ircd.rs/leveva/tests/ at master · xeiaso.net/ircd.rs · Tangled

xeiaso.net / ircd.rs

1

Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services

1

ircd.rs / leveva / tests /

at master 3 folders 429 files

Xe Iaso test: mask volatile version token in TRACE golden snapshots 5w ago

feat(leveva): route user@server alias targets (P11 slice 304) An alias { target "user@server" } block now resolves the server part to a linked remote server and routes :<uid> PRIVMSG user@server :<text> to its uplink, matching charybdis m_alias's find_server branch (was: 440). Unknown or our-own server name -> 440, empty text -> 412. Pure fuzz seam alias::remote_privmsg_wire (totality + round-trip proptest); S2S golden + unit inverses.

1 month ago

fix(test): make read_until return the complete line, de-flaking the SQUIT goldens The golden harness's read_until returned as soon as the sentinel was found in the buffer, cutting at the buffer end when the sentinel's line had no terminating '\n' yet. TCP can deliver one wire line in several fragments under parallel load, so the sentinel could land in one socket read while the rest of its line was still in flight — read_until then returned the truncated line. golden_s2s_squit_propagation::abrupt_drop_of_a_peer_propagates_squit_to_the_sibling matches " SQUIT " then asserts the same line carries ":Connection reset by peer"; when the line arrived split right after the sentinel, the reason assertion failed in well under a second. That is the observed FLAKY 2/3. Wait for the line's '\n' before returning, so read_until always yields a whole line (EOF/deadline still drain a genuinely unterminated tail). The returned line only ever gets more complete, so no existing caller regresses. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

test: mask volatile version token in TRACE golden snapshots The chantrace/masktrace golden tests snapshot the 262 RPL_TRACEEND line, which embeds VERSION (concat!("leveva-", CARGO_PKG_VERSION)). The v0.3.0 bump changed that token from leveva-0.2.0 to leveva-0.3.0, breaking both snapshots on every release. Mask the version column to V, mirroring how these tests already mask the volatile host/ip columns of 708 lines, so future version bumps no longer break them. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

account_proptest.rs

test(leveva): proptest account-notify push tracks current account (P11 slice 140) Driving arbitrary SU login/logout lines past a capable co-member, the delivered ACCOUNT param always tracks the current account (name on login, * on logout) and an invalid account pushes nothing; never panics.

1 month ago

account_tag_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

alias_proptest.rs

feat(leveva): route user@server alias targets (P11 slice 304) An alias { target "user@server" } block now resolves the server part to a linked remote server and routes :<uid> PRIVMSG user@server :<text> to its uplink, matching charybdis m_alias's find_server branch (was: 440). Unknown or our-own server name -> 440, empty text -> 412. Pure fuzz seam alias::remote_privmsg_wire (totality + round-trip proptest); S2S golden + unit inverses.

1 month ago

autoconnect_proptest.proptest-regressions

test(leveva): autoconnect_proptest — eligibility + cooldown fuzzing (P11 slice 128) Property-fuzzes AutoConnect::due against an independent eligibility model: only-eligible-blocks-dialed (faithful coords + every model-eligible name appears on the first tick), a_dial_arms_a_cooldown (an immediate re-tick re-dials nothing), and arbitrary_never_panics — the last exercising i64::MAX `now`, which is why the cooldown arithmetic saturates. Unique connect names are generated via a NAMES subsequence (a real config keys connect{} by name, and the cooldown is per-name).

1 month ago

autoconnect_proptest.rs

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

away_notify_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

away_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

away_s2s_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

ban_speech_proptest.rs

feat(leveva): ban-on-speech (quiet) plane — P11 slice 214 Close the deferred extban "no PRIVMSG/quiet plane" follow-on (slice 164): channel bans were enforced only at JOIN, so a +b-banned member already in the channel — ban set after they joined, or a dynamic extban they later match — could keep talking. Channels::can_send now evaluates the +b/+e lists against the sender (same LiveChannels view + Subject as check_join) and returns a new CanSend::Banned (-> 404) for a non-voiced member matching a +b with no +e. Voice or higher bypasses, exactly as it bypasses +m. Wired into PRIVMSG/NOTICE, TAGMSG and REDACT via a shared command::speech_subject helper. No dedicated +q quiet list mode (+q is the elemental owner prefix) and no S2S wire change. TDD: channel.rs units (mute after join, exception clears, account extban, voice/devoice/unban round-trip), tests/ban_speech_proptest.rs (mute predicate vs an independent extban model + totality fuzz over garbage masks), tests/golden_ban_speech.rs (e2e 404 bounce + voice bypass). Gate: cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

bot_mode_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

bot_oper_s2s_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

bot_tag_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

bots_snomask_proptest.rs

feat(leveva): +s/+b BOTS snomask producer — Excess-Flood flooder spy + HELP SNOMASK — P11 slice 265 Wire the eighth producer for a slice-257 reserved-but-empty snomask category (charybdis SNO_BOTS, `b`). A registered client disconnected for Excess Flood (the command-rate fakelag kill, slices 201-208) now fans a `Flooder <nick>!<user>@<host> (Excess Flood)` spy notice to local `+s +b` watchers at the registered flood-kill chokepoint. The pre-registration flood guard (slice 203) deliberately does not fire it (no nick/identity, no charybdis analogue). Local-only like every snomask producer; charybdis BOTS is mainly message-target flood while leveva fans on the live command-rate kill it has — faithful intent, not a byte copy. Only `d` DEBUG now lacks a producer. Also ship a `HELP SNOMASK` reference page cataloguing every snomask category and trim the `HELP USER_MODES` snomask paragraph to allude to it. - snomask.rs: SnoMask::bots() accessor (BOTS bit, reserved since 257); doc-table `b` row + producer_accessors test. - snotice.rs: pure flood_notice(nick, user, host) builder (the fuzz seam). - session.rs: server_notice_cat(ctx, bots(), flood_notice(...)) at the registered Excess-Flood kill site; unit tests (fan to +s+b and ALL watchers, inverses for +s+k-only / -s / modest burst). - help/SNOMASK.md (new) + help/USER_MODES.md (trimmed) + SNOMASK in the help TOPICS allowlist. - tests/bots_snomask_proptest.rs: builder never panics, carries the scaffold, embeds each field over arbitrary input. Gate: cargo test -p leveva green (golden_privmsg failure was a load flake under two contending suites — passes isolated in 0.5s); clippy clean; workspace build 0 warnings.

1 month ago

callerid_proptest.rs

feat(leveva): caller-id (+g user mode + ACCEPT) — P11 slice 216 Add charybdis-style caller-id ("server-side ignore"): a user sets +g to receive private PRIVMSG/NOTICE only from clients on their ACCEPT list. A blocked PRIVMSG bounces 716 to the sender and notifies the target once (717 to sender + 718 to target); a NOTICE is silently dropped. The pure CallerId store (accept set + once-per-pair notify gate) lives inside Registry — the metadata precedent — so it costs no ServerContext churn; accept entries are stable UIDs (survive nick changes, quit-filtered on read), capped at 30. +g is purely local (not in SEND_UMODES): the gate runs on the target's home server, so a transit/origin server needs no copy. ACCEPT supports add / -remove (mixed) / list (281+282), with 401/456/457/458; self-accept is a no-op. CALLERID=g advertised in 005; 8 new numerics. Picked after confirming no clean documented deferral remained open — the STS-REHASH / S2S-KILL-notice / throttle-knob / MODE+VERSION-proptest / UTF8ONLY "deferred" doc comments were all stale, closed by later slices. Remote-sender gating (S2S) and +G soft caller-id are documented follow-ons. Tests: callerid unit (6), accept (8), message gate (5), numeric round-trip, isupport token, s2s/umode excludes +g; golden_callerid (2); callerid_proptest (2, accept-list + notify model lockstep). Boot snapshots regenerated for the new 004 'g' umode letter and the 005 CALLERID=g token. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

callerid_s2s_proptest.rs

feat(leveva): caller-id remote-sender S2S gating — P11 slice 217 Close the first of slice 216's two caller-id follow-ons: a remote sender's PRIVMSG/NOTICE to a local +g target arrives via s2s::relay::inbound_message, which delivered it with no caller-id check. +g is enforced on the target's home server (it is not in SEND_UMODES), so the gate now runs there too: a blocked PRIVMSG bounces 716 (+ once-per-(target,sender) 717) to the sender's uplink and tells the local target once (718); a blocked NOTICE is silently dropped. Reuses the same callerid store + once-per-pair notify rate-limit as the local path (new route_numeric_to_remote / caller_id_reject_remote helpers). Only +G soft caller-id now remains deferred from the caller-id track. Tests: 4 units in s2s/relay.rs + callerid_s2s_proptest.rs (PROPTEST_CASES=4096, model-lockstep over remote PRIVMSG/NOTICE + accept/unaccept + +g/-g toggles).

1 month ago

cap_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

caps_s2s_proptest.rs

feat(leveva): carry server-time @time across S2S relay (P11 slice 134) The IRCv3 server-time @time tag was single-server-local (stamped only at local delivery, slice 62) — a remote server-time co-member never learned the original send time and a local server-time client saw no @time on a remote-originated message. The direct twin of slice 130 (msgid): make @time a network-stable server tag the introducing server assigns and downstream carries verbatim. - relay_wire gains a time param, emitted as the FIRST server tag (@time;msgid;+client); the four outbound relay fns thread it through. - command/message.rs + command/tagmsg.rs feed s2s_time = the same 'now' local recipients get, gated on the slice-126 CAPAB egress (stripped for a tag-blind peer). - inbound_message/inbound_tagmsg switch to a per-recipient render() closure so server-time is gated INDEPENDENTLY of message-tags: a server-time recipient gets the carried @time verbatim if well-formed (new clock::is_valid_server_time), else a synthesized server_time_now() fallback (server-time is not optional for a negotiating client, unlike msgid). New fanout_local_render/_tagmsg_render helpers. leveva-native (no oracle tags). Regenerated the golden_s2s_msgid outbound snapshot (now @time=<TS>;msgid=<MSGID>) and the dependent test-file call arities.

1 month ago

cconnext_snomask_proptest.rs

feat(leveva): +s/+C CCONNEXT snomask producer — extended CLICONN connection spy — P11 slice 264

1 month ago

certfp_proptest.rs

feat(leveva): S2S capability negotiation — CAPAB verb + egress tag-filter (P11 slice 126) Close a latent breaking-protocol bug: slices 58–66 attached client-only (@+…) tags to S2S lines for every peer unconditionally, so a tag-blind peer would mis-parse the leading @. leveva now negotiates message-tag support per link. - New s2s/caps.rs: PeerCaps { message_tags } + from_capab/ours (named tokens). - PeerLink.caps (default none until the peer's CAPAB arrives). - burst opens with `:<sid> ENCAP * CAPAB :message-tags`. It rides ENCAP because a bare unknown server command is fatal in IRCnet 2.11 (the ircd-common oracle SQUITs the link); ENCAP is m_nop'd and tolerated. CAPAB is link-local (interpreted in forward::inbound_encap, never relayed onward). - Egress tag-filter: callers always build the tagged wire; PeerLinks::broadcast/ route strip the leading @tags for a non-tag peer (egress_wire/strip_leading_tags), and broadcast_tag_only/route_tag_only send a tag-only TAGMSG to tag peers only. The relay functions revert to simple build-tagged + broadcast/route. - set_caps/caps_of on the routing table (the egress authority); the CAPAB arm updates both link.caps and the table. The ~24 peers.link() call sites gain a caps arg (mostly test helpers pass link.caps / PeerCaps::default()). leveva-native; no oracle differential for tags.

1 month ago

channel_lifecycle_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

channels_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

chantrace_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

chantypes_proptest.rs

feat(channel)!: drop the IRCnet channel types (&, !, +); # only (P11 slice 144) Leveva inherited four channel prefixes from IRCnet 2.11 — # (global), & (server-local), + (modeless), and ! (timestamped "safe"). The latter three are IRCnet-specific and unwanted; this removes them so only # is a valid channel prefix. CHANTYPES is now "#". With +/! gone, the *modeless* machinery they were the only users of is dead and is deleted: use_modes() removed, a channel creator is always a chanop, and the unreachable KickGate::NoChanModes / ApplyOutcome::NoChanModes variants (and their 477 handler arms) are gone. ERR_NOCHANMODES stays in the numeric table (a wire-code registry, not a feature list). The three S2S channel-target sigil helpers narrow from #&+! to #, and relay::local_join drops its dead &-channel non-propagation skip. Fuzzing: new tests/chantypes_proptest.rs (512 cases) pins that any legal #-body parses and round-trips, and — the inverse — any &/!/+ -prefixed name is BadPrefix regardless of body, no name resurrects a dropped type, and arbitrary bytes never panic the validator. Docs: CHANNEL_TYPES/KICK/REOP_LIST help pages + 8 ISUPPORT golden snapshots. Gate: cargo test -p leveva green; clippy -p leveva --tests clean; cargo build --workspace 0 warnings. Plan: docs/superpowers/plans/2026-06-13-p11-slice144-drop-irc-net-channel-types.md

1 month ago

chathistory_proptest.rs

test(leveva): chathistory golden + proptest, help page, docs; refresh stale help_users snapshot — P11 slice 274 (3/3)

1 month ago

chghost_proptest.rs

feat(leveva): fire reop invariant on CHGHOST (P11 slice 166) A `+R` reop mask matches a member's nick!user@host; CHGHOST rewrites the user@host half, so a host change can move a member into a channel's reop set. leveva only enforced the reop invariant on JOIN and on +R-add, so an operator who CHGHOSTed into a trusted host was silently left un-opped until their next JOIN. The local CHGHOST handler now iterates the issuer's channels and fires the existing enforce_reop on each (after set_host has updated the registry mask it resolves against, and after the co-member fan-out so a non-cap member sees the reconnect simulation then the fresh +o). The grant is additive (never de-ops) and local-path-only (a remote user's reop is its own server's job, per the apply_reop design — enforce_reop skips non-local candidates). Tests: 4 unit cases (match auto-ops + 3 inverses: non-match, already-op, move-out) and a model-lockstep proptest reop_fires_iff_new_mask_matches.

1 month ago

cidr_proptest.rs

test(leveva): proptest CIDR matching (P11 slice 89) 6 props (400 cases): cidr::contains vs an independent bit-shift model (v4+v6), self/wildcard-/0 laws, parse_cidr round-trips a rendered spec and drives the CIDR path, *-globs are never CIDR, and arbitrary junk never panics through parse_cidr/cidr_match/host_component_matches/allow_host_matches.

1 month ago

cloak_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

conn_limit_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

connaccept_proptest.rs

feat(leveva): enforce + REHASH-able options { connection-accept } (P13 slice 206) The previously parsed-but-dead `connection-accept` (with `split-min-servers`/ `split-min-users` as the Split-mode inputs) is now enforced at registration finalize and hot-reloaded by REHASH — closing the last boot-immutable `options` field on the phase-13 rehash backlog. - connaccept.rs: pure `is_split`/`admits` + REFUSED_REASON (no globals/clock). On accepts; Off refuses everyone; Split accepts only while the net is split (reachable servers/users below the configured thresholds; a 0 threshold disables that dimension). Refusal is a bare ERROR :Closing Link close. - session.rs finalize_registration: the gate is the first check (client path only — servers still link). Existing clients are never kicked (gate bites at registration finalize), so an operator can flip to off and still REHASH back. - control.rs/server.rs/main.rs: the canonical live_*().unwrap_or(ctx.…) ConfStore seam with a StatsConf ctx field (the slice-191 `bans` precedent → zero churn on the 62 hand-rolled ServerContext literals). Tests/fuzz: connaccept units + connaccept_proptest (On/Off invariant, Split≡split, is_split reference + monotone), session gate units (off/on/split + inverses), control units, rehash_conf_proptest lockstep, golden_rehash_conn_accept boot test (off refuses a fresh client / REHASH reopens). 1941 lib pass; clippy clean; workspace 0 warnings.

1 month ago

connect_notice_proptest.rs

feat(leveva): +s client connect/exit server notices — P11 slice 226 Close a long-standing gap in the +s server-notice surface (KILL/SQUIT/ REHASH/SA* were covered, connect/exit were not): post the IRCnet/charybdis SCH_NOTICE connection report to local +s watchers. - snotice::connect_notice / exit_notice — pure format seams (the fuzz targets), charybdis client.c form minus the {class} token. - finalize_registration fans the connecting report (ip from orighost, cloak-independent); release fans the exiting report before the record is freed. Local-only — a remote client's report fires on its home server; single +s mask, not charybdis's split +c. - A KILL victim posts this exit notice in addition to its SCH_KILL one (faithful — a kill is still an exit). Tests: snotice/session units + inverses (-s sees neither; a pre-reg disconnect fires no exit notice), connect_notice_proptest (fuzz, 3 properties), golden_snotice end-to-end connect+exit. Gate: cargo test -p leveva lib green (2074); connect_notice_proptest + golden_snotice green; clippy clean; build 0 warnings.

1 month ago

connect_proptest.proptest-regressions

fix(leveva): gate CONNECT/SQUIT privilege before params (P11 slice 108) The oracle routes a non-oper registered client to m_nopriv (481) before the handler's own param check, so a bare CONNECT/SQUIT from a non-oper is 481, not 461 -- and that already matched leveva's own KILL/DIE/RESTART/REHASH. connect.rs and squit.rs checked param count first; move the OperPrivilege gate ahead of the param/target check in both. An oper still gets 461 for a genuinely missing target (the handler's own min-args, reached only past the privilege gate). Updates the squit/connect unit tests and the connect_proptest decision-ladder model to privilege-first ordering.

1 month ago

connect_proptest.rs

fix(leveva): gate CONNECT/SQUIT privilege before params (P11 slice 108) The oracle routes a non-oper registered client to m_nopriv (481) before the handler's own param check, so a bare CONNECT/SQUIT from a non-oper is 481, not 461 -- and that already matched leveva's own KILL/DIE/RESTART/REHASH. connect.rs and squit.rs checked param count first; move the OperPrivilege gate ahead of the param/target check in both. An oper still gets 461 for a genuinely missing target (the handler's own min-args, reached only past the privilege gate). Updates the squit/connect unit tests and the connect_proptest decision-ladder model to privilege-first ordering.

1 month ago

control_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

cycle_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

deaf_proptest.rs

feat(leveva): +D deaf user mode (charybdis UMODE_DEAF) — P11 slice 247 A +D ("deaf") user receives no channel-addressed messages — PRIVMSG, NOTICE, TAGMSG, and the +z op-moderation redirect — while private (nick-target) messages still reach them. Client-settable by any user (MODE <nick> +D / -D), like +i/+w/+B; no oper gate. The channel fan-out delivers to local members only on each server, so the deaf filter runs on the deaf user's home server local fan-out: a remote server never delivers to a deaf user directly and so never needs to know. +D is therefore purely local and NOT in SEND_UMODES — the same precedent as +g/+G/+s. - mode.rs: UserMode::Deaf (letter D, bit 0x2000, FLAGS_DEAF), threaded through ALL/as_char/bit/flag_name/from_char/from_bit/Display; new pure predicate mode::is_deaf (the fuzz seam). - command/mode.rs: D added to the self-settable umode group + umode_diff. - command/message.rs + command/tagmsg.rs: skip deaf local members at the channel fan-out and the +z op-redirect loops. - isupport: user_modes_string() -> oOiwraWBxsgGZD (004 RPL_MYINFO). Tests: unit (mode predicate/round-trip, self-settable + clear inverse, channel-blocked-but-private-delivered + un-deaf round-trip for PRIVMSG/NOTICE/TAGMSG), boot-golden golden_deaf.rs (sentinel-ordering proves the channel line is dropped while a direct marker arrives), fuzz deaf_proptest.rs (is_deaf vs independent model + unique letter/bit). Regenerated 5 welcome-burst snapshots (004 usermode +D) + 2 hardcoded assertions; s2s::umode propagation test excludes Deaf. cargo test -p leveva green; clippy clean; cargo build --workspace 0 warnings.

1 month ago

debug_snomask_proptest.rs

feat(leveva): +s/+d DEBUG snomask producer — unknown-S2S-command spy — P11 slice 268 The ninth and final producer for a slice-257 snomask category. The `d` DEBUG category had been reserved-but-empty since slice 257 ("genuine future/feature work", since charybdis's SNO_DEBUG is compile-gated debug-build diagnostics with no faithful analogue). When a linked peer sends a server command leveva does not recognise (the s2s::dispatch catch-all, previously a bare `_ => Vec::new()`), it now fans an `Unknown command from <server>: <verb>` notice to local `+s +d` watchers (snotice::unknown_command_notice, leveva-native; the line is still dropped, the oracle's m_nop behaviour). The snomask producer matrix is complete — every category now has a producer. Tests (RED first): snotice render/embed units; s2s dispatch test with inverses (+s+k-only / -s clients get nothing; a known verb / numeric fires no DEBUG notice); proptest debug_snomask_proptest (never panics, scaffold + verbatim fields). Gate: cargo test -p leveva green; clippy clean; build 0 warnings.

1 month ago

default_chanmodes_proptest.rs

feat(leveva): add +N (roleplay) channel mode (P11 slice 308 part 1) Wire ChanMode::Roleplay (letter +N, bit 0x1_0000_0000) through the channel-mode checklist (enum/ALL/as_char/bit/mode_name/from_char) + the Channels::roleplay_enabled accessor. +N appears in CHANMODES/MYINFO; isupport asserts + golden snapshots regenerated for the new token. The commands that use it land next.

1 month ago

default_snomask_proptest.rs

feat(leveva): options { default-snomask } REHASH knob — configurable bare-+s default — P11 slice 266 Promote the bare-`+s` default snomask from a hard-coded SnoMask::ALL to a REHASH-able `options { default-snomask }` config knob (charybdis `default_snomask`). A bare `MODE <nick> +s` (no following mask token) now seeds the configured categories instead of every category. Closes the deferral named verbatim in slice 257's divergence list ("No config knob for the default mask (a future slice could add one, the MAX_PENALTY 208->210 trajectory)") via the same ConfStore live-or-default seam MAX_PENALTY (208->210), max-bans (245->246) and service-string (256) took. - snomask::parse_config(s) -> Result<u32, char>: strict config parser (rejects a typo'd letter) vs the lenient runtime apply_delta; pure+total+panic-free fuzz seam. - Options.default_snomask + parser + ConfBlocks/ConfStore/live_default_snomask() + boot seed; command::mode bare-+s reads live_default_snomask().unwrap_or(ALL). - examples/ + dist/ ircd.kdl documented line. Tests: snomask + config-parse + control round-trip/re-seed-inverse units; golden_default_snomask_config.rs (subprocess, isolates the global singleton: oper bare +s -> 008 +ck, not the all-categories default); fuzz default_snomask_proptest.rs (never-panics + subset-of-ALL round-trip + strict-reject/lenient-ignore contrast). Gate: cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings; no 004/221/welcome-burst snapshot churn.

1 month ago

dline_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

echo_message_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

elemental_extban_proptest.rs

feat(leveva): combination extbans $& (AND) / $| (OR) (P11 slice 307) Port of charybdis extensions/extb_combi.c: two extban operator types whose data is a comma-separated list of child extbans ([~]<type>[:<data>], no leading $), optionally paren-wrapped, with paren-aware comma splitting and backslash escaping. $& matches iff all children match; $| iff any does. Children may nest (depth cap 5, <=10 children/node, data <= BANLEN 195). A faithful byte-walk of eb_combi in extban/combi.rs dispatching to the existing eval_type handlers — the C global recursion_depth is threaded as a depth param (leveva runs many connections). Preserves the two charybdis subtleties: a child type is validated for existence always (even when short-circuited, via the new is_known_type), but child data only up to the short-circuit point, so combiban validity is subject-dependent. extban_chars() -> "&acjmorsxz|" so 005 advertises EXTBAN=$,&acjmorsxz|. Divergence: leveva's $m is usermode (not charybdis's hostmask), so host matching inside a combiban uses $x:<nick!user@host>#*. Tests: 11 combi units (AND/OR/negated/nested/paren+escaped-comma + inverses for every malformed shape, short-circuit type validation, the caps), extban_combi_ proptest (6 props: totality, AND==all/OR==any model vs an independent fold, single-child==bare, De Morgan), golden_extban_combi (JOIN gates biting only after OPER + the 005 token). isupport/elemental_extban/mod.rs asserts updated; 9 EXTBAN-token snapshots regenerated. EXTBANS.md documents the operators.

1 month ago

elemental_modes_proptest.rs

test(leveva): proptest the elemental rank hierarchy (slice 158) Three model-lockstep fuzz properties: prefix render + NJOIN wire round-trip over every status subset, apply_modes rank-gate (threshold/min-rank/protection) vs a from-scratch model, and KICK protection vs a model.

1 month ago

elist_proptest.rs

feat(leveva): ELIST C/T age search letters for LIST — P11 slice 225 Close the slice-224 deferral: the C (channel creation age) and T (topic age) ELIST search letters (C>n/C<n/T>n/T<n, whole minutes), advertised ELIST=CMNTU. The deferral was a plumbing gap, not a data gap — Channel::created_at and Topic::set_at are already stored (unix nanoseconds), and clock::unixnano() is read once in the command layer and passed into the pure elist matcher, which gains a Candidate view + a now argument so it stays deterministic under test. A no-topic channel takes its creation age for the T conditions (divergence from charybdis's epoch-based topic_time=0). Fuzzed via elist_proptest (age-bound totality + strict whole-minute bounds + no-topic T≡C fallback) and pinned end-to-end by golden_elist.

1 month ago

etrace_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

exlimit_proptest.rs

test(leveva): include +M operpeace in the oper-only-modes proptest Slice 309 made +M (operpeace) oper-only and updated the mode.rs unit assertion, but this duplicate check in exlimit_proptest.rs still asserted that only +P and +L are oper-only, so it failed once OperPeace joined the set. Fold OperPeace into the expectation and rename to match.

1 month ago

extban_combi_proptest.rs

feat(leveva): combination extbans $& (AND) / $| (OR) (P11 slice 307) Port of charybdis extensions/extb_combi.c: two extban operator types whose data is a comma-separated list of child extbans ([~]<type>[:<data>], no leading $), optionally paren-wrapped, with paren-aware comma splitting and backslash escaping. $& matches iff all children match; $| iff any does. Children may nest (depth cap 5, <=10 children/node, data <= BANLEN 195). A faithful byte-walk of eb_combi in extban/combi.rs dispatching to the existing eval_type handlers — the C global recursion_depth is threaded as a depth param (leveva runs many connections). Preserves the two charybdis subtleties: a child type is validated for existence always (even when short-circuited, via the new is_known_type), but child data only up to the short-circuit point, so combiban validity is subject-dependent. extban_chars() -> "&acjmorsxz|" so 005 advertises EXTBAN=$,&acjmorsxz|. Divergence: leveva's $m is usermode (not charybdis's hostmask), so host matching inside a combiban uses $x:<nick!user@host>#*. Tests: 11 combi units (AND/OR/negated/nested/paren+escaped-comma + inverses for every malformed shape, short-circuit type validation, the caps), extban_combi_ proptest (6 props: totality, AND==all/OR==any model vs an independent fold, single-child==bare, De Morgan), golden_extban_combi (JOIN gates biting only after OPER + the 005 token). isupport/elemental_extban/mod.rs asserts updated; 9 EXTBAN-token snapshots regenerated. EXTBANS.md documents the operators.

1 month ago

extended_join_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

extended_monitor_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

external_snomask_proptest.rs

feat(leveva): +s/+x EXTERNAL snomask producer — remote-server introduction spy notices — P11 slice 259

1 month ago

fd_stats_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feed_framing_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

findforwards_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

flood_proptest.rs

feat(leveva): fakelag delay/smoothing — throttle a flooder's input instead of only killing (P11 slice 208) Closes the last deferred flood follow-on (kill-only since slice 201). While the penalty clock runs more than flood::MAX_PENALTY (10s, the oracle's fixed MAXPENALTY) ahead but below the kill ceiling, the serve loop now delays the connection's next read (tokio::time::sleep_until on the select! read arm; mailbox/ticker/auth arms stay live, so fan-out + keepalive keep flowing) instead of disconnecting — pacing a flooder's input toward one command per second. Pure FloodClock::delay_secs + Session::flood_delay_secs (0 when disabled / within budget / exempt-oper / paced); charge is unchanged so every 201-204 test holds. Wired into both serve_client (TCP) and the websocket loop. flood units + flood_proptest delay invariants + new session-level flood_delay.rs; golden_rehash_flood folds bob's survival sentinel into the single burst write (the post-burst probe would now be parked by fakelag).

1 month ago

forward_proptest.rs

feat(leveva): +Q/+F forward-target control (charybdis MODE_DISFORWARD/MODE_FREETARGET) — P11 slice 243 The two recorded follow-ons to slice 242's +f channel forwarding. Both are plain channel flag modes that live on the forward *target* and gate forwarding at two different stages: - +F (free target, MODE_FREETARGET): charybdis chm_forward requires a local non-oper setting `+f #target` to be a channel operator (+o) of #target; +F on the target lifts that requirement. This forces the op-on-target permission gate that slice 242 deferred — leveva previously let any manager point +f at any valid channel; now a non-op of the target gets 482 (or 403 if the target doesn't exist), bypassed by +F / oper-override. - +Q (disforward, MODE_DISFORWARD): a +Q target refuses incoming forwards — a would-be-forwarded joiner falls through to the source channel's original reject (no 470, no forward). Mechanism: - mode.rs: ChanMode::DisableForward ('Q', 0x1000) + FreeTarget ('F', 0x2000), both Flag kind; ALL -> [ChanMode; 30]; bit/as_char/mode_name/from_char. - channel.rs: pure forward_set_verdict(exists, chanop, free) -> ForwardSetVerdict (fuzzed); forward_set_verdict_for(target, setter) store accessor (chanop = +o rank, reads the +F bit); forward_disabled(name) (+Q flag, modelled on blocks_notice). - command/mode.rs: supported_flag gains 'Q'/'F'; the ModeReq::Forward set arm runs the +F-gated check (gated on can_manage && !oper_override, ops-checked- first like the extban-validity gate) -> 403/482 for the target, change skipped. - command/join.rs: the forward redirect skips a +Q target (forward_disabled). - ISUPPORT/004: both auto-classify into CHANMODES group D -> CHANMODES=beIR,k,ljf,psmntiOCcSzTgrQF; MYINFO chan-mode string gains QF. Divergences: target-op rank is strictly chanop (+o), so a leveva halfop on the target does not satisfy the +F gate (faithful to charybdis is_chanop); a nonexistent/invalid +f target is now 403 for a manager-setter (charybdis find_channel) where slice 242 silently dropped it, but a self-forward stays silently dropped at the apply layer. No S2S follow-on — plain flag bits ride the standard MODE/CHANTS machinery; both gates run at the home server (distributed), same as +f/+g/+r. Tests: mode/channel/command::mode unit tests (truth tables, store accessors, 482/+F set gate, +Q set/clear inverse); golden_forward_control.rs (both +F and +Q scenarios with inverses); forward_proptest.rs gains an exhaustive + proptest model of forward_set_verdict. 9 CHANMODES snapshots regenerated. cargo test (edited + snapshot binaries) green; clippy -p leveva --tests clean.

1 month ago

freeinvite_proptest.rs

feat(leveva): +g free-invite channel mode (charybdis MODE_FREEINVITE) — P11 slice 240 A leveva-native channel flag mode +g: when set, any member (not just a chanop) may INVITE a user, and that invite is authoritative — it bypasses the +i chanop requirement and records the one-shot bypass token. The join/management-plane counterpart to the chm_simple speech-plane family (+C/+c/+S/+z/+T). Distributed enforcement at the inviter's home server, so no S2S follow-on. The g letter is the channel free-invite mode, disjoint from the user mode +g (CallerId). Plain flag mode — rides the generic ModeChange::Flag path everywhere (apply/render/CHANTS), so no new match arms. Wiring: mode.rs variant + bit 0x40000000 + the supported_flag second allowlist; gate via the pure channel::free_invite_allows seam in Channels::invite (both the +i check and the stored-token decision). CHANMODES/MYINFO auto-derive (+g into type-D); 9 golden snapshots + the isupport/registration asserts regenerated. Tests: golden_freeinvite (+i +g non-op invite crosses +i; -g restores 482), channel/mode/command::mode units, and fuzz (freeinvite_proptest + FreeInvite added to modes_proptest FLAGS). cargo test -p leveva green, clippy clean, workspace 0 warnings.

1 month ago

full_snomask_proptest.rs

feat(leveva): +s/+f FULL snomask producer — connection-limit-reached spy notices — P11 slice 261

1 month ago

global_caps_proptest.rs

test(leveva): fuzz + golden the global per-host caps (P11 slice 150) global_caps_proptest (2 props): check_global_admission vs an independent boolean model (verdict + denial variant); the live registry counter driven through random try_claim/release interleavings cross-checked against a HashMap reference model (counts exact for every (host,user) pair, never negative, panic-free). golden_global_caps (boot golden, real binary): a max-global-per-host 2 class welcomes two loopback clients, refuses the third with the global-host ERROR, and — the inverse — frees the network slot on disconnect so a fresh connection registers.

1 month ago

golden_account_ext.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_alias.rs

feat(leveva): route user@server alias targets (P11 slice 304) An alias { target "user@server" } block now resolves the server part to a linked remote server and routes :<uid> PRIVMSG user@server :<text> to its uplink, matching charybdis m_alias's find_server branch (was: 440). Unknown or our-own server name -> 440, empty text -> 412. Pure fuzz seam alias::remote_privmsg_wire (totality + round-trip proptest); S2S golden + unit inverses.

