate test\n\nThis hint was removed in jj 0.41.0 with commit\nf2eea823d6919ed88fa4e7778d9e0e302af851c1\n\n\nradicle-cli: Remove fullstop from RID on rad init\n\nPrevents fullstop from being selected on double click the RID.\n\n\nnode/wire: Always report fetch results to the service\n\nA fetch result was discarded whenever the peer was no longer `Connected`\nby the time the worker reported, and queued fetches were dropped silently\nwhen the peer disconnected before the `Io::Fetch` was processed. In both\ncases the fetcher's `active` entry for the repo was never cleared. Since\nthat entry is keyed by repo, it blocked the repository from being fetched\nfrom any node until the process restarted.\n\n- Report the result in `worker_result` even when the peer is no longer\n  connected, instead of returning early\n- Report a failed fetch when an `Io::Fetch` is dropped for a disconnected\n  peer, so the active entry is cleared\n- Flip the wire regression test to assert the entry is now cleared on\n  disconnect\n\n\nfetcher: Guard fetched against stale node results\n\n- Clear active[rid] only when the result's node matches the node that\n  started the fetch; mismatched results now report NotFound\n- Prevent a late completion from a disconnected peer clearing a newer\n  fetch for the same repo started by a different node\n- Add test covering the stale-from mismatch path\n\n\nfetcher/state: Extend test for same RID, different nodes\n\nThe extension of the test shows that Node B's fetch cannot be dequeued because\nthe RID is in the active fetch set.\n\nIt can then be dequeued once Node A has been fetched from.\n\n\nfetcher: Test removing active fetch from another node\n\nAdd test coverage to show that an active fetch is only removed when the `NodeId`\nof the `from` field matches the `NodeId` of the active fetch.\n\n\nnode/test: Reproduce orphaned fetch at service layer\n\n- Drive the real cancel-skip path: a connection conflict makes\n  `disconnected` early-return on a link mismatch, leaving the fetch\n  uncancelled\n- Combined with an undelivered fetch result, the `active[rid]` entry is\n  orphaned and the repo can no longer be fetched from any node\n- Confirm delivering the missing result clears the entry and unblocks\n  the queued fetch, showing what the fix must guarantee\n\n\nnode/wire: Test disconnected node remove active fetch\n\n- Drive `worker_result` through the real wire layer with the peer in\n  `Disconnecting` state, mirroring a fetch that ends mid-disconnect\n- Assert `active[rid]` survives, proving the result is discarded without\n  calling `service.fetched`, which is what orphans the entry\n- Add helpers to wrap a service with an active fetch in a `Wire`\n\n\nnode/wire: Test connected node removes active fetch\n\n- Assert that with the peer still `Connected`, `worker_result` clears\n  `active[rid]` as expected\n- Confirm the disconnect test is exercising the discard path rather than\n  passing vacuously\n\n\nradicle-cli: fix tests for git ddiff on Windows.\n\nI took the easy way of changing the tests to compare the lines\nindependently, as I suspect diffs should remain platform-specific.\n\n\nFix NO_COLOR to only suppress colors, not all ANSI styles\n\nThe NO_COLOR convention (https://no-color.org) only calls for\nsuppressing ANSI *color* codes. It does not demand the removal of\nother attributes such as bold, italic, underline or reverse.\n\nPreviously, Paint::is_enabled() bundled anstyle_query::no_color()\ninto the single boolean that decides whether to emit any formatting.\nBecause Paint relies on that boolean alone, NO_COLOR ended up\nstripping bold, italic, reverse, etc. alongside the color codes.\nThat conflates two concerns: terminal styling support and color\nsuppression. It is also contrary to the intent of the standard.\n\nInstead, treat the general style decision separately from the\ncolor decision.  Remove the no_color() check from is_enabled()\nand add Paint::is_styling_enabled() for the coarse terminal gate.\nStyle::fmt_prefix and fmt_suffix now query NO_COLOR directly and\nconditionally drop foreground and background codes while preserving\nnon-colour properties.  This way bold, italic, underline and the\nlike continue to work when NO_COLOR is set, while colors alone are\nsuppressed.\n\nCloses: rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5/cob/xyz.radicle.issue/f922d90\nAssisted-by: Pi:deepinfra/moonshotai/Kimi-K2.6\nSigned-off-by: Richard Levitte <richard@levitte.org>\n\n\nradicle/cob/identity: Strengthen test assumptions\n\nNot only assert that the revision is active, but\nalso its parent.\n\n\nradicle/cob/identity: Use verdicts to count votes\n\nEvaluation of this COB is implemented under the assumption that\ndelegates accept at most one revision.