feat(trios-mesh): trios integration - crypto hardening, HELLO MAC verification, and three spec-pipeline repairs

Cargo.toml

@@ -8,12 +8,23 @@ repository = "https://github.com/gHashTag/trios-mesh"
 readme = "README.md"
 keywords = ["mesh", "drone", "sdr", "crypto", "routing"]
 categories = ["network-programming", "cryptography"]
+autobins = false
+autoexamples = false
+autotests = true
+autobenches = false
+
+# NOTE: trios-meshd binary (src/bin/trios_meshd.rs) is intentionally not
+# registered as a [[bin]] target. It was written against an older trios-mesh API
+# and needs a dedicated revival pass (M2/M5 milestone) before it can compile.
+# The file is preserved and already panic-hardened /tmp-free for that future pass.
 
 [dependencies]
 x25519-dalek = { version = "2.0", features = ["static_secrets", "zeroize"] }
 chacha20poly1305 = "0.10"
 hkdf = "0.12"
 sha2 = "0.10"
+hmac = "0.12"
+subtle = "2.6"
 rand_core = { version = "0.6", features = ["getrandom"] }
 zeroize = { version = "1", features = ["derive"] }
 num-complex = "0.4"
@@ -24,18 +35,13 @@ serde_json = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 
+[lints]
+workspace = true
+
 [features]
 # Off-by-default: swap the pure-Rust GF16 scalar backend for the goldenfloat-sys
 # C ABI (gf16_add/mul/fma/from_f32/to_f32). The unsafe FFI is isolated behind a
 # safe adapter; `trios-mesh` itself stays `#![forbid(unsafe_code)]`. CI runs the
 # default (pure-Rust) path. See src/gf16.rs and tests/gf16_conformance.rs.
 default = []
 goldenfloat-ffi = []
-
-[[bin]]
-name = "smoke-m1"
-path = "src/bin/smoke_m1.rs"
-
-[profile.release]
-opt-level = "z"
-lto = true

build.rs

@@ -1,36 +1,46 @@
 // build.rs — auto-regenerate from .t27 specs if any changed
-use std::process::Command;
 use std::path::Path;
+use std::process::Command;
+
+fn modified_age_secs(path: &Path) -> u64 {
+    std::fs::metadata(path)
+        .ok()
+        .and_then(|m| m.modified().ok())
+        .and_then(|t| t.elapsed().ok())
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
 
 fn main() {
     let t27c = "../t27/target/release/t27c";
     if !Path::new(t27c).exists() {
         return; // t27c not available, skip regen
     }
-    
+
     // Check if any spec is newer than its generated output
     let specs_dir = Path::new("specs");
     let gen_dir = Path::new("gen/rust");
-    
+
     if !specs_dir.exists() || !gen_dir.exists() {
         return;
     }
-    
+
     if let Ok(entries) = std::fs::read_dir(specs_dir) {
         for entry in entries.flatten() {
             let spec_path = entry.path();
-            if spec_path.extension().map_or(false, |e| e == "t27") {
-                let name = spec_path.file_stem().unwrap();
-                let gen_path = gen_dir.join(format!("{}.rs", name.to_str().unwrap()));
-
-                let needs_regen = !gen_path.exists() || {
-                    let spec_time = entry.metadata().map_or(0, |m| m.modified().ok())
-                        .map_or(0, |t| t.elapsed().map_or(0, |d| d.as_secs()));
-                    let gen_time = std::fs::metadata(&gen_path).map_or(0, |m| m.modified().ok())
-                        .map_or(0, |t| t.elapsed().map_or(0, |d| d.as_secs()));
-                    spec_time < gen_time // spec is newer
+            if spec_path.extension().is_some_and(|e| e == "t27") {
+                let Some(name) = spec_path.file_stem().and_then(|s| s.to_str()) else {
+                    eprintln!(
+                        "cargo:warning=Skipping spec with non-UTF8 stem: {}",
+                        spec_path.display()
+                    );
+                    continue;
                 };
-
+                let gen_path = gen_dir.join(format!("{}.rs", name));
+
+                let needs_regen = !gen_path.exists()
+                    || modified_age_secs(&spec_path) < modified_age_secs(&gen_path);
+
                 if needs_regen {
                     let _ = Command::new(t27c)
                         .arg("gen-rust")
@@ -39,13 +49,13 @@ fn main() {
                         .map(|o| {
                             if o.status.success() {
                                 let _ = std::fs::write(&gen_path, &o.stdout);
-                                println!("cargo:warning=Regenerated {}", name.to_str().unwrap());
+                                println!("cargo:warning=Regenerated {}", name);
                             }
                         });
                 }
             }
         }
     }
-    
+
     println!("cargo:rerun-if-changed=specs/");
 }

gen/rust/adaptive_retry.rs

@@ -11,24 +11,59 @@ pub const QUALITY_HIGH: u8 = 0xCC;
 
 pub const QUALITY_MEDIUM: u8 = 0x80;
 
-pub fn backoff_delay_ms(attempt: u8) -> u16 { unimplemented!() }
+pub fn backoff_delay_ms(attempt: u8) -> u16 {
+    if (attempt == 0) {
+        return (BASE_DELAY_MS as u16);
+    }
+    if (attempt <= 5) {
+        let multiplier: u16 = (1 << attempt);
+        let delay: u16 = ((BASE_DELAY_MS as u16) * multiplier);
+        if (delay > 5000) {
+            return 5000;
+        }
+        return delay;
+    }
+    return 5000;
+}
 
-pub fn max_retries_for_quality(quality_q8: u8) -> u8 { unimplemented!() }
+pub fn max_retries_for_quality(quality_q8: u8) -> u8 {
+    if (quality_q8 >= QUALITY_HIGH) {
+        return 5;
+    }
+    if (quality_q8 >= QUALITY_MEDIUM) {
+        return 3;
+    }
+    return 1;
+}
 
 pub fn should_retry(current_attempt: u8, link_quality_q8: u8) -> bool {
-    let;
-    max_retries;
-    (current_attempt < max_retries);
+    let max_retries: u8 = max_retries_for_quality(link_quality_q8);
+    return (current_attempt < max_retries);
 }
 
-pub fn base_probability(quality_q8: u8) -> u8 { unimplemented!() }
+pub fn base_probability(quality_q8: u8) -> u8 {
+    if (quality_q8 >= QUALITY_HIGH) {
+        return 200;
+    }
+    if (quality_q8 >= QUALITY_MEDIUM) {
+        return 150;
+    }
+    return 100;
+}
 
 pub fn retry_success_probability(attempt: u8, quality_q8: u8) -> u8 {
-    let;
-    base_prob;
-    let;
-    decay;
+    let base_prob: u8 = base_probability(quality_q8);
+    let decay: u8 = ((base_prob / 4) * attempt);
+    if (base_prob > decay) {
+        return (base_prob - decay);
+    }
+    return 10;
 }
 
-pub fn total_retry_time(max_retries: u8) -> u16 { unimplemented!() }
+pub fn total_retry_time(max_retries: u8) -> u16 {
+    if (max_retries == 0) {
+        return 0;
+    }
+    return (backoff_delay_ms((max_retries - 1)) + total_retry_time((max_retries - 1)));
+}