1 month ago

golden_autoconnect.rs

test(leveva): golden_autoconnect — unattended boot dial (P11 slice 128) Boot-level golden: a fake peer binds, leveva boots with no client connected and no CONNECT issued, and its auto-connect ticker dials out on its own. The peer reads leveva's active PASS/SERVER greeting and the (userless/channelless) CAPAB/EOB burst. The peer thread's accept() blocking until the unattended dial arrives is the assertion that auto-connect fired.

1 month ago

feat(leveva): AWAY command (P11 slice 15) — 301/305/306, +a, WHO G/H, WHOIS 301 Add the AWAY command and away-state, the 15th P11 leveva slice. An away message is stored in the shared registry record (read by other connections), the server-managed +a (FLAGS_AWAY) bit is toggled in lockstep, and away-ness is wired into its three observers: - AWAY :msg -> 306 RPL_NOWAWAY (truncate to TOPICLEN=255, char-boundary safe); bare/empty AWAY -> 305 RPL_UNAWAY (unconditional, faithful to m_away). - PRIVMSG (not NOTICE) to an away nick -> 301 RPL_AWAY to the sender. - WHO shows G (away) / H (here); WHOIS inserts 301 after 312. +a is server-managed: MODE keeps ignoring 'a', only AWAY toggles it. Grounded in the original C (b88264f3^: m_away/send_away/who_one/send_whois) + the P5g oracle port. Unit + boot-golden + proptest (fuzz) coverage; leveva-only, no shared C state. Gate: cargo test -p leveva (344 lib + golden + proptest) + -p leveva-integration (10) green; clippy clean; workspace build 0 warnings.

1 month ago

golden_away_notify.rs

test(leveva): boot golden + proptest for away-notify - golden_away_notify.rs: dan negotiates away-notify, mel does not, both share #here with bob — set/clear reach dan only; an already-away eve's join reaches dan only; mel drained of any AWAY frame. - away_notify_proptest.rs: a watcher receives an AWAY line iff the mover's state changes (trailing matches an Option<String> model); panic-freedom on arbitrary `AWAY ` bytes with a watcher on the channel. - golden_cap snapshots regenerated for the new LS tail (away-notify).

1 month ago

golden_ban_speech.rs

feat(leveva): ban-on-speech (quiet) plane — P11 slice 214 Close the deferred extban "no PRIVMSG/quiet plane" follow-on (slice 164): channel bans were enforced only at JOIN, so a +b-banned member already in the channel — ban set after they joined, or a dynamic extban they later match — could keep talking. Channels::can_send now evaluates the +b/+e lists against the sender (same LiveChannels view + Subject as check_join) and returns a new CanSend::Banned (-> 404) for a non-voiced member matching a +b with no +e. Voice or higher bypasses, exactly as it bypasses +m. Wired into PRIVMSG/NOTICE, TAGMSG and REDACT via a shared command::speech_subject helper. No dedicated +q quiet list mode (+q is the elemental owner prefix) and no S2S wire change. TDD: channel.rs units (mute after join, exception clears, account extban, voice/devoice/unban round-trip), tests/ban_speech_proptest.rs (mute predicate vs an independent extban model + totality fuzz over garbage masks), tests/golden_ban_speech.rs (e2e 404 bounce + voice bypass). Gate: cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

golden_bot_mode.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_bot_tag.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_callerid.rs

feat(leveva): caller-id (+g user mode + ACCEPT) — P11 slice 216 Add charybdis-style caller-id ("server-side ignore"): a user sets +g to receive private PRIVMSG/NOTICE only from clients on their ACCEPT list. A blocked PRIVMSG bounces 716 to the sender and notifies the target once (717 to sender + 718 to target); a NOTICE is silently dropped. The pure CallerId store (accept set + once-per-pair notify gate) lives inside Registry — the metadata precedent — so it costs no ServerContext churn; accept entries are stable UIDs (survive nick changes, quit-filtered on read), capped at 30. +g is purely local (not in SEND_UMODES): the gate runs on the target's home server, so a transit/origin server needs no copy. ACCEPT supports add / -remove (mixed) / list (281+282), with 401/456/457/458; self-accept is a no-op. CALLERID=g advertised in 005; 8 new numerics. Picked after confirming no clean documented deferral remained open — the STS-REHASH / S2S-KILL-notice / throttle-knob / MODE+VERSION-proptest / UTF8ONLY "deferred" doc comments were all stale, closed by later slices. Remote-sender gating (S2S) and +G soft caller-id are documented follow-ons. Tests: callerid unit (6), accept (8), message gate (5), numeric round-trip, isupport token, s2s/umode excludes +g; golden_callerid (2); callerid_proptest (2, accept-list + notify model lockstep). Boot snapshots regenerated for the new 004 'g' umode letter and the 005 CALLERID=g token. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_certfp.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_channel_lifecycle.rs

test(leveva): channel-lifecycle parity inverses (P11 slice 45) First slice of the P11→P12 parity matrix. leveva already had per-command happy-path channel coverage and the forward mode gates (475/474/473), but nothing exercised the un-block / re-gate / authority-revocation inverses — exactly where a faithful insert paired with a broken removal silently corrupts membership while every positive test stays green. - golden_channel_lifecycle.rs (7 boot tests): -b unban / -i reopen / -k un-key round-trips; +l free-slot on part; INVITE one-shot re-gate (join→part→re-join 473 again); deop revokes MODE/KICK authority (482); kick→clean-rejoin (no stale @); recreate-after-last-part is fresh (331 + 324 +); QUIT removes membership everywhere. - channel_lifecycle_proptest.rs (2 props, 400 cases): the first proptest to set modes AND gate a JOIN — a lockstep model fusing check_join's gate order (key→invite-one-shot→limit→ban→invite-only) with membership/op state and channel teardown; bans emitted as nick!*@* (modelable by index, non-circular w.r.t. the glob matcher). Plus panic-freedom on arbitrary JOIN/MODE/KICK bytes. No bug surfaced — parity confirmed; leveva's removal/teardown paths are sound. No leveva-integration differential (oracle channel fns are private/impure; match_differential still pins the glob matcher). Gate: cargo build --workspace 0 warnings; clippy -p leveva --tests clean; both new files green; sibling channel goldens + proptests still green.

1 month ago

golden_channels.rs

test(leveva): boot golden for channel JOIN/PART/messaging Two real clients over the booted binary: create/JOIN with a one-name NAMES, a second JOIN broadcast to the existing member with a two-name NAMES, a channel PRIVMSG delivered to the other member (not echoed to the sender), and a PART broadcast. Deterministic (fixed peer host), snapshotted.

1 month ago

golden_chantrace.rs

test: mask volatile version token in TRACE golden snapshots The chantrace/masktrace golden tests snapshot the 262 RPL_TRACEEND line, which embeds VERSION (concat!("leveva-", CARGO_PKG_VERSION)). The v0.3.0 bump changed that token from leveva-0.2.0 to leveva-0.3.0, breaking both snapshots on every release. Mask the version column to V, mirroring how these tests already mask the volatile host/ip columns of 708 lines, so future version bumps no longer break them. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_chathistory.rs

feat(leveva): message redaction deletes the chat-history line — P11 slice 275 Wire IRCv3 message-redaction (REDACT) to the slice-274 chat-history store: an accepted channel `REDACT <chan> <msgid>` now deletes the stored line so CHATHISTORY can never replay it. Closes the gap left by slice 274, where REDACT was a pure relay and command/redact.rs still claimed "leveva keeps no message history". - history.rs: new History::delete_by_msgid(target, msgid) -> usize (DELETE WHERE folded-target + msgid; no-op when disabled/unknown). Unit tests + a proptest fuzzing an arbitrary redacted subset. - command/redact.rs: delete in the channel CanSend::Ok arm only; refresh the stale "no history" docstring (still a stateless authorization relay, but the storage side now deletes). - s2s/redact.rs: delete in the plain-channel inbound branch of apply_encap_redact so each server drops its own recorded copy. Load-bearing boundary: deletion mirrors recording (full-delivery only). A +z op-moderated REDACT — local opmod broadcast and inbound @<chan> op-redirect — is "shown to ops", never recorded, so never deleted. Nick/DM targets aren't channel history. Gate: history/command::redact/s2s::redact units; golden_chathistory end-to-end (learn a msgid, REDACT it, re-query -> gone, sibling survives); two new redact_proptest command-path fuzzes (random subset via real Session + rejected-non-member-deletes-nothing). cargo clippy -p leveva --tests clean; full cargo test -p leveva green.

1 month ago

golden_chghost.rs

feat(leveva): IRCv3 chghost / oper self-CHGHOST + ENCAP CHGHOST S2S (P11 slice 71) The `chghost` capability tells clients a user's user@host changed without a simulated reconnect. leveva originates the change with an operator self-CHGHOST command, notifies channel co-members per the spec's two delivery modes, and propagates it across links as the ENCAP CHGHOST carrier. - cap.rs: `chghost` added to SUPPORTED + ClientCaps (LS/golden_cap regenerated). - command/chghost.rs: `CHGHOST <newuser> <newhost>` changes the issuing oper's own identity (oper-gated like KILL; validated via UserName/HostName; invalid or leading-':' values -> NOTICE). Registry::set_host mirrors the new mask. - s2s/chghost.rs + forward.rs: local_chghost broadcasts `:<uid> ENCAP * CHGHOST u h`; inbound_encap routes the CHGHOST subcommand to apply_encap_chghost (updates the RemoteUser mirror + registry + notifies local co-members) while still relaying every ENCAP verbatim. - The shared notify plane sends a chghost consumer the in-place CHGHOST and a non-cap co-member the reconnect-simulation fallback (QUIT -> JOIN -> MODE status restore, via the new Channels::member_status). Tests: cap/registry/command/s2s/forward units + golden_chghost + chghost_proptest (the fuzz target, which found the leading-':' guard). 1248 pass, clippy clean, 0 warnings.

1 month ago

golden_conn_limits.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_connect.rs

feat(leveva): CONNECT — operator-initiated outbound server link (P11 slice 32) The active (dialing) counterpart to slice 31's passive (accepting) S2S link. Until now leveva could only accept an inbound link on a server-only port; it had no way to initiate one. CONNECT <server> [<port> [<remote>]] is the oper command that dials a configured peer. - Outbound-link plane (src/link.rs): a global mpsc queue of OutboundLink, the multi-shot sibling of slice 25's control plane. CONNECT enqueues; main's drain task dials each (one task per link). - Handler (src/command/connect.rs): consumes the dormant ConnectLocal privilege; pure connect_decision ladder = min-params 461 -> privilege 481 -> remote-routing 402 -> resolution (unknown/already-linked NOTICE) -> port (0/non-numeric NOTICE) -> dial (Connecting-to NOTICE + queued link). New Network::server_by_name backs the already-linked check. - main.rs: serve_server refactored into a side-agnostic read_link_handshake + a shared serve_linked_peer lifecycle; new dial_server sends our PASS/SERVER greeting first (s2s::build_link_greeting), validates the peer's reply through the same reader, then bursts. Documented divergences (single-server): no remote routing (connect-remote stays dormant); plain-TCP only (TLS-outbound deferred); leveva NOTICE phrasing, no SCH_NOTICE/in-band confirmation. Verified: connect 10 unit + link 1 unit; 3-property connect_proptest; golden_connect boot golden (an oper CONNECT dials a fake peer listener which receives the active greeting + full burst + EOB); help/CONNECT.md page. cargo test -p leveva 719 passed/0 failed; clippy + fmt clean; workspace 0 warnings.

1 month ago

golden_control.rs

feat(leveva): DIE + RESTART + REHASH oper control-plane (P11 slice 25) The first leveva commands that act on the whole process. Introduces a server control plane (leveva/src/control.rs: a process-global ServerControl = Notify + latching AtomicU8) — the process-level analogue of slice 19's per-connection eject plane. Faithful to the IRCnet 2.11 m_die/m_restart/m_rehash msgtab gate ({ m_nop, m_nopriv, m_<cmd>, m_nop, m_unreg }): a non-oper -> 481; an oper -> the handler, which re-gates on is_allowed(ACL_DIE|RESTART|REHASH) -> also 481 without the flag. This wakes the dormant OperPrivilege machinery (parsed since slice 16): Registered gains a `privileges` set, populated from the matched block on a successful OPER, and each control command gates on its OperPrivilege (a non-oper's empty set => 481, reproducing both oracle arms in one check). - DIE/RESTART (shutdown_all): eject every registered client (issuer included) with a `Server (Terminating|Restarting). <nick>[<user>@<host>]` NOTICE as the eject wire, then control::request(Die|Restart). main's select! drains the ejects over a 200ms grace then exits (Die) or reexec()s the binary (Restart, CommandExt::exec; CLOEXEC sockets re-bind cleanly). - REHASH: 382 RPL_REHASHING + re-read/validate the on-disk config. Documented divergences: killer as <nick>[<user>@<host>]; single-server (no server-link ERROR branch); RESTART re-exec is review-covered not golden-tested; REHASH only validates the re-read (applying it to the immutable ServerContext is deferred); no SCH_NOTICE; KILL/WALLOPS still gate on the oper bit only. No leveva-integration differential (all three are impure into global buffers). Verified: unit (control 8; die/restart/rehash 3 each w/ inverses; OPER stores the set) + control_proptest (gate / eject-conservation / panic-freedom) + golden_control (mortal 481, oper 382, oper DIE -> NOTICE then exit) + live boots (DIE->EOF->exit; RESTART->re-exec->port re-bind). cargo test -p leveva green (lib 468 + all golden/proptest bins), clippy/fmt clean, workspace 0 warnings, leveva-integration unchanged.

1 month ago

golden_cycle.rs

feat(leveva): CYCLE — self-only channel refresh (P11 slice 295) charybdis-style `CYCLE <channel>` (extensions/m_cycle.c): part and rejoin a channel *without races*. Faithful to the real m_cycle, the effect is entirely client-side for the issuer — `:source PART <chan> :Cycling`, `:source JOIN <chan>`, then a fresh 353/366 — and nothing changes server-side, so the user keeps op/voice and place and cannot be locked out by +i/+k/+l or lose a glare. No new Channels seam (CYCLE never mutates): it composes the read-only display_name/is_member/names_query accessors. Per-channel gate ladder: 461 no param → 403 nonexistent → 442 not-a-member → success, existence before membership; the re-sent NAMES honours the issuer's multi-prefix/userhost-in-names. Divergences (leveva-native, no oracle): self-only/observationally-pure (NOT member-visible — that would drop ops, destroy a sole-member channel, and desync peers), fixed :Cycling reason, local-only. 7 command units + cycle_proptest (observational-purity + arbitrary-args) + golden_cycle; CYCLE.md help + COMMANDS allowlist + index.md.

1 month ago

feat(leveva): +D deaf user mode (charybdis UMODE_DEAF) — P11 slice 247 A +D ("deaf") user receives no channel-addressed messages — PRIVMSG, NOTICE, TAGMSG, and the +z op-moderation redirect — while private (nick-target) messages still reach them. Client-settable by any user (MODE <nick> +D / -D), like +i/+w/+B; no oper gate. The channel fan-out delivers to local members only on each server, so the deaf filter runs on the deaf user's home server local fan-out: a remote server never delivers to a deaf user directly and so never needs to know. +D is therefore purely local and NOT in SEND_UMODES — the same precedent as +g/+G/+s. - mode.rs: UserMode::Deaf (letter D, bit 0x2000, FLAGS_DEAF), threaded through ALL/as_char/bit/flag_name/from_char/from_bit/Display; new pure predicate mode::is_deaf (the fuzz seam). - command/mode.rs: D added to the self-settable umode group + umode_diff. - command/message.rs + command/tagmsg.rs: skip deaf local members at the channel fan-out and the +z op-redirect loops. - isupport: user_modes_string() -> oOiwraWBxsgGZD (004 RPL_MYINFO). Tests: unit (mode predicate/round-trip, self-settable + clear inverse, channel-blocked-but-private-delivered + un-deaf round-trip for PRIVMSG/NOTICE/TAGMSG), boot-golden golden_deaf.rs (sentinel-ordering proves the channel line is dropped while a direct marker arrives), fuzz deaf_proptest.rs (is_deaf vs independent model + unique letter/bit). Regenerated 5 welcome-burst snapshots (004 usermode +D) + 2 hardcoded assertions; s2s::umode propagation test excludes Deaf. cargo test -p leveva green; clippy clean; cargo build --workspace 0 warnings.

1 month ago

golden_default_chanmodes.rs

test(leveva): fuzz + boot-golden default-channel-modes (slice 80) - proptest: any valid flag-letter spec round-trips to the right bits; any non-flag channel letter is always rejected; arbitrary text never panics. - golden: boot `chanmodes.kdl` (+nt), create #rust, assert no MODE in the JOIN burst (silent application), then `MODE #rust` → `324 … +nt`.

1 month ago

golden_default_snomask_config.rs

feat(leveva): options { default-snomask } REHASH knob — configurable bare-+s default — P11 slice 266 Promote the bare-`+s` default snomask from a hard-coded SnoMask::ALL to a REHASH-able `options { default-snomask }` config knob (charybdis `default_snomask`). A bare `MODE <nick> +s` (no following mask token) now seeds the configured categories instead of every category. Closes the deferral named verbatim in slice 257's divergence list ("No config knob for the default mask (a future slice could add one, the MAX_PENALTY 208->210 trajectory)") via the same ConfStore live-or-default seam MAX_PENALTY (208->210), max-bans (245->246) and service-string (256) took. - snomask::parse_config(s) -> Result<u32, char>: strict config parser (rejects a typo'd letter) vs the lenient runtime apply_delta; pure+total+panic-free fuzz seam. - Options.default_snomask + parser + ConfBlocks/ConfStore/live_default_snomask() + boot seed; command::mode bare-+s reads live_default_snomask().unwrap_or(ALL). - examples/ + dist/ ircd.kdl documented line. Tests: snomask + config-parse + control round-trip/re-seed-inverse units; golden_default_snomask_config.rs (subprocess, isolates the global singleton: oper bare +s -> 008 +ck, not the all-categories default); fuzz default_snomask_proptest.rs (never-panics + subset-of-ALL round-trip + strict-reject/lenient-ignore contrast). Gate: cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings; no 004/221/welcome-burst snapshot churn.

1 month ago

golden_dline.rs

feat(leveva): D-lines (DLINE/UNDLINE) — IP-level operator bans (P11 slice 284) charybdis-style D-lines, the IP/CIDR sibling of the temporary K-line family (slices 281–283): `DLINE <duration> <ip/cidr> [:reason]` bans a raw IP or CIDR block, `UNDLINE <ip/cidr>` lifts it. Built as a near-clone of the K-line plane keyed on a single IP/CIDR `mask` (matched with the CIDR-aware `matching::host_component_matches`) instead of `user@host`. - `dline.rs`: `DlineStore` mirrors `KlineStore` (Vec+Mutex, NOCASE dedup, `find_active`, same `database {}` SQLite write-through + boot reload as slice 282); `Dline::covers` = `host_component_matches`. Reuses the kline duration grammar/clock/clamp. - `command/dline.rs`: `dline`/`undline` mirror `tkline`/`untkline` (461→481 gate, empty/`*` mask → Incorrect format, no success reply); `reap_matching_ip` ejects local matching clients by `orighost` (real connect IP), skipping remote + `kline-exempt`. New `OperPrivilege::Dline` (bit 0x400000). - `session.rs`: registration gate checked before the K-line gate, matching the pre-cloak connect IP → 465+ERROR+REJ snomask, never counted/claimed. - `s2s/dline.rs`+`forward.rs`+`burst.rs`: `ENCAP * DLINE`/`UNDLINE` propagation (server-prefixed, remaining-seconds, slice-281 KLINE shape) + burst re-assertion. - `stats.rs`: `STATS d` → `250 RPL_STATSDLINE` via `dline_report`. - `server.rs`: `ctx.dlines` opens against the same `database {}` file (persists across restart); boot test + inverse extended. - help `DLINE.md`/`UNDLINE.md` + COMMANDS allowlist. Tests (TDD, inverse invariants, mandated fuzzing): unit+proptest per module; `tests/golden_dline.rs` (real binary, `dline.kdl` fixture) and `tests/dline_proptest.rs` (6 properties incl. model-lockstep registration gate over `Session::feed`). leveva-native, no oracle differential. `cargo test -p leveva` green (2530 lib); clippy clean; workspace 0 warnings.

1 month ago

golden_dnsbl.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_echo_message.rs

test(leveva): boot golden + proptest for echo-message golden_echo_message: real binary — alice negotiates echo-message and sees her own PRIVMSG #chan echoed back while reaching bob; bob (no cap) never receives his own line. echo_message_proptest: an echoer gets exactly one self-echo per message sent, a cap-less co-member gets none, and the other member always gets one fan-out copy; plus panic-freedom on arbitrary bytes after PRIVMSG.

1 month ago

golden_elemental_modes.rs

test(leveva): boot golden for elemental channel modes (slice 158) Drives a live server: oper-seeded +q via SAMODE, owner-granted +a/+h, NAMES rendering ~alice &bob %carol, the admin-can't-strip-owner and plain-can't-+m 482s, and the advertised PREFIX=(qaohv)~&@%+ token.

1 month ago

golden_elist.rs

feat(leveva): ELIST C/T age search letters for LIST — P11 slice 225 Close the slice-224 deferral: the C (channel creation age) and T (topic age) ELIST search letters (C>n/C<n/T>n/T<n, whole minutes), advertised ELIST=CMNTU. The deferral was a plumbing gap, not a data gap — Channel::created_at and Topic::set_at are already stored (unix nanoseconds), and clock::unixnano() is read once in the command layer and passed into the pure elist matcher, which gains a Candidate view + a now argument so it stays deterministic under test. A no-topic channel takes its creation age for the T conditions (divergence from charybdis's epoch-based topic_time=0). Fuzzed via elist_proptest (age-bound totality + strict whole-minute bounds + no-topic T≡C fallback) and pinned end-to-end by golden_elist.

1 month ago

golden_etrace.rs

feat(leveva): ETRACE extended local-person trace, oper-gated (P11 slice 27)

1 month ago

golden_exlimit.rs

feat(leveva): +L large ban list (charybdis MODE_EXLIMIT/chm_staff) — P11 slice 245 The last missing standard charybdis channel mode. +L is an oper-only (chm_staff) plain flag that raises the per-list size cap on the ban-family list modes (+b/+e/+I) from MAX_LIST_DEFAULT=100 to MAX_LIST_LARGE=500; implementing it first required giving leveva a list-size cap at all (the lists were unbounded). With +L every standard charybdis cmode is in leveva. - ChanMode::ExtendLimit: letter 'L', bit 0x1 (the last free u32 bit), MODE_EXLIMIT, kind Flag. Generalized the oper-only set-gate via a new ChanMode::is_oper_only() (Permanent | ExtendLimit), routed through the shared channel::permanent_set_allowed predicate -> 481 before 482. - Pure seams channel::list_limit / list_is_full / is_ban_family (+R reop list is leveva-native and uncapped). apply_changes records over-cap adds in a new ApplyOutcome::Applied.full field without pushing; the command layer emits 478 ERR_BANLISTFULL per entry. S2S burst is NOT capped (a linked server is authoritative). Consts->REHASH knobs is a clean follow-on. - Tests: mode/channel/command::mode unit tests (cap + inverse slot-free + +L raises + oper-override-still-capped + +R-uncapped + 481 gate + 478), golden_exlimit.rs, exlimit_proptest.rs; regenerated CHANMODES/004 assertions + 9 insta snapshots for the new type-D letter.

1 month ago

golden_extban.rs

feat(leveva): charybdis-style extended bans (P11 slice 164) Add `+b`/`+e`/`+I` ban-list entries of the form `$[~]<type>[:<data>]` that match a richer client predicate than a plain nick!user@host glob, ported faithfully from Elemental-IRCd (doc/technical/extban.txt, src/extban.c, extensions/extb_*.c). A new `leveva::extban` module holds the framework (the $/~/: parse, Verdict/ModeType/Subject/ChannelView, match_extban/valid_extban/ entry_matches/extban_chars) plus one handler file per type: $a account, $o oper, $z ssl, $r realname, $x extgecos, $s server, $c on-channel, $j banned-from-channel, $m usermode. The nine handlers were implemented in parallel via a multi-agent workflow, one per extb_*.c. Extbans are enforced at the JOIN gate: check_join's last param is now &extban::SubjectAttrs (was is_oper: bool), and its +b/+e/+I iteration runs through extban::entry_matches against a Subject built in place. A private LiveChannels ChannelView adapter resolves $c/$j from the already-locked channel map (no re-lock) with a depth-1 recursion guard for nested $j. join.rs builds SubjectAttrs from the registry (account, certfp->ssl, realname, modes->oper/umodes) plus the server name. ISUPPORT advertises EXTBAN=$,acjmorsxz (re-chunking nine existing 005 golden bursts, content-identical). Divergences (leveva-native, documented): JOIN-gate-only enforcement (no PRIVMSG/quiet plane; +q is the slice-158 owner mode), $s matches the joiner's server (= me.name for a local JOIN), $j caps at depth 1, $x has no DynSpoof retry, and add-time validity rejection is deferred. Tests: 97 extban unit tests, elemental_extban_proptest (parser totality, negation duality, $a model, extban_chars invariant), and a real-binary golden_extban. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_extban_combi.rs

feat(leveva): combination extbans $& (AND) / $| (OR) (P11 slice 307) Port of charybdis extensions/extb_combi.c: two extban operator types whose data is a comma-separated list of child extbans ([~]<type>[:<data>], no leading $), optionally paren-wrapped, with paren-aware comma splitting and backslash escaping. $& matches iff all children match; $| iff any does. Children may nest (depth cap 5, <=10 children/node, data <= BANLEN 195). A faithful byte-walk of eb_combi in extban/combi.rs dispatching to the existing eval_type handlers — the C global recursion_depth is threaded as a depth param (leveva runs many connections). Preserves the two charybdis subtleties: a child type is validated for existence always (even when short-circuited, via the new is_known_type), but child data only up to the short-circuit point, so combiban validity is subject-dependent. extban_chars() -> "&acjmorsxz|" so 005 advertises EXTBAN=$,&acjmorsxz|. Divergence: leveva's $m is usermode (not charybdis's hostmask), so host matching inside a combiban uses $x:<nick!user@host>#*. Tests: 11 combi units (AND/OR/negated/nested/paren+escaped-comma + inverses for every malformed shape, short-circuit type validation, the caps), extban_combi_ proptest (6 props: totality, AND==all/OR==any model vs an independent fold, single-child==bare, De Morgan), golden_extban_combi (JOIN gates biting only after OPER + the 005 token). isupport/elemental_extban/mod.rs asserts updated; 9 EXTBAN-token snapshots regenerated. EXTBANS.md documents the operators.

1 month ago

golden_extban_validity.rs

feat(leveva): reject invalid extbans at MODE add-time (P11 slice 172) Closes the slice-164 deferral: a chanop adding a malformed/unknown extban ($q, $o:x, $r on +e, ...) to +b/+e/+I now gets a NOTICE and the mask is dropped, instead of storing an inert never-matching ban. - Channels::validate_extban builds the live LiveChannels view + Subject (so $c/$j resolve referenced channels) and routes through extban::valid_extban. - Gated on the management threshold so a non-privileged setter still hits the 482 op-gate first (charybdis ops-checked-first precedence); removals, +R reop masks, and plain n!u@h globs are never validated. - Tests: channel.rs validate_extban units, mode.rs handler units (reject + inverses + non-op 482), an inline proptest fuzzing the MODE-path invariant (stored iff valid iff no NOTICE), and a boot-level golden.

1 month ago

golden_extended_monitor.rs

feat(leveva): IRCv3 extended-monitor / push AWAY+CHGHOST to MONITOR watchers sharing no channel (P11 slice 74)

1 month ago

golden_findforwards.rs

feat(leveva): FINDFORWARDS reverse +f lookup (P11 slice 291)

1 month ago

golden_flood.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_flood_prereg.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_forward.rs

feat(leveva): +f channel forwarding (charybdis MODE_FORWARD) — P11 slice 242 A JOIN refused by a forwardable reject (+i/+l/+b/+r) on a +f channel is redirected to the forward target instead of erroring: the joiner gets 470 RPL_LINKCHANNEL <from> <to> and a clean single-hop JOIN of the target. - mode.rs: ChanMode::Forward (letter f, bit 0x10000, Param kind), ALL→28. - channel.rs: ChannelModes.forward; pure seams forwardable() + valid_forward_target() (valid ChanName + not-self, fold-aware); ModeChange::Forward applied (set re-validates, invalid/self silently dropped; trusted-peer verbatim); 324 render + forward_target(). - command/{mode,join}.rs: +f param parse (461 on bare +f, -f clears); join_one gains allow_forward — single hop, no chaining (SAJOIN/OJOIN pass false). - numeric.rs: RplLinkchannel = 470. - S2S: rides the live channel-MODE plane (relay render + s2s/mode parse → apply_modes_as_server); not in the netburst CHANTS, matching the +j precedent (documented divergence). - ISUPPORT/004: +f auto-classifies into CHANMODES group C (beIR,k,ljf,…); MYINFO gains f. Tests: channel/mode/command::mode/s2s::mode units; golden_forward (470 redirect + inverse); forward_proptest (forwardable + valid_forward_target totality/model); ISUPPORT/004 snapshots + characterization literals updated for the trailing f. Divergences: single hop (charybdis chains); invalid/self target silently dropped; +k bad-key and the hard +O/+S gates never forward; +Q/+F are follow-on slices.

1 month ago

golden_forward_control.rs

feat(leveva): +Q/+F forward-target control (charybdis MODE_DISFORWARD/MODE_FREETARGET) — P11 slice 243 The two recorded follow-ons to slice 242's +f channel forwarding. Both are plain channel flag modes that live on the forward *target* and gate forwarding at two different stages: - +F (free target, MODE_FREETARGET): charybdis chm_forward requires a local non-oper setting `+f #target` to be a channel operator (+o) of #target; +F on the target lifts that requirement. This forces the op-on-target permission gate that slice 242 deferred — leveva previously let any manager point +f at any valid channel; now a non-op of the target gets 482 (or 403 if the target doesn't exist), bypassed by +F / oper-override. - +Q (disforward, MODE_DISFORWARD): a +Q target refuses incoming forwards — a would-be-forwarded joiner falls through to the source channel's original reject (no 470, no forward). Mechanism: - mode.rs: ChanMode::DisableForward ('Q', 0x1000) + FreeTarget ('F', 0x2000), both Flag kind; ALL -> [ChanMode; 30]; bit/as_char/mode_name/from_char. - channel.rs: pure forward_set_verdict(exists, chanop, free) -> ForwardSetVerdict (fuzzed); forward_set_verdict_for(target, setter) store accessor (chanop = +o rank, reads the +F bit); forward_disabled(name) (+Q flag, modelled on blocks_notice). - command/mode.rs: supported_flag gains 'Q'/'F'; the ModeReq::Forward set arm runs the +F-gated check (gated on can_manage && !oper_override, ops-checked- first like the extban-validity gate) -> 403/482 for the target, change skipped. - command/join.rs: the forward redirect skips a +Q target (forward_disabled). - ISUPPORT/004: both auto-classify into CHANMODES group D -> CHANMODES=beIR,k,ljf,psmntiOCcSzTgrQF; MYINFO chan-mode string gains QF. Divergences: target-op rank is strictly chanop (+o), so a leveva halfop on the target does not satisfy the +F gate (faithful to charybdis is_chanop); a nonexistent/invalid +f target is now 403 for a manager-setter (charybdis find_channel) where slice 242 silently dropped it, but a self-forward stays silently dropped at the apply layer. No S2S follow-on — plain flag bits ride the standard MODE/CHANTS machinery; both gates run at the home server (distributed), same as +f/+g/+r. Tests: mode/channel/command::mode unit tests (truth tables, store accessors, 482/+F set gate, +Q set/clear inverse); golden_forward_control.rs (both +F and +Q scenarios with inverses); forward_proptest.rs gains an exhaustive + proptest model of forward_set_verdict. 9 CHANMODES snapshots regenerated. cargo test (edited + snapshot binaries) green; clippy -p leveva --tests clean.

1 month ago

golden_freeinvite.rs

feat(leveva): +g free-invite channel mode (charybdis MODE_FREEINVITE) — P11 slice 240 A leveva-native channel flag mode +g: when set, any member (not just a chanop) may INVITE a user, and that invite is authoritative — it bypasses the +i chanop requirement and records the one-shot bypass token. The join/management-plane counterpart to the chm_simple speech-plane family (+C/+c/+S/+z/+T). Distributed enforcement at the inviter's home server, so no S2S follow-on. The g letter is the channel free-invite mode, disjoint from the user mode +g (CallerId). Plain flag mode — rides the generic ModeChange::Flag path everywhere (apply/render/CHANTS), so no new match arms. Wiring: mode.rs variant + bit 0x40000000 + the supported_flag second allowlist; gate via the pure channel::free_invite_allows seam in Channels::invite (both the +i check and the stored-token decision). CHANMODES/MYINFO auto-derive (+g into type-D); 9 golden snapshots + the isupport/registration asserts regenerated. Tests: golden_freeinvite (+i +g non-op invite crosses +i; -g restores 482), channel/mode/command::mode units, and fuzz (freeinvite_proptest + FreeInvite added to modes_proptest FLAGS). cargo test -p leveva green, clippy clean, workspace 0 warnings.

1 month ago

golden_global_caps.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_help_users.rs

feat(leveva): HELP serves embedded per-command help pages (P11 slice 30) HELP now serves plain-text help pages embedded from leveva/help/ via rust-embed: bare HELP -> index.md, HELP <CMD> -> <CMD>.md (upper-folded, [A-Z0-9]-sanitized so path traversal misses), unknown -> not-found NOTICE. Pages ship for all 39 commands + an index; 34 were authored by an ultracode multi-agent workflow grounded in each handler's source. Two tests enforce the convention that adding a command means adding its help page.