\n\nThis can lead to issues, if some delegates create new revisions eagerly,\nwithout waiting for the others to vote on earlier revisions. As the\neager delegates start accepting newer and newer revisions, this shadows\ntheir acceptance of earlier revisions, which leads to failure to\nrecognize that these earlier revisions were actually accepted by a\nmajority.\n\nTo avoid such situations, remove `heads`, and always count the number of\n\"accept\" verdicts explicitly.\n\n\nradicle/cob/identity: Rewrite Evaluation\n\nThe evaluation of the reposioty identity is rewritten to better handle cases\nwhere there are child and sibling revisions that are active at the same time.\n\nIn particular, `fn Identity::action` is now free of any references to\n`self.current`.\n\nThis is achieved through two main improvements. The first is that the `State`\nof revisions changes to improve clarity:\n 1. `Active` and `Accepted` remain, and their meanings also remain the same.\n 2. `Stale` is removed entirely.\n 3. `Rejected` is improved to also contain `RejectedBy`, to keep track of the\n    reason for rejection.\n 4. `Redacted` is promoted to a state. Similarly, the reason for\n    redaction is tracked by `RedactedBy`.\n\nThe transition of a revision from `Active` to one of the other states now\ninfluences siblings and children.\n\nIf a revision transitions to `Accepted`, then the sibling revisions can no\nlonger transition to `Accepted`. They are considered `Rejected` where the reason\nis `Sibling`. This cascades: Children of siblings are `Rejected`\nrecursively, tracking `RejectedBy::Parent`.\nAny children of the `Accepted` revision are also evaluated to see if they can be\nsimilarly transitioned to the `Accepted` state; since they may have already been\nvoted on.\n\nIf a revision was rejected by a majority, then the it transitions to `Rejected`\nwith `RejectedBy::Vote`. Dually to acceptance, the children of this revision\nare also rejected with the reason of `Ancestor`.\n\nFinally, when the author of a revision redacts a revision, it transitions\nto `Redacted`, tracking `RedactedBy::Author`, and its children are redacted\ntracking `RedactedBy::Parent`.\n\nThe test is adjusted to `remove_delegate_concurrent` reflect that concurrently\nproposed revisions are retained in the timeline and explicitly marked as rejected,\nrather than being dropped entirely (as before).\n\n\nradicle/cob/identity: Test rejected sibling\n\nAdd a test case to show that when Bob creates two sibling changes `b1` and `b2`,\nthat the acceptance of one means the other gets rejected.\n\n\nradicle/cob/identity: Add concurrent terminal state test\n\nThe new identity evaluation logic was updated to ignore `Accept` or `Reject`\nactions if the revision has already reached a terminal state (`Accepted` or\n`Rejected`), however this handling was not explicitly covered by the test suite.\n\nThis test ensures that the state machine correctly short-circuits the\nlate-arriving vote, proving that the new logic succesfully ensures\nterminal states remain immutable under concurrent network conditions.\n\n\nradicle/cob/identity: Test terminal states\n\nThe identity evaluation rewrite changed how revision redactions are\nhandled. Instead of removing the revision entirely, it explicitly\ntransitions the revision to `State::Redacted`.\n\nAdd a test to cover two redaction scenarios:\n - Attempting to redact a revision that has already been `Accepted`.\n - Attempting to redact a revision that has already been `Rejected`.\n\n\nradicle/cob/identity: Test cascading rejection\n\nWhen a revision reaches qourum and is adopted, the state all competing sibling\nrevisions as `Rejected`.\n\nHowever, the test suite lacked coverage for deeper proposal branches,\nspecifically testing that this rejection correctly cascades to the\nchildren of those rejected siblings.\n\nIntroduces a test to simulate the scenario where a delegate eagerly\nproposes a chain of revisions (a child branching off a sibling) while\nothers concurrently accept a competing branch.\n\n\nradicle/cob/identity: Test cascading of redaction\n\nAdd a test case to show that when a revision is redacted that its children also\nbecome redacted, tracking `RedactedBy::Parent`.\n\n\nradicle/cob/identity: Test evaluating children of accepted revision\n\nAdd a test case to show that when a revision becomes accepted that its children,\nwhich reach a majority vote, are also marked as accepted.\n\n\nradicle/cob/identity: Fix comments in test `reject_concurrent`\n\nThis incorrectly listed the number of votes and delegates.\n\n\nradicle/test/arbitrary: Make BoundedVec shared\n\nA `BoundedVec` that implements `Arbitrary` is useful for all property testing.\nMove it from the `sigrefs` module so that it can be reused by other components.\n\n\nradicle/cob/identity: Add Property Tests\n\nIntroduce a property testing harness for asserting a set of properties expected\nof the repository identity.