proto: split running into create, load and start, pulling modules by …

…digest (#41)

This replaces the push upload of an app's module with a pull by digest,
and splits running a task into three requests of the host. `exec_create`
names the main module by its SHA-256 digest and returns the task id at
once. `exec_load` answers once the Ark has fetched and checked every
module of the task. The Ark asks the host for those modules through its
own `exec_module_size` and `exec_module_read` requests. `exec_start`
opens the owner's approval and answers once the owner approves.

The three requests take the tags of `exec_upload_start`,
`exec_upload_chunk` and `exec_sched`, which are gone, and the module
requests take 0x509 and 0x50a. Each message's comment states its
contract, such as the 5s expiry between steps, the 30s per module
request and the absence of an overall loading deadline. The design
follows the apps spec in dark-bio/specs, where an app can use other apps
pinned by digest.

The library already routes any request of the Ark as it routes
`relay_outbound`, so no handwritten code changes, and the existing tests
cover that routing. The firmware, `ark` and Ark Hub still speak the old
messages and move over in changes of their own, Ark Hub with regenerated
TypeScript bindings. The error codes of the new requests belong to the
firmware, and the crate stays at 0.17.1 until its release.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Astra <noreply@openai.com>

cargo: move to darkbio-crypto v0.20.1 and darkbio-trust v0.7.1, bump …

…to v0.17.1 (#40)

Moves darkbio-crypto to 0.20.1 and darkbio-trust to 0.7.1, refreshes
`Cargo.lock` and `fuzz/Cargo.lock` to the latest compatible releases,
and bumps the crate to 0.17.1.

The refresh moves ctutils from 0.4.2 to 0.4.6, which fixes
RUSTSEC-2026-0385, so the scheduled audit passes again. wire re-exports
crypto and trust, which only move by a patch, so wire moves to 0.17.1.
No code changes, and the generated sources, vectors and fuzz seeds are
unchanged.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

generator, proto: add structural variant and copy number slot kinds (#39

)

Adds the slot kinds for the Structural Variants and Copy Number Variants
datasets, and renames kind 3 after its dataset.

- `SLOT_KIND_STRUCTURAL_VARIANTS = 5` and
`SLOT_KIND_COPY_NUMBER_VARIANTS = 6` are new.
- `SLOT_KIND_SNP_INDEL_CALLS` becomes `SLOT_KIND_SMALL_VARIANTS`, the
name the dataset carries everywhere else. Its number stays 3, so the
bytes on the wire do not change.
- `SlotKind` is generated `#[non_exhaustive]`, like `ReservedErrors`, so
later kinds stay additive for Rust consumers.
- `DatasetPath.public` keeps its field and now marks a grant that reads
nothing about the owner's DNA, rather than data every Ark shares. The
planned `datasets/` path, which lists the uploaded datasets, is public
under this meaning. The wording example follows the new rsID wording.
- Bumps the crate to v0.17.0, since the rename and `#[non_exhaustive]`
break the API.

A peer on 0.16.0 keeps kinds 5 and 6 as raw numbers, and its typed
getters read them as `Unspecified`. After the upgrade every Rust
`SlotKind` match needs a wildcard arm, including the CLI's `variants!`
slot list, which cannot stay an exhaustive match. The firmware, `ark`,
Ark Hub and Ark Companion move to this version in their own changes, and
this stays open until they have integrated it.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

proto: release run output through the owner and prefix enum values (#37)

Adds result release to the execute flow. A run's output reaches the host
only after the owner releases it on the phone, and the host reads it
through two new requests.

- `exec_status` answers where a run stands, as running, awaiting the
owner's review or resolved. The state sits on field 3, so a host built
on 0.15 fails at its first poll instead of polling on.
- `exec_result` (0x507) answers a released run's facts, or fails with
the reserved error the owner's review closed with.
- `exec_output` (0x508) reads standard output or standard error once and
in order, at an offset the Ark checks and a size the host picks.
- A task belongs to the session that opened it. When that session ends,
the Ark drops the task and cancels a running app.
- `DatasetPath` gains `public` and `wording`, so a host can show a grant
in the Ark's words.
- Every enum value carries its enum's full name, so the generated names
drop the repeated prefix, as in `SlotKind::ReferenceGenome`.
- The three approval errors cover an approval the request depends on,
which `exec_result` did not open.
- Bumps the crate to v0.16.0, since the API breaks.

The firmware, `ark` and Ark Hub move to this version in their own
changes. Code that matches enum names by their old prefixes, such as
`SLOT_`, has to follow.

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cargo, transport: move to darkbio-crypto v0.20.0 and darkbio-trust v0…

….7.0 (#36)

Moves wire to darkbio-crypto 0.20.0 and darkbio-trust 0.7.0. The crypto
release pads sealed envelopes inside the encryption, and its sealing
calls take a padding policy (dark-bio/crypto-rs#49). Every
`cose::seal_at` in wire passes `Padding::None`: the client's ack and the
server's hello, plus the tests, mocks and vector replay. The wire
session stays unpadded on purpose, since only a USB tap sees its message
lengths, and the relay frames it carries pad themselves. `Padding::None`
seals byte for byte as before, so `make generate`, `make vectors` and
the fuzz seeds leave the tree unchanged.