1 month ago

golden_ident.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_identify.rs

feat(leveva): charybdis alias{} services command aliases (P11 slice 303) Port charybdis's alias{} mechanism (modules/m_alias.c + newconf.c alias_entry): an `alias "<name>" { target "<t>" }` block makes <name> a command that rewrites `<name> <text...>` into `PRIVMSG <target> :<text...>`, delivered through the message plane. A real command always takes precedence (the hook is the existing 421 fallback). Found by comparing against a charybdis checkout: the 'configurable IDENTIFY nicks' originally scoped does not exist in charybdis (the nicks are hardcoded #defines); the alias{} block is the real, faithful, more general mechanism. - alias.rs pure seam: parse_target (split on first @ -> nick vs user@server), combined_args / reconstruct; fuzzed by tests/alias_proptest.rs. - new top-level alias{} config block (model/parse/from_kdl), held live + REHASH-able through ConfStore (live_aliases, the service-string chain); main.rs boot seed. - command/alias.rs: deliver_to_service_nick shared core (target must be a present +S service else 440 ERR_SERVICESDOWN; empty text -> 412; else synth PRIVMSG + message::message, so a remote service is reached by UID routing). new numeric 440. - folds in the slice-302 IDENTIFY faithfulness fix the comparison surfaced: empty args -> 412 (was 461), absent/non-+S agent -> 440 (was 401), via the shared core. - user@server target parsed/fuzzed but not yet routed (-> 440, documented follow-on). Tests: alias seam + command + config-parse units; identify units updated; extended rehash_conf_proptest alias reload; golden_alias (S2S +S burst: route + 440 + 421 inverses); golden_identify rewritten (S2S +S NickServ/ChanServ). cargo test -p leveva green / clippy clean / build --workspace 0 warnings.

1 month ago

golden_iline.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_iline_cidr.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_invite.rs

test(leveva): boot golden + proptest fuzzing for INVITE - golden_invite.rs: a 3-connection boot golden — alice sets #rust +i, bob's un-invited JOIN is 473, alice INVITEs bob (341 + bob sees the INVITE line), bob's JOIN now succeeds, re-inviting a member is 443, inviting a ghost nick is 401. Nothing volatile in the snapshot. - invite_proptest.rs (400 cases): a lockstep JOIN/PART/INVITE/MODE±i script over 4 distinct-nick sessions vs an invite+membership+mode model — real membership never drifts (pinning invited-crosses-+i-exactly-once + consumed-on-join + non-invited-never-crosses), and mailbox delivery is conserved. A 2nd property feeds arbitrary bytes after `INVITE ` for panic-freedom + well-formed replies.

1 month ago

golden_invite_notify.rs

test(leveva): boot golden + proptest for invite-notify golden_invite_notify.rs drives the real binary: alice ops both dan (invite-notify ON) and mel (OFF) on #chan, invites a fresh off-channel bob, and asserts only dan receives :alice!... INVITE bob :#chan while mel's socket is drained of any INVITE frame. invite_notify_proptest.rs fuzzes the Session layer: an op-watcher receives an INVITE line iff the invite succeeds (target registered + not on the channel), a non-op watcher (cap and all) never does, and a ghost target (401) notifies nobody; plus panic-freedom on arbitrary bytes after 'INVITE ' with an op-watcher on the channel. The two golden_cap snapshots are bumped for the appended invite-notify LS token.

1 month ago

golden_ip_cloaking.rs

feat(leveva): IP cloaking / the +x hidden-host usermode + user modes on connect (P11 slice 72) Ports Elemental-IRCd's extensions/ip_cloaking.c to leveva as a client-settable `+x` usermode that hides a client's host behind a deterministic FNV-keyed scramble of its original host. The host change is distributed by reusing the slice-71 chghost plane, so a cap co-member sees an in-place CHGHOST and the network an ENCAP CHGHOST. - cloak.rs: faithful port of the C — fnv_hash(s,32), cloak_ip (keep IPv4 first two octets / IPv6 first half, substitute the rest from the g–z alphabet), cloak_host (scramble first-label letters then digits), dispatch on IpAddr. Wire-safety: never introduces a leading ':'. - mode.rs/numeric.rs: UserMode::Cloak (+x, 0x0100, appended last); 396 RPL_HOSTHIDDEN. +x is NOT in SEND_UMODES — it propagates as a host change, not a umode diff (no double-propagation). - registry.rs: immutable ClientRecord.orighost (set at try_claim, never by set_host) so the cloak is computed from / reverts to the real connect host. - command/mode.rs: 'x' joins the i|w|B settable arm; apply_cloak_change cloaks/ restores the host, mirrors set_host, distributes over the chghost plane, and emits 396 (is now your hidden host / hostname reset). - config/parse.rs: default-user-modes now accepts 'x' so a network can auto-cloak everyone; a default-+x client is cloaked at registration (the C check_new_user path). - session.rs: clients are now told their user modes on connect (:nick MODE nick :+<modes> after the welcome burst). leveva-native (no C oracle) → unit + golden + proptest, no differential. Tests: cloak/mode/numeric/registry/command/session/config units + golden_ip_cloaking (127.0.0.1 -> 127.0.y.p) + cloak_proptest (the fuzz target). 4 registration snapshots regenerated (004 -> oOiwraWBx + the trailing MODE notice). clippy clean, 0 warnings.

1 month ago

golden_jointhrottle.rs

feat(leveva): +j join throttle channel mode — P11 slice 234 Charybdis-style `+j n:t` (MODE_JOINTHROTTLE): a channel admits at most n joins per t-second window; the next join bounces 480 ERR_THROTTLE and is not added. The first parameter-bearing flag mode since +l/+k and the first JOIN-rate gate; continues the channel-mode parity track (220 +C, 232 +c, 233 +S). leveva-native — gate is unit + golden + proptest. - Pure core join_throttle.rs: parse_param(n:t) + format_param + the charybdis fixed-window decide() (both fuzz seams); JoinThrottle counter store (reads no clock, self-draining) housed inside Channels (zero ServerContext-literal churn). - ChanMode::JoinThrottle ('j', bit 0x8000000, Param kind) threaded through both mode parsers + the three ModeChange matches + 324/CHANMODES-type-C/004 render. - JOIN gate in command::join::join_one: non-members, local path only (remote NJOIN gated at its home server); SAJOIN bypasses; refusal -> 480 ErrThrottle. - Tests: 12 core units + 2 channel + 1 mode units; jointhrottle_proptest (5, incl. no-window-over-admits) + golden_jointhrottle; 8 005/004 snapshots regenerated (CHANMODES ...,k,lj,... / 004 ...IRklj, token-only).

1 month ago

golden_keepalive.rs

test(leveva): client keepalive boot golden (P11 slice 117) Close the testing-plan §4 'features fuzzed but never boot-tested' tail for the client keepalive plane (heartbeat + ping). The S2S link keepalive already has a boot golden (golden_s2s_keepalive); this is its client-plane twin. tests/golden_keepalive.rs (reusing the s2s_fastping.kdl 2s ping-freq fixture) drives the real binary over a live socket: - client_ping_gets_pong: a client PING <token> is answered with PONG :<token> (closes the 'ping' boot-golden gap — the verb was only unit-tested); - leveva_pings_an_idle_client: a silent client gets a server PING within ~2s; - idle_client_is_timed_out: a client that stays silent through 2*ping-freq gets ERROR :Closing Link: (Ping timeout) and the socket closes; - client_answering_pings_survives (inverse): a client that answers the keepalive is never timed out past 2*ping-freq and keeps getting normal replies. Assertion-based (timing is non-deterministic), mirroring golden_s2s_keepalive.

1 month ago

test(leveva): boot golden + proptest fuzzing for KICK golden_kick.rs: a 4-connection boot golden (non-op 482, op kicks a member with the victim + a bystander witnessing it + the kicker's echo, 441 for a registered-but-absent victim, 403 for a ghost channel). kick_proptest.rs: a lockstep JOIN/PART/KICK script vs a membership + op-state model (real membership, is_op, and mailbox delivery never drift; the op-gate holds) plus arbitrary-bytes-after-KICK panic-freedom.

1 month ago

feat(leveva): KILL command (P11 slice 19) — 481/461/483/401, oper forced disconnect First leveva command that forcibly closes another connection, faithful to the IRCnet 2.11 m_kill local-oper branch (single server; killer+victim local; +o/+O). - KILL <nick> <comment>: non-oper → 481, missing target/comment → 461, server → 483, unknown nick → 401. Success ejects the victim (KILL notice + ERROR), then its serve loop relays QUIT :Local Kill by <killer> (<comment>) to co-members. - Cross-connection control plane: mailbox payload becomes Envelope::{Wire,Eject} (eject rides the same mpsc, never overtakes queued wire); Registry::eject_uid + Session::force_close drive the disconnect via the existing release() QUIT relay. - Tests: 8 unit + 1 session + kill_proptest (privilege/outcome + per-victim eject conservation + arbitrary-bytes panic-freedom) + golden_kill boot snapshot.

1 month ago

golden_knock.rs

feat(leveva): KNOCK — request an invite to a restricted channel (P11 slice 198) A user kept out of a +i/+k/+l channel can now KNOCK to ask its operators for an invite without joining. Eligibility is decided by the same Channels:: check_join gate the JOIN path uses (key = None), so KNOCK and JOIN never disagree: open -> 713, already-a-member -> 714, nonexistent/invalid -> 403, banned/+O -> 404. On a delivered knock every local op (rank >= Op, the INVITE-capable set) gets 710 RPL_KNOCK and the knocker gets 711 RPL_KNOCKDLVR. leveva-native (the retired IRCnet 2.11 oracle had no KNOCK; charybdis/ratbox 710/711/713/714 convention). S2S propagation and a 712 flood throttle are documented follow-ons. Tests: 12 command/knock.rs units (happy + every inverse), knock_proptest (outcome map + delivery conservation + arbitrary-args panic-freedom, PROPTEST_CASES=2000), golden_knock boot-golden (two clients, one server).

1 month ago

golden_labeled_response.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_links_map.rs

feat(leveva): LINKS + MAP commands (P11 slice 23) Server-topology query pair. On single-server leveva the network is one node, so LINKS emits one 364 (this server as its own upstream, hop 0, SID + description) then 365, and MAP emits 018/015/017 with a trailing 's' selecting the verbose dump_map_sid variant (Server users SID version). An optional server mask glob-filters the single server; a non-match drops the 364/015. Documented divergences (no S2S): LINKS drops the hunt_server remote-forward and answers locally (second token = mask); no RPL_TRYAGAIN throttle; MAP draws no tree connectors and never shows the bursting annotation. Verified by unit (each command + inverse non-matching-mask suppression + empty- description branch), a 3-property server_topology_proptest fuzzer, and a golden_links_map boot snapshot. No leveva-integration differential (m_links/ m_map are not pure).

1 month ago

golden_locops.rs

feat(leveva): +l locops + LOCOPS command, and make all user modes global — P11 slice 254 Part A — +l locops user mode + LOCOPS command (charybdis UMODE_LOCOPS), the local-server sibling of +z/OPERWALL: an oper broadcasts to +l users on the originating server only; the command never crosses a link. Oper-gated to set, letter 'l' (bit 0x40000). New command/locops.rs + golden_locops.rs + locops_proptest.rs. The last named standard charybdis umode — surface complete. Part B — leveva has NO local-only user modes (product decision). SEND_UMODES is now every UserMode::ALL bit (self-maintaining const loop), so +O/+x/+s/+g/+G/+D/ +R/+Q/+z/+l all propagate and a remote WHOIS shows them. Verified safe: the burst already rendered the full unmasked set, and a user's host is always carried explicitly (UNICK field / ENCAP CHGHOST), never recomputed from the +x bit, so +x cannot double-apply the cloak (+x now emits both UMODE +x and ENCAP CHGHOST). Enforcement unchanged: caller-id (+g/+G) and +R stay gated on the target's home server — the ACCEPT list lives only there and is not propagated, so those S2S gates are the actual enforcement, not redundant re-checks, and are kept. - mode.rs: UserMode::LocOps + is_locops(); doc sweep (bit propagates, enforcement is server-local) - command/mode.rs: 'l' in the oper-gated arm + umode_diff; +x test asserts both frames - s2s/umode.rs: SEND_UMODES = every umode; exclusion test -> carries-every-mode - snotice.rs / s2s/relay.rs: stale 'not in SEND_UMODES' comments corrected - help/LOCOPS.md + USER_MODES +l row; 004 umode list -> ...zSl (6 snapshots) - golden_s2s_umode rewritten (demonstrates +D now propagating)

1 month ago

golden_markread.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

golden_masktrace.rs

test: mask volatile version token in TRACE golden snapshots The chantrace/masktrace golden tests snapshot the 262 RPL_TRACEEND line, which embeds VERSION (concat!("leveva-", CARGO_PKG_VERSION)). The v0.3.0 bump changed that token from leveva-0.2.0 to leveva-0.3.0, breaking both snapshots on every release. Mask the version column to V, mirroring how these tests already mask the volatile host/ip columns of 708 lines, so future version bumps no longer break them. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_maxbans_config.rs

feat(leveva): max-bans/max-bans-large REHASH knobs (charybdis maxbans) — P11 slice 246 Promote the slice-245 hard-coded ban-family list-size caps (MAX_LIST_DEFAULT 100 / MAX_LIST_LARGE 500, the cap +L toggles between) to live, hot-reloadable `options { max-bans / max-bans-large }` config — the exact const→knob trajectory MAX_PENALTY took (const slice 208 → knob slice 210). Mirrors the max-penalty live-config seam one-for-one: list_limit/list_is_full take caller-supplied caps; Channels::apply_changes reads control::live_max_bans().unwrap_or(MAX_LIST_DEFAULT) (+ large) so an unseeded store (unit tests) falls back to the consts. Config plumbing through Options/parser/ConfBlocks/ConfStore/main + the example+dist kdl. 0 is legal (no entries permitted); negative rejected; caps parsed independently. Tests: config default/override/zero parse; control seed/live/rehash readback; channel seam over arbitrary caps; exlimit_proptest rewritten over arbitrary (default,large) caps; boot-golden golden_maxbans_config (max-bans 2 → 478 on the 3rd, +L raises to 4, inverse frees a slot).

1 month ago

golden_metadata.rs

feat(leveva): METADATA SYNC subcommand (metadata batch of server-message events) — P11 slice 229 Closes the last draft/metadata-2 gap: METADATA <target> SYNC re-sends the issuer the current value of every key it is subscribed to on the target as a metadata batch of METADATA server-message events (not 761), and for a channel target also every member's subscribed user metadata. Oper-restricted keys (slice 223) are withheld from a non-oper via the pure metadata::sync_emits seam. 774 RPL_METADATASYNCLATER is ruled a deliberate divergence — a small in-memory store always syncs immediately, so the load-shedding 'sync later' path is never taken; the numeric is intentionally not added. The draft/metadata-2 track is now complete. Gate: 4 unit tests (subscribed-as-events + empty-batch inverse + channel-member walk + oper-restricted withheld), golden_metadata end-to-end SYNC scenario, and metadata_sync_proptest (6 properties over sync_emits). cargo build 0 warnings; clippy clean.

1 month ago

golden_metadata_priv.rs

feat(leveva): metadata privileged keys / restricted visibility — P11 slice 223 Close the last draft/metadata-2 deferral (named by slice 221): the privileged-key / restricted-visibility system. A metadata key is oper-restricted (settable/viewable only by +o/+O, visibility token `oper` not `*`) iff it begins with the built-in `priv.` prefix or matches a REHASH-able `options { oper-keys "<glob>" }` allowlist (prefix+config scheme via the ConfStore live_oper_keys seam). A non-oper is refused SET/GET (KEY_NO_PERMISSION), omitted from LIST/760 WHOIS, skipped by CLEAR, and never pushed a restricted key via the notify plane (local + inbound-S2S paths). Pure fuzz seam metadata::key_visibility + golden_metadata_priv (config-driven, end-to-end) + a key_visibility proptest. Also fixed two stale doc comments (metadata burst landed slice 189; privileged visibility now here).

1 month ago

golden_metadata_rate.rs

feat(leveva): metadata-rate-cost/metadata-rate-burst REHASH knobs — P11 slice 230 Close the slice-228 follow-on: the METADATA SET/CLEAR rate-limit budget (was the hard-coded META_RATE_COST_SECS/META_RATE_BURST_SECS consts) is now the REHASH-able options { metadata-rate-cost / metadata-rate-burst } pair via the slice-204/210/212 ConfStore live seam. - rate_charge/charge_rate take cost_secs/burst_secs (consts become defaults; negatives clamped); command::metadata::rate_gate reads live_meta_rate_cost/live_meta_rate_burst. - Options/ConfBlocks/ConfStore carry the i64 pair, seeded at boot and re-seeded on REHASH. - 0 legal for both: cost 0 disables the limiter, burst 0 caps at one mutation/sec; negative rejected. Tests: metadata.rs units (custom budget + inverses, cost-0-disables, store threads knobs), config parse (default/override/0/negative), control re-seed lockstep, metadata_rate_proptest fuzzes cost/burst incl. 0 + negatives (the proptest caught and corrected an over-broad cost-0 property), and a config-driven golden_metadata_rate.rs. cargo build --workspace 0 warnings; clippy clean.

1 month ago

golden_metrics.rs

test(leveva): boot golden + canonicalizer masks for STATS traffic (P11 slice 145) golden_stats_traffic boots two real clients and diffs STATS l (sorted 211s, traffic tail masked) + t (masked :Traffic 249s) + L/T uppercase terminators. Canonicalizer gained a 211 traffic-tail mask + a 249 :Traffic digit mask (leaving the deterministic STATS z 249 lines untouched); golden_metrics masks the four wire-volatile leveva_traffic_* counter values (presence-only).

1 month ago

golden_modes.rs

feat(leveva): +r registered-only-join channel mode (charybdis MODE_REGONLY) — P11 slice 241 Adds the leveva-native channel flag mode +r: on a +r channel only a client signed in to a services account may JOIN; a signed-out client is refused 477 (charybdis ERR_NEEDREGGEDNICK, which overloads numeric 477 — reuses Numeric::ErrNochanmodes since a duplicate-discriminant variant is impossible). The join-plane sibling of +g; a hard JOIN gate like +O/+S (an INVITE/key/ exception does NOT bypass it — account identity is a user property), so KNOCK to a +r channel is refused too. - mode.rs: ChanMode::RegisteredOnly, letter r, bit 0x80000000 (last free u32 bit), Flag kind; added to ALL/as_char/bit/mode_name/from_char. - command/mode.rs: supported_flag 'r' (the second allowlist). - channel.rs: pure regonly_blocks(set, has_account) seam + the hard-gate clause in check_join (reads attrs.account, same source as $a extban); new JoinReject::RegisteredOnly. - command/join.rs + command/knock.rs: reject mapping + KNOCK refusal. - ISUPPORT/MYINFO auto-derive (CHANMODES …SzTgr, MYINFO …SzTgr…); 10 snapshots + isupport/registration assertions updated (token-only). Reclaiming the slice-77 ripped-out reop letter r triggered the unknown-chanmode-letter hazard: removed the obsolete ripped_out_reop_is_unknown test, updated chan_mode_bits_match_oracle, switched golden_modes's unknown-mode probe to +>, and repurposed the modes_proptest AnonReop op to BareAdmin. Tests: golden_regonly.rs (RED-first), channel/mode/command::mode units (gate + inverse + hard-gate proof + truth table), regonly_proptest.rs, modes_proptest FLAGS += RegisteredOnly. cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

golden_monitor.rs

feat(leveva): IRCv3 MONITOR / the online-offline watch list (P11 slice 70) Adds the MONITOR extension: a per-connection nick watch list with server-pushed 730/731 online/offline notifications, replacing ISON polling. Advertised via the MONITOR=100 ISUPPORT token (not a CAP). New leveva::monitor shared index (keyed by watcher UID, off the Registered struct), command/monitor.rs handler (+/-/C/L/S, 734 overflow, comma-chunked replies), live-notify hooks at the registration / disconnect / nick-change seams, numerics 730-734, and help/MONITOR.md. Single-server-local: live pushes fire on local lifecycle events only (remote S2S transitions deferred). Gate: monitor module + command + seam units, golden_monitor (two clients), monitor_proptest; full leveva suite 1222 pass, clippy clean, 0 warnings.

1 month ago

golden_msgid.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_multi_prefix.rs

test(leveva): boot-golden for multi-prefix (P11 slice 51) Two observers query the same op+voice member; one negotiates multi-prefix, one does not. The cap-gated divergence (@+alice/H@+/@+#rust vs @alice/H@/@#rust across NAMES/WHO/WHOIS) is the whole point of the test.

1 month ago

golden_names_list.rs

chore: run cargo format Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_nick_collision.rs

chore: run cargo format Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_no_implicit_names.rs

feat(leveva): IRCv3 no-implicit-names / suppress the implicit NAMES burst on JOIN (P11 slice 73)

1 month ago

golden_nocolor.rs

feat(leveva): +c no-control-codes (no-color) channel mode — P11 slice 232 A leveva-native channel flag mirroring slice-220 +C (no-CTCP): a PRIVMSG or NOTICE carrying mIRC text-formatting control codes (bold/color/italic/hex/ reset/mono/reverse/strike/underline) to a +c channel is blocked 404 ERR_CANNOTSENDTOCHAN :Channel doesn't accept control codes (PRIVMSG) or silently dropped (NOTICE), and not delivered. Port of charybdis MODE_NOCOLOR. leveva blocks rather than charybdis's strip — never mutating the body (the utf8only/+C "reject, don't mangle" stance). Unlike +C (PRIVMSG-only), +c gates both PRIVMSG and NOTICE. Ops not exempt; distributed enforcement at the sender's home server, like +n/+m/+C — no S2S enforcement path. Pure seam channel::has_control_codes(text) + FORMATTING_CODES const, paired with Channels::blocks_color(name); gated in command/message.rs right after the +C check. ChanMode::NoColor ('c', bit 0x2000000) wired through both flag-mode allowlists (mode.rs + command::mode::supported_flag); CHANMODES/004 auto-derive. Also corrects a pre-existing stale golden_setname snapshot (its CHANMODES was missing the slice-220 C). Tests: 7 unit (mode/channel/message), nocolor_proptest (~2k cases vs an independent model), golden_nocolor end-to-end, 9 regenerated 004/005 snapshots. cargo test -p leveva --lib 2110 pass; clippy clean; workspace builds 0 warnings.

1 month ago

golden_noctcp.rs

feat(leveva): +C no-CTCP channel mode — P11 slice 220 A leveva-native port of charybdis MODE_NOCTCP, extending the slice-214 speech-plane work. On a +C channel a CTCP query other than ACTION sent as a PRIVMSG is refused 404 ERR_CANNOTSENDTOCHAN :Channel doesn't accept CTCP and is not delivered. NOTICE/CTCP-reply never blocked; ops not exempt; distributed enforcement at the sender's home server (like +n/+m/+b). - mode.rs: ChanMode::NoCtcp ('C', bit 0x1000000, MODE_NOCTCP) — enum/ALL/ as_char/bit/mode_name/from_char; ISUPPORT + 004 auto-derive. - command/mode.rs: supported_flag (the second char→mode allowlist used by the MODE parser) gains 'C' — without it the command 472s though from_char knows C. - channel.rs: pure is_blocked_ctcp (public fuzz seam) + Channels::blocks_ctcp. - command/message.rs: gate in the channel CanSend::Ok arm (PRIVMSG only). Tests: mode/message/channel unit + the MODE-command path; golden_noctcp end-to-end; noctcp_proptest (total + model-lockstep); regenerated 6 golden snapshots + 3 inline string assertions for the added C.

1 month ago

golden_noctcp_umode.rs

feat(leveva): user mode +C no-CTCP (P11 slice 306) Port charybdis extensions/umode_noctcp.c to a leveva user mode +C: a self-settable umode that refuses CTCP queries (other than ACTION) sent to the user as a PRIVMSG, replying 531 ERR_CANNOTSENDTOUSER :+C set. NOTICE, CTCP replies, and ACTION always pass. The recipient-side private-message counterpart of the channel +C (slice 220), reusing the fuzzed channel::is_blocked_ctcp. Pure seams mode::is_noctcp + mode::noctcp_user_blocks (the composite gate decision), enforced home-server-local on both the local command/message.rs path and the inbound-S2S s2s/relay::inbound_message path (new noctcp_reject_remote routes 531 to the sender's uplink, the +R 248->249 split precedent). The bit still propagates (slice-254 "no local-only umodes"), so WHOIS shows +C. Bit 0x80000, numeric 531; umode_diff/RENDERED/004-literal/snapshot wiring per the user-mode checklist. Tests: mode seam units, command self-settable + inverse, message gate + inverses, s2s inbound + inverses, golden_noctcp_umode, noctcp_umode_proptest (5 props). 5 welcome snapshots regenerated (004 gains C).

1 month ago

golden_noforward.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_nonotice.rs

feat(leveva): +T no-NOTICE channel mode (charybdis MODE_NONOTICE) — P11 slice 239 Add the leveva-native channel flag +T: a NOTICE addressed to the channel is silently dropped, a PRIVMSG is unaffected (the inverse of +C). A port of charybdis's extensions/chm_nonotice.c, continuing the chm_simple speech-plane track (+C/+c/+S/+z). Wiring mirrors slice 220 (+C): ChanMode::NoNotice (letter T, bit 0x20000000) + supported_flag allowlist + Channels::blocks_notice + the pure notice_blocked decision, enforced in command::message's CanSend::Ok arm (silent drop, no 404). Ops not exempt; distributed enforcement at the sender's home server (no S2S follow-on, as for +C/+c). ISUPPORT CHANMODES/MYINFO auto-derive the new T; snapshots + hard-coded assertions updated. Tests: golden_nonotice (TDD red-first) + channel/message/mode unit tests + fuzz (nonotice_proptest over the notice_blocked predicate; modes_proptest FLAGS += NoNotice). Gate: cargo test -p leveva green, clippy clean, build 0 warnings.

1 month ago

golden_ojoin.rs

feat(leveva): InspIRCd-style OJOIN +Y official-join (P11 slice 165) Port InspIRCd's m_ojoin: a network-service "official join" via the oper-only OJOIN <channel> command plus a top-of-hierarchy channel membership mode +Y (sigil !, rank 128). An OJOIN'd oper is forced in past every restriction, granted +Yo, announced to the channel, and made un-kickable; +Y is set only by OJOIN/burst and self-removable only. - mode.rs: ChanMode::OfficialJoin (Y/!/rank 128/min_rank_to_set u8::MAX), leads MEMBERSHIP_BY_RANK -> PREFIX=(Yqaohv)!~&@%+ - channel.rs: KickVictim::OfficialBusiness (absolute kick immunity) + a +Y-scoped self-removal escape in apply_changes - s2s: MemberPrefix gains `official` (! wire) so +Y bursts/NJOINs round-trip - command/ojoin.rs (+ join::force_join_self, dispatch wiring); MODE parses Y; kick.rs renders the official-business 482 - fuzz: tests/ojoin_proptest.rs (model-lockstep); tests/golden_ojoin.rs - help/OJOIN.md + CHANNEL_MODES.md membership ranks; refreshed 9 burst snapshots

1 month ago

golden_okick.rs

feat(leveva): OKICK — operator force-kick bypassing chanop status (P11 slice 294) charybdis extensions/m_okick.c: an operator force-kicks a member without being a chanop (or even a member of the channel), sourced from the server so the channel sees a normal KICK. The oper-override sibling of KICK (chanop-gated) and REMOVE (chanop force-part), completing the operator channel-intervention family. - New atomic seam Channels::okick: no permission/rank check (the override); the one refusal is +Y official-join, whose immunity leveva keeps absolute. - command/okick.rs gate ladder 481/461/401/403/441/482; server-sourced KICK echoed to the oper + fanned to local members; relayed via new s2s::relay::server_kick; +s audit snomask. - Help page + COMMANDS allowlist + index.md operator line. - 4 channel units + 5 command units + okick_proptest (2 props) + golden_okick. leveva-native (no oracle); plain oper-bit gate; +Y respected (vs charybdis raw removal); oper always gets the echo even off-channel; local-only.

1 month ago

golden_olist.rs

feat(leveva): OLIST — operator LIST revealing +s/+p channels (P11 slice 293) charybdis extensions/m_olist.c: the operator variant of LIST that bypasses the secret (+s) / private (+p) channel-hiding so an oper enumerates every channel, including the hidden ones a normal LIST skips. The read-only sibling of LIST and the latest member of the charybdis operator diagnostic family (TESTLINE/TESTMASK/MASKTRACE/CHANTRACE/FINDFORWARDS/OPME). - Channels::list_all() (full folded sweep) + list_one_any(name) (named incl. hidden) — the visibility-bypass seams, no filter; also the fuzz seam. - command/olist.rs: plain oper-bit gate (non-oper 481 before any sweep), same 321/322/323 numerics as LIST; no-arg → all incl. +s/+p, named → that channel revealed-or-skipped, no ELIST conditions (faithful to mo_olist). - Wired "OLIST" + mod olist; help/OLIST.md + COMMANDS allowlist + index.md. Divergences (leveva-native, no oracle): plain oper-bit gate (not a per-command privilege), no +s audit snomask (read-only diagnostic family precedent), local-only. Tests: list_all/list_one_any units; 6 command units; olist_proptest (full-set + superset-of-list model equality, arbitrary_args_never_panic); golden_olist (LIST hides #secret, OLIST reveals it, non-oper 481). Regenerating golden_help_users also picks up the pre-existing stale operator-index line (OPME/FINDFORWARDS from slices 291/292). cargo test -p leveva green; clippy clean; build --workspace 0 warnings.

1 month ago

feat(leveva): OPER command (P11 slice 16) — 381/491/464, +o/+O, WHOIS 313 Authenticate `OPER <name> <password>` against the configured operator blocks (name IRC-fold + user@host mask glob + Password::verify), granting +o (or +O for a local operator) with a MODE echo + 381 RPL_YOUREOPER, mirrored into the shared registry so WHOIS reports 313 RPL_WHOISOPERATOR (after the 301 away slot). The 491-vs-464 split distinguishes "no O-line for your host" from a wrong password. - Password::verify: Plain → byte compare; Hashed → pwhash::unix::verify (new pure-Rust crypt dependency; libc's crypt isn't available and leveva links no libcrypt). ServerContext carries the operator blocks from config. - WHOIS gains 313 in send_whois order (311 [319] 312 [301] [313] 318). - Grounded in the oracle m_oper/find_Oline/send_whois (git b88264f3^, P5 port). - Tests: password verify (+2), command/oper.rs (+8 with inverses), whois (+2), golden_oper boot test, oper_proptest fuzzing (2 properties, 400 cases). - Documented divergences: no class oper limit, no LUSERS oper count, no S2S +o propagation; any matching block may authenticate (not strictly the first). Gate: cargo test -p leveva 417 + leveva-integration 10 green; clippy clean; cargo build --workspace 0 warnings.

1 month ago

golden_oper_tag.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_operonly.rs

test(leveva): fuzz + boot-golden the +O oper-only join gate (slice 77) oper_only_proptest.rs (800 cases): the gate fires iff +O set and the joiner is not an oper after a random toggle sequence, an INVITE never relaxes it, and +O is checked before +i. golden_operonly.rs drives the real binary (oper sets +O, a second oper joins, a plain client is denied 520 via a PING barrier, then -O lets it in). modes_proptest folds +O into the lockstep flag pool and keeps the inverse fuzz that the removed a/r letters never render.

1 month ago

golden_operpeace.rs

test(leveva): fuzz + golden for +M operpeace (P11 slice 309) operpeace_proptest (3 props: total + model-equal over the boolean cube; an oper kicker is never blocked; a non-+M channel never blocks) + golden_operpeace (boot: a non-oper chanop's KICK of an oper on +M -> 482; an oper kicker bypasses).

1 month ago

golden_operwall.rs

feat(leveva): +z operwall user mode + OPERWALL command (charybdis UMODE_OPERWALL) — P11 slice 252 The oper-only sibling of +w/WALLOPS: an operator broadcasts OPERWALL to every +z operator network-wide. Closes one of the named remaining charybdis umodes. A near-exact mirror of the slice-178 WALLOPS machinery (command/operwall.rs + s2s/operwall.rs). - +z (letter "z", bit 0x10000, FLAGS_OPERWALL): oper-gated to set like +s (non-oper +z silently ignored, -z always allowed); purely local, NOT in SEND_UMODES (the OPERWALL command propagates and each server fans to its own local +z — diverges from +w, which is in SEND_UMODES only for oracle faithfulness). - OPERWALL <text>: oper-only (481), 461 on empty, fans :mask OPERWALL :text to local +z, propagates :<uid> OPERWALL :text; inbound fans is_local_uid-gated + split-horizon relay. - mode.rs UserMode::Operwall (+ is_operwall predicate); umode_diff/RENDERED; 004 umode literal +z; help/OPERWALL.md + USER_MODES.md row. - The mode.rs round-trip test also moved off "z" as its unknown example to ">". Tests: command/operwall.rs + s2s/operwall.rs units (mirror wallops), +z oper-gate units, golden_operwall.rs (+z oper receives, -z oper and -z sender do not), operwall_proptest.rs (delivery decided by +z alone). 5 welcome-burst snapshots gain the z letter. cargo test -p leveva green; clippy clean; build --workspace 0 warnings.

