Kernel compatible#1
Open
Quant-TheodoreFelix wants to merge 18 commits into
Open
Conversation
Adds .planning/codebase/ with 7 GSD reference documents produced by parallel gsd-codebase-mapper agents (tech / arch / quality / concerns). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces blake3 / ed25519-dalek / subtle / rand / aes-gcm / x25519-dalek with elib-k0-nt modules so the crate graph contains no external crypto dependencies. Adds explicit zeroization for ephemeral X25519 seeds, AES session keys, and the DRBG reseed entropy buffer. Removes the dead SigningKey::to_seed footgun. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the candle-transformers + HuggingFace tokenizers stack: it shipped with HF Hub download code and a multi-hundred-crate dependency tree that does not survive cargo vendor bundling. Full LLM text generation now flows through the llama.cpp stub or the host-TEE ChannelEngine forward path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drops the halo2_proofs / ff / pasta_curves dependency tree (~30 elliptic curve crates) along with the halo2 feature and RoutingProofCircuit. The mock prover is already BLAKE3-based and remains intact. Real succinct ZK (SP1 / RISC Zero) is deferred to a future milestone review. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces .cargo/vendor-config.toml as a source-replacement template that scripts/vendor.sh activates after running cargo vendor. AIR-GAPPED .md documents the end-to-end procedure: vendor the workspace, bundle, transfer, then validate the four CI gates with --offline. Online builds remain untouched because .cargo/config.toml is gitignored. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add Ed25519 domain separation prefixes for capability bodies, attested channel handshakes/frames, and provenance manifests so that the same identity key cannot have a signature replayed across protocols. - Reject unsigned manifests when trusted_signers is configured, instead of silently skipping signature verification (verify_model and verify_model_against_pinset). - Cap guest-controlled buffer copies at 64 KiB and bound audit/tool call vectors per execution to block host-memory DoS via repeated lumen_log / lumen_call_tool invocations. - Reorder attested channel recv to short-circuit on epoch / seq before ed25519 verify. - Migrate trailing rand::OsRng test import to lumen_core::rng::OsRng. - Add regression tests for the domain prefix and unsigned-manifest hardenings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Member
Author
|
claude commit really awesome brh |
Member
Author
|
cargo deny issue related to the MIT license of the applied elib-k0-nt sub-crate |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
커널 연계작업