\n\nThe harness uses the `Network` fixture for providing four nodes that can\ninteract with the repository identity. The state of the harness is advanced by\nproviding an actor and operation on the identity document. Invariants are then\nasserted about the identity.\n\nThe current invariants are:\n- The `current` revision is the one and only `Accepted` revision.\n- The chain of revisions is valid. That is, `Active` revisions only have a\n  parent that is `Accepted`, and not `Rejected` or `Redacted`.\n- `Active` revisions do not contain a majority approval.\n- `Accepted` revisions contain a majority approval.\n- `Rejected` revisions do not contain a majority approval.\n- For each revision, at most one child is `Accepted`.\n- For each revision, if any of its children is `Accepted`, all other\n  children are `Rejected`.\n- A revision which is `Rejected(RejectedBy::Parent)` has a parent that\n  is `Rejected`.\n- A revision which is `Redacted(RedactedBy::Parent)` has a parent that\n  is `Redacted`.\n- For each revision that is `Rejected` or `Redacted`, none of its\n  children is `Active`.\n- A sibling or ancestor revision's rejected state applies to its sibling or\n  descendant.\n- The repository identity documents converge when all nodes have applied all\n  operations.\n\n\nradicle/cob/identity: Test queued children with delegate change\n\nEnsure that adopting queued children takes into account that the delegate set\ncan change.\n\n\nradicle/cob/identity: Test `authorization_based_on_parent_not_current`\n\nTo reflect that autorization is governed by the causal parent of a\nrevision, not the currently accepted revision.\n\n\nradicle/cob/identity: Test redacting accepted revisions\n\nAdd a test to ensure that a previously accepted revision cannot be redacted.\n\n\nradicle/cob/identity: Deprecate `Identity::id`\n\nIn the heartwood workspace, there is just a single use of this function.\nAlso, the repository ID can be computed on demand, saving memory.\n\n\nradicle/cob/identity: Fix cascading_rejections test to test actual cascading\n\nThe test previously had B2 as a sibling of B1 (both children of A1),\nbecause update() always uses self.current as parent. This meant\nthe test was testing multi-sibling rejection, not cascading.\n\nNow B2 is a child of B1 via a manual transaction, so when B1 is\nrejected (sibling E1 accepted), B2 is rejected via RejectedBy::Parent\n(cascade), which is what the test name promises.\n\n\nradicle/cob/identity: Test concurrent redact-vs-accept convergence\n\nVerifies that when Alice redacts a revision and Bob concurrently\naccepts it, both nodes converge after sync. The CRDT evaluation\norder (timestamp-based) determines which operation takes effect.\n\n\nradicle/cob/identity: Test accept-before-redact convergence\n\nCompanion to the redact-vs-accept test, with reversed timestamp ordering so\naccept wins.\n\n\nradicle/cob/identity: Add has_active_sibling_accept helper\n\nAdd a helper method to check if a delegate has already voted on a sibling\nrevision.\n\n\nradicle/cob/identity: Enforce sibling-accept invariant for `RevisionAccept` in `action`\n\nOn `Action::RevisionAccept` use `has_active_sibling_accept` to check for a sibling accept.\nIf one is found, the `RevisionAccept` is logged and skipped.\n\nThis preserves the invariant of a single accept per delegate on active, sibling\nrevisions without throwing an error on existing histories.\n\n\nradicle/cob/identity: Strip implicit author accept for sibling revisions in `action`\n\nWhen a delegate creates a new `Revision`, their signature is implicitly added to the revision.\nPrevent the delegate from an accept verdict on two active, sibling revisions by:\n1. Checking that the `state` is `Active`, and then checking `has_active_sibling_accept`\n2. If there is an existing verdict, then it the verdict from the new revision is stripped.\n\nThe creation of the `Revision` must still happen, as opposed to throwing an\nerror, in case of existing histories.\n\n\nradicle/cob/identity: Add SiblingAccepted error variant\n\nAdd an `ApplyError` for variant, `SiblingAccepted`, to use to enforce the new\ninvariant: delegates must not accept active, sibling revisions.\n\n\nradicle/cob/identity: Guard `IdentityMut::accept` against sibling accepts\n\nEnsure that the `IdentityMut::accept` API returns an error when it encounters an\nactive, sibling revision by the same delegate.\n\n\nradicle/cob/identity: Guard `IdentityMut::update` against sibling proposals\n\nEnsure that the `IdentityMut::update` API returns an error when it encounters an\nactive, sibling revision by the same delegate.\n\n\nradicle/cob/identity: Add sibling-accept invariant to property tests\n\n\nCHANGELOG: Describe the changes to repository identity evaluation\n\n\ncargo: Bump zlib-rs to 0.6.5\n\nFetching a large repository looped with\n\n    Failed to consume the pack sent by the remote\n\neven though the pack appears valid (Git indexes it in full).