1 month ago

feat(leveva): OPME — oper self-op of an opless channel (P11 slice 292)

1 month ago

golden_opmod.rs

feat(leveva): +z op-moderation channel mode — P11 slice 235 A port of charybdis chm_simple MODE_OPMODERATE. On a +z channel a message that would be blocked from reaching the channel — by +n (external), +m (moderated), or a +b ban/quiet (CanSend::External/Moderated/Banned) — is not refused 404; it is delivered to the channel's operators (rank >= +o) only, so ops can see what muted, banned, or external users are saying. Ok/NoSuchChannel verdicts are never redirected. Extends the speech-plane can_send work of slices 214/220/232. - mode.rs: ChanMode::OpModerate ('z', bit 0x10000000, Flag kind, MODE_OPMODERATE); CHANMODES + 004 chan-mode string auto-derive from ALL/kind(). - command/mode.rs: 'z' in the supported_flag allowlist (the recurring flag-mode gotcha — needs both the ChanMode and this second allowlist or MODE +z 472s). - channel.rs: pure opmod_redirects(set, verdict) + Channels::op_moderated / op_members (rank >= op). - command/message.rs: the block arm redirects to local ops when op_moderated — no 404, no echo, no relay (TAGMSG/REDACT + S2S op-redirect are documented follow-ons), else the existing 404/silent. Tests: mode/channel/command-mode units (5) incl. inverses; fuzz opmod_proptest (opmod_redirects vs an independent model over every (bool, CanSend); op_members exactly the rank>=op set over arbitrary membership); golden_opmod (real binary: +mz redirects bob's muted line to the op, not to carol/bob, no 404; -z restores the 404). Snapshot/assertion churn: isupport/registration/config literals gain z (+z is now an accepted default flag; unknown-letter test uses '>'); 6 golden 004/005 snapshots regenerated (token-only z). Gate: cargo test -p leveva green (pre-existing golden_restricted_op read_until flake aside); cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

golden_opmod_redact.rs

feat(leveva): +z op-moderation for TAGMSG/REDACT — P11 slice 236

1 month ago

golden_opmod_tagmsg.rs

feat(leveva): +z op-moderation for TAGMSG/REDACT — P11 slice 236

1 month ago

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_permanent.rs

feat(leveva): +P permanent channel (charybdis MODE_PERMANENT/chm_staff) — P11 slice 244 A channel carrying +P is not destroyed when its last member leaves: its topic, modes, and list masks persist with zero members, so the next joiner enters an existing channel and is NOT made creator-op. +P is oper-only — only a server operator (or a SAMODE override) may set or clear it (a non-oper gets 481, checked before the chanop gate, matching chm_staff). - mode.rs: ChanMode::Permanent (letter P, bit 0x80000, MODE_PERMANENT, Flag). - channel.rs: pure destroy_when_empty(flags) + permanent_set_allowed(...) decision seams (fuzzed); permanent(name) accessor; part/kick/remove_everywhere skip the empty-channel deletion for +P; join() decides creator-op from `created`, not members.is_empty() (the permanent-empty-channel fix). - command/mode.rs: supported_flag gains P; the Flag arm refuses a non-oper +P/-P with 481. - isupport/004: CHANMODES group D + MYINFO gain a trailing P. Divergences: a bare (non-chanop) oper still hits the 482 op-gate — use SAMODE (the 481-vs-482 precedence is honoured); bursting empty permanent channels on link is a documented follow-on. Tests: unit (mode letter/bit/name/kind; channel persistence across PART/KICK/QUIT + no-op-on-rejoin + flag tracking; command 481 oper-gate), golden_permanent.rs (persistence + topic preserved + creator-op inverse + non-oper 481), permanent_proptest.rs (destroy_when_empty + permanent_set_allowed totality/model), regenerated CHANMODES snapshots.

1 month ago

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_post_registration.rs

test(leveva): boot golden for post-registration PING/421 Register, drain the welcome burst, then PING + an unknown command end-to-end through the real binary; snapshot the canonicalized PONG + 421 (both volatile-free).

1 month ago

golden_pre_away.rs

feat(leveva): IRCv3 draft/pre-away / accept AWAY before registration (P11 slice 75) A client that negotiates draft/pre-away may send AWAY before registration completes; the staged away is applied at finalize so WHOIS/WHO/PRIVMSG see it from connect. AWAY * is stored verbatim. Without the cap, a pre-registration AWAY is refused (451). - cap.rs: DRAFT_PRE_AWAY const + SUPPORTED tail + ClientCaps.pre_away + mapping - registration.rs: stage away (apply_pre_away/pre_away), truncated via the shared command::away::truncate (AWAY_MAX); command::away made pub(crate) - session.rs: intercept AWAY pre-CAP-END (before the pending_complete guard); fold +a into seeded modes + mirror registry away at finalize - tests: cap/registration/session units, golden_pre_away, pre_away_proptest; regenerated the two golden_cap snapshots

1 month ago

golden_privmsg.rs

chore: run cargo format Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_privmsg_mask.rs

test(leveva): boot golden + proptest for PRIVMSG/NOTICE mask targets

1 month ago

golden_privmsg_targets.rs

test(leveva): boot-golden PRIVMSG recipient cap + dedup (slice 87) Drives the real binary: a PRIVMSG to u1,u1,u2..u6 yields a single 407 for the over-cap u6 and a single delivery to the duplicated u1, snapshotted.

1 month ago

golden_recvq.rs

test(leveva): grapheme-cap fuzz + update 512-pinning tests (P11 slice 121) - linelen_proptest.rs (new fuzzing): over arbitrary Unicode bodies, to_wire body == full body truncated to LINELEN graphemes (the unicode-segmentation model); the within-budget byte-identical round-trip; the never-split-a-grapheme prefix invariant. Never panics. - message_tags_proptest: body cap assertion now grapheme-based (was 512 bytes). - feed_framing_proptest: MAX_INBOUND_LINE mirror now + MAX_BODY_BYTES. - golden_recvq: unterminated blob bumped to 200 KB so it still exceeds the raised 139263-byte framer ceiling and 417s.

1 month ago

golden_redact.rs

feat(leveva): IRCv3 message-redaction / the REDACT command (P11 slice 68) Adds the draft/message-redaction capability and the REDACT <target> <msgid> [<reason>] command (IRCv3 message-redaction spec). leveva keeps no message history, so it is a stateless relay: it forwards :sender REDACT … only to recipients that negotiated the cap (spec MUST NOT to others), does no authorship/permission/msgid validation, and emits the spec's first standard- replies line (FAIL REDACT INVALID_TARGET …) on an unresolvable target. First new command and first FAIL on the IRCv3 track. Single-server-local; sender cap not enforced (recipient-only gate, the TAGMSG precedent). Gate: cap + redact units + golden_redact + redact_proptest; clippy clean; workspace 0 warnings.

1 month ago

golden_registration.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_regonly.rs

feat(leveva): +r registered-only-join channel mode (charybdis MODE_REGONLY) — P11 slice 241 Adds the leveva-native channel flag mode +r: on a +r channel only a client signed in to a services account may JOIN; a signed-out client is refused 477 (charybdis ERR_NEEDREGGEDNICK, which overloads numeric 477 — reuses Numeric::ErrNochanmodes since a duplicate-discriminant variant is impossible). The join-plane sibling of +g; a hard JOIN gate like +O/+S (an INVITE/key/ exception does NOT bypass it — account identity is a user property), so KNOCK to a +r channel is refused too. - mode.rs: ChanMode::RegisteredOnly, letter r, bit 0x80000000 (last free u32 bit), Flag kind; added to ALL/as_char/bit/mode_name/from_char. - command/mode.rs: supported_flag 'r' (the second allowlist). - channel.rs: pure regonly_blocks(set, has_account) seam + the hard-gate clause in check_join (reads attrs.account, same source as $a extban); new JoinReject::RegisteredOnly. - command/join.rs + command/knock.rs: reject mapping + KNOCK refusal. - ISUPPORT/MYINFO auto-derive (CHANMODES …SzTgr, MYINFO …SzTgr…); 10 snapshots + isupport/registration assertions updated (token-only). Reclaiming the slice-77 ripped-out reop letter r triggered the unknown-chanmode-letter hazard: removed the obsolete ripped_out_reop_is_unknown test, updated chan_mode_bits_match_oracle, switched golden_modes's unknown-mode probe to +>, and repurposed the modes_proptest AnonReop op to BareAdmin. Tests: golden_regonly.rs (RED-first), channel/mode/command::mode units (gate + inverse + hard-gate proof + truth table), regonly_proptest.rs, modes_proptest FLAGS += RegisteredOnly. cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

golden_regonly_msg.rs

feat(leveva): +R registered-only-messages user mode (charybdis UMODE_REGONLYMSG) — P11 slice 248 A +R user receives a private PRIVMSG/NOTICE only from a sender identified to a services account, bypassed by an identified/operator/accepted sender; a blocked PRIVMSG bounces 486 ERR_NONONREG, a NOTICE is silently dropped. Channel messages are unaffected. Client-settable, purely local (gate runs on the target's home server) so not in SEND_UMODES — the caller-id/deaf precedent. This is the local-sender plane; the remote-sender S2S plane is the slice-249 follow-on (mirroring the caller-id 216->217 split). UserMode::RegOnlyMsg (bit 0x4000), mode::is_regonly_msg predicate, callerid::regonly_msg_blocks decision core, the command::message gate, and numeric 486. Unit + golden + proptest coverage; 004 usermode list -> oOiwraWBxsgGZDR.

1 month ago

golden_rehash_auto_connect.rs

feat(leveva): REHASH hot-reloads options { auto-connect } (P13 slice 205) Phase 13 (refinement) opens — "make all config fields REHASH-able". The outgoing auto-connect master switch was read once at boot to decide whether to spawn the dial loop; it is now read per tick via the slice-91/204 ConfStore live seam, so an operator can start/stop the dialer with no restart. - control.rs: ConfBlocks.auto_connect + ConfStore.auto_connect (ArcSwapOption) + config_conf extract + live_auto_connect(). - main.rs: always spawn auto_connect_loop(ctx, boot_auto_connect); each tick skip the dial pass when !live_auto_connect().unwrap_or(boot). No AbortHandle task-management (an idle ticker is cheap/idempotent), no ServerContext field (slice-204 precedent — main seeds LIVE_CONF before spawning the loop). Tests: control units (extract/seed/reseed/empty-clear) + rehash_conf_proptest lockstep (auto-connect by name parity) + golden_rehash_auto_connect (boot off → peer never dialed; REHASH on → peer dialed, reads active PASS/SERVER greeting).

1 month ago

golden_rehash_ban.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_blocks.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_channel_modes.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_conf.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_conn_accept.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_flood.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_iauth.rs

feat(leveva): REHASH hot-reloads the iauth block (P13 slice 207) The iauth block (ident flag, per-probe timeout, dnsbl/socks/webproxy/pipe/ident module set) was read once at boot and never re-read — the last boot-immutable config block. It now hot-reloads via the ConfStore live seam like every options field (91/175/204/205/206), completing phase 13's make-all-config-REHASH-able mission: no config block remains boot-immutable. ConfBlocks carries the plain Iauth struct (Debug/Eq); the built module set (Arc<dyn Module>, not Debug/Eq) is cached in a separate ConfStore ArcSwapOption, rebuilt only at seed/REHASH (build_auth_modules made pub(crate); server name from a new boot IRCD_NAME OnceLock mirroring CONFIG_PATH) so live connections keep one shared resolver/DNS cache and a REHASH swaps the set atomically. Read sites: the serve-loop auth task (modules+timeout), resolve_username (the ~ rule's ident flag), and STATS a (239 module list) — all live-or-boot-ctx.auth. Tests: control units extended (seed/reseed/empty-clear track iauth + module names); rehash_conf_proptest lockstep gains iauth; NEW iauth_module_order_proptest (arbitrary sub-block subset -> canonical module order, present iff configured); NEW golden_rehash_iauth (boot ident -> STATS a; REHASH to dnsbl -> rebuilt set; recovery). 1941 lib pass; clippy clean; workspace 0 warnings.

1 month ago

golden_rehash_iline.rs

test(leveva): boot-golden REHASH allow-block reload (slice 83) End-to-end through the real binary: boot open (*@*) → loopback client admitted; rewrite to restrictive (*@10.0.0.*, no *@*) + REHASH → a fresh loopback client refused 465; inverse — rewrite back to open + REHASH → admitted again (removal takes effect live, not just additions). These configs carry no MOTD file, so the welcome burst ends with 422, never 376; uses 001 RPL_WELCOME as the "admitted" sentinel (arrives promptly — the slice-81 golden eats a 5s read-timeout per register waiting for a 376 that never comes).

1 month ago

golden_rehash_listeners.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_motd.rs

feat(leveva): REHASH live-reloads the MOTD (P11 slice 65) The first rehash/restart parity-matrix slice. DIE/RESTART/REHASH already existed, but REHASH only *validated* the on-disk config and applied nothing to the live, immutable-per-boot server. Close the canonical gap, faithful to the IRCnet 2.11 rehash() -> read_motd(MPATH): an operator edits the MOTD file, REHASHes, and the next MOTD / welcome burst serves the new text without a restart. A removed file falls back to 422. Mechanism mirrors how control.rs already routes the process-singleton DIE/RESTART/REHASH plane through a module global (keeping the ~44 ServerContext literals untouched): a new MotdStore (ArcSwapOption + AtomicBool, unit-tested on a fresh instance) lives in control.rs as LIVE_MOTD; main records the resolved --motd path and seeds it at boot; the MOTD command + registration burst read the live store when seeded and fall back to ctx.motd otherwise (so every unit test stays green - the global is uninitialized under cargo test); rehash.rs calls control::reload_motd() after the existing config validation. Divergences: MOTD-only hot-apply (opers/allows/classes still boot-immutable, each a future slice); no SCH_NOTICE; a bare \r survives a line (faithful to str::lines, which only strips \r\n). Tests (TDD, inverse invariants): control units incl. seed(None) clears the stale MOTD; golden_rehash_motd drives v1 -> rewrite -> REHASH -> v2 -> truncate -> REHASH -> 422 through the real binary (additive harness boot_minimal_with_motd); motd_reload_proptest (400 cases) fuzzes load_motd_lines (total / no embedded \n / fixed point) and models the MOTD reply shape through real dispatch. Plan: docs/superpowers/plans/2026-06-10-p11-slice65-rehash-motd.md

1 month ago

golden_rehash_sts.rs

feat(leveva): REHASH-able IRCv3 sts policy — P11 slice 212 Close slice 211's deferred follow-on: the IRCv3 sts policy now rides the live config seam end-to-end. The sts-duration/sts-preload scalars move onto ConfStore (the slice-204/210 idiom: live_sts_duration/live_sts_preload), and the TLS port — which comes from the listener set, not an options knob — is re-derived live from listeners::specs() (slice 137 already rebinds listeners on REHASH). A new session::live_sts_policy(ctx) assembles all three live inputs, each falling back to the boot ctx for unit tests. An operator can now enable, retune, or disable STS — including binding a fresh TLS client listener — with no restart. Only wss-as-secure remains deferred. Tests: control units extended (unseeded None / extract default / swap / clear inverse); rehash_conf_proptest lockstep extended; new golden_rehash_sts.rs drives the full live path through the real binary (off -> add TLS listener + sts-duration + REHASH -> sts=port= appears -> remove + REHASH -> dark).

1 month ago

golden_rehash_throttle.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_rehash_webirc.rs

feat(leveva): REHASH hot-reloads webirc {} gateways (P11 slice 305) Close the slice-301 follow-on: a webirc {} trusted-gateway block was parsed once at boot into ctx.stats_conf.webirc and never re-read, so adding, editing, or removing a trusted webchat gateway required a restart. Carry the gateway list through the control::ConfStore live-config chain (mirroring how slice 303 made alias {} reloadable) and read it live-or-ctx at session::handle_webirc, so REHASH hot-applies an edited webirc set with no restart. - control.rs: ConfBlocks.webirc + config_conf extraction; ConfStore.webirc ArcSwapOption + new()/seed() + webirc() accessor + live_webirc() global. - main.rs: seed the live store with config.webirc at boot. - session.rs::handle_webirc: read gateways live-or-ctx (live store wins; a session that never ran main falls back to the immutable boot list). Tests (TDD; inverse invariants): control units (fresh none / no-block empty / seeded reads back / empty-seed clears the stale gateway); golden_rehash_webirc (no-block refuse -> add+REHASH spoof -> remove+REHASH refuse again); the rehash_conf_proptest reload model extended with a generated webirc set (live (label,host) == last successful reload; None while unseeded).

1 month ago

golden_remove.rs

feat(leveva): REMOVE — chanop force-part (P11 slice 290) charybdis-style REMOVE (extensions/m_remove.c): a channel operator forcibly removes a member who appears to PART rather than be KICKed, so client-side auto-rejoin-on-kick scripts don't fire. Reuses KICK's kick_gate/kick gate verbatim (inheriting 403/442/482/401/441, rank protection, +Y immunity, cross-product, 461) but emits a PART prefixed with the victim's own mask; propagated S2S as the victim's PART and recorded to chat-history. leveva-native (no oracle). Help + COMMANDS allowlist + golden + proptest.

1 month ago

golden_restricted.rs

feat(leveva): enforce +r (restricted) — no IRC-oper, no chanop (P11 slice 193) The `restricted` allow-block flag (C I-line CFLAG_RESTRICTED) set the +r user mode at registration but was never enforced; 484 ERR_RESTRICTED was defined but never sent. leveva's +r is FLAGS_RESTRICT (IRCnet IsRestricted), so a restricted user can become neither an IRC operator nor a channel operator. - mode::is_restricted(modes) pure-core predicate (the fuzz/enforcement seam); corrected the stale UserMode::Restricted doc ("change nick" is a different ircd's +r, not ported). - OPER → 484 before any credential check (command/oper.rs). - channel creation: a restricted creator is deopped in the store + the local snapshot before any wire output, so no @ flickers (command/join.rs + channel::Channels::deop); auto-reop suppressed for restricted joiners. Named follow-on: MODE +o targeting a restricted user (a third party's action) is not yet blocked. Tests: mode/channel/oper/join units (each with inverse); restricted_proptest.rs (Session-layer OPER-always-484 / creator-never-@ with non-restricted controls + bytes-fuzz, PROPTEST_CASES=3000); golden_restricted.rs boot end-to-end.

1 month ago

golden_restricted_nick.rs

feat(leveva): a restricted (+r) user cannot change nick — NICK→484 (P11 slice 196) Completes the IRCnet IsRestricted family (RFC 2812 §3.1.7: a restricted client cannot change nickname, nor become a channel/IRC operator). The post-registration NICK handler now refuses a +r connection with 484 ERR_RESTRICTED, placed after the 431 guard but before the 432/433 checks so the restriction dominates a malformed or taken target (mirroring OPER's pre-credential 484); case-only changes are refused too. Local-only; inbound S2S NICK and oper SANICK are untouched. Tests: 4 nick.rs units (incl. 433/432 precedence + 431 inverse), a fuzzed restricted_proptest case (NICK never renames; control does) + NICK added to the panic-freedom fuzz, and golden_restricted_nick.rs at the wire.

1 month ago

golden_restricted_op.rs

test(leveva): harden golden_restricted_op against the flood-kill flake The test set `max-penalty 600` (lifting the slice-208 fakelag *delay* half) but left `flood-kill-ahead` at its default 60. Per `flood.rs`, `max-penalty > flood-kill-ahead` runs the connection in kill-only mode with no smoothing brake, so under CPU starvation a burst of the test's three heavy `NAMES` scans could cross the 60s-ahead kill line and `exit_client` `op` mid-test — closing its socket, so the client's `read_until` hit EOF and the `353` lookup panicked (a sub-30s FAILED with no daemon panic, matching the observed intermittent failure). This is a restricted-op correctness test, not a flood test, so add `flood-kill-ahead 600` to lift the kill ceiling too: with both knobs above any reachable penalty the flood clock is removed as a variable entirely. The prior session's temporary DIAG stderr capture in tests/harness/mod.rs already ruled out a daemon-side panic and is dropped (revert was a no-op against HEAD). Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_restricted_reop.rs

feat(leveva): restricted user never auto-reopped — enforce_reop chokepoint (P11 slice 195) Generalize slice 193's join-only auto-reop suppression so a restricted (+r / FLAGS_RESTRICT) user can never gain channel-operator status via ANY auto-reop trigger. The shared enforce_reop helper is reached from five paths — JOIN, a local +R-set, an inbound S2S +R burst, a CHGHOST host change, and a CHANTS/NJOIN merge — but only the JOIN site checked +r. Filter restricted candidates inside enforce_reop itself (reading the registry mirror's modes), closing all five at once, and drop the now-redundant !restricted gate at the join site. Tests (TDD; fuzzing mandated): three command/mode.rs units on the +R-set path (restricted skipped, non-restricted opped, mixed per-candidate); the slice-193 join test reseeded to mirror production's registry +r; a 3000-case proptest (a_restricted_member_is_never_auto_reopped + non-restricted control); and a golden_restricted_reop.rs boot test. Full lib suite + chghost/s2s-reop goldens green; clippy clean; workspace builds 0 warnings.

1 month ago

golden_resv_config.rs

feat(leveva): enforce nick RESV at registration finalize — 432 + reopen — P11 slice 273 Closes the first documented follow-on of slice 272 (RESV/UNRESV): slice 272 gated the post-registration NICK command and JOIN, but a brand-new connection could still register directly as a reserved nick (the common grab vector). The finalize path now checks ctx.resvs.nick_reserved before try_claim and, on a hit, emits 432 ERR_ERRONEOUSNICKNAME + reopen_nick — the same shape as the adjacent 433 nick-in-use path, so the retained USER line lets a fresh unreserved NICK complete. A registering connection is never an operator, so no exemption applies. Divergence (leveva-native): charybdis force-changes to a Guest<n> nick; leveva refuses + reopens. Tests (RED first): boot golden registration_with_reserved_nick_is_refused_then_recovers (register as NickServ -> 432, no 001; then NICK realuser -> 001) + fuzz registration_nick_gate_ignores_channel_reservations (gate is total and never swayed by channel reservations).

1 month ago

golden_roleplay.rs

test(leveva): fuzz + golden for roleplay (P11 slice 308 part 3) roleplay_proptest: compose is total/never-panics over spicy nick+text input, the display nick keeps no control char but the deliberate \x1F underline pair, ACTION bodies are \x01ACTION…\x01, the (author) attribution is always present, and underline only wraps the same inner nick. golden_roleplay: NPC underlined fake nick + SCENE =Scene= delivered to a co-member, inverse -N channel → 573.

1 month ago

feat(leveva): server-to-server link protocol (P11 slice 31) Add the UID-based IRCnet 2.11 S2S burst on server-only listeners: leveva goes from single-server to linking a peer, exchanging state, and tearing down on split. New leveva/src/s2s/ modtree (network/handshake/unick/njoin/mode/save/eob/ squit + PeerLink + MemberPrefix codec), a Network mirror in ServerContext (BTreeMap<Uid,RemoteUser>; netsplit = SID-prefix range drain), and a serve_server loop in main.rs replacing the old drop. - Handshake: PASS/SERVER authenticated against connect{} blocks. - Inbound burst: UNICK/NJOIN/MODE/SAVE/EOB/EOBACK. - Outbound burst: our servers/users/channels then EOB to a new peer. - Teardown: SQUIT + abrupt-drop via one squit_subtree (relays QUITs to local co-members, frees nicks); oper-facing SQUIT command gated on SquitLocal. Faithful to the oracle wire format; clean-modern implementation. Built by an ultracode multi-agent workflow, then 3 adversarial-review bugs fixed with regression tests: NJOIN-only ghost member surviving SQUIT (new Channels::members_behind_sids sweep), UNICK-collision stale mirror nick, and the NJOIN '.' empty-channel placeholder wire/parse mismatch. Verified: unit (s2s 55 + command::squit) + golden_s2s boot golden + 7-property s2s_proptest. cargo test -p leveva 702 passed/0 failed; clippy + fmt clean; cargo build --workspace 0 warnings. No pure-oracle entry point, so no leveva-integration differential (consistent with recent slices).

1 month ago

golden_s2s_account.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_s2s_away.rs

test(leveva): AWAY S2S golden + inbound-lockstep fuzzing (P11 slice 122) golden_s2s_away drives both directions through the real binary (inbound rover away/back → alice sees the client-form AWAY; outbound alice away/back → the peer gets the UID-form AWAY and alice gets her own MODE ±a echo). away_s2s_proptest fuzzes the inbound plane (set/clear lockstep vs an Option<String> model over both the registry record and the RemoteUser mirror; unknown source fabricates nothing; arbitrary AWAY lines never panic). The away_proptest model now predicts the appended MODE echo on each +a/-a flip.

1 month ago

golden_s2s_bot_oper.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_s2s_caps.rs

test(leveva): golden_s2s_caps — a tag-blind peer never receives an @-prefix (P11 slice 126) Boot golden through the real binary: a no-CAPAB (tag-blind) peer receives a local message-tags client's tagged PRIVMSG with its @+react stripped, and its TAGMSG not at all; leveva's own burst opens with the ENCAP CAPAB announcement. The safety inverse of the egress tag-filter, end-to-end.

1 month ago

golden_s2s_channel_ts.rs

fix(leveva): carry channel-TS on the live NJOIN (P11 slice 167) A live join propagated as `:<sid> NJOIN <chan> :<members>` with no creation timestamp, and a newly-learned channel was stamped with the local clock. Two servers therefore disagreed on a channel's `created_at` by propagation latency, and the burst CHANTS arbitration then deopped whichever server learned of the channel later. Across repeated split/recreate/relink flaps that stripped ops from every side — observed in prod as `#leveva` at `+nt`/zero-ops with `Mode #leveva [-o Xe] by nophica.vibecoding.svc`. Carry the TS inline (`:<sid> NJOIN <chan> <ts> :<members>`) so peers agree from birth, and arbitrate a genuine split-recreate conflict as members are added (oldest wins, the younger side's chanops drop) instead of waiting for the next burst. Reuses the existing reconcile + a factored-out `broadcast_demotions` fan-out. The burst NJOIN stays TS-less (CHANTS still owns burst arbitration + flag-state reset). Tests: njoin units (older/newer/equal TS, create-stamps-wire-TS, burst-defers) + an inline convergence proptest + a boot-level golden reproducing the prod `-o` and proving an equal TS no longer deops.

1 month ago

golden_s2s_chathistory.rs

feat(leveva): record remote-originated channel messages into chat-history — P11 slice 276 The S2S relay's inbound channel fan (s2s::relay::inbound_message) delivered a remote user's PRIVMSG/NOTICE to local members but never recorded it, so on a multi-server network CHATHISTORY held only locally-sent lines (slice 274 recorded only the local delivery plane). Record the inbound line on this server too, keyed by the carried network msgid (slice 130) + @time (slice 134), gated on this server having a local member of the channel (only a local member can CHATHISTORY it; a hub relaying for a channel it has no local stake in stores nothing). The +z op-redirect and non-channel branches never record, mirroring the local plane; an inbound REDACT (slice 275) now deletes the identical row everywhere. Tests: s2s::relay units (recorded-under-carried-msgid, NOTICE, + three inverses) + proptest (total/ordered recording); golden_s2s_chathistory.rs (+ s2s_history.kdl) end-to-end through the real binary.

1 month ago

golden_s2s_forward.rs

test(leveva): fuzz + golden for the S2S relay/notice verbs (P11 slice 35) s2s_forward_proptest (3 properties): ENCAP/SDIE fan to exactly the other N-1 of N linked peers once each with the origin excluded (split-horizon) + the mirror server-count unchanged; ERROR relays to zero peers; arbitrary ':<sid> {ENCAP|SDIE|ERROR} <args>' and raw bytes through dispatch never panic and never fabricate a server node. golden_s2s_forward boot golden: a peer fires ENCAP/SDIE/ERROR, then rover speaks on the shared #hub -- alice still receives the message, proving the link survived and SDIE did NOT kill the server (the placeholder-not-kill regression guard).

1 month ago

golden_s2s_invite.rs

test(leveva): INVITE S2S golden + inbound-lockstep fuzzing (P11 slice 123) golden_s2s_invite drives the real binary both directions: a remote op invites a local op (who gets the invite-notify line — the divergence this slice closes) and the local target gets the direct relay; a local op invites a remote target and the peer receives the UID-form INVITE. invite_s2s_proptest pins the inbound plane (no oracle differential — invite-notify is leveva-native): a token is recorded iff the remote inviter is a channel op (+ the inverse — a non-op records nothing so +i still bites — + idempotence); an unknown inviter fabricates nothing; arbitrary bytes through s2s::dispatch never panic.

1 month ago

golden_s2s_keepalive.rs

test(leveva): boot-golden S2S keepalive + silent-link reap (slice 85) Three goldens on a 2s-ping-freq fixture: leveva PINGs an idle peer; leveva answers a peer's PING with PONG echoing the token; and the headline leak fix — a peer that introduces a user then goes SILENT (socket held open, no FIN) is PING-timed-out and its user reaped, asserted while the socket is still open (so the reap is driven by the timeout, not a TCP close).

1 month ago

golden_s2s_links_map.rs

test(leveva): boot-golden LINKS/MAP over a real multi-server network (slice 88) Real binary: a Peer links and bursts :1ZZZ SERVER leaf.test 2 2LEF so the network is us->peer->leaf; a client runs LINKS / MAP / MAP s. The snapshot pins the leaf's 364 upstream = peer.test (its true tree parent, not us) and its 015 nesting one level under the peer (' `- leaf.test'), with '*' remote versions.

1 month ago

golden_s2s_mass_burst_drop.rs

chore(clippy): drop redundant closure in golden_s2s_mass_burst_drop Pre-existing redundant_closure nit (surfaced by a clippy version bump), unrelated to the slice; fixed first to keep the gate clean.

1 month ago

golden_s2s_monitor.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_s2s_msgid.rs

test(leveva): golden_s2s_msgid — msgid propagates both directions (P11 slice 130) End-to-end through the real binary: a CAPAB-advertising scripted peer receives a local client's PRIVMSG carrying a server msgid (outbound), and an inbound PRIVMSG the peer sends with its own @msgid=1ZZZ-7 reaches a local message-tags consumer with that EXACT id (a direct assert, since canonicalize() masks every msgid value to <MSGID> — the snapshot pins the shape, the assert pins the value).

1 month ago

golden_s2s_netjoin_batch.rs

test(leveva): golden netjoin batch end-to-end + netsplit drain fix (slice 160) golden_s2s_netjoin_batch: a batch client and a plain client in #hub; a peer links and bursts an op'd user in -> the cap client sees the netjoin batch (open/JOIN/MODE/close agreeing on the ref), the plain client sees a bare JOIN (the inverse). golden_s2s_netsplit_batch: its batch-cap dan now receives the burst JOIN inside a netjoin batch, so drain that batch's BATCH - before the split.

1 month ago

golden_s2s_netsplit.rs

test(leveva): boot-golden for S2S netsplit inverses (P11 slice 46) New golden_s2s_netsplit.rs proves the user-visible netsplit inverses end-to-end through the real binary, which golden_s2s does not: - split_relays_quit_to_a_local_co_member: a remote user sharing alice's #hub — on peer drop she sees ":rover!ro@rover.host QUIT" at the wire, then 401. - explicit_squit_of_a_leaf_spares_the_peer: an explicit SQUIT of a 2-hop leaf removes its user (QUIT + 401) while the peer's own user survives (311). - reburst_after_split_is_clean: after a split, a fresh peer re-bursts the same nick into #hub; WHOIS resolves again and NAMES lists it exactly once. The NJOIN burst uses UID members (the wire form), so the remote users are real co-members of alice and the QUIT fan-out actually fires.

1 month ago

golden_s2s_netsplit_batch.rs

test(leveva): golden netjoin batch end-to-end + netsplit drain fix (slice 160) golden_s2s_netjoin_batch: a batch client and a plain client in #hub; a peer links and bursts an op'd user in -> the cap client sees the netjoin batch (open/JOIN/MODE/close agreeing on the ref), the plain client sees a bare JOIN (the inverse). golden_s2s_netsplit_batch: its batch-cap dan now receives the burst JOIN inside a netjoin batch, so drain that batch's BATCH - before the split.

1 month ago

golden_s2s_njoin_live.rs

fix(leveva): burst NJOIN carries the channel TS — P11 slice 215 A channel a server learned **for the first time in a burst** was re-clocked to the receiver's local nanosecond clock instead of adopting the origin's `created_at`: the leading `CHANTS` is dropped on an unknown channel (`apply_encap_chants` → `ChanTsOutcome::Unknown`), and the burst `NJOIN` was TS-less, so `handle_njoin` stamped `clock::unixnano()`. Two servers then disagreed on a channel's TS by *when each learned it*, and the next merge deopped the later learner — the divergence slice 167 fixed for the live NJOIN, left unfixed on the burst path. Observed in prod: updating a server to v0.1.0 and relinking stripped `#xe`'s ops + `+R` that should have survived the merge. Fix: the burst `NJOIN` now carries the channel TS as a middle param (`:<sid> NJOIN <chan> <ts> :<members>`, the live form since slice 167) so a peer adopts the origin's TS. Safe w.r.t. the merge case despite the slice-167 caveat: the burst is CHANTS-first (slice 171), so `we_lost` reads the pre-merge `created_at` before NJOIN runs, and `njoin_member` only stamps on creation — so for an existing channel the NJOIN-TS is a no-op (CHANTS owns arbitration), and it only supplies the TS for a newly-learned channel. `njoin_member_chunks` subtracts `1 + ts_digits` from the line budget; the boot canonicalizer masks the new `NJOIN <chan> <ts> :` TS like CHANTS/USERTS. Tests: burst_channel_ts_is_adopted_not_reclocked (the regression), burst_njoin_line_carries_the_ts_middle_param, …_does_not_clobber_an_existing _channels_arbitrated_ts (inverse merge), and a fuzz round-trip over arbitrary origin TS. Updated the two burst snapshots + golden_s2s_njoin_live. Gate: cargo test -p leveva green (pre-existing golden_s2s_keepalive BrokenPipe flake aside); clippy clean; workspace build 0 warnings.

