Complete SQLite-only Arti integration seams

ober commented

2026-09-23 17:32:23 -04:00

Owner

This PR implements the Jerboa-sqlite-only Tor foundation described in Tor-everywhere.md and records the remaining qualification gates.

Implemented:

Maintained Arti fork changes are stored under patches/arti/ and applied reproducibly into target/arti-patched; vendor/arti remains a pinned read-only source mirror.
Jerboa SQLite directory, ordinary state, encrypted key, replay, and PoW storage seams use authenticated transactions and generation fencing.
Arti external typed state-directory primitives now support restart round trips and competing-writer rejection. Full tor-hsservice injection remains disabled until its concrete filesystem handles are refactored.
Rust supervisor launch provisions independent storage, application, and wrapping-key credentials over inherited descriptors 3, 4, and 5, with executable/socket validation and child cleanup.
Jerboa transport contexts are bound to their client; close, stream-close, and onion-key operations fail closed when backend callbacks are absent or fail.
Typed WASM directory preconditions and consensus/authcert/microdescriptor differential fixtures are covered.
RustCrypto TLS fixtures, dependency/artifact checks, SBOM generation, IPC, storage, sandbox, leak, and Jerboa module behavior tests are included.

Verification:

make test
make binary
./tools/apply-arti-patches --check
make check-deps
make check-artifacts
cargo check --locked --features arti-onion-service
./jtor --version (0.3.0)

Production capabilities remain disabled pending controlled Tor/HTTPS interoperability, full tor-hsservice SQLite state injection, broader typed parser construction, bridge/PT qualification, separately authorized sibling application integrations, platform confinement evidence, and independent security review. The ignored canary requires operator-provided JTOR_CANARY_BINARY and JTOR_CANARY_TARGET.

This PR implements the Jerboa-sqlite-only Tor foundation described in `Tor-everywhere.md` and records the remaining qualification gates. Implemented: - Maintained Arti fork changes are stored under `patches/arti/` and applied reproducibly into `target/arti-patched`; `vendor/arti` remains a pinned read-only source mirror. - Jerboa SQLite directory, ordinary state, encrypted key, replay, and PoW storage seams use authenticated transactions and generation fencing. - Arti external typed state-directory primitives now support restart round trips and competing-writer rejection. Full `tor-hsservice` injection remains disabled until its concrete filesystem handles are refactored. - Rust supervisor launch provisions independent storage, application, and wrapping-key credentials over inherited descriptors 3, 4, and 5, with executable/socket validation and child cleanup. - Jerboa transport contexts are bound to their client; close, stream-close, and onion-key operations fail closed when backend callbacks are absent or fail. - Typed WASM directory preconditions and consensus/authcert/microdescriptor differential fixtures are covered. - RustCrypto TLS fixtures, dependency/artifact checks, SBOM generation, IPC, storage, sandbox, leak, and Jerboa module behavior tests are included. Verification: - `make test` - `make binary` - `./tools/apply-arti-patches --check` - `make check-deps` - `make check-artifacts` - `cargo check --locked --features arti-onion-service` - `./jtor --version` (`0.3.0`) Production capabilities remain disabled pending controlled Tor/HTTPS interoperability, full `tor-hsservice` SQLite state injection, broader typed parser construction, bridge/PT qualification, separately authorized sibling application integrations, platform confinement evidence, and independent security review. The ignored canary requires operator-provided `JTOR_CANARY_BINARY` and `JTOR_CANARY_TARGET`.

ober added 1 commit

2026-09-23 17:32:23 -04:00