\n\nThe cause appears to be a bug in zlib-rs 0.6.3 according to\n<https://github.com/trifectatechfoundation/zlib-rs/pull/504>.\n\n\nradicle/identity: Tidy up\n\nSmall improvements:\n - Remove confusing comments in test\n - Rename `has_active_sibling_accept`\n     to   `has_accepted_active_sibling`\n - Small refactoring to avoid `… } else { None }`\n\n\nnode/reactor: Remove unnecessary functions/types\n\nThe functions\n - `Session::run_handshake`\n - `Session::stream`\n - `Session::disconnect`\nare unused.\n\nThe associated type `Session::Inner` is unused.\n\nThe function `Session::display` is of limited use with little benefit.\n\n`Transport::link_direction` is only used in implementations of\n`Debug` and `Display`, but is not helpful otherwise.\n\n\nnode/reactor/session: `Protocol::{state → machine}`\n\nEven though for the existing implementations all state machines are\nsomehow named \"state\", it is less confusing to call the struct member\n\"machine\".\n\n\nnode/reactor: Simplify Transport\n\n 1. Properly drain readiness\n 2. Remove `WriteAtomic`\n 3. Introduce `BufWrite`\n 4. Remove flushing\n\n\nnode: Refactor Tests\n\nThe tests in `crates/radicle-node/src/tests/.rs` repeat code quite a\nbit, for example, construction of IP addresses. Also, `Peer` is\nunnecessarily complex (too many struct members, state indicated via a\nboolean, type parameter that is always instantiated for the same type).\n\nClean up `Peer` by removing multiple struct members, remove the\nunnecessary type parameter, and provide convenience functions that make\nstatement of the actual tests a little less repetitive and more concise.\n\nFor test networks, five standard nodes (Amy, Bob, Cid, Dan, Eve) are all\neasy to construct. Tests are refactored to make use of these nodes in\nlexicgraphic oreder. The order of initialization may differ.\nModification of configuration is done by passing `FnMut`.\n\nIn the future, using the builder pattern could be explored.\n\n\nflake.nix: Add cargo-shear\n\nThe [cargo-shear] tool can be used to detect unused dependencies.\n\n[cargo-shear]: https://crates.io/crates/cargo-shear\n\n\ncli: Remove unused dependencies\n\n`tree-sitter` and `pretty-assertions` are no longer used.\n\n\nfetch: Remove gix-refpsec dependency\n\n\nlog: Remove unused dependencies\n\n`radicle-term` and `regex` are not required.\n\n\nschemars: Remove unused serde dependency\n\n\nterm: Remove unused tempfile dependency\n\n\nnode: Remove unused qcheck-macros dependency\n\n\ncli-test: Remove unused radicle dependency\n\n\nprotocol: Remove unused radicle-crypto dev-dependency\n\n\ngit2: 0.20 → 0.21\n\nUpdate `git2` due to\n - https://rustsec.org/advisories/RUSTSEC-2026-0008.html\n - https://rustsec.org/advisories/RUSTSEC-2026-0183.html\n - https://rustsec.org/advisories/RUSTSEC-2026-0184.html\n\n\nradicle: Remove dependency `amplify`\n\nThe `amplify` crate is only used in a handful places to derive `impl`s\nthat are not very complex.\n\nProvide the required `impl`s directly, and remove the dependency.\n\n\nprotocol: Remove duplicate `enum AddressType`\n\nWe already have `radicle::node::address::AddressType` for the same\npurpose.\n\n\nradicle: Mark `AddressType` as `non_exhaustive`\n\n\nrust: 1.95 → 1.97.1\n\nThe update to `flake.lock` is a simple\n\n    nix flake update rust-overlay\n\nto be able to reach 1.97.1.\n\nThe changes to `**/*.rs` files are improvements suggested by Clippy.\n\n\ntreewide: Use channels from `std`, not Crossbeam\n\nFor most use-cases, i.e., except some in `radicle-node`, the channels\nin `std::sync::mpsc` suffice, allowing us to get rid of the dependency\n`crossbeam-channel`.\n\nCrossbeam is sometimes mentioned to offer higher performance compared\nto `std::sync::mpsc`.\nFor usage in `radicle-signals` (and the counterparts in `radicle-node`\nand `radicle-term`) performance is irrelevant, as these channels are\nused to send a singular message (to the effect of shutting down the\nnode or stopping the spinner). These could potentially use\n`std::sync::oneshot` in the future, which is nightly-only as of\n2026-06-17, see <https://github.com/rust-lang/rust/issues/143674>.\nUsage in `radicle-protocol` and `radicle`, is a heavier duty.\nThe channels pass commands to the service (arriving e.g. via the\ncontrol socket in `radicle-node`), events from the service to other\nlisteners (e.g. the control socket), and fetch results from workers to\nthe service. For user interaction, performance is irrelevant, since\nthe messages are in the tens or hundreds per second. Even for delivering\nevents and programmatic usage of commands, thousands to hundreds of\nthousands of messages per second are plenty.