1 month ago

golden_s2s_permanent.rs

feat(leveva): burst empty +P permanent channel over S2S — stale-S2S-flag-allowlist fix — P11 slice 269 Closes slice 244's documented "Bursting empty permanent channels on link" follow-on. A +P channel survives memberless so its topic/modes persist, but a freshly-linked peer's NJOIN carries only the empty-channel placeholder (.), so the receiver dropped the whole channel block (CHANTS on an unknown channel was a no-op, the . NJOIN added nobody, and the following MODE/TOPIC landed on a nonexistent channel). Receiver-only fix: s2s::chants::apply_encap_chants now materializes the empty channel from the burst CHANTS line via the new Channels::create_permanent_from_burst, gated on +P (pure channel::burst_creates_permanent, the inverse of destroy_when_empty) so a leaky non-permanent empty channel is never created and a known channel is never clobbered. Also fixes a root-cause sub-bug surfaced while scoping: the S2S burst/MODE parser s2s::mode::supported_flag carried a stale nmtipsO-only flag-letter allowlist that silently dropped every leveva-native channel flag (+C +c +S +z +T +g +r +Q +F +P +L) off a server burst/MODE, so they never replicated across a link. Both the client and S2S parsers now delegate to one canonical ChanMode::flag_from_char so they can never drift again. Tests (TDD + fuzz): golden_s2s_permanent (MODE->324 +Pkl, TOPIC->332, inverse non-+P->403); unit tests in channel/chants/mode; permanent_proptest extended (burst_creates_permanent totality+inverse, create_permanent_from_burst gated/never-clobbers).

1 month ago

golden_s2s_redact.rs

test(leveva): golden_s2s_redact — ENCAP-wrapped egress (P11 slice 127) Inbound peer now sends :1ZZZAAAAA ENCAP * REDACT #hub ...; outbound the peer reads the :0ABCAAAAA ENCAP * REDACT #hub ... egress. alice (a local cap client) still sees the bare client-form :rover!ro@rover.host REDACT #hub ... Snapshot regenerated.

1 month ago

golden_s2s_reject.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_s2s_relay.rs

test(leveva): fuzz + golden for S2S command relay (P11 slice 33) relay_proptest (3 properties): outbound one-frame-per-peer conservation; inbound split-horizon (origin never echoed); inbound forward-to-other-peers exactly once. golden_s2s_relay: bidirectional relay through the real binary (alice local + rover remote share #hub; alice's PRIVMSG/TOPIC reach the peer UID-prefixed, rover's PRIVMSG/PART reach alice in client form). The hand-rolled ServerContext literals in the existing *_proptest.rs fixtures gain the new peers: PeerLinks::new() field.

1 month ago

golden_s2s_remote_server_dies.rs

test(leveva): S2S teardown is leak-free at 10k users behind a dying server (slice 85) s2s_squit_scale.rs drives the real UNICK/SERVER/SQUIT dispatch with 10,000 remote users — on the peer and on a leaf behind it — then tears the link / server down and asserts ctx.net, the registry, AND channels all return to baseline (a booted-binary golden can only probe one store via WHOIS; this inspects every store directly). Plus boot goldens: a 300-user mid-burst drop (harness send_batch for a fast batched burst), and a leaf-server SQUIT / link drop reaping users behind the link.

1 month ago

golden_s2s_reop.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_s2s_server.rs

feat(leveva)!: emit UID targets for user messages on S2S (TS6-consistent wire) (P11 slice 297) leveva used UID sources + UID targets for member ops, but emitted the typed NICK in the target slot of user-directed messages (PRIVMSG/NOTICE/TAGMSG). Flip the two outbound emit call sites (command/message.rs route_message_to_remote, command/tagmsg.rs route_tagmsg_to_remote) to pass the recipient's UID, making the wire fully UID-consistent like TS6. Deliberate protocol divergence (every peer must parse the new form). Receive side already UID-ready (slice 296 resolve_user_target + nick_of final-hop render + verbatim onward relay). Channel/opmod/$$/$# mask targets, the sender's local echo, and the final-hop client rendering are unchanged -- clients still see nicks. Tests/snapshots flipped to UID targets; docs/s2s.md updated. Live-verified: leveva emits ':0LVAAAAAA PRIVMSG 0ATHAAAAG :HELP' to atheme; the client still sees 'NOTICE probe'. Built via an ultracode discover->implement->verify workflow.

1 month ago

golden_s2s_server_time.rs

test(leveva): server-time S2S golden + proptest (P11 slice 134) - golden_s2s_server_time: both directions end-to-end through the binary — a tag peer receives @time ahead of msgid outbound; a local server-time client receives the peer's exact carried @time inbound (direct pre-canonicalization assert, since canonicalize masks time= -> time=<TS>). - server_time_s2s_proptest (3 properties): inbound propagated-iff-valid-else- synthesized gated by the server-time cap (+ no-cap-never-sees-a-@time inverse); outbound gated by the peer cap (never leaks an @ to a tag-blind peer); arbitrary inbound tags never wedge and never give a member without server-time a @time.

1 month ago

golden_s2s_smask.rs

feat(leveva)!: emit UID targets for user messages on S2S (TS6-consistent wire) (P11 slice 297) leveva used UID sources + UID targets for member ops, but emitted the typed NICK in the target slot of user-directed messages (PRIVMSG/NOTICE/TAGMSG). Flip the two outbound emit call sites (command/message.rs route_message_to_remote, command/tagmsg.rs route_tagmsg_to_remote) to pass the recipient's UID, making the wire fully UID-consistent like TS6. Deliberate protocol divergence (every peer must parse the new form). Receive side already UID-ready (slice 296 resolve_user_target + nick_of final-hop render + verbatim onward relay). Channel/opmod/$$/$# mask targets, the sender's local echo, and the final-hop client rendering are unchanged -- clients still see nicks. Tests/snapshots flipped to UID targets; docs/s2s.md updated. Live-verified: leveva emits ':0LVAAAAAA PRIVMSG 0ATHAAAAG :HELP' to atheme; the client still sees 'NOTICE probe'. Built via an ultracode discover->implement->verify workflow.

1 month ago

golden_s2s_squit_propagation.rs

test(leveva): golden SQUIT propagation end-to-end (slice 161) New two-connect-block fixture s2s_two_peers.kdl + real-binary golden: peer A drops abruptly -> sibling B reads :0ABC SQUIT 1ZZZ :Connection reset by peer; an explicit leaf SQUIT propagates too; split-horizon inverse (B never told to split itself).

1 month ago

golden_s2s_umode.rs

feat(leveva): +l locops + LOCOPS command, and make all user modes global — P11 slice 254 Part A — +l locops user mode + LOCOPS command (charybdis UMODE_LOCOPS), the local-server sibling of +z/OPERWALL: an oper broadcasts to +l users on the originating server only; the command never crosses a link. Oper-gated to set, letter 'l' (bit 0x40000). New command/locops.rs + golden_locops.rs + locops_proptest.rs. The last named standard charybdis umode — surface complete. Part B — leveva has NO local-only user modes (product decision). SEND_UMODES is now every UserMode::ALL bit (self-maintaining const loop), so +O/+x/+s/+g/+G/+D/ +R/+Q/+z/+l all propagate and a remote WHOIS shows them. Verified safe: the burst already rendered the full unmasked set, and a user's host is always carried explicitly (UNICK field / ENCAP CHGHOST), never recomputed from the +x bit, so +x cannot double-apply the cloak (+x now emits both UMODE +x and ENCAP CHGHOST). Enforcement unchanged: caller-id (+g/+G) and +R stay gated on the target's home server — the ACCEPT list lives only there and is not propagated, so those S2S gates are the actual enforcement, not redundant re-checks, and are kept. - mode.rs: UserMode::LocOps + is_locops(); doc sweep (bit propagates, enforcement is server-local) - command/mode.rs: 'l' in the oper-gated arm + umode_diff; +x test asserts both frames - s2s/umode.rs: SEND_UMODES = every umode; exclusion test -> carries-every-mode - snotice.rs / s2s/relay.rs: stale 'not in SEND_UMODES' comments corrected - help/LOCOPS.md + USER_MODES +l row; 004 umode list -> ...zSl (6 snapshots) - golden_s2s_umode rewritten (demonstrates +D now propagating)

1 month ago

golden_s2s_userts.rs

test(leveva): user-ts boot golden + USERTS canonicalizer/skeleton fallout (P11 slice 133) golden_s2s_userts boots the real binary and proves the cross-task eviction an unit test can't reach: an older remote 'alice' forces the younger local 'alice' to its UID (the ForceNick serve-loop path) and WHOIS then resolves to the remote winner. The canonicalizer masks the USERTS nanosecond ts; s2s_skeleton_differential excludes the USERTS line (native divergence, like CAPAB/CHANTS). kill/control proptests gain an exhaustive ForceNick arm. golden_s2s_caps / golden_autoconnect CAPAB snapshots gain the user-ts token.

1 month ago

golden_s2s_who.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_s2s_whois_service.rs

feat(leveva): WHOIS service display — 313 "is a Network Service" + channel hiding — P11 slice 255 Closes the last open follow-on of the +S network-service track (slice 253), named verbatim in slice 253's "Out of scope": WHOIS servicestring (313 "is a Network Service") + channel-list hiding for services (charybdis m_whois.c). With this, the +S service track is complete. A pure display change in command/whois.rs — no new mode / SEND_UMODES / 004 / burst change, so no welcome-burst snapshot churn: - New pure seam whois_oper_line(modes) -> Option<&'static str>: a network service (+S) reads "is a Network Service" and takes precedence over operator status (charybdis single_whois: if(IsService) … else if(SeesOper) …), so a +oS user reads as a service; an operator (+o/+O) reads "is an IRC Operator"; anyone else -> None. The 313 block calls this instead of the inline check. - The 319 RPL_WHOISCHANNELS block gains a leading !is_service(rec.modes) guard: a service's channel memberships are hidden in WHOIS, for any requester. - command/mod.rs: mod whois -> pub mod whois so whois_oper_line is reachable from the integration fuzz target; handler fns stay pub(crate). - help/WHOIS.md notes the service 313 string + channel hiding. Divergences (documented): "is a Network Service" is hardcoded (no servicestring config knob); channel hiding is unconditional (no operspy/self carve-out); the 313 service line fires for every requester (matching the existing oper-313). Tests (RED first): whois.rs unit cases for the service 313 string, +oS precedence, and channel hiding (each with its inverse); whois_service_proptest fuzzes whois_oper_line against an independent model; golden_s2s_whois_service bursts a +S service into a shared #hub and WHOISes it (new snapshot). Gate: cargo test -p leveva green; clippy clean; build 0 warnings. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): learn the SASL mechanism list from services (ENCAP * MECHLIST) (P11 slice 299) A linked SASL services agent announces its mechanisms via `:<svcSID> ENCAP * MECHLIST :<comma-list>`; leveva learns the list, advertises it (client-facing `sasl=` cap value + `908 RPL_SASLMECHS`) instead of the hardcoded `PLAIN,EXTERNAL`, and relays whichever advertised mechanism a client picks — faithful charybdis transparent relay (special-casing only EXTERNAL for the CertFP; an unadvertised mechanism → 908+904, never relayed). - sasl.rs: pure fuzzed `parse_mechlist`; `Mechanism` reworked `{Plain,External,Other(Box<str>)}` with `from_advertised`/`name`/`is_external`. - s2s/links.rs: PeerLinks learned-mechlist store, cleared when the last sasl agent unlinks. - s2s/mechlist.rs (new): `apply_encap_mechlist`, dispatched in forward.rs's interpret-and-onward-relay block (broadcast, like SU). - cap.rs: `apply`/`ls`/`req` `sasl_available: bool` → `sasl_mechs: Option<&str>`. - session.rs: AUTHENTICATE gate uses `from_advertised`; 908 lists the advertised set; relay_start takes &Mechanism. leveva-native (the C 2.11 oracle predates SASL). Tests cover the happy path and every inverse invariant (unadvertised rejected, all-junk keeps the prior list, unlink clears, default fallback) + 2 proptests.

1 month ago

golden_server_query.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_server_time.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_service.rs

feat(leveva): +S service user mode (charybdis UMODE_SERVICE) — P11 slice 253 Server-set-only umode: settable only on an S2S burst, a client/oper MODE +S silently ignored (like +Z/+W). A +S holder is immune to an operator's KILL (481 "Cannot kill a network service", charybdis no_kill_services); an inbound server KILL is still honoured. Propagates via SEND_UMODES — a service is a service network-wide. - mode.rs: UserMode::Service ('S', bit 0x20000) + is_service() predicate - command/kill.rs: 481 gate before eject/route, reads registry or net mirror - command/mode.rs: 'S' joins the server-set-only ignore set - s2s/umode.rs: Service added to SEND_UMODES - golden_service.rs + service_proptest.rs; 004 RPL_MYINFO umode-list bump

1 month ago

golden_service_string_config.rs

feat(leveva): options { service-string } REHASH knob for the WHOIS 313 service line — P11 slice 256 Promotes the slice-255 hard-coded WHOIS 313 service text "is a Network Service" to a REHASH-able options { service-string } config knob (charybdis ConfigFileEntry.servicestring) via the ConfStore live-or-default seam — the const->knob trajectory MAX_PENALTY (208->210) and max-bans (245->246) took. Closes the single documented follow-on slice 255 left open. Splits whois_oper_line into a pure precedence enum WhoisLine + a pure render whois_oper_text_with (the fuzz seam) + the live resolver whois_oper_text (reads control::live_service_string, falls back to DEFAULT_SERVICE_STRING). Empty value -> default, matching charybdis ignoring an empty servicestring. Plumbs Options/parser/ConfBlocks/ConfStore/config_conf/main + dist/example kdl + WHOIS help. Tests: whois units + config defaults/override/empty + control seed/reseed/empty round-trip + whois_service_proptest rewritten onto the enum & arbitrary service string + golden_service_string_config (new s2s_service_string.kdl fixture) proving config->live->WHOIS end-to-end.

1 month ago

golden_setname.rs

test(leveva): boot-golden setname (P11 slice 90) End-to-end through the real binary: alice (setname cap) renames herself → self-echo + dan's push; mel (no cap) gets no push but WHOIS 311 shows the new GECOS (the mutation applied while the push was correctly withheld); an over-long realname is rejected with FAIL SETNAME INVALID_REALNAME; CAP LS advertises setname and the 005 burst advertises NAMELEN.

1 month ago

golden_snomask.rs

feat(leveva): +s server-notice snomask category mask — P11 slice 257 Promotes the slice-184 all-or-nothing +s (FLAGS_SERVNOTICE) umode to charybdis's snomask category mask. +s becomes the one parameterized umode: a following token is its snomask delta (apply_delta, ignoring unknown letters), a bare +s seeds SnoMask::ALL (slice-184 back-compat). Per-record snomask routes each notice by category via snotice::server_notice_cat — c (connect/exit), k (kill), s (general/rehash/SA*). 008 RPL_SNOMASK reports the mask; an emptied mask drops +s; a non-oper +s <mask> swallows its param (no spurious 501). The mask is local-only (the bit still propagates); 221/004 unchanged (mask surfaces via 008 only). New: snomask.rs (pure parser/renderer fuzz seam), Numeric::RplSnomask, ClientRecord.snomask + Registry::set_snomask/snomask_of. Tests: snomask + mode + snotice units (incl. inverses), snomask_proptest, golden_snomask; every existing +s watcher test now seeds ALL to model bare-+s. Help: USER_MODES.md +s row.

1 month ago

golden_snotice.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_socks.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_sslonly.rs

feat(leveva): +S TLS-only channel mode — P11 slice 233 A leveva-native channel flag porting charybdis chm_sslonly (MODE_SSLONLY): a JOIN of a +S channel by a client NOT on a secure (TLS) transport is refused 519 ERR_SSLONLYCHAN :Cannot join channel (+S) - SSL/TLS required and the client is not added. Builds on slice 227's +Z secure user mode and the +C/+c flag-mode wiring (220/232). A hard JOIN gate like +O: checked in Channels::check_join alongside +O, before the invite override, so INVITE/+I do not bypass it (a transport requirement, not an access list); ops not exempt; existing members keep their seat (only new joins gated, matching charybdis's can_join hook). KNOCK to a +S channel is refused like +O. The secure signal is the joiner's +Z (UserMode::Secure) bit via mode::is_secure(attrs.umodes), NOT attrs.is_ssl — the latter is certfp-based and undercounts TLS users with no client cert (the gap slice 227 closed). $z extban semantics are left untouched. check_join runs for local joins only; remote joins arrive via NJOIN and bypass it. ChanMode::SslOnly ('S', bit 0x4000000, MODE_SSLONLY, Flag) wired through both flag-mode allowlists (mode.rs ALL/as_char/bit/mode_name/from_char + command::mode::supported_flag). JoinReject::SecureOnly → join_reject maps to the new ErrSslonlychan = 519. CHANMODES/004/MYINFO auto-derive S. Pure seam channel::sslonly_blocks(set, secure). Tests: 2 unit (check_join_enforces_ssl_only incl. INVITE-no-bypass + -S round-trip; sslonly_blocks_truth_table), sslonly_proptest (gate keys only off +Z over arbitrary u32 umode masks; plain channel never gates; toggling +Z flips), golden_sslonly end-to-end (plaintext JOIN → 519, not added, NAMES confirms; -S re-opens), 9 regenerated 004/005 snapshots (chanmode string only). cargo test -p leveva 2298 pass; clippy clean; workspace builds 0 warnings.

1 month ago

golden_standard_replies.rs

feat(leveva): IRCv3 standard-replies / the FAIL/WARN/NOTE framework (P11 slice 69)

1 month ago

golden_stats.rs

test(leveva): boot golden for STATS ?/P/a (P11 slice 146)

1 month ago

golden_stats_config_ban.rs

feat(leveva): STATS k lists static config ban (K-line) blocks (P11 slice 192) Closes the slice-191 deferred follow-on: config `ban {}` blocks were made enforceable at registration but stayed invisible to `STATS k`, which reported only the runtime temporary t-klines. The `Some('k')` arm now appends one `216 RPL_STATSKLINE` per config ban (`k <host> <user> :<reason>`, no ttl — the absent integer marks a permanent ban) after the runtime set, read live-or-ctx so REHASH is reflected. A gecos realname pattern folds into the reason trailing. Tests: config_ban_report/split_ban_mask units (+ inverses), a 3000-case proptest over arbitrary seeded ban sets, and a golden boot test proving display + live REHASH reload. clippy clean, workspace builds 0 warnings.

1 month ago

golden_stats_fd_ping.rs

feat(leveva): STATS f/F (fd table) + p, completing the STATS surface (P11 slice 154) f/F = the oracle report_fd connection table: one 211 per registered connection via the new pure fd_report over a richer registry::connections() snapshot, oper-gated on the trace privilege (ACL_TRACE+MyConnect; denied -> no body + 219 *, not 481). Renders the tokio-available analogues only: the connection UID stands in for the raw fd; the local-listener/remote socket addresses are dropped, not faked; idle from last_activity. p (lowercase; uppercase P stays listeners) = recognized-but-always-empty like K: leveva has no aCPing/calculate_preference connect-block preference-pinging, so never any 246. The gate rides a new stats_fd_ok: bool param on the shared query_answer/stats (local dispatch passes has_privilege(Trace); the S2S hunt_server query path passes false -- a remote requester is never a local-fd oper). leveva-native, no differential. Tests: fd_report + gate units (incl. inverses: plain user and oper-without-trace both denied), registry connections() snapshot + inverse, fd_stats_proptest (256 cases: trace-oper body count + idle>=0 + the non-oper-always-* inverse), golden_stats_fd_ping boot test. Completes the STATS surface -- only unmodeled config-block letters stay *.

1 month ago

golden_stats_traffic.rs

feat(leveva): S2S server-link traffic metrics (P11 slice 180)

1 month ago

feat(leveva): advertise IRCv3 `sts` capability — P11 slice 211 Add Strict Transport Security advertisement: a plaintext `CAP LS 302` client is told the TLS upgrade port (`sts=port=<p>`) and a TLS client the policy duration (`sts=duration=<n>[,preload]`). Advisory-only — `sts` stays out of the `SUPPORTED` registry, so `CAP REQ sts` NAKs and it never appears in `CAP LIST`; injected straight into the `LS` token list (302+ only). - new pure `sts::StsPolicy::ls_value(secure)` (None when disabled: no TLS client listener, or `sts-duration 0`); `port=` over plaintext, `duration=` over TLS (preload only over TLS, per spec) - `options { sts-duration N; sts-preload }` (boot-read; default off) - `StatsConf.sts` (slice-206 churn-free bundling) built in `from_config` from the first `tls && !server_only && websocket.is_none()` listener - `Session.secure` set by `serve_client`; the CAP LS path threads the value into `cap.apply`'s new `sts` param REHASH-ability of the knobs + treating wss as secure are documented follow-ons. Tests: sts/cap/config units + sts_proptest (fuzz) + golden_sts (real binary, plaintext sees the upgrade port; inverse no-TLS-listener sees no token).

1 month ago

golden_summon.rs

test(leveva): boot golden for SUMMON disabled skeleton (P11 slice 143) Real binary: SUMMON -> 411; SUMMON bob / bob * / bob leveva.test -> 445 ERR_SUMMONDISABLED; SUMMON bob other.server -> 402. Closes SUMMON's boot-level gap (it had no golden).

1 month ago

golden_tagmsg.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_testline.rs

feat(leveva): TESTLINE ban-match diagnostic (P11 slice 285) TESTLINE <[nick!]user@host | ip/cidr | nick | #channel> — a charybdis-style read-only operator command, the capstone of the ban family (RESV 272, TKLINE 281, DLINE 284). It reports which active ban (K/D-line or RESV) would match a mask, laying/lifting nothing. - Param gate (461) then a plain oper-bit gate (any oper, no per-ban privilege → 481), matching charybdis (TESTLINE needs IsOper with no specific flag). - A pure probe() classifier strips an optional nick! then routes by mask shape: user@host → D-line(host)-then-K-line; #channel → channel RESV; bare token → D-line(as IP)-then-nick RESV. Reports the first hit, priority D > K > R. - New numerics RplTestline=725 (<type> <minutes-left> <ban-mask> :<reason>; 0 minutes for a permanent RESV) and RplNotestline=726 (<mask> :No matches). Expiry honoured for free via find_active. - TESTLINE.md help + COMMANDS allowlist (bijection test). leveva-native, no oracle (2.11 has no TESTLINE): single best match, no I-line/auth-block arm, local-only (no S2S propagation, mirroring charybdis). Tests (TDD, failing first + fuzzing): command/testline.rs units + inline probe_is_total proptest; testline_proptest.rs (reply-well-formed, non-oper-481, laid-ban-always-reported inverse); golden_testline.rs (real binary, minutes field masked). cargo test -p leveva green (2543 lib), clippy clean, workspace 0 warnings.

1 month ago

golden_testmask.rs

feat(leveva): TESTMASK mask-population diagnostic (P11 slice 288) TESTMASK <[nick!]user@host> [<gecos>] counts how many connected clients match a hostmask (and optional realname glob), split into local vs remote — the read-only population sibling of TESTLINE (slice 285, which reports bans), together completing charybdis's test* diagnostic family. 461 param gate before the plain oper-bit gate (481); a malformed mask (no @, or empty user/host) yields a NOTICE :Invalid parameters (faithful to charybdis's sendto_one_notice, not a numeric); a registry sweep glob-matches nick/user/host(+orighost)/gecos (nick & gecos default *) and tallies is_local_uid into one 727 RPL_TESTMASKGECOS reply. New numeric 727 (charybdis's 724 is dead — no format string, no caller). Pure parse_mask fuzz seam. Confirmed against cloned charybdis m_testmask.c / messages.h / numeric.h. leveva-native, local-only (no S2S, mirroring charybdis). Tests: 13 units (inverse filters + quit-drops-count), golden_testmask (real binary), testmask_proptest (4 properties incl. l+g <= population, never panics).

1 month ago

golden_time_admin_info.rs

feat(leveva): TIME + ADMIN + INFO commands (P11 slice 22) Server-information query commands, ported as a pure read-only trio (previously caught by dispatch's 421 fallback). All three reach the CLIENT and OPER msgtab columns (no oper gate) and ignore the single-server hunt_server target arg. - TIME -> a single 391; the time renders as unix seconds (leveva's wire-time convention, like 333/312/314). Pure time_at(now) core + a thin clock-reading wrapper. - ADMIN -> the 256/257/258/259 block from a new ServerContext.admin config field (257=name, 258=location, 259=email); 423 when all fields are empty (unreachable -- the admin block is mandatory with name+email required). - INFO -> leveva's own 371* description block (with an On-line since <created> line) then 374; leveva content, oracle shape (as with VERSION's URL). The new admin field touched the 19 proptest struct-literal sites. Canonicalizer gained a 391-seconds + On-line-since mask. Verified by unit tests, a golden_time_admin_info boot golden, and a 4-property server_query_proptest (512 cases): TIME shape, ADMIN block-xor-423, INFO 371*-then-374, and arbitrary-input panic-freedom. No leveva-integration differential (m_time/m_admin/m_info sendto_one into global buffers -> no pure oracle entry point). Gate: cargo test -p leveva green (lib 429 + all golden/proptest binaries); clippy --all-targets clean; fmt clean; build --workspace 0 warnings.

1 month ago

golden_tkline.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_topic.rs

test(leveva): boot golden + proptest fuzzing for channel topics golden_topic.rs drives query-empty -> set -> topic-on-join -> retopic-relay across two booted clients (333 set-time masked by a new canonicalizer rule alongside 003). topic_proptest.rs fuzzes a lockstep JOIN/PART/TOPIC-set script against a (membership+topic) model asserting topic-state coherence (403/331/exact text) and mailbox delivery conservation, plus a second property feeding arbitrary bytes after TOPIC for panic-freedom + well-formed replies.

1 month ago

golden_trace.rs

feat(leveva): TRACE connection introspection, oper-gated (P11 slice 26)

1 month ago

golden_user_spaceless.rs

test: parallelize golden suite via ephemeral ports + nextest The boot-level golden tests each booted a real `leveva` on a fixed port, forcing a global lock that serialized the whole suite (~230s). Make them parallel-safe and run them under nextest: - Ephemeral ports: each daemon reserves `127.0.0.1:0`, templates its fixture to the assigned client/server ports, and threads them through the clients/peers. Per-port flock + a CPU-count slot semaphore (MAX_CONCURRENT_DAEMONS=128) bound concurrency. - `.config/nextest.toml`: a `golden` test-group caps in-flight daemons, with `retries = 2` and a 30s `slow-timeout terminate-after` backstop. - Streaming `read_until`: a per-connection `pending` buffer returns through the sentinel line and retains the rest, and a 30s overall deadline now PANICS (was a silent hang) so a never-arriving sentinel fails loudly. Sentinels that previously matched on a since-coalesced read were re-pointed at their transcript's true last line; a handful of snapshots reattributed accordingly (content preserved). - Fakelag off in tests: the daemon arms flood protection unless `LEVEVA_DISABLE_FAKELAG=1`, which the harness sets by default so barrier-paced clients don't eat the fakelag *delay*; the dedicated flood goldens opt back in via `want_fakelag()`. - Slow-test sentinels: `golden_rehash_conf` waited on a `376` its no-MOTD config never sends (124s -> 1s); `golden_s2s_monitor` keyed on a too-early `731`. Suite: ~230s -> ~25s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_userhost_in_names.rs

test(leveva): boot golden + proptest for userhost-in-names Golden: alice (cap ON) sees full hostmasks in NAMES, bob (cap OFF) sees bare nicks. Proptest: drives NAMES through a real Session over an arbitrary member set — every 353 token is masked iff the requester has the cap, every member's mask appears under the cap, and the path never panics. Bumps the two golden_cap LS snapshots for the new advertised token.

1 month ago

golden_userhost_ison.rs

feat(leveva): USERHOST + ISON commands (P11 slice 20) The two RFC "query a list of nicks" commands, ported as a pair (split a nick list, look each up, format one batched reply). USERHOST <nick>{ <nick>} -> one 302 listing up to five resolvable nicks as <nick>[*]=<sign><user>@<host> (* iff oper +o/+O, sign - iff away +a), faithful to the oracle m_userhost's 5-token cap and byte layout. ISON <nick>{ <nick>} -> one 303 echoing the online subset in query order as canonical (fold-resolved) nicks, dropping absent names and stopping before the wire budget overflows. Both flatten params + trailing to one token stream and 461 on no param. Divergence: leveva emits a single 302 line (the oracle's BUFSIZE re-head is unreachable under the 5-nick cap within 512 bytes). No pure oracle entry point (both sendto_one into global buffers) -> no leveva-integration differential. Verified by 19 unit tests (with inverses), a 3-property proptest (online-subset-in-order / first-five-resolvable models + arbitrary-query panic-freedom & wire-budget), and a boot golden.

1 month ago

golden_usermode.rs

test(leveva): use a never-real umode for the unknown-flag golden golden_usermode asserted MODE +Z -> 501 Unknown MODE flag, but slice 227 made +Z the real secure-connection user mode (server-set-only, silently ignored from a client), so no 501 fires. Switch the probe to '>' — the guaranteed-never-a-real-mode letter the channel-mode tests already use — so the unknown-flag assertion is immune to a future slice claiming the letter. Refreshed the snapshot to match.

1 month ago

golden_utf8only.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_wallops.rs

feat(leveva): WALLOPS command (P11 slice 17) — 481/461, consumes +w Adds WALLOPS <text>: an operator (+o/+O) broadcasts :nick!user@host WALLOPS :text to every connected +w user — the first consumer of UserMode::Wallops (default +iw since slice 14). Non-oper → 481 ERR_NOPRIVILEGES; no text → 461. Privilege gate first, then text, then fan-out via registry.records()/deliver_uid (including the sender when +w); empty direct reply, like a channel PRIVMSG. Deliberate divergence from the IRCnet 2.11 oracle: m_wallops's msgtab row routes *client* WALLOPS to m_nop (server-sourced only there). leveva adopts the RFC 2812 §4.7 / modern-ircd oper-issued form, documented. No pure oracle entry point → no new leveva-integration differential. Tests: 6 unit (with inverses), tests/golden_wallops.rs (boot golden: 481, OPER+WALLOPS reaches +w bob & alice's own copy, -w carol gets nothing via PING/PONG sentinel), tests/wallops_proptest.rs (fuzzing: 2 properties / 300 cases — per-observer conservation + arbitrary-bytes panic-freedom). Gate: cargo test -p leveva (362 lib + golden + proptest) and -p leveva-integration (10) green; clippy clean; workspace 0 warnings.

1 month ago

golden_webirc.rs

feat(leveva): WEBIRC webchat-gateway client IP/host spoofing (P11 slice 301) Port charybdis extensions/m_webirc.c: a trusted webchat gateway sends a pre-registration WEBIRC <password> <gateway> <hostname> <ip> so the proxied connection is recorded under the real client's host/IP, not the gateway's. Every later admission gate (D/K/X-line, config-ban, per-class conn caps, +x cloak) and WHOIS key off the spoofed self.host. - new pure fuzz seam leveva::webirc {parse_request, spoof_host, authorize} - webirc {} config block (host mask + password) -> StatsConf (boot-read) - Session::handle_webirc dispatched phase-independently (CAP/AUTHENTICATE seam), one-spoof-per-connection, +s audit snotice; registered -> 462, bad-pw / untrusted host / malformed -> NOTICE, no spoof - HELP WEBIRC topic + commented example/dist config block Divergences (leveva-native, no oracle): single-host/no-DNS collapse of charybdis host/sockhost; trust via webirc {} not auth{}; boot-read. Tests: webirc/config/session units (inverses), golden_webirc end-to-end, webirc_proptest (parse total + round-trip, spoof_host range, authorize contract).

1 month ago

golden_websocket.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

golden_websocket_sts.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

feat(leveva): user modes (MODE <nick> → +i/+w) + config default +iw P11 slice 14: the first *user*-mode slice. `MODE <nick>` was a stub (221 `+` / 502); now a client has real, tracked user modes, a configurable registration default, and +i (invisible) affects WHO. - State: a u32 FLAGS_* bitmask (reusing the P10 UserMode enum) on command::Registered (authoritative) + registry::ClientRecord (the WHO-visible snapshot), synced by Registry::set_modes. - Handler (command/mode.rs): faithful to the oracle m_umode resolved to the client-toggleable set — other nick → 502; own nick query → 221 +<render>; change string applies i/w, silently ignores o/O/r/a (no 501), 501s any unknown letter; on a net change echoes :nick MODE nick :<diff> (send_umode sign-grouped diff) + mirrors to the registry. No change → no echo. - Config: `default-user-modes` (options block), restricted to i/w, absent → +iw; Options::Default matches so a config with no options block is also +iw (the out-of-box default). Seeded silently at registration; documented in examples/*.kdl. - WHO: +i users are omitted from the user sweeps (no-arg/0/*, exact, glob) unless the requester shares a channel or is them; channel WHO is unaffected. Retires the "no +i filtering" divergence. Tests: +10 umode unit (with inverses), +4 WHO invisible-filter unit, +1 config matrix, golden_usermode boot snapshot, usermode_proptest (3 properties / 400 cases: model lockstep, WHO visibility matrix, arbitrary-bytes panic-freedom). golden_who regenerated — carol now hidden from the global sweep (a clean +iw-default demonstration); the 12 direct-ServerContext proptest harnesses get default_user_modes: 0. cargo test -p leveva (328 lib + golden + proptest) + -p leveva-integration green; clippy clean; workspace 0 warnings.