The crate stays at 0.15.0. #34 already moved main to 0.15.0, and that
version was never tagged or published, so the release absorbs this
change instead of skipping a number.

cargo: bump to v0.14.0 (#31)

Bumps the crate to v0.14.0 for the release that carries #30.

A failed read no longer ends the protocol server, which a consumer could
rely on, as the Ark firmware's reset button teardown did. So the release
takes the next minor version rather than a patch. Only the version lines
change, in Cargo.toml and the two lock files.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

generator, proto: add a reserved UNDELIVERED error, bump to v0.13.1 (#25

)

Adds UNDELIVERED to the reserved errors, for a request whose approval
could not be sent to the phone because the relay failed on the way. It
completes the approval outcomes next to UNAUTHORIZED and UNCONFIRMED, so
hosts can tell a refusal, a timeout and a relay failure apart.

The generator now marks ReservedErrors non-exhaustive, so later reserved
codes stay compatible. A new reserved code is additive, since older
peers see an unknown code, so this ships as a patch.

cargo: bump darkbio-crypto to v0.19.3 and darkbio-trust to v0.6.1 (#24)

Picks up darkbio-crypto 0.19.3, whose COSE signer and peek wipe the payload copy they make, and darkbio-trust 0.6.1, which requires it. The crate and fuzz locks take both, and the version stays 0.13.0.

all: document every item and rework the comments (#21)

Documents every item in the crate and reworks the comments to one
consistent style.

- Every module, item, field, variant and test has a doc, including
private, test and fuzz code, local items, the benches, the fuzz targets,
the build script and the generator.
- Each doc opens with a one-sentence summary. Functions start with a
verb, and types, fields and variants with a noun phrase. Named items are
linked.
- Field and variant docs move from the end of the line to a doc comment
above the item, where rustdoc and editors pick them up.
- Notes take one consistent shape, and bodies doing several things,
scenario tests included, read as commented steps.
- Docs that contradicted the code now describe what it does, such as the
errors a handshake expiry returns and what a failed open does to the
receive sequence.

Only comments and blank lines change, apart from 23 trailing commas
rustfmt adds where a field doc splits a one-line variant. The generated
protocol sources are untouched.

It changes no code, so the few code issues the pass noticed, such as a
scenario test that asserts after its session has closed, are left for
separate changes.

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

all: move time onto darkbio-clock, bump to v0.12.0 (#18)

Moves wire's time onto darkbio-clock, one reviewed commit per step.

- `all:` threads the clock in from the stream adapters and reads every
deadline, timeout and handshake time from it. `transport::Read` and
`transport::Write` gain `clock()`, defaulting to the real clock.
`memory::duplex` takes a clock, `Verifier::verify` takes the clock's
wall time, and `Stream`, `Session`, `Requester` and `Responder` expose
the clock for computing deadlines. `Stream::new` panics on halves with
different clocks. wire re-exports darkbio-clock as `clock`, and the
version moves to v0.12.0. `.cargo/clippy.toml` bans the real-time calls
the clock replaces.
- `fuzz, Makefile:` builds the fuzz targets' dependencies as plain
release code and keeps debug assertions and overflow checks on the wire
alone, which makes the crypto-bound targets 2.4 to 3.1 times faster.
- `memory, protocol, transport:` moves the four condvars onto the
clock's locks. `Promise::wait` receives untimed while the session's
deadline worker settles every timeout, and `Promise::notify` takes a
callback that runs, and whose captures drop, outside every wire lock.
- `cargo:` bumps darkbio-cobs to v1.0.1, a README-only release.
- `all:` runs every test and fuzz mock on a `TestClock` and removes the
watchdogs, so no test or fuzz target waits on real time. The duplex and
connection fuzz targets replay their corpora about 8 times faster. CI
runs the tests under nextest, which kills a test after 120 s, and clippy
now covers the tests. The socket round trip moves onto a memory duplex,
so it runs on every platform.
- `README:` rewrites the overview by topic, adding the module map, the
verifier choices, the request semantics and limits, and the stream's
clock.
- `cargo:` bumps darkbio-clock to v0.3.0, whose timed waits report
timeouts like std and whose advances wake only the waits they reach.
wire only notifies with `notify_all` and rechecks its deadlines after
every wait, so no code changes.
- `transport:` fixes a race in the duplex mock's silent handshake
scenario, which the fuzzer hit once. Taking the ACK's fault wakes the
parked server, and the clock unlists a wait while it wakes, so the
scenario reads the server's deadline off its pipe rather than the clock.
- `fuzz:` replaces the corpus with a set-cover minimization of it plus
about 8,500 units from a 7.5 hour campaign on the clock 0.3 code, 4,552
units in all.
- `cargo:` bumps darkbio-clock to v0.3.1, which fixes its `notify_one`
hand-off and reports a passed deadline as the current time. wire only
uses `notify_all`, so no code changes.
- `fuzz:` minimizes the corpus again after a 30 minute round on v0.3.1
without findings, 4,380 units in all.

On the real clock nothing changes, and the vectors, fuzz seeds and
generated sources come out identical. Mutation checks pointed 20 time
sites at the real clock and broke 10 of the third commit's guarantees,
and every one fails a test, some by hanging until nextest's kill. `make
check` now needs cargo-nextest. Clippy with default features fails on a
`large_enum_variant` in the session state, as it does on main.

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Astra <noreply@openai.com>