\n\nNote that these channel implementations are benchmarked in the millions\nof operations per second, see e.g.:\n - <https://github.com/crossbeam-rs/crossbeam/tree/b23b7e8eca2efdad9bdc1ceb1aee1207a852c03b/crossbeam-channel/benchmarks#results>\n - <https://github.com/fereidani/rust-channel-benchmarks/blob/b4c979a94482e5012734657c2ee153b528bc56d6/README.md>\n\nAlso, `crossbeam-channel` was merged into `std` in 2022-11, and we do\nnot believe that performance of the implementations has siginifcantly\ndrifted since then, see <https://github.com/rust-lang/rust/pull/93563>.\n\nOne minor downside is that the channels in the standard library do not\nexpose the number of pending messages.\n\n\nflake.nix: Remove darwin.apple_sdk.frameworks as it is deprecated\n\nMore information can be found at <https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks>.\n\n\nnode/worker/garbage: Clean up\n\nClippy reports dead code on all variants except `Hours` on `Expiry`,\nsince the type is defined in a binary crate.\n\nAllow dead code here, just in case we want to use the other variants in\nthe future. They are not a maintenance burden, as the implementation is\nsimple and does not see much change.\n\nSlightly refactor:\n - `impl std::fmt::Display for Expiry` to look cleaner.\n - `fn collect` to borrow `RepoId`, since it only needs\n   a borrow, and a a borrow of `Expiry` to spare a copy\n   at the only call site.\n - The constant for the default value of `Expiry` to be\n   associated with the type `Expiry`.\n\nRemove a remark about the default value of `Expiry` from `FetchConfig`,\nas the default value is not a concern there, but rather wherever\n`Expiry` is initialized.\n\n\ntreewide: Add configurable per-stream fetch timeout\n\nThis introduces a `fetch_timeout` setting to the node configuration,\nreplacing the hardcoded constant. It defines the duration a fetch stream\nis allowed to stall before being aborted. The default remains 30s, but\nusers on anonymizing transports like Tor can now increase it to avoid\nspurious timeouts during network congestion.\n\n\ncrypto/test: Diffie-Hellman Fixture\n\nBefore rewriting `radicle-crypto`, add a fixture to have some assurance\non compatibility.\n\n\nradicle, cli/auth: Let binary crate generate seed\n\nIn preparation of a rewrite of `radicle-crypto`, move the\nresponsibility for generating a cryptographically secure\nseed from `radicle` (transitively via dependency on\n`radicle-crypto` and `ec25519`) to the dependent of `radicle`.\n\nApplications should decide how to obtain randomness, not `radicle` via\nsome far-removed dependency.\n\nWithin the workspace, the only dependent using `Profile::seed` is\n`radicle-cli`, in particular for the `rad auth` subcommand. To obtain\nrandom bytes, `radicle-cli` depends on `getrandom` and uses\n`getrandom::fill`.\n\n\ncrypto: Rewrite\n\nReasons for the rewrite:\n - Migrate away from `ec25519` as our implementation of Ed25519,\n   because that crate is unmaintained.\n   Instead of `ec25519` we use `ed25519-dalek` which is the most popular\n   implementation of Ed25519 in Rust.\n - Migrate away from `amplify`, because we make very little use of its\n   features. Here, we only use `amplify::Bytes32`, which is just a thin\n   wrapper of `[u8; 32]`.\n   Instead of `amplify::Bytes32` we use `type PublicKeyBytes = [u8; 32]`.\n\nThe realization that `ExtendedSignature` is not really tied to SSH, but\nis merely a representation of a key together with a signature, allows to\nrelax the bounds on traits in `radicle-cob`.\n\nSeparating out uses of \"public key\" (a rather simple model of a key,\njust 32 bytes) and \"verifying key\" (an actual point on the Edwards\ncurve, ready to verify signatures, using more memory than just 32 bytes)\nallows a more sensible definition of `crypto::Signer`, which propagates\nto `radicle-cob`, `radicle`, `radicle-cli`, `radicle-node` and\nsimplifies trait bounds.\n\nIn `radicle-node`, make the fact clearer that actually the secret key\nitself is required (for our implementation of Diffie-Hellman) not\n\"just\" signing. This results in removal of the generic argument\n(usually called `G`) of multiple types.\n\nConcretizing the types in `radicle-node` this way, i.e. by (morally)\nsetting `G = radicle_crypto::SigningKey`, leads to removal of\n`MemorySigner` and `MockSigner`, as they really just wrap a signing\nkey.\n\nRe-exporting `ed25519::Signature` (via re-export in `ed25519-dalek`)\nis hopefully more future-proof than using our own type for signatures.\nHowever, the fact that `ed25519::Signature` is not serializable and\ndoes not implement `std::hash::Hash` means that we have to resort to\nad-hoc solutions in `radicle`:\n 1. The Identity COB requires serialization of signatures. These are\n    generally questionable, since the security of the Identity COB\n    should rely on the security of Signed References. In the medium\n    term we might even want to consider ignoring signatures in actions.