1 month ago

golden_whois.rs

feat(leveva): WHOIS emits 317 RPL_WHOISIDLE for local targets (P11 slice 97) The oracle and RFC 1459/2812 carry 317 (idle seconds + signon) in the WHOIS reply; leveva omitted it for want of idle tracking. Add per-connection signon + last_activity stamps to ClientRecord (seeded at claim), advanced only by the sender's own PRIVMSG (faithful to the oracle's IDLE_FROM_MSG, where only m_private bumps user.last). WHOIS emits 317 as the last per-target line before 318, gated on a local target (my_connect). Converges the info/query differential (skeleton now matches incl. 317); remote targets omit it (inverse).

1 month ago

golden_whois_metadata.rs

feat(leveva): 760 RPL_WHOISKEYVALUE — metadata in WHOIS — P11 slice 221 Close the documented draft/metadata-2 deferral named verbatim in command::metadata's out-of-scope list. A WHOIS on a user with metadata set now exposes it as 760 <requester> <target> <key> * :<value> lines, gated on the requester having negotiated the draft/metadata-2 cap (no cap → no 760). One line per key in sorted order; visibility always '*' (no privileged-key system — now the only remaining metadata-2 deferral); fires for remote targets too (metadata is UID-keyed + network-wide via the burst/propagate). - numeric.rs: RplWhoiskeyvalue = 760 (+ name map + try_from) - command/whois.rs: pure whois_keyvalue_lines builder (fuzz seam) + the cap-gated handler hook, placed before the 317/318 tail - tests: unit (incl. inverses: no-cap, no-keys, set→remove round-trip, remote target) + inline proptest + golden_whois_metadata boot test Gate: cargo test -p leveva (whois/numeric/metadata + golden + proptest) green; clippy clean; cargo build --workspace 0 warnings.

1 month ago

golden_whois_modes.rs

test(leveva): boot golden for WHOIS user modes 379 (P11 slice 138) Real binary: a self-WHOIS shows 379 :is using modes +iw; a non-oper's cross-WHOIS shows no 379 (the privacy gate). golden_s2s_reject's self-WHOIS snapshot updated to carry the new 379 line.

1 month ago

golden_whowas.rs

feat(leveva): WHOWAS command + nick-history ring (P11 slice 21) Records a vacated identity on every NICK-change and disconnect into a new bounded newest-first whowas ring; WHOWAS <nicklist> [count] [target] answers 314+312 per match, 406 on miss, one 369, 431 with no nick. Single-server divergences (no routing, 312 time as unix seconds) documented. Verified by unit + session integration + 3-property whowas_proptest + golden_whowas.

1 month ago

test(leveva): boot-golden for WHOX fields/token/oper-flag/o-filter (P11 slice 47)

1 month ago

golden_xline.rs

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

harness_read_until_fragmentation.proptest-regressions

test(harness): pin read_until line-completeness with a regression + fuzz Feed a sentinel-bearing line through the real Peer::read_until path with the bytes split at a boundary (a fixed case right after the sentinel, plus a proptest fuzzing the split point), and assert the whole line — including the post-sentinel reason — comes back intact and newline-terminated. Reverting the read_until fix makes both fail fast, matching the original flake profile. The committed proptest seed (split = 12) is the exact post-sentinel boundary. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

harness_read_until_fragmentation.rs

test(harness): pin read_until line-completeness with a regression + fuzz Feed a sentinel-bearing line through the real Peer::read_until path with the bytes split at a boundary (a fixed case right after the sentinel, plus a proptest fuzzing the split point), and assert the whole line — including the post-sentinel reason — comes back intact and newline-terminated. Reverting the read_until fix makes both fail fast, matching the original flake profile. The committed proptest seed (split = 12) is the exact post-sentinel boundary. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

heartbeat_proptest.rs

feat(leveva): WHOWAS command + nick-history ring (P11 slice 21) Records a vacated identity on every NICK-change and disconnect into a new bounded newest-first whowas ring; WHOWAS <nicklist> [count] [target] answers 314+312 per match, 406 on miss, one 369, 431 with no nick. Single-server divergences (no routing, 312 time as unix seconds) documented. Verified by unit + session integration + 3-property whowas_proptest + golden_whowas.

1 month ago

help_users_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

iauth_module_order_proptest.proptest-regressions

feat(leveva): REHASH hot-reloads the iauth block (P13 slice 207) The iauth block (ident flag, per-probe timeout, dnsbl/socks/webproxy/pipe/ident module set) was read once at boot and never re-read — the last boot-immutable config block. It now hot-reloads via the ConfStore live seam like every options field (91/175/204/205/206), completing phase 13's make-all-config-REHASH-able mission: no config block remains boot-immutable. ConfBlocks carries the plain Iauth struct (Debug/Eq); the built module set (Arc<dyn Module>, not Debug/Eq) is cached in a separate ConfStore ArcSwapOption, rebuilt only at seed/REHASH (build_auth_modules made pub(crate); server name from a new boot IRCD_NAME OnceLock mirroring CONFIG_PATH) so live connections keep one shared resolver/DNS cache and a REHASH swaps the set atomically. Read sites: the serve-loop auth task (modules+timeout), resolve_username (the ~ rule's ident flag), and STATS a (239 module list) — all live-or-boot-ctx.auth. Tests: control units extended (seed/reseed/empty-clear track iauth + module names); rehash_conf_proptest lockstep gains iauth; NEW iauth_module_order_proptest (arbitrary sub-block subset -> canonical module order, present iff configured); NEW golden_rehash_iauth (boot ident -> STATS a; REHASH to dnsbl -> rebuilt set; recovery). 1941 lib pass; clippy clean; workspace 0 warnings.

1 month ago

iauth_module_order_proptest.rs

feat(leveva): REHASH hot-reloads the iauth block (P13 slice 207) The iauth block (ident flag, per-probe timeout, dnsbl/socks/webproxy/pipe/ident module set) was read once at boot and never re-read — the last boot-immutable config block. It now hot-reloads via the ConfStore live seam like every options field (91/175/204/205/206), completing phase 13's make-all-config-REHASH-able mission: no config block remains boot-immutable. ConfBlocks carries the plain Iauth struct (Debug/Eq); the built module set (Arc<dyn Module>, not Debug/Eq) is cached in a separate ConfStore ArcSwapOption, rebuilt only at seed/REHASH (build_auth_modules made pub(crate); server name from a new boot IRCD_NAME OnceLock mirroring CONFIG_PATH) so live connections keep one shared resolver/DNS cache and a REHASH swaps the set atomically. Read sites: the serve-loop auth task (modules+timeout), resolve_username (the ~ rule's ident flag), and STATS a (239 module list) — all live-or-boot-ctx.auth. Tests: control units extended (seed/reseed/empty-clear track iauth + module names); rehash_conf_proptest lockstep gains iauth; NEW iauth_module_order_proptest (arbitrary sub-block subset -> canonical module order, present iff configured); NEW golden_rehash_iauth (boot ident -> STATS a; REHASH to dnsbl -> rebuilt set; recovery). 1941 lib pass; clippy clean; workspace 0 warnings.

1 month ago

iauth_seam_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

identify_proptest.rs

feat(leveva): IDENTIFY services login shortcut (P11 slice 302) A port of charybdis's extensions/m_identify.c, the client-facing companion to the services/SASL cluster (296-299): a registered client types `IDENTIFY [<target>] <password...>` and the server rewrites it into a PRIVMSG to a services pseudo-agent (ChanServ when the first argument is a channel, else NickServ), delivered through the ordinary message plane. - leveva/src/identify.rs: the pure, fuzzable rewrite seam `rewrite(params) -> Option<Rewrite>` (target by params[0]'s '#', verbatim args re-joined after the keyword, empty first arg -> 461). - leveva/src/command/identify.rs: synthesizes the PRIVMSG and delegates to message::message, so the agent sees the real source mask and an unlinked services sender gets the plane's own 401. Dispatch + HELP IDENTIFY. leveva-native sugar: hardcoded service nicks, registered-clients-only, no state and no S2S of its own. Units + golden_identify + identify_proptest.

1 month ago

iline_proptest.rs

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

integration_post_link_join.rs

test(leveva): golden — post-link registration is introduced across the link Live two-node regression for the missing live UNICK: brings the link up first, then registers alice (A) and bob (B), and asserts the introduction works both ways — each is WHOIS-visible on the far node, the remote member appears in the shared channel's NAMES, and JOIN/PRIVMSG arrive in client form (nick!user@host), not the raw UID prefix a missing introduction left behind.

1 month ago

integration_two_node.rs

test(leveva): live two-node relay integration (P11 slice 52) Boot two real leveva subprocesses, link them with a real operator CONNECT, and assert PRIVMSG/TOPIC/MODE relay in both directions. First test to exercise the outbound dial path (command::connect -> link::request -> dial_server -> build_link_greeting) and a real leveva accepting a link from another real leveva — every prior S2S test drives a hand-coded Peer into the inbound accept side only.

1 month ago

integration_two_node_tls.rs

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

invite_notify_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

invite_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

invite_s2s_proptest.rs

feat(leveva): charybdis-style extended bans (P11 slice 164) Add `+b`/`+e`/`+I` ban-list entries of the form `$[~]<type>[:<data>]` that match a richer client predicate than a plain nick!user@host glob, ported faithfully from Elemental-IRCd (doc/technical/extban.txt, src/extban.c, extensions/extb_*.c). A new `leveva::extban` module holds the framework (the $/~/: parse, Verdict/ModeType/Subject/ChannelView, match_extban/valid_extban/ entry_matches/extban_chars) plus one handler file per type: $a account, $o oper, $z ssl, $r realname, $x extgecos, $s server, $c on-channel, $j banned-from-channel, $m usermode. The nine handlers were implemented in parallel via a multi-agent workflow, one per extb_*.c. Extbans are enforced at the JOIN gate: check_join's last param is now &extban::SubjectAttrs (was is_oper: bool), and its +b/+e/+I iteration runs through extban::entry_matches against a Subject built in place. A private LiveChannels ChannelView adapter resolves $c/$j from the already-locked channel map (no re-lock) with a depth-1 recursion guard for nested $j. join.rs builds SubjectAttrs from the registry (account, certfp->ssl, realname, modes->oper/umodes) plus the server name. ISUPPORT advertises EXTBAN=$,acjmorsxz (re-chunking nine existing 005 golden bursts, content-identical). Divergences (leveva-native, documented): JOIN-gate-only enforcement (no PRIVMSG/quiet plane; +q is the slice-158 owner mode), $s matches the joiner's server (= me.name for a local JOIN), $j caps at depth 1, $x has no DynSpoof retry, and add-time validity rejection is deferred. Tests: 97 extban unit tests, elemental_extban_proptest (parser totality, negation duality, $a model, extban_chars invariant), and a real-binary golden_extban. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

jointhrottle_proptest.rs

feat(leveva): +j join throttle channel mode — P11 slice 234 Charybdis-style `+j n:t` (MODE_JOINTHROTTLE): a channel admits at most n joins per t-second window; the next join bounces 480 ERR_THROTTLE and is not added. The first parameter-bearing flag mode since +l/+k and the first JOIN-rate gate; continues the channel-mode parity track (220 +C, 232 +c, 233 +S). leveva-native — gate is unit + golden + proptest. - Pure core join_throttle.rs: parse_param(n:t) + format_param + the charybdis fixed-window decide() (both fuzz seams); JoinThrottle counter store (reads no clock, self-draining) housed inside Channels (zero ServerContext-literal churn). - ChanMode::JoinThrottle ('j', bit 0x8000000, Param kind) threaded through both mode parsers + the three ModeChange matches + 324/CHANMODES-type-C/004 render. - JOIN gate in command::join::join_one: non-members, local path only (remote NJOIN gated at its home server); SAJOIN bypasses; refusal -> 480 ErrThrottle. - Tests: 12 core units + 2 channel + 1 mode units; jointhrottle_proptest (5, incl. no-window-over-admits) + golden_jointhrottle; 8 005/004 snapshots regenerated (CHANMODES ...,k,lj,... / 004 ...IRklj, token-only).

1 month ago

keepalive_freq_proptest.rs

feat(leveva): per-class keepalive ticker cadence — P11 slice 231 The session heartbeat already adopts the matched `allow -> class` block's `ping-freq` at registration finalize (the decision), but the serve-loop tokio check ticker was seeded once from the default (first) class and never updated, so a client in a non-default class was checked at the wrong rate — stretching its ping/timeout detection latency. Add a pure `heartbeat::class_ping_freq(class, classes)` seam (matched class -> its ping-freq; unknown/None -> default_ping_freq) that both the finalize re-arm and the loop key off, expose `Session::keepalive_freq()`, and re-arm the serve_client ticker whenever the session keepalive freq changes (top of loop, covering the feed + deferred resolve_auth finalize paths). Fix the stale 'leveva does not yet match clients against allow -> class' comments. Tests: class_ping_freq unit (matched-wins/unknown-default/empty-set) + keepalive_freq_proptest (2048 cases: total, matched-or-default, tick always >=1s) + session matched-vs-default-class re-arm. golden_keepalive green.

1 month ago

keepalive_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

kick_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

kill_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

kill_s2s_proptest.rs

feat(leveva): +s server-notice snomask category mask — P11 slice 257 Promotes the slice-184 all-or-nothing +s (FLAGS_SERVNOTICE) umode to charybdis's snomask category mask. +s becomes the one parameterized umode: a following token is its snomask delta (apply_delta, ignoring unknown letters), a bare +s seeds SnoMask::ALL (slice-184 back-compat). Per-record snomask routes each notice by category via snotice::server_notice_cat — c (connect/exit), k (kill), s (general/rehash/SA*). 008 RPL_SNOMASK reports the mask; an emptied mask drops +s; a non-oper +s <mask> swallows its param (no spurious 501). The mask is local-only (the bit still propagates); 221/004 unchanged (mask surfaces via 008 only). New: snomask.rs (pure parser/renderer fuzz seam), Numeric::RplSnomask, ClientRecord.snomask + Registry::set_snomask/snomask_of. Tests: snomask + mode + snotice units (incl. inverses), snomask_proptest, golden_snomask; every existing +s watcher test now seeds ALL to model bare-+s. Help: USER_MODES.md +s row.

1 month ago

kline_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

knock_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

knock_s2s_proptest.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

knock_throttle_proptest.rs

feat(leveva): KNOCK per-channel flood throttle (712 ERR_TOOMANYKNOCK) (P11 slice 200) Close the last KNOCK follow-on (the slice-198/199 deferral). A KNOCK to a restricted channel delivered unconditionally, letting a user spam a channel's operators by re-knocking in a loop. A channel now has a per-channel cooldown (knock_throttle::KnockThrottle, charybdis knock_delay_channel, 60s): it admits at most one KNOCK per window; a knock inside the window is refused with 712 ERR_TOOMANYKNOCK and notifies nobody (local ops and, via S2S, remote ops). The store is clock-injected (caller passes unix-second now, like kline/ autoconnect) so it is deterministic under test, case-folds the channel key, and self-prunes expired holds so it never leaks. Throttle is local-path only by design: an inbound relayed ENCAP * KNOCK is unthrottled (the origin server already throttled its own user; charybdis throttles per-server). The per-user knock_delay stays out of scope. The KNOCK family (198/199/200) is now complete. Adding the shared ServerContext.knock_throttle field touched the two command::testutil literals and every integration-test ctx() literal (they build ServerContext by hand, not via from_config). Tests (RED first, inverse invariants, fuzzing): 7 knock_throttle units + 2 command::knock units + tests/knock_throttle_proptest.rs (PROPTEST_CASES=2000). Gate: cargo test -p leveva --lib 1915 pass/0 fail; clippy --tests clean; build --workspace 0 warnings.

1 month ago

knock_user_throttle_proptest.rs

feat(leveva): per-user KNOCK throttle (charybdis knock_delay) — P11 slice 209 Closes the last documented gap in the KNOCK throttle family (slices 198/199/200). Slice 200's per-channel cooldown stops a chorus spamming one channel's operators; it did nothing about one user spraying KNOCKs across many *fresh* channels. This adds charybdis's per-user `knock_delay` (default 300s). - Reuse `KnockThrottle` as a generic per-key cooldown; second `ServerContext` field `knock_user_throttle` keyed by the knocker's UID (folds injectively). - New `cooling`/`arm` peek/arm split: the command peeks both throttles and arms neither unless the knock is delivered (charybdis updates its clocks on success only). `admit` retained; a unit test pins `admit == cooling-then-arm`. - `KNOCK_DELAY_USER_SECS = 300` const beside `KNOCK_DELAY_CHANNEL_SECS`. - Command gate answers `712 ERR_TOOMANYKNOCK` if either window is cooling, notifying nobody; per-user peeked first. Tests: store units (cooling-does-not-arm, window-not-permanent, admit==split); command units (second knock to a fresh channel is 712 with no 710; per-user is per-user not global; per-channel test rewritten with distinct knockers); new `knock_user_throttle_proptest.rs` (clock-tracking + arbitrary-key totality). New `testutil::run_as` dispatches as a named client. `knock_user_throttle` added to the 60 hand-rolled ServerContext test literals (slice-206 churn). Gate: cargo test -p leveva green (1949 lib + all knock proptests/golden/s2s); clippy -p leveva --tests clean; build --workspace 0 warnings.

1 month ago

labeled_response_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

linelen_proptest.rs

test(leveva): grapheme-cap fuzz + update 512-pinning tests (P11 slice 121) - linelen_proptest.rs (new fuzzing): over arbitrary Unicode bodies, to_wire body == full body truncated to LINELEN graphemes (the unicode-segmentation model); the within-budget byte-identical round-trip; the never-split-a-grapheme prefix invariant. Never panics. - message_tags_proptest: body cap assertion now grapheme-based (was 512 bytes). - feed_framing_proptest: MAX_INBOUND_LINE mirror now + MAX_BODY_BYTES. - golden_recvq: unterminated blob bumped to 200 KB so it still exceeds the raised 139263-byte framer ceiling and 417s.

1 month ago

link_greeting_proptest.rs

test(leveva): link-greeting roundtrip proptest (P11 slice 52) Fuzz the dial-side handshake at unit speed: build_link_greeting fed through a fresh inbound Handshake. Properties: matching passwords roundtrip with conserved remote identity; a differing accept-password always rejects (the inverse); the greeting is always well-formed PASS+SERVER and no truncation panics the handshake.

1 month ago

links_map_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

listener_rebind_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

locops_proptest.rs

feat(leveva): +l locops + LOCOPS command, and make all user modes global — P11 slice 254 Part A — +l locops user mode + LOCOPS command (charybdis UMODE_LOCOPS), the local-server sibling of +z/OPERWALL: an oper broadcasts to +l users on the originating server only; the command never crosses a link. Oper-gated to set, letter 'l' (bit 0x40000). New command/locops.rs + golden_locops.rs + locops_proptest.rs. The last named standard charybdis umode — surface complete. Part B — leveva has NO local-only user modes (product decision). SEND_UMODES is now every UserMode::ALL bit (self-maintaining const loop), so +O/+x/+s/+g/+G/+D/ +R/+Q/+z/+l all propagate and a remote WHOIS shows them. Verified safe: the burst already rendered the full unmasked set, and a user's host is always carried explicitly (UNICK field / ENCAP CHGHOST), never recomputed from the +x bit, so +x cannot double-apply the cloak (+x now emits both UMODE +x and ENCAP CHGHOST). Enforcement unchanged: caller-id (+g/+G) and +R stay gated on the target's home server — the ACCEPT list lives only there and is not propagated, so those S2S gates are the actual enforcement, not redundant re-checks, and are kept. - mode.rs: UserMode::LocOps + is_locops(); doc sweep (bit propagates, enforcement is server-local) - command/mode.rs: 'l' in the oper-gated arm + umode_diff; +x test asserts both frames - s2s/umode.rs: SEND_UMODES = every umode; exclusion test -> carries-every-mode - snotice.rs / s2s/relay.rs: stale 'not in SEND_UMODES' comments corrected - help/LOCOPS.md + USER_MODES +l row; 004 umode list -> ...zSl (6 snapshots) - golden_s2s_umode rewritten (demonstrates +D now propagating)

1 month ago

masktrace_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

message_tags_proptest.rs

test(leveva): grapheme-cap fuzz + update 512-pinning tests (P11 slice 121) - linelen_proptest.rs (new fuzzing): over arbitrary Unicode bodies, to_wire body == full body truncated to LINELEN graphemes (the unicode-segmentation model); the within-budget byte-identical round-trip; the never-split-a-grapheme prefix invariant. Never panics. - message_tags_proptest: body cap assertion now grapheme-based (was 512 bytes). - feed_framing_proptest: MAX_INBOUND_LINE mirror now + MAX_BODY_BYTES. - golden_recvq: unterminated blob bumped to 200 KB so it still exceeds the raised 139263-byte framer ceiling and 417s.

1 month ago

metadata_proptest.proptest-regressions

feat(leveva): metadata privileged keys / restricted visibility — P11 slice 223 Close the last draft/metadata-2 deferral (named by slice 221): the privileged-key / restricted-visibility system. A metadata key is oper-restricted (settable/viewable only by +o/+O, visibility token `oper` not `*`) iff it begins with the built-in `priv.` prefix or matches a REHASH-able `options { oper-keys "<glob>" }` allowlist (prefix+config scheme via the ConfStore live_oper_keys seam). A non-oper is refused SET/GET (KEY_NO_PERMISSION), omitted from LIST/760 WHOIS, skipped by CLEAR, and never pushed a restricted key via the notify plane (local + inbound-S2S paths). Pure fuzz seam metadata::key_visibility + golden_metadata_priv (config-driven, end-to-end) + a key_visibility proptest. Also fixed two stale doc comments (metadata burst landed slice 189; privileged visibility now here).

1 month ago

metadata_proptest.rs

feat(leveva): metadata privileged keys / restricted visibility — P11 slice 223 Close the last draft/metadata-2 deferral (named by slice 221): the privileged-key / restricted-visibility system. A metadata key is oper-restricted (settable/viewable only by +o/+O, visibility token `oper` not `*`) iff it begins with the built-in `priv.` prefix or matches a REHASH-able `options { oper-keys "<glob>" }` allowlist (prefix+config scheme via the ConfStore live_oper_keys seam). A non-oper is refused SET/GET (KEY_NO_PERMISSION), omitted from LIST/760 WHOIS, skipped by CLEAR, and never pushed a restricted key via the notify plane (local + inbound-S2S paths). Pure fuzz seam metadata::key_visibility + golden_metadata_priv (config-driven, end-to-end) + a key_visibility proptest. Also fixed two stale doc comments (metadata burst landed slice 189; privileged visibility now here).

1 month ago

metadata_rate_proptest.rs

feat(leveva): metadata-rate-cost/metadata-rate-burst REHASH knobs — P11 slice 230 Close the slice-228 follow-on: the METADATA SET/CLEAR rate-limit budget (was the hard-coded META_RATE_COST_SECS/META_RATE_BURST_SECS consts) is now the REHASH-able options { metadata-rate-cost / metadata-rate-burst } pair via the slice-204/210/212 ConfStore live seam. - rate_charge/charge_rate take cost_secs/burst_secs (consts become defaults; negatives clamped); command::metadata::rate_gate reads live_meta_rate_cost/live_meta_rate_burst. - Options/ConfBlocks/ConfStore carry the i64 pair, seeded at boot and re-seeded on REHASH. - 0 legal for both: cost 0 disables the limiter, burst 0 caps at one mutation/sec; negative rejected. Tests: metadata.rs units (custom budget + inverses, cost-0-disables, store threads knobs), config parse (default/override/0/negative), control re-seed lockstep, metadata_rate_proptest fuzzes cost/burst incl. 0 + negatives (the proptest caught and corrected an over-broad cost-0 property), and a config-driven golden_metadata_rate.rs. cargo build --workspace 0 warnings; clippy clean.

1 month ago

metadata_s2s_proptest.proptest-regressions

feat(leveva): METADATA SET/CLEAR S2S propagation (P11 slice 177) draft/metadata-2 (slices 163/167/169) was single-server-local: a SET/CLEAR mutated the local store and notified only local subscribers, so a key set on one server was invisible to a GET/LIST/push on another. Closes that deferral. Modelled on SU (139) / SETNAME (90): server-authoritative state carried as `:<sid> ENCAP * METADATA <target> <key> [:<value>]` (target = UID for users, channel name for channels; value absent = removal). command/metadata.rs SET and CLEAR now call s2s::metadata::propagate after the local store mutation + notify; forward::inbound_encap dispatches METADATA to apply_encap_metadata, which applies it to this server's store and reuses notify_subscribers (now pub(crate), actor: Option<&Uid>) for its local subscribers. ENCAP onward-relay (split-horizon) is unchanged, so the change converges across multiple hops. Divergences (documented): leveva-native, no differential; MAX_KEYS not re-enforced per-hop (would desync which keys exist); no registration metadata burst (learns changes from link time on), like SU. Tests: 9 s2s units + 3 command units (incl. inverse removal / rejected-set no-propagation / per-key CLEAR) + a 2-property round-trip+panic-safety proptest through propagate -> inbound_encap. cargo test -p leveva green (lib 1751 + new proptest), clippy -p leveva --tests clean, build --workspace 0 warnings.

1 month ago

metadata_s2s_proptest.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

metadata_sync_proptest.rs

feat(leveva): METADATA SYNC subcommand (metadata batch of server-message events) — P11 slice 229 Closes the last draft/metadata-2 gap: METADATA <target> SYNC re-sends the issuer the current value of every key it is subscribed to on the target as a metadata batch of METADATA server-message events (not 761), and for a channel target also every member's subscribed user metadata. Oper-restricted keys (slice 223) are withheld from a non-oper via the pure metadata::sync_emits seam. 774 RPL_METADATASYNCLATER is ruled a deliberate divergence — a small in-memory store always syncs immediately, so the load-shedding 'sync later' path is never taken; the numeric is intentionally not added. The draft/metadata-2 track is now complete. Gate: 4 unit tests (subscribed-as-events + empty-batch inverse + channel-member walk + oper-restricted withheld), golden_metadata end-to-end SYNC scenario, and metadata_sync_proptest (6 properties over sync_emits). cargo build 0 warnings; clippy clean.

1 month ago

metrics_endpoint_proptest.proptest-regressions

feat(leveva): add SASL numerics 900-908 (slice 159)

1 month ago

metrics_endpoint_proptest.rs

test(leveva): exclude session-layer verbs (CAP/QUIT/AUTHENTICATE) from command-metering proptest The metrics command counter is recorded in command::dispatch; CAP, QUIT, and AUTHENTICATE are handled by Session::dispatch with an early return before that point, so they never appear in the exposition. The test already carved out QUIT but not CAP — a prior session recorded the failing ['CAP'] seed without fixing it. Extend the carve-out to all session-layer verbs (and AUTHENTICATE, new in slice 159).

1 month ago

metrics_proptest.rs

test(leveva): metrics + STATS m/z fuzz proptests, golden update (P11 slice 42) - metrics_proptest.rs: command_stats matches a BTreeMap model + sorted over arbitrary record_command sequences; the user gauge equals max(raw,0) and the max is a never-shrinking high-water mark over any register/deregister interleaving; STATS m/z through a real Session never panic, always terminate with a 219 echoing the letter, 212 bodies carry numeric count/bytes, STATS z always emits four 249 lines. - stats_proptest.rs: m/M/z/Z moved into the recognized set; body-count model now expects m -> 212,219 and z -> 249x4,219; STATS_NUMERICS gains 212/249. - golden_stats.rs: added STATS m (-> 212 STATS 7 61) and STATS z (-> four 249 lines + Commands 8 processed), deterministic under the fixed script; snapshot regenerated.

1 month ago

mkpasswd_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

modes_proptest.rs

feat(leveva): add +N (roleplay) channel mode (P11 slice 308 part 1) Wire ChanMode::Roleplay (letter +N, bit 0x1_0000_0000) through the channel-mode checklist (enum/ALL/as_char/bit/mode_name/from_char) + the Channels::roleplay_enabled accessor. +N appears in CHANMODES/MYINFO; isupport asserts + golden snapshots regenerated for the new token. The commands that use it land next.

1 month ago

monitor_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

monitor_s2s_proptest.proptest-regressions

test(leveva): MONITOR S2S golden + inbound-lockstep fuzzing (P11 slice 124) - golden_s2s_monitor: boot golden through the real binary — a local alice MONITORs two not-yet-existing nicks, then a peer drives rover online (UNICK → 730), rename (NICK → 731 old + 730 new), and offline (QUIT → 731); snapshot the canonicalized 730/731 push lines. - monitor_s2s_proptest: pins the inbound push plane against a bool presence model — a random script of online/offline attempts pushes exactly one 730 on an offline→online and one 731 on online→offline (idempotent no-ops stay silent), plus unknown-quit-fabricates-nothing and arbitrary-bytes panic-freedom. - Drop the stray golden_s2s_invite .snap.new accidentally tracked by slice 123. Also adds the slice plan under docs/superpowers/plans/.

1 month ago

monitor_s2s_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

motd_reload_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

msgid_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

msgid_s2s_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

multi_prefix_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

names_list_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

nchange_snomask_proptest.rs

feat(leveva): +s/+n NCHANGE snomask producer — local nick-change spy notices — P11 slice 258

1 month ago

netio_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

netjoin_batch_proptest.rs

test(leveva): netjoin batch framer proptest (fuzz, slice 160) Mirrors netsplit_batch_proptest: empty flood -> nothing; non-empty bracketed + every inner tagged + params preserved over random JOIN/MODE floods; arbitrary input never panics and always re-parses.

1 month ago

netsplit_batch_proptest.rs

feat(leveva): IRCv3 netsplit batch type (P11 slice 157) The first batch *type* beyond slice 155's labeled-response: a server split's QUIT flood is collapsed into one IRCv3 `netsplit` batch per batch-capable local co-member, so a client can visually suppress netsplit casualties. - pure framer `s2s::squit::netsplit_frame` (reuses slice-155 `labeled::next_ref`) - `squit_subtree` restructured inline-deliver -> per-recipient collect->deliver; split teardown helpers keep the single relayed-QUIT path immediate; non-batch recipients stay byte-identical (zero churn in existing squit/netsplit tests) - the two server-name params resolved from the split point (s2 = squit root name, s1 = its slice-88 tree parent name, falling back to ctx.name for a direct peer) - QUIT reason kept as leveva's existing text (divergence; names ride BATCH params) - netjoin/chathistory deferred; leveva-native (no differential) Tests: 4 squit units + netsplit_batch_proptest (3 props) + golden_s2s_netsplit_batch (cap client batched, plain client bare-QUIT inverse).

1 month ago

nick_collision_proptest.rs

test(leveva): nick-collision resolution fuzzing + inverse units (P11 slice 112) Closes the testing-plan §4 nick_collision fuzzing gap (golden but no proptest) now that the cross-daemon differential matrix is complete (slice 111 = last undiffed surface). Fuzzes the S2S collision logic (s2s::unick::handle_unick + s2s::save::handle_save), whose minimal first-claimant-wins policy deliberately diverges from the oracle's nick-timestamp arbitration — so it is pinned against an independent first-claimant model, not a skeleton differential. - nick_collision_proptest.rs (3 props): model agreement over a random UNICK sequence (collision <=> a SAVE is emitted); the freed-slot inverse (handle_save(winner) frees the nick -> a third user takes it cleanly); arbitrary UNICK/SAVE through s2s::dispatch never panics. - +2 inverse units: two losers on one nick both SAVEd / winner intact; a freed nick is re-claimable by a different UID. Characterization — no leveva source change. Lib 1172 (+2), proptest 3/3.

1 month ago

njoin_live_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

no_implicit_names_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

nocolor_proptest.rs

feat(leveva): +c no-control-codes (no-color) channel mode — P11 slice 232 A leveva-native channel flag mirroring slice-220 +C (no-CTCP): a PRIVMSG or NOTICE carrying mIRC text-formatting control codes (bold/color/italic/hex/ reset/mono/reverse/strike/underline) to a +c channel is blocked 404 ERR_CANNOTSENDTOCHAN :Channel doesn't accept control codes (PRIVMSG) or silently dropped (NOTICE), and not delivered. Port of charybdis MODE_NOCOLOR. leveva blocks rather than charybdis's strip — never mutating the body (the utf8only/+C "reject, don't mangle" stance). Unlike +C (PRIVMSG-only), +c gates both PRIVMSG and NOTICE. Ops not exempt; distributed enforcement at the sender's home server, like +n/+m/+C — no S2S enforcement path. Pure seam channel::has_control_codes(text) + FORMATTING_CODES const, paired with Channels::blocks_color(name); gated in command/message.rs right after the +C check. ChanMode::NoColor ('c', bit 0x2000000) wired through both flag-mode allowlists (mode.rs + command::mode::supported_flag); CHANMODES/004 auto-derive. Also corrects a pre-existing stale golden_setname snapshot (its CHANMODES was missing the slice-220 C). Tests: 7 unit (mode/channel/message), nocolor_proptest (~2k cases vs an independent model), golden_nocolor end-to-end, 9 regenerated 004/005 snapshots. cargo test -p leveva --lib 2110 pass; clippy clean; workspace builds 0 warnings.