\n 2. When reading Signed References, detection of Replay Attacks uses\n    a `HashMap` keyed by signatures. This detection only exists for\n    backwards compatibility.\nThese two use cases are exotic enough to warrant ad-hoc implementations.\nBy not wrapping `ed25519::Signature`, we encourage writing more widely\ncompatible code in the future.\n\nCo-authored-by: Fintan Halpenny <fintan.halpenny@gmail.com>\n\n\ncargo/dev: Optimize compute-heavy dependencies\n\n\nnode: Remove re-export `…::node::PROTOCOL_VERSION`\n\nIt appears that `radicle_node::PROTOCOL_VERSION` (which is a re-export\nof `radicle::node::PROTOCOL_VERSION` is the only symbol exported from\n`radicle-node` that is used in `radicle-cli` (except tests).\n\nSince `radicle-cli` depends on `radicle` anyway, it is questionable how\nmuch sense that re-export and use from a binary crate (!) makes.\n\nRemove the re-export.\n\n\nnode: Clean up `use`s\n\nThe re-exports from other crates got quite confusing.\n\nRemove all `pub use` from `radicle-node`, and rewrite all `use`s\naccordingly.\n\nThe result is a slight increase in the number of `use` lines, but with\nimproved clarity on which type is actually imported.\n\n\nnode/test: Clean up\n\nAdjusting visibility and conditional compilation for the modules in\n`radicle_node::test` allows some dead code elimination.\n\n\nprotocol/handle: `Responder` in `Command::Block`\n\nOther variants of `Command` use `Responder` respond with data.\n`Command::Block` does not.\n\nChange `Command::Block` to be in line with other variants.\n\n\nbuild/Dockerfile: Omit default `RUST_VERSION`\n\nThe Rust version used for development is tracked in\n`/rust-toolchain.toml`, and the value specified there is used to set\n`RUST_VERSION` in the `build/build` script. Thus, when using\n`build/build`, the default value is unimportant.\n\nHowever, ensuring that the default value remains consistent with\n`/rust-toolchain.toml` is a maintenance burden.\n\nRemove the default value. This increases friction of building without\n`build/build`, but makes maintenance easier.\n\n\nbuild/Dockerfile/alpine: 3.24 → 3.24\n\n\nbuild/Dockerfile: Re-use `$ALPINE_VERSION`\n\nUse the same version of Alpine Linux for building and packaging.\n\n\nbuild/Dockerfile: Specify Registry docker.io\n\nMake explicit that Docker Hub is used.\n\n\nbuild/Dockerfile/zig: 0.13.0 → 0.16.0\n\n\nbuild/Dockerfile: Install Zig via `apk`\n\n\nterm: Fix features for zeroize\n\nIn `df6524e7e21027c4eb128dd2eaab0a6d70a6d76d`, default features for\n`zeroize` were disabled for the workspace in `/Cargo.toml`, accidentally\naffecting `radicle-term`, since `radicle-term` depends on\n`impl Zeroize for String` which is available on feature \"alloc\" only.\n\n\ncrypto: Add conditions for `PublicKey::to_bytes`\n\n\nflake/nixpkgs: 25.11 → 26.05\n\nRunning `cargo semver-checks` errors with\n\n    error: unsupported rustdoc format v57 for file:\n    …/heartwood/target/semver-checks/local-radicle-…/target/doc/radicle.json\n    (supported formats are v53, v55, v56)\n\nSupport for rustdoc format v57 is part of cargo-semver-checks 0.46,\nwhich is not part of NixOS 25.11, which has reached EOL.\n\nRe-point the \"nixpkgs-stable\" input to NixOS 26.05 to reach a newer\ncargo-semver-checks and a NixOS version that is supported.\n\nUpdate the flake.\n\n\ncargo/workspace: Bump crate versions\n\nIn topological order:\n\n - radicle-crypto         0.17.0 → 0.18.0\n - radicle-oid             0.2.0 →  0.2.1\n - radicle-cob            0.20.0 → 0.21.0\n - radicle-core            0.3.0 →  0.4.0\n - radicle                0.24.0 → 0.25.0\n - radicle-signals        0.11.0 → 0.12.0\n - radicle-fetch          0.20.0 → 0.21.0\n - radicle-log             0.1.0 →  0.2.0\n - radicle-term           0.18.0 → 0.19.0\n - radicle-protocol        0.8.0 →  0.9.0\n - radicle-cli-test       0.13.0 → 0.14.0\n - radicle-node           0.20.0 → 0.21.0\n - radicle-cli            0.21.0 → 0.22.0\n - radicle-schemars        0.8.0 →  0.9.0\n - radicle-remote-helper  0.17.0 → 0.18.0\n\n\nsignals: Fix Windows\n\nCommit `41d776be4120df9f84633f1d54c1a1de27624c4e` accidentally broke\n`radicle-signals` by a simple confusion of\n`std::sync::mpsc::{,Sync}Sender`.\n\n\ncli: Tighten visibility and minimize `pub use`\n\nIn `radicle-cli`, which is a binary crate (!) a few `pub use`s can be\nremoved. This forces `radicle-remote-helper` to depend on the library\ncrate `radicle-term` to access some of the types that were re-exported\nfrom `radicle-cli`, making the dependency more obvious, and minimizing\nthe public symbols on `radicle-cli`.\n\nThe dependency on `radicle-cli` cannot be removed from\n`radicle-remote-helper` easily, so is kept.\n\n\ncargo/workspace: Remove `package.authors` metadata\n\nThis field is deprecated, see\n<https://doc.rust-lang.org/cargo/reference/manifest.html#the-authors-field>.\n\n\ncargo/workspace: Reorder package metadata\n\nIn all `/crates/*/Cargo.toml`, split package metadata into two or three\nblocks:\n\n 1. name, version, and description (in this order)\n 2. Further metadata defined per crate.\n 3. References to the workspace.\n\nLines in blocks (2.) and (3.) are sorted lexicographically, and blocks\nare separated by empty lines.\n\n\ncargo/workspace: Remove homepage\n\nIn `/Cargo.toml` and all `/crates/*/Cargo.toml`, remove homepage package\nmetadata. This field is inteded to carry the *homepage of the crate*. In\nour case, no crate has an actual homepage on its own.\n\n\ncargo/workspace: Add repository metadata\n\nSome `/crates/*/Cargo.toml` were missing to inherit repository package\nmetadata from `/Cargo.toml`.\n\n\ncargo/workspace: Remove workspace version\n\nNo crate actually inherits this version number, remove it.\n\n\ncargo/workspace: Add \"no-std\" category\n\nAdd the \"no-std\" category package metadata to all crates that are\n`no_std`.\n\n\nprotocol: Calm `typos`\n\nThe `typos` spell-checker complains about \"[T]ype\" and \"[I]nitiator\".\n\nReformulate the comment to work around the issue.\n\n\nscripts/just/check-ellipses: Replace less\n\nReplacing all \"...\" with \"…\" is too aggressive.\n\n\nsurf: Copy over from radicle-git\n\nThis is the result of a simple\n\n    cp -r ../radicle-git/radicle-surf/ crates\n    rm -r crates/radicle-surf/{data,scripts,build.rs}\n\nwith the radicle-git workspace at commit\n8c5df5ecbd3f2507d323608b52e1fbf7b177d864.\n\n\nsurf: Move test files into place\n\nIn the radicle-git workspace, crates brought their own testing crates\nalong with them, usually in a subdirectory named \"t\". In the heartwood\nworkspace we use tests within the same crate.\n\nThis commit only moves files, so that it is easier to follow changes to\nthem in the upcoming commit.\n\n\nsurf: Refactor\n\nRefactor the `radicle-surf` crate to use OIDs from `radicle-oid` instead\nof `radicle-git-ext`, and `radicle-git-ref-format` instead of re-exports\nfrom `radicle-git-ext`. Also remove the dependency `radicle-std-ext`.\n\nThis requires changing `use`s, and an ad-hoc reimplementation of\n`ResultExt::or_matches`.\n\nThe remaining changes (excl. tests) are automatic via `rustfmt` and\n`cargo clippy`.\n\nFor testing, implement reconstruction of\n\n    https://github.com/radicle-dev/git-platinum\n\nin particular of the commits\n - a0dd9122d33dff2a35f564d564db127152c88e02\n - 27acd68c7504755aa11023300890bb85bbd69d45\n - e972683fe8136bf8a5cb2378cf50303554008049\nand some tags.\n\n`…/src/test/roundtrip.rs` was copied from the `test-helpers` crate in\nthe radicle-git workspace.\n\n`…/src/test/{repository.rs,gen*}` was copied from the `radicle-git-ext`\ncrate in the radicle-git workspace.\n\n\nsurf: Switch to crate in workspace\n\nNow that `radicle-surf` lives in this workspace, use it.\n\n\ngit-ref-format: Copy over from radicle-git\n\nThis is the result of\n\n    cp -r \\\n      ../radicle-git/radicle-git-ext/git-ref-format/core/src/{{cbor,check,deriv,lit,name,refspec,serde}.rs,{name,refspec}} \\\n      crates/radicle-git-ref-format/src/\n\nwith the radicle-git workspace at commit\n8c5df5ecbd3f2507d323608b52e1fbf7b177d864.\n\n\ngit-ref-format: Integrate with workspace\n\nInstead of depending on `git-ref-format-core`, the\n`radicle-git-ref-format` crate succeeds it.\n\n\ncargo/workspace: Bump crate versions\n\nIn topological order:\n\n - radicle-git-metadata     0.2.0 →  0.2.1\n - radicle-git-ref-format   0.1.0 →  0.2.0\n - radicle-oid              0.2.1 →  0.2.2\n - radicle-crypto          0.18.0 → 0.19.0\n - radicle-surf            0.28.0 → 0.29.0\n - radicle-cob             0.21.0 → 0.21.1\n - radicle-core             0.4.0 →  0.4.1\n - radicle                 0.25.0 → 0.25.1\n - radicle-signals         0.12.0 → 0.12.1\n - radicle-fetch           0.21.0 → 0.21.1\n - radicle-term            0.19.0 → 0.19.1\n - radicle-protocol         0.9.0 →  0.9.1\n - radicle-cli-test        0.14.0 → 0.14.1\n - radicle-node            0.21.0 → 0.21.1\n - radicle-cli             0.22.0 → 0.23.0\n - radicle-schemars         0.9.0 →  0.9.1\n - radicle-remote-helper   0.18.0 → 0.18.1\n\n\ncli/id: Incorporate reason for rejection\n\n\ncli/id: Add verbose output to show and list\n\n\ncli/id: Introduce `rad id cache`\n\nSimilar to `rad [issue|patch] cache`, this will re-compute cached state\nabout the identity document. The identity COB does not cache to SQLite,\nbut there is `refs/rad/id`, which can become stale.\n\n\nsurf: Ignore Rust and JSON examples\n\nThe examples do not import everything necessary to compile, so the doctests will\nfail using `no_run`.\n\nInstead, use `ignore` instead so that it does not attempt to compile the examples.\n\n\nsurf: Fix flakey test with sorted vector\n\n\nRelease 1.10.0\n\n\nbuild/config: Link `-dead_strip_dylibs` on macOS\n\n\nMove windows Command helpers to radicle-windows\n\nThe approach still feels a bit weird as we explicitly call windows\nhelpers in random places, rather than having platform-agnostic helpers,\nbut at least we don't import windows as a dependency in the other\nmodules.",