1 month ago

noctcp_proptest.rs

feat(leveva): +C no-CTCP channel mode — P11 slice 220 A leveva-native port of charybdis MODE_NOCTCP, extending the slice-214 speech-plane work. On a +C channel a CTCP query other than ACTION sent as a PRIVMSG is refused 404 ERR_CANNOTSENDTOCHAN :Channel doesn't accept CTCP and is not delivered. NOTICE/CTCP-reply never blocked; ops not exempt; distributed enforcement at the sender's home server (like +n/+m/+b). - mode.rs: ChanMode::NoCtcp ('C', bit 0x1000000, MODE_NOCTCP) — enum/ALL/ as_char/bit/mode_name/from_char; ISUPPORT + 004 auto-derive. - command/mode.rs: supported_flag (the second char→mode allowlist used by the MODE parser) gains 'C' — without it the command 472s though from_char knows C. - channel.rs: pure is_blocked_ctcp (public fuzz seam) + Channels::blocks_ctcp. - command/message.rs: gate in the channel CanSend::Ok arm (PRIVMSG only). Tests: mode/message/channel unit + the MODE-command path; golden_noctcp end-to-end; noctcp_proptest (total + model-lockstep); regenerated 6 golden snapshots + 3 inline string assertions for the added C.

1 month ago

noctcp_umode_proptest.rs

feat(leveva): user mode +C no-CTCP (P11 slice 306) Port charybdis extensions/umode_noctcp.c to a leveva user mode +C: a self-settable umode that refuses CTCP queries (other than ACTION) sent to the user as a PRIVMSG, replying 531 ERR_CANNOTSENDTOUSER :+C set. NOTICE, CTCP replies, and ACTION always pass. The recipient-side private-message counterpart of the channel +C (slice 220), reusing the fuzzed channel::is_blocked_ctcp. Pure seams mode::is_noctcp + mode::noctcp_user_blocks (the composite gate decision), enforced home-server-local on both the local command/message.rs path and the inbound-S2S s2s/relay::inbound_message path (new noctcp_reject_remote routes 531 to the sender's uplink, the +R 248->249 split precedent). The bit still propagates (slice-254 "no local-only umodes"), so WHOIS shows +C. Bit 0x80000, numeric 531; umode_diff/RENDERED/004-literal/snapshot wiring per the user-mode checklist. Tests: mode seam units, command self-settable + inverse, message gate + inverses, s2s inbound + inverses, golden_noctcp_umode, noctcp_umode_proptest (5 props). 5 welcome snapshots regenerated (004 gains C).

1 month ago

noforward_proptest.rs

feat(leveva): +Q no-forward user mode (charybdis UMODE_NOFORWARD) — P11 slice 250 The user-side counterpart of the channel +f forwarding feature (slice 242), closing the +f family. A client that sets +Q on itself is never redirected by a +f channel: a forwardable JOIN reject (+i/+l/+b/+r) falls through to the source channel's original reject numeric instead of a 470 RPL_LINKCHANNEL + re-JOIN of the target. Client-settable, purely-local umode (letter Q, bit 0x8000) — like +D/+R/+g/+G: the forward decision runs only at the joining user's home server (a remote NJOIN is never forwarded), so the bit is not in SEND_UMODES. Decision core mode::is_noforward; the JOIN forward condition gains !is_noforward(joiner.modes). (Disjoint from the channel +Q DisableForward, which reuses the letter in its own table — the channel refuses incoming forwards; this user refuses being forwarded.) Tests: boot-golden golden_noforward.rs (a +Q user gets a plain 473, no 470/no forward; -Q restores the redirect) and proptest noforward_proptest.rs (the forward composite is false for every reject/allow_forward/co-set-mode combo when +Q is set, exactly allow_forward && forwardable when clear; bit + letter round-trip uniquely). Updated the s2s::umode local-only exclusion + the two 004/ISUPPORT literals; regenerated the 5 welcome-burst snapshots (004 usermode param …GZDR → …GZDRQ).

1 month ago

nonotice_proptest.rs

feat(leveva): +T no-NOTICE channel mode (charybdis MODE_NONOTICE) — P11 slice 239 Add the leveva-native channel flag +T: a NOTICE addressed to the channel is silently dropped, a PRIVMSG is unaffected (the inverse of +C). A port of charybdis's extensions/chm_nonotice.c, continuing the chm_simple speech-plane track (+C/+c/+S/+z). Wiring mirrors slice 220 (+C): ChanMode::NoNotice (letter T, bit 0x20000000) + supported_flag allowlist + Channels::blocks_notice + the pure notice_blocked decision, enforced in command::message's CanSend::Ok arm (silent drop, no 404). Ops not exempt; distributed enforcement at the sender's home server (no S2S follow-on, as for +C/+c). ISUPPORT CHANMODES/MYINFO auto-derive the new T; snapshots + hard-coded assertions updated. Tests: golden_nonotice (TDD red-first) + channel/message/mode unit tests + fuzz (nonotice_proptest over the notice_blocked predicate; modes_proptest FLAGS += NoNotice). Gate: cargo test -p leveva green, clippy clean, build 0 warnings.

1 month ago

ojoin_proptest.rs

feat(leveva): InspIRCd-style OJOIN +Y official-join (P11 slice 165) Port InspIRCd's m_ojoin: a network-service "official join" via the oper-only OJOIN <channel> command plus a top-of-hierarchy channel membership mode +Y (sigil !, rank 128). An OJOIN'd oper is forced in past every restriction, granted +Yo, announced to the channel, and made un-kickable; +Y is set only by OJOIN/burst and self-removable only. - mode.rs: ChanMode::OfficialJoin (Y/!/rank 128/min_rank_to_set u8::MAX), leads MEMBERSHIP_BY_RANK -> PREFIX=(Yqaohv)!~&@%+ - channel.rs: KickVictim::OfficialBusiness (absolute kick immunity) + a +Y-scoped self-removal escape in apply_changes - s2s: MemberPrefix gains `official` (! wire) so +Y bursts/NJOINs round-trip - command/ojoin.rs (+ join::force_join_self, dispatch wiring); MODE parses Y; kick.rs renders the official-business 482 - fuzz: tests/ojoin_proptest.rs (model-lockstep); tests/golden_ojoin.rs - help/OJOIN.md + CHANNEL_MODES.md membership ranks; refreshed 9 burst snapshots

1 month ago

okick_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

olist_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

oper_only_proptest.rs

feat(leveva): charybdis-style extended bans (P11 slice 164) Add `+b`/`+e`/`+I` ban-list entries of the form `$[~]<type>[:<data>]` that match a richer client predicate than a plain nick!user@host glob, ported faithfully from Elemental-IRCd (doc/technical/extban.txt, src/extban.c, extensions/extb_*.c). A new `leveva::extban` module holds the framework (the $/~/: parse, Verdict/ModeType/Subject/ChannelView, match_extban/valid_extban/ entry_matches/extban_chars) plus one handler file per type: $a account, $o oper, $z ssl, $r realname, $x extgecos, $s server, $c on-channel, $j banned-from-channel, $m usermode. The nine handlers were implemented in parallel via a multi-agent workflow, one per extb_*.c. Extbans are enforced at the JOIN gate: check_join's last param is now &extban::SubjectAttrs (was is_oper: bool), and its +b/+e/+I iteration runs through extban::entry_matches against a Subject built in place. A private LiveChannels ChannelView adapter resolves $c/$j from the already-locked channel map (no re-lock) with a depth-1 recursion guard for nested $j. join.rs builds SubjectAttrs from the registry (account, certfp->ssl, realname, modes->oper/umodes) plus the server name. ISUPPORT advertises EXTBAN=$,acjmorsxz (re-chunking nine existing 005 golden bursts, content-identical). Divergences (leveva-native, documented): JOIN-gate-only enforcement (no PRIVMSG/quiet plane; +q is the slice-158 owner mode), $s matches the joiner's server (= me.name for a local JOIN), $j caps at depth 1, $x has no DynSpoof retry, and add-time validity rejection is deferred. Tests: 97 extban unit tests, elemental_extban_proptest (parser totality, negation duality, $a model, extban_chars invariant), and a real-binary golden_extban. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

oper_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

oper_tag_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

operpeace_proptest.rs

test(leveva): fuzz + golden for +M operpeace (P11 slice 309) operpeace_proptest (3 props: total + model-equal over the boolean cube; an oper kicker is never blocked; a non-+M channel never blocks) + golden_operpeace (boot: a non-oper chanop's KICK of an oper on +M -> 482; an oper kicker bypasses).

1 month ago

operwall_proptest.rs

feat(leveva): +z operwall user mode + OPERWALL command (charybdis UMODE_OPERWALL) — P11 slice 252 The oper-only sibling of +w/WALLOPS: an operator broadcasts OPERWALL to every +z operator network-wide. Closes one of the named remaining charybdis umodes. A near-exact mirror of the slice-178 WALLOPS machinery (command/operwall.rs + s2s/operwall.rs). - +z (letter "z", bit 0x10000, FLAGS_OPERWALL): oper-gated to set like +s (non-oper +z silently ignored, -z always allowed); purely local, NOT in SEND_UMODES (the OPERWALL command propagates and each server fans to its own local +z — diverges from +w, which is in SEND_UMODES only for oracle faithfulness). - OPERWALL <text>: oper-only (481), 461 on empty, fans :mask OPERWALL :text to local +z, propagates :<uid> OPERWALL :text; inbound fans is_local_uid-gated + split-horizon relay. - mode.rs UserMode::Operwall (+ is_operwall predicate); umode_diff/RENDERED; 004 umode literal +z; help/OPERWALL.md + USER_MODES.md row. - The mode.rs round-trip test also moved off "z" as its unknown example to ">". Tests: command/operwall.rs + s2s/operwall.rs units (mirror wallops), +z oper-gate units, golden_operwall.rs (+z oper receives, -z oper and -z sender do not), operwall_proptest.rs (delivery decided by +z alone). 5 welcome-burst snapshots gain the z letter. cargo test -p leveva green; clippy clean; build --workspace 0 warnings.

1 month ago

opme_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

opmod_proptest.rs

feat(leveva): +z op-moderation channel mode — P11 slice 235 A port of charybdis chm_simple MODE_OPMODERATE. On a +z channel a message that would be blocked from reaching the channel — by +n (external), +m (moderated), or a +b ban/quiet (CanSend::External/Moderated/Banned) — is not refused 404; it is delivered to the channel's operators (rank >= +o) only, so ops can see what muted, banned, or external users are saying. Ok/NoSuchChannel verdicts are never redirected. Extends the speech-plane can_send work of slices 214/220/232. - mode.rs: ChanMode::OpModerate ('z', bit 0x10000000, Flag kind, MODE_OPMODERATE); CHANMODES + 004 chan-mode string auto-derive from ALL/kind(). - command/mode.rs: 'z' in the supported_flag allowlist (the recurring flag-mode gotcha — needs both the ChanMode and this second allowlist or MODE +z 472s). - channel.rs: pure opmod_redirects(set, verdict) + Channels::op_moderated / op_members (rank >= op). - command/message.rs: the block arm redirects to local ops when op_moderated — no 404, no echo, no relay (TAGMSG/REDACT + S2S op-redirect are documented follow-ons), else the existing 404/silent. Tests: mode/channel/command-mode units (5) incl. inverses; fuzz opmod_proptest (opmod_redirects vs an independent model over every (bool, CanSend); op_members exactly the rank>=op set over arbitrary membership); golden_opmod (real binary: +mz redirects bob's muted line to the op, not to carol/bob, no 404; -z restores the 404). Snapshot/assertion churn: isupport/registration/config literals gain z (+z is now an accepted default flag; unknown-letter test uses '>'); 6 golden 004/005 snapshots regenerated (token-only z). Gate: cargo test -p leveva green (pre-existing golden_restricted_op read_until flake aside); cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

opmod_s2s_proptest.rs

feat(leveva): +z op-moderation S2S op-redirect for TAGMSG/REDACT — P11 slice 238 Closes the sole remaining +z (op-moderation) deferral named by slices 236/237: the TAGMSG/REDACT S2S op-redirect. Until now an op-moderated TAGMSG or REDACT (a +n/+m/+b-blocked tag-only/redaction event on a +z channel) reached only the local operators on the sender's home server (slice 236); operators on other servers never saw it. This carries it network-wide over the slice-237 @<chan> statusmsg seam, so each receiving server fans it to its local operators only (trusting the @<chan> marker, not re-checking +z — distributed enforcement, like +n/+m/+b). - TAGMSG (first-class verb): relay::local_opmod_tagmsg (wraps local_tagmsg, broadcast_tag_only) + relay::fanout_local_ops_tagmsg_render (local ops with message-tags) + an @<chan> arm in inbound_tagmsg before the is_channel arm. - REDACT (rides ENCAP): redact::local_opmod_redact_channel (wraps local_redact_channel -> ENCAP * REDACT @<chan>) + an @<chan> arm in apply_encap_redact fanning to local ops with draft/message-redaction; the onward relay is forward::inbound_encap's verbatim ENCAP broadcast. - Wired into command::tagmsg / command::redact op-moderated arms after the local-op fanout, carrying the same minted msgid/server-time as the CanSend::Ok path. Unit-tested (relay/redact outbound + inbound op/cap/member inverses; command-layer S2S relay + the no-+z inverse) and fuzzed (opmod_s2s_proptest round-trip + a new wrapped_target_is_never_a_bare_channel safety invariant). The +z track (235-238) is now complete with no remaining follow-on. Also slimmed the bloated PLAN.md P11 row.

1 month ago

parse_utf8_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

pass_proptest.rs

test(leveva): fuzz authorize_connection vs an independent model + structural laws (slice 82) Adds iline_proptest (three-way verdict matches a reference walk; empty-accepts and non-matching-non-empty-is-no-authorization invariants) and updates pass_proptest to the new admission semantics.

1 month ago

password_classify_proptest.rs

test: cap case counts for crypt-bound password proptests `MKPASSWD` and the config password classifier both run a real SHA-512 `crypt(3)` per case (deliberately slow key stretching), so the default 256 cases pushed each file to tens of seconds with no added coverage — the round-trip / usage / panic-safety properties are exercised just as well by a dozen cases. Pin `real_sha512_hash_round_trips` and the whole mkpasswd suite to `ProptestConfig::with_cases(12)`. password_classify: 43s -> 1s. mkpasswd: -> 1.1s. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

permanent_proptest.rs

feat(leveva): add +N (roleplay) channel mode (P11 slice 308 part 1) Wire ChanMode::Roleplay (letter +N, bit 0x1_0000_0000) through the channel-mode checklist (enum/ALL/as_char/bit/mode_name/from_char) + the Channels::roleplay_enabled accessor. +N appears in CHANMODES/MYINFO; isupport asserts + golden snapshots regenerated for the new token. The commands that use it land next.

1 month ago

ping_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

post_registration_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

pre_away_proptest.rs

feat(leveva): IRCv3 draft/pre-away / accept AWAY before registration (P11 slice 75) A client that negotiates draft/pre-away may send AWAY before registration completes; the staged away is applied at finalize so WHOIS/WHO/PRIVMSG see it from connect. AWAY * is stored verbatim. Without the cap, a pre-registration AWAY is refused (451). - cap.rs: DRAFT_PRE_AWAY const + SUPPORTED tail + ClientCaps.pre_away + mapping - registration.rs: stage away (apply_pre_away/pre_away), truncated via the shared command::away::truncate (AWAY_MAX); command::away made pub(crate) - session.rs: intercept AWAY pre-CAP-END (before the pending_complete guard); fold +a into seeded modes + mirror registry away at finalize - tests: cap/registration/session units, golden_pre_away, pre_away_proptest; regenerated the two golden_cap snapshots

1 month ago

prereg_flood_proptest.proptest-regressions

fix(test): assume base-cost verbs in prereg small-burst flood proptest `a_small_pre_registration_burst_never_floods` asserted a 0..50 burst of an `[A-Z]{1,8}` verb never floods, assuming each costs base 1 — but the strategy can emit a real surcharged command (WHO/LIST cost 5, JOIN/KNOCK cost 3 per slice 202), and 13xLIST (65) already crosses the 60 ceiling. A latent flake that only tripped on unlucky seeds. Skip surcharged verbs via the real `flood::command_penalty` rather than re-encoding the command table, keeping the documented base-cost invariant honest.

1 month ago

prereg_flood_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

privmsg_mask_proptest.rs

test(leveva): boot golden + proptest for PRIVMSG/NOTICE mask targets

1 month ago

privmsg_proptest.proptest-regressions

test(leveva): fix privmsg conservation model for slice-87 target dedup delivery_is_well_formed_and_conserved's model counted every comma-separated target occurrence, but slice 87's canonicalize_targets de-duplicates the list case- insensitively, so a target repeated within one PRIVMSG/NOTICE delivers once. The model predated the dedup → a persisted seed (PRIVMSG a{},a{}) predicted 2 deliveries while the server (correctly) delivered 1. Fix the test model, not the server: de-dup each message's target list by folded nick before tallying expected deliveries, matching canonicalize_targets' eq_ignore_case (fold-equality). Check in the regression seed as a permanent guard.

1 month ago

privmsg_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

query_routing_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

readmarker_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

redact_proptest.proptest-regressions

feat(leveva): message redaction deletes the chat-history line — P11 slice 275 Wire IRCv3 message-redaction (REDACT) to the slice-274 chat-history store: an accepted channel `REDACT <chan> <msgid>` now deletes the stored line so CHATHISTORY can never replay it. Closes the gap left by slice 274, where REDACT was a pure relay and command/redact.rs still claimed "leveva keeps no message history". - history.rs: new History::delete_by_msgid(target, msgid) -> usize (DELETE WHERE folded-target + msgid; no-op when disabled/unknown). Unit tests + a proptest fuzzing an arbitrary redacted subset. - command/redact.rs: delete in the channel CanSend::Ok arm only; refresh the stale "no history" docstring (still a stateless authorization relay, but the storage side now deletes). - s2s/redact.rs: delete in the plain-channel inbound branch of apply_encap_redact so each server drops its own recorded copy. Load-bearing boundary: deletion mirrors recording (full-delivery only). A +z op-moderated REDACT — local opmod broadcast and inbound @<chan> op-redirect — is "shown to ops", never recorded, so never deleted. Nick/DM targets aren't channel history. Gate: history/command::redact/s2s::redact units; golden_chathistory end-to-end (learn a msgid, REDACT it, re-query -> gone, sibling survives); two new redact_proptest command-path fuzzes (random subset via real Session + rejected-non-member-deletes-nothing). cargo clippy -p leveva --tests clean; full cargo test -p leveva green.

1 month ago

redact_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

redact_s2s_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

registration_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

registry_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

regonly_msg_proptest.rs

feat(leveva): +R registered-only-messages user mode (charybdis UMODE_REGONLYMSG) — P11 slice 248 A +R user receives a private PRIVMSG/NOTICE only from a sender identified to a services account, bypassed by an identified/operator/accepted sender; a blocked PRIVMSG bounces 486 ERR_NONONREG, a NOTICE is silently dropped. Channel messages are unaffected. Client-settable, purely local (gate runs on the target's home server) so not in SEND_UMODES — the caller-id/deaf precedent. This is the local-sender plane; the remote-sender S2S plane is the slice-249 follow-on (mirroring the caller-id 216->217 split). UserMode::RegOnlyMsg (bit 0x4000), mode::is_regonly_msg predicate, callerid::regonly_msg_blocks decision core, the command::message gate, and numeric 486. Unit + golden + proptest coverage; 004 usermode list -> oOiwraWBxsgGZDR.

1 month ago

regonly_msg_s2s_proptest.rs

feat(leveva): +R registered-only-messages remote-sender S2S plane — P11 slice 249 Close the remote-sender half of the +R (charybdis UMODE_REGONLYMSG) gate: slice 248 enforced it only for a local sender, this re-runs the same decision on the target's home server for a remote sender arriving across a link — the caller-id 216->217 split repeated, completing the +R family. s2s::relay::inbound_message's local-nick branch now runs the unchanged pure callerid::regonly_msg_blocks core for a remote sender (neither +R nor +g/+G is in SEND_UMODES, so the gate is local to the target's server), reusing the already- resolved sender_account/sender_is_oper values plus registry.modes_of(target) and callerid().is_accepted. A blocked PRIVMSG bounces one 486 ERR_NONONREG to the sender's uplink via the new regonly_msg_reject_remote helper (no once-per-pair notify and nothing to the target — unlike caller-id's 717/718); a blocked NOTICE is silently dropped. Caller-id +g/+G keeps precedence (its gate continues first). Tests: 6 units in s2s/relay.rs (block + NOTICE-silent inverse + the three identified/oper/accepted bypasses + a plain-target baseline) and a new 4096-case regonly_msg_s2s_proptest.rs mirroring callerid_s2s_proptest. No separate golden, matching slice 217 (S2S planes are unit+proptest only). Gate: cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

regonly_proptest.rs

feat(leveva): +r registered-only-join channel mode (charybdis MODE_REGONLY) — P11 slice 241 Adds the leveva-native channel flag mode +r: on a +r channel only a client signed in to a services account may JOIN; a signed-out client is refused 477 (charybdis ERR_NEEDREGGEDNICK, which overloads numeric 477 — reuses Numeric::ErrNochanmodes since a duplicate-discriminant variant is impossible). The join-plane sibling of +g; a hard JOIN gate like +O/+S (an INVITE/key/ exception does NOT bypass it — account identity is a user property), so KNOCK to a +r channel is refused too. - mode.rs: ChanMode::RegisteredOnly, letter r, bit 0x80000000 (last free u32 bit), Flag kind; added to ALL/as_char/bit/mode_name/from_char. - command/mode.rs: supported_flag 'r' (the second allowlist). - channel.rs: pure regonly_blocks(set, has_account) seam + the hard-gate clause in check_join (reads attrs.account, same source as $a extban); new JoinReject::RegisteredOnly. - command/join.rs + command/knock.rs: reject mapping + KNOCK refusal. - ISUPPORT/MYINFO auto-derive (CHANMODES …SzTgr, MYINFO …SzTgr…); 10 snapshots + isupport/registration assertions updated (token-only). Reclaiming the slice-77 ripped-out reop letter r triggered the unknown-chanmode-letter hazard: removed the obsolete ripped_out_reop_is_unknown test, updated chan_mode_bits_match_oracle, switched golden_modes's unknown-mode probe to +>, and repurposed the modes_proptest AnonReop op to BareAdmin. Tests: golden_regonly.rs (RED-first), channel/mode/command::mode units (gate + inverse + hard-gate proof + truth table), regonly_proptest.rs, modes_proptest FLAGS += RegisteredOnly. cargo test -p leveva green; cargo clippy -p leveva --tests clean; cargo build --workspace 0 warnings.

1 month ago

rehash_conf_proptest.rs

feat(leveva): add +N (roleplay) channel mode (P11 slice 308 part 1) Wire ChanMode::Roleplay (letter +N, bit 0x1_0000_0000) through the channel-mode checklist (enum/ALL/as_char/bit/mode_name/from_char) + the Channels::roleplay_enabled accessor. +N appears in CHANMODES/MYINFO; isupport asserts + golden snapshots regenerated for the new token. The commands that use it land next.

1 month ago

rej_snomask_proptest.rs

feat(leveva): +s/+r REJ snomask producer — rejected/banned-connection spy notices — P11 slice 262 Wire the fifth producer-less snomask category opened by slice 257 (after n/x/y/f). charybdis SNO_REJ (letter `r`) fans a notice to local opers carrying +s +r whenever a client connection is actively rejected by a ban or blocklist at registration — the REJ half of the pair slice 261 deferred (the UNAUTH `u` authorization-failure half stays a follow-on). Chokepoints = the three active-ban refusals in session.rs::finalize_registration, each firing server_notice_cat(SnoMask::rej(), reject_notice(...)) before the ERROR close: dnsbl auth-deny (reports the raw USER param — runs before username resolution), runtime K-line, static config-ban. The connection-cap denials stay FULL (261); the no-I-line (465) / bad-password (464) / ident-required authorization failures are deliberately not REJ. - snomask.rs: SnoMask::rej() accessor (r bit, reserved since 257) + doc-table row. - snotice.rs: reject_notice builder "Rejecting client <nick>!<user>@<host> (<reason>)". - session.rs: fan at the three chokepoints; tests for each + inverses. - tests/rej_snomask_proptest.rs: builder fuzz (never panics, embeds each field). Local-only like every snomask producer; no S2S plane. Gate: cargo test -p leveva green (lib + new proptest); clippy clean; cargo build --workspace 0 warnings.

1 month ago

relay_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

remote_account_tag_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

remove_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

restricted_proptest.rs

feat(leveva): a restricted (+r) user cannot change nick — NICK→484 (P11 slice 196) Completes the IRCnet IsRestricted family (RFC 2812 §3.1.7: a restricted client cannot change nickname, nor become a channel/IRC operator). The post-registration NICK handler now refuses a +r connection with 484 ERR_RESTRICTED, placed after the 431 guard but before the 432/433 checks so the restriction dominates a malformed or taken target (mirroring OPER's pre-credential 484); case-only changes are refused too. Local-only; inbound S2S NICK and oper SANICK are untouched. Tests: 4 nick.rs units (incl. 433/432 precedence + 431 inverse), a fuzzed restricted_proptest case (NICK never renames; control does) + NICK added to the panic-freedom fuzz, and golden_restricted_nick.rs at the wire.

1 month ago

resv_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

roleplay_proptest.rs

test(leveva): fuzz + golden for roleplay (P11 slice 308 part 3) roleplay_proptest: compose is total/never-panics over spicy nick+text input, the display nick keeps no control char but the deliberate \x1F underline pair, ACTION bodies are \x01ACTION…\x01, the (author) attribution is always present, and underline only wraps the same inner nick. golden_roleplay: NPC underlined fake nick + SCENE =Scene= delivered to a co-member, inverse -N channel → 573.

1 month ago

s2s_client_reject_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

s2s_forward_proptest.rs

feat(leveva): S2S capability negotiation — CAPAB verb + egress tag-filter (P11 slice 126) Close a latent breaking-protocol bug: slices 58–66 attached client-only (@+…) tags to S2S lines for every peer unconditionally, so a tag-blind peer would mis-parse the leading @. leveva now negotiates message-tag support per link. - New s2s/caps.rs: PeerCaps { message_tags } + from_capab/ours (named tokens). - PeerLink.caps (default none until the peer's CAPAB arrives). - burst opens with `:<sid> ENCAP * CAPAB :message-tags`. It rides ENCAP because a bare unknown server command is fatal in IRCnet 2.11 (the ircd-common oracle SQUITs the link); ENCAP is m_nop'd and tolerated. CAPAB is link-local (interpreted in forward::inbound_encap, never relayed onward). - Egress tag-filter: callers always build the tagged wire; PeerLinks::broadcast/ route strip the leading @tags for a non-tag peer (egress_wire/strip_leading_tags), and broadcast_tag_only/route_tag_only send a tag-only TAGMSG to tag peers only. The relay functions revert to simple build-tagged + broadcast/route. - set_caps/caps_of on the routing table (the egress authority); the CAPAB arm updates both link.caps and the table. The ~24 peers.link() call sites gain a caps arg (mostly test helpers pass link.caps / PeerCaps::default()). leveva-native; no oracle differential for tags.

1 month ago

s2s_netsplit_concurrency_proptest.proptest-regressions

fix(leveva): netsplit batch no longer duplicated to batch clients — P11 slice 277 A `batch`-capable local client could receive a netsplit casualty's QUIT (and its enclosing IRCv3 `netsplit` batch) twice when the same splitting subtree was torn down by two tasks at once — a dying peer detected via its abrupt socket drop AND a sibling's inbound SQUIT, each calling squit_subtree in its own tokio task. The mirrored-user sweep is single-shot (Network::remove_behind_sid drains under one lock), but the NJOIN-only ghost-member sweep used co_members(uid) then remove_everywhere(uid) — two separate lock acquisitions with no gate — so two racing teardowns both relayed the ghost's QUIT. New atomic Channels::detach_member fuses recipient-gather + removal into one critical section and returns None for the racing loser, making the QUIT fan-out idempotent. s2s::squit teardown helpers rewired onto it. Tests: new s2s_netsplit_concurrency_proptest (RED before the fix: max_per_casualty == 2) + channel detach_member unit test with inverse invariants.

1 month ago

s2s_netsplit_concurrency_proptest.rs

fix(leveva): netsplit batch no longer duplicated to batch clients — P11 slice 277 A `batch`-capable local client could receive a netsplit casualty's QUIT (and its enclosing IRCv3 `netsplit` batch) twice when the same splitting subtree was torn down by two tasks at once — a dying peer detected via its abrupt socket drop AND a sibling's inbound SQUIT, each calling squit_subtree in its own tokio task. The mirrored-user sweep is single-shot (Network::remove_behind_sid drains under one lock), but the NJOIN-only ghost-member sweep used co_members(uid) then remove_everywhere(uid) — two separate lock acquisitions with no gate — so two racing teardowns both relayed the ghost's QUIT. New atomic Channels::detach_member fuses recipient-gather + removal into one critical section and returns None for the racing loser, making the QUIT fan-out idempotent. s2s::squit teardown helpers rewired onto it. Tests: new s2s_netsplit_concurrency_proptest (RED before the fix: max_per_casualty == 2) + channel detach_member unit test with inverse invariants.

1 month ago

s2s_netsplit_proptest.rs

feat(leveva): LINKS/MAP enumerate the true network tree via RemoteServer.parent (P11 slice 88) m_links/m_map hardcoded single-server output despite the Network mirror tracking the whole topology since slices 31-87 (the gap slice 52 flagged). Both now enumerate the mirror as the oracle does, rendering the genuine multi-level tree (no flattening, per the user). RemoteServer.uplink is the routing direct-peer, not the tree parent; the oracle prints serv->up->name (the real spanning-tree edge). So add a display-only RemoteServer.parent (the true tree parent = the announcing SERVER/SMASK line prefix), populated at the three real introduction sites (handshake = our SID, server.rs = the :announcing_sid prefix, smask = announcer) + ~20 test fixtures. Routing/squit_subtree still key on uplink. New command/topology.rs: topology() enumerator (me first, remotes in Sid order, per- server user counts, orphan-reparents-to-root) + a pure map_lines() tree renderer faithful to dump_map's ' |- '/' `- ' connector cells with a visited-set cycle guard so every server renders exactly once. links() shows each server's true upstream; map() nests behind-peer servers under their parent. Single-server output is byte-identical (zero existing-snapshot churn). Divergences: MAP s remote version '*' (unmirrored), Sid-sorted order, orphan->root reparenting.

1 month ago

s2s_proptest.proptest-regressions

fix(leveva): burst NJOIN carries the channel TS — P11 slice 215 A channel a server learned **for the first time in a burst** was re-clocked to the receiver's local nanosecond clock instead of adopting the origin's `created_at`: the leading `CHANTS` is dropped on an unknown channel (`apply_encap_chants` → `ChanTsOutcome::Unknown`), and the burst `NJOIN` was TS-less, so `handle_njoin` stamped `clock::unixnano()`. Two servers then disagreed on a channel's TS by *when each learned it*, and the next merge deopped the later learner — the divergence slice 167 fixed for the live NJOIN, left unfixed on the burst path. Observed in prod: updating a server to v0.1.0 and relinking stripped `#xe`'s ops + `+R` that should have survived the merge. Fix: the burst `NJOIN` now carries the channel TS as a middle param (`:<sid> NJOIN <chan> <ts> :<members>`, the live form since slice 167) so a peer adopts the origin's TS. Safe w.r.t. the merge case despite the slice-167 caveat: the burst is CHANTS-first (slice 171), so `we_lost` reads the pre-merge `created_at` before NJOIN runs, and `njoin_member` only stamps on creation — so for an existing channel the NJOIN-TS is a no-op (CHANTS owns arbitration), and it only supplies the TS for a newly-learned channel. `njoin_member_chunks` subtracts `1 + ts_digits` from the line budget; the boot canonicalizer masks the new `NJOIN <chan> <ts> :` TS like CHANTS/USERTS. Tests: burst_channel_ts_is_adopted_not_reclocked (the regression), burst_njoin_line_carries_the_ts_middle_param, …_does_not_clobber_an_existing _channels_arbitrated_ts (inverse merge), and a fuzz round-trip over arbitrary origin TS. Updated the two burst snapshots + golden_s2s_njoin_live. Gate: cargo test -p leveva green (pre-existing golden_s2s_keepalive BrokenPipe flake aside); clippy clean; workspace build 0 warnings.

1 month ago

s2s_proptest.rs

feat(leveva): InspIRCd-style OJOIN +Y official-join (P11 slice 165) Port InspIRCd's m_ojoin: a network-service "official join" via the oper-only OJOIN <channel> command plus a top-of-hierarchy channel membership mode +Y (sigil !, rank 128). An OJOIN'd oper is forced in past every restriction, granted +Yo, announced to the channel, and made un-kickable; +Y is set only by OJOIN/burst and self-removable only. - mode.rs: ChanMode::OfficialJoin (Y/!/rank 128/min_rank_to_set u8::MAX), leads MEMBERSHIP_BY_RANK -> PREFIX=(Yqaohv)!~&@%+ - channel.rs: KickVictim::OfficialBusiness (absolute kick immunity) + a +Y-scoped self-removal escape in apply_changes - s2s: MemberPrefix gains `official` (! wire) so +Y bursts/NJOINs round-trip - command/ojoin.rs (+ join::force_join_self, dispatch wiring); MODE parses Y; kick.rs renders the official-business 482 - fuzz: tests/ojoin_proptest.rs (model-lockstep); tests/golden_ojoin.rs - help/OJOIN.md + CHANNEL_MODES.md membership ranks; refreshed 9 burst snapshots

1 month ago

s2s_pseudoserver.rs

test(leveva): boot golden servers on ephemeral ports for safe parallelism The golden harness pinned every single-node and s2s fixture to port 16700 under one global flock, serializing the entire boot-level suite. Rework it so a fixture using the conventional 16700/16701 ports is booted on freshly reserved ephemeral ports instead, with the real port threaded to clients via a thread-local — so all ~240 existing PORT/S2S_PORT call sites stay unchanged. Concurrency is now bounded by a CPU-count counting semaphore (so parallel binary runners do not oversubscribe the single-threaded daemon and trip the read deadline) rather than the all-or-nothing lock, and same-fixed-port tests serialize on a per-port lock instead of globally. This removes the lock that would otherwise force a parallel runner (cargo nextest) back to serial. Also fix the dynamic-port-sensitive output: mask the numeric link name in the 211 STATS canonicalizer, keep the temp config's basename equal to the fixture so the 382 rehash reply is unchanged, and pass the real s2s port to the external Python pseudoserver. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

s2s_sendq_proptest.rs

test(leveva): fuzz the server-link SendQ accounting (P11 slice 148) s2s_sendq_proptest: a peer at ceiling M fed an arbitrary frame-length sequence through PeerLinks::route in lockstep with an independent model — per-frame verdict (queued vs dropped), exact mailbox contents (Wire prefix, one terminal eject at the overrun, then nothing), and the single latched eject all match; an uncapped peer tracks the model forever and never latches dead. Panic-free.