        "base": "6ba619f9a636fecfe5f30b36ebb6b8c06774d5cb",
        "oid": "41e908e59c1b7f05b9b0fd67e894f8d6f989502f",
        "timestamp": 1786300238
      },
      {
        "id": "0ed2af2c4c91010b7bcd33d5c820db726aa113ff",
        "author": {
          "id": "did:key:z6MktBiMxUQ8SP1cRWhnTVxVwM8ijac6M9P1T3BDxaeVnqjh",
          "alias": "fred-surface-win"
        },
        "description": "Fix compilation on non-windows hosts.\n\nForgot to import the only symbol in scope...",
        "base": "6ba619f9a636fecfe5f30b36ebb6b8c06774d5cb",
        "oid": "a40472d45140a54a7b336a11d1b227acae66f371",
        "timestamp": 1786302021
      }
    ]
  }
}

executor from config: /usr/bin/ambient-execute-plan
executor from PATH: /usr/bin/ambient-execute-plan
run CI for rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5
CONSTRUCT: Config {
    tmpdir: "/home/_rad/tmp",
    image_store: "/home/_rad/ambient-images",
    projects: "/dev/null",
    state: "/home/_rad/ambient-state",
    rsync_target: None,
    rsync_target_base: None,
    rsync_target_map: None,
    dput_target: None,
    executor: Some(
        "/usr/bin/ambient-execute-plan",
    ),
    artifacts_max_size: Byte(
        1000000000,
    ),
    cache_max_size: Byte(
        30000000000,
    ),
    qemu: QemuConfig {
        cpus: 2,
        memory: Byte(
            12000000000,
        ),
        kvm_binary: "/usr/bin/kvm",
        ovmf_vars_file: "/usr/share/ovmf/OVMF.fd",
        ovmf_code_file: "/usr/share/ovmf/OVMF.fd",
    },
    uefi: false,
    lint: false,
    secrets: None,
} Project {
    source: TildePathBuf {
        path: "src",
    },
    expanded_source: "/tmp/.tmpCR3BF1/src",
    image: TildePathBuf {
        path: "/home/_rad/ambient.qcow2",
    },
    expanded_image: "/home/_rad/ambient.qcow2",
    pre_plan: Some(
        [
            CargoFetch,
            Rustup {
                channel: Some(
                    "1.95.0",
                ),
                target: None,
                components: None,
                profile: None,
            },
            Rustup {
                channel: Some(
                    "1.95",
                ),
                target: None,
                components: None,
                profile: None,
            },
        ],
    ),
    plan: Some(
        [
            Shell {
                shell: "sed -i /components/d rust-toolchain.toml\n\n# Commit this to git so that the Debian package building doesn't\n# see changes outside the debian directory.\ngit config set user.name \"Ambient CI\"\ngit config set user.email \"ambient@example.com\"\ngit commit -m \"remove components from toolchain file\" rust-toolchain.toml\n",
            },
            CargoFmt,
            CargoClippy,
            CargoBuild,
            CargoTest,
            Shell {
                shell: "# Because of a (temporary) limitation in Ambient, we need to set\n# these variables manually. Once Ambient manages environment\n# variables better, these can be deleted.\nexport CARGO_TARGET_DIR=/workspace/cache\nexport CARGO_HOME=/workspace/deps\nexport HOME=/root\nexport PATH=\"/root/.cargo/bin:$PATH\"\nexport RUSTDOCFLAGS='-D warnings'\n\ncargo doc --workspace --no-deps --all-features\n",
            },
            Shell {
                shell: "# Because of a (temporary) limitation in Ambient, we need to set\n# these variables manually. Once Ambient manages environment\n# variables better, these can be deleted.\nexport CARGO_TARGET_DIR=/workspace/cache\nexport CARGO_HOME=/workspace/deps\nexport HOME=/root\nexport PATH=\"/root/.cargo/bin:$PATH\"\n\n# These are based on debian/control.\nexport DEBEMAIL=liw@liw.fi\nexport DEBFULLNAME=\"Lars Wirzenius\"\n\n# Clean up after tests and documentation building. The Debian\n# package building tools do not want changes outside the\n# `debian` directory, compared to what is committed to Git, from\n# which the \"upstream tarball\" is created.\ngit reset --hard\ngit clean -fdx\ngit status --ignored\n\n# Update debian/changelog with a new version so that every run\n# creates a newer version. This avoids us having to update the\n# file manually for every CI run.\nV=\"$(dpkg-parsechangelog -SVersion | sed 's/-[^-]*$//')\"\nT=\"$(date -u \"+%Y%m%dT%H%M%S\")\"\nversion=\"$V.ci$T-1\"\ndch -v \"$version\" \"CI build under Ambient.\"\ndch -r ''\n",
            },
            Deb,
        ],
    ),
    post_plan: Some(
        [],
    ),
    artifact_max_size: None,
    cache_max_size: None,
    dependencies_max_size: None,
}
======================== run log:

====================== end of run log
ERROR: CI run failed inside QEMU

<empty log>