1 month ago

s2s_server_proptest.rs

feat(leveva): S2S capability negotiation — CAPAB verb + egress tag-filter (P11 slice 126) Close a latent breaking-protocol bug: slices 58–66 attached client-only (@+…) tags to S2S lines for every peer unconditionally, so a tag-blind peer would mis-parse the leading @. leveva now negotiates message-tag support per link. - New s2s/caps.rs: PeerCaps { message_tags } + from_capab/ours (named tokens). - PeerLink.caps (default none until the peer's CAPAB arrives). - burst opens with `:<sid> ENCAP * CAPAB :message-tags`. It rides ENCAP because a bare unknown server command is fatal in IRCnet 2.11 (the ircd-common oracle SQUITs the link); ENCAP is m_nop'd and tolerated. CAPAB is link-local (interpreted in forward::inbound_encap, never relayed onward). - Egress tag-filter: callers always build the tagged wire; PeerLinks::broadcast/ route strip the leading @tags for a non-tag peer (egress_wire/strip_leading_tags), and broadcast_tag_only/route_tag_only send a tag-only TAGMSG to tag peers only. The relay functions revert to simple build-tagged + broadcast/route. - set_caps/caps_of on the routing table (the egress authority); the CAPAB arm updates both link.caps and the table. The ~24 peers.link() call sites gain a caps arg (mostly test helpers pass link.caps / PeerCaps::default()). leveva-native; no oracle differential for tags.

1 month ago

s2s_smask_proptest.rs

feat(leveva): S2S capability negotiation — CAPAB verb + egress tag-filter (P11 slice 126) Close a latent breaking-protocol bug: slices 58–66 attached client-only (@+…) tags to S2S lines for every peer unconditionally, so a tag-blind peer would mis-parse the leading @. leveva now negotiates message-tag support per link. - New s2s/caps.rs: PeerCaps { message_tags } + from_capab/ours (named tokens). - PeerLink.caps (default none until the peer's CAPAB arrives). - burst opens with `:<sid> ENCAP * CAPAB :message-tags`. It rides ENCAP because a bare unknown server command is fatal in IRCnet 2.11 (the ircd-common oracle SQUITs the link); ENCAP is m_nop'd and tolerated. CAPAB is link-local (interpreted in forward::inbound_encap, never relayed onward). - Egress tag-filter: callers always build the tagged wire; PeerLinks::broadcast/ route strip the leading @tags for a non-tag peer (egress_wire/strip_leading_tags), and broadcast_tag_only/route_tag_only send a tag-only TAGMSG to tag peers only. The relay functions revert to simple build-tagged + broadcast/route. - set_caps/caps_of on the routing table (the egress authority); the CAPAB arm updates both link.caps and the table. The ~24 peers.link() call sites gain a caps arg (mostly test helpers pass link.caps / PeerCaps::default()). leveva-native; no oracle differential for tags.

1 month ago

s2s_squit_scale.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

s2s_traffic_proptest.rs

feat(leveva): S2S server-link traffic metrics (P11 slice 180)

1 month ago

s2s_umode_proptest.rs

feat(leveva): +l locops + LOCOPS command, and make all user modes global — P11 slice 254 Part A — +l locops user mode + LOCOPS command (charybdis UMODE_LOCOPS), the local-server sibling of +z/OPERWALL: an oper broadcasts to +l users on the originating server only; the command never crosses a link. Oper-gated to set, letter 'l' (bit 0x40000). New command/locops.rs + golden_locops.rs + locops_proptest.rs. The last named standard charybdis umode — surface complete. Part B — leveva has NO local-only user modes (product decision). SEND_UMODES is now every UserMode::ALL bit (self-maintaining const loop), so +O/+x/+s/+g/+G/+D/ +R/+Q/+z/+l all propagate and a remote WHOIS shows them. Verified safe: the burst already rendered the full unmasked set, and a user's host is always carried explicitly (UNICK field / ENCAP CHGHOST), never recomputed from the +x bit, so +x cannot double-apply the cloak (+x now emits both UMODE +x and ENCAP CHGHOST). Enforcement unchanged: caller-id (+g/+G) and +R stay gated on the target's home server — the ACCEPT list lives only there and is not propagated, so those S2S gates are the actual enforcement, not redundant re-checks, and are kept. - mode.rs: UserMode::LocOps + is_locops(); doc sweep (bit propagates, enforcement is server-local) - command/mode.rs: 'l' in the oper-gated arm + umode_diff; +x test asserts both frames - s2s/umode.rs: SEND_UMODES = every umode; exclusion test -> carries-every-mode - snotice.rs / s2s/relay.rs: stale 'not in SEND_UMODES' comments corrected - help/LOCOPS.md + USER_MODES +l row; 004 umode list -> ...zSl (6 snapshots) - golden_s2s_umode rewritten (demonstrates +D now propagating)

1 month ago

sa_snotice_proptest.proptest-regressions

feat(leveva): +s server-notice snomask category mask — P11 slice 257 Promotes the slice-184 all-or-nothing +s (FLAGS_SERVNOTICE) umode to charybdis's snomask category mask. +s becomes the one parameterized umode: a following token is its snomask delta (apply_delta, ignoring unknown letters), a bare +s seeds SnoMask::ALL (slice-184 back-compat). Per-record snomask routes each notice by category via snotice::server_notice_cat — c (connect/exit), k (kill), s (general/rehash/SA*). 008 RPL_SNOMASK reports the mask; an emptied mask drops +s; a non-oper +s <mask> swallows its param (no spurious 501). The mask is local-only (the bit still propagates); 221/004 unchanged (mask surfaces via 008 only). New: snomask.rs (pure parser/renderer fuzz seam), Numeric::RplSnomask, ClientRecord.snomask + Registry::set_snomask/snomask_of. Tests: snomask + mode + snotice units (incl. inverses), snomask_proptest, golden_snomask; every existing +s watcher test now seeds ALL to model bare-+s. Help: USER_MODES.md +s row.

1 month ago

sa_snotice_proptest.rs

test(leveva): sa_snotice_proptest SANICK expects the slice-258 NCHANGE spy notice The slice-258 `n` NCHANGE producer wired `apply_local_nick_change` (the shared NICK/SANICK rename chokepoint) to fan a `Nick change: From <old> to <new>` spy notice to local `+s +n` watchers. Slice 258 updated the SANICK *unit* test for this but missed this proptest: its case-4 (SANICK) `+s`(ALL) watcher now receives the NCHANGE notice *before* the SANICK audit notice, so the single-line expected set was stale and the property failed (reproduced on clean HEAD). Generalize `expected` from `Option<String>` to an ordered `Vec<String>` notice set and give the SANICK case both lines in fire order (NCHANGE, then audit). Pre-existing red, fixed as a separate prep commit before the slice-260 work.

1 month ago

sasl_mechlist_proptest.rs

feat(leveva): learn the SASL mechanism list from services (ENCAP * MECHLIST) (P11 slice 299) A linked SASL services agent announces its mechanisms via `:<svcSID> ENCAP * MECHLIST :<comma-list>`; leveva learns the list, advertises it (client-facing `sasl=` cap value + `908 RPL_SASLMECHS`) instead of the hardcoded `PLAIN,EXTERNAL`, and relays whichever advertised mechanism a client picks — faithful charybdis transparent relay (special-casing only EXTERNAL for the CertFP; an unadvertised mechanism → 908+904, never relayed). - sasl.rs: pure fuzzed `parse_mechlist`; `Mechanism` reworked `{Plain,External,Other(Box<str>)}` with `from_advertised`/`name`/`is_external`. - s2s/links.rs: PeerLinks learned-mechlist store, cleared when the last sasl agent unlinks. - s2s/mechlist.rs (new): `apply_encap_mechlist`, dispatched in forward.rs's interpret-and-onward-relay block (broadcast, like SU). - cap.rs: `apply`/`ls`/`req` `sasl_available: bool` → `sasl_mechs: Option<&str>`. - session.rs: AUTHENTICATE gate uses `from_advertised`; 908 lists the advertised set; relay_start takes &Mechanism. leveva-native (the C 2.11 oracle predates SASL). Tests cover the happy path and every inverse invariant (unadvertised rejected, all-junk keeps the prior list, unlink clears, default fallback) + 2 proptests.

1 month ago

sasl_proptest.rs

feat(leveva): learn the SASL mechanism list from services (ENCAP * MECHLIST) (P11 slice 299) A linked SASL services agent announces its mechanisms via `:<svcSID> ENCAP * MECHLIST :<comma-list>`; leveva learns the list, advertises it (client-facing `sasl=` cap value + `908 RPL_SASLMECHS`) instead of the hardcoded `PLAIN,EXTERNAL`, and relays whichever advertised mechanism a client picks — faithful charybdis transparent relay (special-casing only EXTERNAL for the CertFP; an unadvertised mechanism → 908+904, never relayed). - sasl.rs: pure fuzzed `parse_mechlist`; `Mechanism` reworked `{Plain,External,Other(Box<str>)}` with `from_advertised`/`name`/`is_external`. - s2s/links.rs: PeerLinks learned-mechlist store, cleared when the last sasl agent unlinks. - s2s/mechlist.rs (new): `apply_encap_mechlist`, dispatched in forward.rs's interpret-and-onward-relay block (broadcast, like SU). - cap.rs: `apply`/`ls`/`req` `sasl_available: bool` → `sasl_mechs: Option<&str>`. - session.rs: AUTHENTICATE gate uses `from_advertised`; 908 lists the advertised set; relay_start takes &Mechanism. leveva-native (the C 2.11 oracle predates SASL). Tests cover the happy path and every inverse invariant (unadvertised rejected, all-junk keeps the prior list, unlink clears, default fallback) + 2 proptests.

1 month ago

secure_umode_proptest.proptest-regressions

feat(leveva): +R registered-only-messages user mode (charybdis UMODE_REGONLYMSG) — P11 slice 248 A +R user receives a private PRIVMSG/NOTICE only from a sender identified to a services account, bypassed by an identified/operator/accepted sender; a blocked PRIVMSG bounces 486 ERR_NONONREG, a NOTICE is silently dropped. Channel messages are unaffected. Client-settable, purely local (gate runs on the target's home server) so not in SEND_UMODES — the caller-id/deaf precedent. This is the local-sender plane; the remote-sender S2S plane is the slice-249 follow-on (mirroring the caller-id 216->217 split). UserMode::RegOnlyMsg (bit 0x4000), mode::is_regonly_msg predicate, callerid::regonly_msg_blocks decision core, the command::message gate, and numeric 486. Unit + golden + proptest coverage; 004 usermode list -> oOiwraWBxsgGZDR.

1 month ago

secure_umode_proptest.rs

test(leveva): fix stale +Z renders-last proptest invariant slices 247 (+D) and 248 (+R) appended user modes after +Z in UserMode::ALL, so render() no longer ends with 'Z' — render_shows_z_iff_secure's ends_with('Z') assertion became a pre-existing red (confirmed via git stash: untouched by the slice-249 work). Replace the brittle positional check with the durable invariant that rendered letters are a table-order subsequence of UserMode::ALL.

1 month ago

sendq_proptest.rs

test(leveva): fuzz SendQ accounting + the Max-SendQ eject (P11 slice 147) Three model-lockstep properties: the `ConnStats` accumulator over an arbitrary enqueue/drain interleaving (depth + dead-latch + per-op verdict match an independent model; overflow fires at most once); the uncapped (`max == 0`) link tracks the model forever without a kill; and the registry delivers the fitting prefix as `Wire` then exactly one `Max SendQ exceeded` eject at the first over-cap frame and drops the rest.

1 month ago

server_link_class_proptest.rs

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

server_query_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

server_time_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

server_time_s2s_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

server_topology_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

service_proptest.rs

feat(leveva): +S service user mode (charybdis UMODE_SERVICE) — P11 slice 253 Server-set-only umode: settable only on an S2S burst, a client/oper MODE +S silently ignored (like +Z/+W). A +S holder is immune to an operator's KILL (481 "Cannot kill a network service", charybdis no_kill_services); an inbound server KILL is still honoured. Propagates via SEND_UMODES — a service is a service network-wide. - mode.rs: UserMode::Service ('S', bit 0x20000) + is_service() predicate - command/kill.rs: 481 gate before eject/route, reads registry or net mirror - command/mode.rs: 'S' joins the server-set-only ignore set - s2s/umode.rs: Service added to SEND_UMODES - golden_service.rs + service_proptest.rs; 004 RPL_MYINFO umode-list bump

1 month ago

setname_proptest.rs

test(leveva): proptest setname (P11 slice 90) Model-lockstep fuzzing of both public entry points: the SETNAME command applies a valid realname (and is inert on empty/over-length), tracked by a last-valid model with a wire round-trip; inbound ENCAP SETNAME tracks the last non-empty realname and never panics; a non-SETNAME ENCAP subcommand leaves the realname untouched.

1 month ago

snomask_proptest.rs

feat(leveva): +s server-notice snomask category mask — P11 slice 257 Promotes the slice-184 all-or-nothing +s (FLAGS_SERVNOTICE) umode to charybdis's snomask category mask. +s becomes the one parameterized umode: a following token is its snomask delta (apply_delta, ignoring unknown letters), a bare +s seeds SnoMask::ALL (slice-184 back-compat). Per-record snomask routes each notice by category via snotice::server_notice_cat — c (connect/exit), k (kill), s (general/rehash/SA*). 008 RPL_SNOMASK reports the mask; an emptied mask drops +s; a non-oper +s <mask> swallows its param (no spurious 501). The mask is local-only (the bit still propagates); 221/004 unchanged (mask surfaces via 008 only). New: snomask.rs (pure parser/renderer fuzz seam), Numeric::RplSnomask, ClientRecord.snomask + Registry::set_snomask/snomask_of. Tests: snomask + mode + snotice units (incl. inverses), snomask_proptest, golden_snomask; every existing +s watcher test now seeds ALL to model bare-+s. Help: USER_MODES.md +s row.

1 month ago

snotice_proptest.proptest-regressions

test(leveva): arm +s after all registrations in the snotice fan proptests Slice 226 added the +s client-connect server notice, which fires to whoever is +s at registration time. These two proptests set +s on a watcher and then registered further clients, so the watcher captured those clients' connect notices and the exact-fan assertion failed (seed-dependent — surfaced intermittently). Defer the +s bit until after every registration so each watcher's mailbox holds only the SA*/ server_notice fan the property is about. Committed the regression seeds.

1 month ago

snotice_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

softcallerid_proptest.rs

feat(leveva): +G soft caller-id (co-channel bypass) — P11 slice 218 Closes the last deferred follow-on of the caller-id track (slices 216/217): charybdis-style soft caller-id. UserMode::SoftCallerId (+G, bit 0x0800, FLAGS_SCALLERID) is identical to +g except a sender sharing a channel with the target passes the gate without an ACCEPT. Client-settable, purely local (not in SEND_UMODES). The block decision is now the pure callerid::blocks(strict, soft, accepted, common_channel) — single source of truth + fuzz target — wrapped by command::message::caller_id_blocks and shared by both the local (command::message) and remote-sender (s2s::relay::inbound_message) gates so they cannot disagree; Channels::shares_channel is the common-channel predicate. Caller-id track complete.

1 month ago

spy_snomask_proptest.rs

feat(leveva): +s/+y SPY snomask producer — STATS-request spy notices — P11 slice 260 Wire the third producer-less snomask category opened by slice 257 (after `n` NCHANGE in 258 and `x` EXTERNAL in 259). charybdis (`SNO_SPY`, letter `y`) fans a notice to local `+s +y` opers whenever a client requests STATS from this server — the "someone is poking at the server" spy. - snotice.rs: pure builder `stats_spy_notice(letter, nick, user, host, server)` -> `STATS <c> requested by <nick> (<user>@<host>) [<server>]` (the fuzz seam). - snomask.rs: `SnoMask::spy()` accessor (the `y` bit, reserved since 257); doc-table row flipped to its producer. - command/stats.rs: fire at the `stats` chokepoint before answering, gated on a selector char being present AND the requester resolving to a local registry record (its user@host source; unresolved only in synthetic tests). Fires for any selector (even unrecognized), skips bare STATS; no self-exclusion; local-only ([<server>] = ctx.name, STATS answered locally). Tests (RED first): builder render+embed units; `spy()` letter round-trip; stats units (happy +s+y delivery with numerics asserted unchanged, inverses: +s+k-only and -s get nothing, bare STATS fans nothing, unrecognized selector still fans, unclaimed caller fans nothing); fuzz tests/spy_snomask_proptest.rs (builder never panics, scaffold + each field verbatim). Plan: docs/superpowers/plans/2026-06-18-p11-slice260-spy-snomask.md

1 month ago

squit_propagation_proptest.rs

test(leveva): SQUIT propagation proptest (fuzz, slice 161) Fuzz the fan-out + pure builder: exact-non-origin reach over arbitrary peer sets, the built line round-trips to a real sibling teardown via handle_squit, and an arbitrary reason always re-parses as SQUIT <target> without wedging.

1 month ago

sslonly_proptest.rs

feat(leveva): +S TLS-only channel mode — P11 slice 233 A leveva-native channel flag porting charybdis chm_sslonly (MODE_SSLONLY): a JOIN of a +S channel by a client NOT on a secure (TLS) transport is refused 519 ERR_SSLONLYCHAN :Cannot join channel (+S) - SSL/TLS required and the client is not added. Builds on slice 227's +Z secure user mode and the +C/+c flag-mode wiring (220/232). A hard JOIN gate like +O: checked in Channels::check_join alongside +O, before the invite override, so INVITE/+I do not bypass it (a transport requirement, not an access list); ops not exempt; existing members keep their seat (only new joins gated, matching charybdis's can_join hook). KNOCK to a +S channel is refused like +O. The secure signal is the joiner's +Z (UserMode::Secure) bit via mode::is_secure(attrs.umodes), NOT attrs.is_ssl — the latter is certfp-based and undercounts TLS users with no client cert (the gap slice 227 closed). $z extban semantics are left untouched. check_join runs for local joins only; remote joins arrive via NJOIN and bypass it. ChanMode::SslOnly ('S', bit 0x4000000, MODE_SSLONLY, Flag) wired through both flag-mode allowlists (mode.rs ALL/as_char/bit/mode_name/from_char + command::mode::supported_flag). JoinReject::SecureOnly → join_reject maps to the new ErrSslonlychan = 519. CHANMODES/004/MYINFO auto-derive S. Pure seam channel::sslonly_blocks(set, secure). Tests: 2 unit (check_join_enforces_ssl_only incl. INVITE-no-bypass + -S round-trip; sslonly_blocks_truth_table), sslonly_proptest (gate keys only off +Z over arbitrary u32 umode masks; plain channel never gates; toggling +Z flips), golden_sslonly end-to-end (plaintext JOIN → 519, not added, NAMES confirms; -S re-opens), 9 regenerated 004/005 snapshots (chanmode string only). cargo test -p leveva 2298 pass; clippy clean; workspace builds 0 warnings.

1 month ago

stats_proptest.proptest-regressions

fix(test): model STATS d/D as a recognized selector (slice 284 follow-up) The slice-284 D-line work added a recognized `STATS d`/`D` arm (250 RPL_STATSDLINE) but never updated stats_proptest's `is_recognized` model, so `terminator_is_always_last_and_singular` flaked whenever proptest's random seed hit `STATS d` (the terminator echoes the live selector 'd', the stale model expected '*'). Add 'd'/'D' to `is_recognized` and to the positive-coverage select list (empty body in the no-ban ctx → the default ["219"] covers it).

1 month ago

stats_proptest.rs

feat(leveva): XLINE/UNXLINE realname (gecos) operator ban (P11 slice 289) Charybdis-style XLINE/UNXLINE: an operator bans connections by a realname (gecos) glob — the realname sibling of the K-line (user@host) and D-line (ip/cidr) families, completing the runtime ban quartet K/D/X/RESV. Bolt-for-bolt the DLINE plane (slice 284) with a single-token gecos matcher (matching::matches) instead of CIDR: - leveva::xline::{Xline,XlineStore} — SQLite write-through + boot reload. - command/xline.rs — 461 param gate before OperPrivilege::Xline 481; reap local matching realnames (465 + ERROR close); s2s propagation. - s2s/xline.rs — ENCAP * XLINE/UNXLINE carrier (remaining seconds) + apply. - s2s/burst.rs::xline_burst re-assertion; forward.rs ENCAP arms. - Registration X-line gate in finalize_registration after the K-line/config-ban gates; STATS x -> 247 RPL_STATSXLINE. - Lights up the dead xline_exempt flag end-to-end (Admission/ClientRecord + set_xline_exempt), a dedicated exemption distinct from kline-exempt. leveva-native (no differential). Gate: cargo test -p leveva green (golden_xline + xline_proptest + the touched iline/stats/help goldens), clippy clean, workspace build 0 warnings.

1 month ago

stats_topology_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

stats_traffic_proptest.rs

feat(leveva): S2S server-link traffic metrics (P11 slice 180)

1 month ago

stdreply_proptest.rs

feat(leveva): IRCv3 standard-replies / the FAIL/WARN/NOTE framework (P11 slice 69)

1 month ago

sts_proptest.rs

feat(leveva): advertise IRCv3 `sts` capability — P11 slice 211 Add Strict Transport Security advertisement: a plaintext `CAP LS 302` client is told the TLS upgrade port (`sts=port=<p>`) and a TLS client the policy duration (`sts=duration=<n>[,preload]`). Advisory-only — `sts` stays out of the `SUPPORTED` registry, so `CAP REQ sts` NAKs and it never appears in `CAP LIST`; injected straight into the `LS` token list (302+ only). - new pure `sts::StsPolicy::ls_value(secure)` (None when disabled: no TLS client listener, or `sts-duration 0`); `port=` over plaintext, `duration=` over TLS (preload only over TLS, per spec) - `options { sts-duration N; sts-preload }` (boot-read; default off) - `StatsConf.sts` (slice-206 churn-free bundling) built in `from_config` from the first `tls && !server_only && websocket.is_none()` listener - `Session.secure` set by `serve_client`; the CAP LS path threads the value into `cap.apply`'s new `sts` param REHASH-ability of the knobs + treating wss as secure are documented follow-ons. Tests: sts/cap/config units + sts_proptest (fuzz) + golden_sts (real binary, plaintext sees the upgrade port; inverse no-TLS-listener sees no token).

1 month ago

summon_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

svslogin_identity_proptest.rs

feat(leveva): apply SVSLOGIN-assigned identity as a services vhost (P11 slice 298) An inbound ENCAP <us> SVSLOGIN <cliUID> <nick> <user> <host> <account> previously honored only <account>; <nick>/<user>/<host> were parsed but used merely cosmetically in the 900 RPL_LOGGEDIN. Now non-* <user>/<host> are applied as a services vhost on SASL login (the HostServ-vhost-on-login case); * / empty / IRC-invalid = unchanged. - sasl.rs: pure fuzzed SvsIdentity::from_fields (validated via UserName/HostName::try_from); SaslEntry.identity; SaslSessions::{set_identity,identity}; remove -> SaslResolution{account,identity}. - s2s/sasl.rs apply_encap_svslogin: stash the identity alongside the account. - session.rs finalize_registration: drain the resolution before the cloak block, commit the vhost (overriding auto-cloak) as a DISPLAY identity after all host-based admission gates ran on the real user@host, before local_introduce so UNICK/welcome carry it; orighost kept real. The <nick> field is deliberately not applied (no pre-introduction rename primitive; real flows send *; SANICK forces a nick). leveva-native; TDD + inverse invariants + golden + proptest.

1 month ago

tagmsg_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

testline_proptest.proptest-regressions

feat(leveva): TESTLINE ban-match diagnostic (P11 slice 285) TESTLINE <[nick!]user@host | ip/cidr | nick | #channel> — a charybdis-style read-only operator command, the capstone of the ban family (RESV 272, TKLINE 281, DLINE 284). It reports which active ban (K/D-line or RESV) would match a mask, laying/lifting nothing. - Param gate (461) then a plain oper-bit gate (any oper, no per-ban privilege → 481), matching charybdis (TESTLINE needs IsOper with no specific flag). - A pure probe() classifier strips an optional nick! then routes by mask shape: user@host → D-line(host)-then-K-line; #channel → channel RESV; bare token → D-line(as IP)-then-nick RESV. Reports the first hit, priority D > K > R. - New numerics RplTestline=725 (<type> <minutes-left> <ban-mask> :<reason>; 0 minutes for a permanent RESV) and RplNotestline=726 (<mask> :No matches). Expiry honoured for free via find_active. - TESTLINE.md help + COMMANDS allowlist (bijection test). leveva-native, no oracle (2.11 has no TESTLINE): single best match, no I-line/auth-block arm, local-only (no S2S propagation, mirroring charybdis). Tests (TDD, failing first + fuzzing): command/testline.rs units + inline probe_is_total proptest; testline_proptest.rs (reply-well-formed, non-oper-481, laid-ban-always-reported inverse); golden_testline.rs (real binary, minutes field masked). cargo test -p leveva green (2543 lib), clippy clean, workspace 0 warnings.

1 month ago

testline_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

testmask_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

tls_connector_integration.rs

chore: version bump Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

tls_outbound_proptest.proptest-regressions

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

tls_outbound_proptest.rs

feat(leveva): outbound S2S server links over TLS (P11 slice 176) Closes the documented deferral in command::connect: leveva accepted TLS server-links on a server-only TLS listener but could only dial out in plaintext. A connect{} block flagged `tls` now dials over a rustls client connection (new tls::connect_outbound + accept-any-server-cert verifier, symmetric to the inbound accept-any-client-cert; links authenticate by PASS, not PKI). The flag rides OutboundLink so both operator CONNECT and the auto-connect ticker inherit it; main::dial_server wraps the socket then hands off to a stream-generic run_outbound. Config-parse fuzzed + in-process connector integration + a full two-node TLS link golden.

1 month ago

topic_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

trace_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

uid_proptest.rs

chore: run cargo format Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

unauth_snomask_proptest.rs

feat(leveva): +s/+u UNAUTH snomask producer — authorisation-failed-connection spy notices — P11 slice 263 The sixth producer for a slice-257 reserved-but-empty snomask category (charybdis SNO_UNAUTH, `u`). A registering client refused because no credential authorises it — bad connection password (464), no matching I-line (465), or a missing required ident — fans an `Unauthorised connection from <nick>!<user>@<host> (<reason>)` spy notice to local `+s +u` watchers. Distinct from REJ (slice 262, an active ban/blocklist): these are "no credentials" failures, reported with the resolved user since all three gates run after username resolution. Local-only like every snomask producer; no S2S plane. Closes the slice-262 follow-on, leaving only C/d/b without a producer. - snomask.rs: SnoMask::unauth() accessor (UNAUTH = 1<<6); doc-table row - snotice.rs: pure unauth_notice() builder (the fuzz seam) - session.rs: server_notice_cat(unauth()) at the three auth-failure gates - tests: snotice/snomask units + session fan tests (3 gates + inverses) - fuzz: tests/unauth_snomask_proptest.rs (panic-free + scaffold + verbatim)

1 month ago

userhost_in_names_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

userhost_ison_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

userip_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

usermode_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

utf8only_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

version_proptest.rs

chore: cargo fmt Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

wallops_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

wallops_s2s_proptest.rs

feat(leveva): WALLOPS S2S propagation (P11 slice 178)

1 month ago

webirc_proptest.rs

feat(leveva): WEBIRC webchat-gateway client IP/host spoofing (P11 slice 301) Port charybdis extensions/m_webirc.c: a trusted webchat gateway sends a pre-registration WEBIRC <password> <gateway> <hostname> <ip> so the proxied connection is recorded under the real client's host/IP, not the gateway's. Every later admission gate (D/K/X-line, config-ban, per-class conn caps, +x cloak) and WHOIS key off the spoofed self.host. - new pure fuzz seam leveva::webirc {parse_request, spoof_host, authorize} - webirc {} config block (host mask + password) -> StatsConf (boot-read) - Session::handle_webirc dispatched phase-independently (CAP/AUTHENTICATE seam), one-spoof-per-connection, +s audit snotice; registered -> 462, bad-pw / untrusted host / malformed -> NOTICE, no spoof - HELP WEBIRC topic + commented example/dist config block Divergences (leveva-native, no oracle): single-host/no-DNS collapse of charybdis host/sockhost; trust via webirc {} not auth{}; boot-read. Tests: webirc/config/session units (inverses), golden_webirc end-to-end, webirc_proptest (parse total + round-trip, spoof_host range, authorize contract).

1 month ago

websocket_proptest.rs

feat(leveva): wss-as-secure — P11 slice 213 A TLS-protected WebSocket is now flagged secure, so its IRCv3 sts CAP LS token is the persistence form (sts=duration=...) rather than the plaintext upgrade hint (sts=port=...). Until now serve_ws never called Session::set_secure, so every WebSocket — including wss:// — defaulted to secure=false (the divergence named in slices 211/212). A WebSocket is secure when (1) this listener TLS-terminated it (a wss:// port, new PerConn.tls_terminated), or (2) a trusted reverse proxy forwarded it with X-Forwarded-Proto: https/wss. The proxy path reuses the resolve_host trust gate (proxy-ranges), so a plaintext client cannot spoof secure by sending the header itself. The trust+proto verdict is the pure, fuzzable parent-module helper websocket::forwarded_proto_secure; server.rs keeps only the thin HeaderMap extraction. Closes the last STS-track deferral — the sts track is now complete. Tests (failing first): resolve_secure unit cases (incl. untrusted-peer header ignored = spoof-resistance); forwarded_proto_secure_is_spoof_resistant proptest; golden_websocket_sts e2e (proxied https => duration=, http => port=). Gate: cargo test -p leveva green; clippy clean; build --workspace 0 warnings.

1 month ago

who_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

whois_modes_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

whois_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

whois_service_proptest.rs

feat(leveva): options { service-string } REHASH knob for the WHOIS 313 service line — P11 slice 256 Promotes the slice-255 hard-coded WHOIS 313 service text "is a Network Service" to a REHASH-able options { service-string } config knob (charybdis ConfigFileEntry.servicestring) via the ConfStore live-or-default seam — the const->knob trajectory MAX_PENALTY (208->210) and max-bans (245->246) took. Closes the single documented follow-on slice 255 left open. Splits whois_oper_line into a pure precedence enum WhoisLine + a pure render whois_oper_text_with (the fuzz seam) + the live resolver whois_oper_text (reads control::live_service_string, falls back to DEFAULT_SERVICE_STRING). Empty value -> default, matching charybdis ignoring an empty servicestring. Plumbs Options/parser/ConfBlocks/ConfStore/config_conf/main + dist/example kdl + WHOIS help. Tests: whois units + config defaults/override/empty + control seed/reseed/empty round-trip + whois_service_proptest rewritten onto the enum & arbitrary service string + golden_service_string_config (new s2s_service_string.kdl fixture) proving config->live->WHOIS end-to-end.

1 month ago

whowas_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

whox_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago

xline_proptest.rs

feat(leveva): IRCv3 draft/read-marker + the MARKREAD command (P11 slice 300) The read-state companion to draft/chathistory (slice 274). MARKREAD <target> [timestamp=<iso8601>] records or queries how far a client has read a target; a set stores max(existing, new) (monotonic — never regresses), echoes the effective value, and on a genuine advance fans the MARKREAD to the user's other capable connections (cross-device read-state sync). A bare MARKREAD <target> queries the stored marker. Markers are owned by the services account (synced across connections, survives a reconnect) when logged in, else by the connection UID (per-connection, dropped on Session::release). The cap is statically advertised and valueless; the command is processed regardless of the issuer's own cap — the cap gates only the cross-connection fan, per spec. leveva-native: the C 2.11 oracle predates IRCv3, so the gate is unit + golden + proptest (no differential). - readmarker.rs: pure parse/format seam (parse_set_timestamp / format_value) + the monotonic ReadMarkers store (account|UID owner key) - command/markread.rs: the handler (NEED_MORE_PARAMS / query / set / INVALID_PARAMS / advance + fan) - cap.rs: DRAFT_READ_MARKER const + SUPPORTED entry + read_marker ClientCaps bit; CAP LS snapshots refreshed (a long SASL mechlist now tips the 302 LS into a spec-legal multiline split) - server.rs: read_markers field; session.rs: forget_connection release hook - help/MARKREAD.md + COMMANDS allowlist + index.md Queries line - tests: readmarker/markread units (inverse invariants), golden_markread (single-conn round-trip + cross-device push vs uncapped sibling), readmarker_proptest (total parse + round-trip; advance keeps-max, order-independent + idempotent)

1 month ago