fix(node): implement reconciliation sweep as durability backstop (#218)

.cargo/audit.toml

@@ -21,6 +21,25 @@ ignore = [
     # the build, at which point it becomes a real reachable advisory.
     "RUSTSEC-2023-0071", # rsa Marvin attack (no fix; not linked in our build)
 
+    # lru 0.16.3 (use-after-free in pop()). Reachable via alloy. The
+    # lockfile holds only 0.16.3 — the aws-sdk-s3 path that once pulled
+    # 0.12.5 no longer does. The RUSTSEC-2026-0253 advisory covers this
+    # range, so the ignore stays load-bearing until a fixed 0.16.x lands;
+    # REMOVE when the locked version is fixed or lru leaves the tree.
+    # Retirement owner: node maintainers, enforced by the weekly
+    # audit-schedule drift guard ("Fail if lru moved while its ignore
+    # remains"), which fails if either locked version moves or lru
+    # leaves the tree. No separate tracking issue exists; file one
+    # against the lru upgrade if this waiver needs discussion outside
+    # the schedule job.
+    "RUSTSEC-2026-0253",
+    #
+    # Round-3 P2 (reviewer 2): the previous version of this file
+    # ignored RUSTSEC-2026-0258 for h2 0.4.13, but the lockfile
+    # already has h2 0.4.18 (verified 2026-08-31: cargo tree -p h2
+    # shows 0.4.18) — the fix is in. The ignore was stale and would
+    # have silently re-accepted the advisory if h2 dropped back to
+    # 0.4.13. Removed.
     # crypto-bigint 0.5.5 (secret-dependent branches in operations meant
     # to be constant-time). REACHABLE accepted risk, on two paths:
     # - alloy-signer -> elliptic-curve 0.13 -> crypto-bigint 0.5: the k256

.env.example

@@ -359,6 +359,20 @@ GITLAWB_TRUSTED_PROXY=
 # Enable automatic background sync from known peers
 GITLAWB_AUTO_SYNC=false
 
+# ── Reconciliation sweep ─────────────────────────────────────────────────
+# Periodic durability sweep: re-derives the public pin set and the withheld-blob
+# recovery set each hour and fills gaps so a dropped replication job never means
+# data loss. Defaults to true; set to false to disable the sweep even when a pin
+# backend (IPFS/Pinata) is configured.
+#
+# Phase-capability matrix:
+#   - Public pin repair: IPFS-only, Pinata-only, or both (requires the
+#     respective backend to be configured).
+#   - Encrypted recovery repair: requires local IPFS (GITLAWB_IPFS_API).
+#     Pinata-only nodes reconcile public pins only; encrypted recovery
+#     reconciliation is not performed.
+GITLAWB_RECONCILIATION_SWEEP=true
+
 # ── iCaptcha proof-of-intelligence gate ───────────────────────────────────
 # Optional gate on create_repo + register: require callers to present an
 # iCaptcha proof (X-ICaptcha-Proof header) earned at icaptcha.gitlawb.com.

.github/workflows/audit-schedule.yml

@@ -86,3 +86,27 @@ jobs:
             exit 1
           fi
           echo "No drift: ignore list is consistent with the pinned hickory-proto version."
+
+      # Drift guard: the RUSTSEC-2026-0253 (lru) ignore is only valid while
+      # the lockfile holds exactly the version it was written for (0.16.3
+      # via alloy). Any move — an upgrade that may carry the upstream fix,
+      # or removal of the dependency — must revisit the ignore. Retirement
+      # owner: node maintainers, via this weekly job (no separate tracking
+      # issue; see the waiver comment in .cargo/audit.toml).
+      - name: Fail if lru moved while its ignore remains
+        run: |
+          set -euo pipefail
+          versions="$(grep -A1 'name = "lru"' Cargo.lock | grep '^version' | cut -d'"' -f2 | sort -u | tr '\n' ' ')"
+          echo "lru versions in Cargo.lock: ${versions:-not present}"
+          lru_ignore_present=false
+          if grep -q 'RUSTSEC-2026-0253' .cargo/audit.toml; then
+            lru_ignore_present=true
+          fi
+          # Drift = the lockfile no longer matches what the ignore assumes:
+          # the version moved (possible fix) or lru left the tree
+          # (dead ignore). Both must fail for explicit re-triage.
+          if [ "$lru_ignore_present" = true ] && [ "${versions}" != "0.16.3 " ]; then
+            echo "::error::lru versions are [${versions:-absent from Cargo.lock}] but the RUSTSEC-2026-0253 ignore is still in .cargo/audit.toml. Re-triage the waiver against the advisory's fixed range and either drop the ignore or update the pinned set."
+            exit 1
+          fi
+          echo "No drift: lru ignore is consistent with the pinned versions."

README.md

@@ -404,6 +404,7 @@ Important node settings:
 | `GITLAWB_REQUIRE_SIGNED_PEER_WRITES` | Require peer writes to prove their DID on every transport: RFC 9421 signatures on the announce/sync routes, and an Ed25519 payload signature on gossip ref-update events. Defaults to `false` during the staged rollout below. Upgrade every gossip publisher before enabling, or their updates are dropped with no error on their side. |
 | `GITLAWB_ENFORCE_OWNER_PUSH` | Require the authenticated pusher to be the repo owner on `git-receive-pack`. **Defaults to `true`.** A `did:key` signature is authentication, not authorization (anyone can mint a key and sign), so with this off every signed caller may push to every repository, private ones included. Delegated and CI keys count as non-owners: a UCAN `git/push` capability is verified but not yet honored for authorization, so they cannot push while this is on. Set `false` only for a rolling upgrade; see [`docs/RUN-A-NODE.md`](docs/RUN-A-NODE.md). |
 | `GITLAWB_AUTO_SYNC` | Enable automatic sync from known peers. |
+| `GITLAWB_RECONCILIATION_SWEEP` | Enable the hourly durability sweep that re-pins/backstops missing objects (default `true`; disabled when no IPFS/Pinata backend is configured). Public pin repair runs against any configured backend (IPFS, Pinata, or both). Encrypted recovery repair requires local IPFS (`GITLAWB_IPFS_API`); Pinata-only nodes reconcile public pins only. |
 | `GITLAWB_MAX_PACK_BYTES` | Max git pack body size for smart-HTTP routes. |
 | `GITLAWB_GIT_SERVICE_TIMEOUT_SECS` | Max seconds a served git upload-pack, receive-pack, or `info/refs` advertisement may run before it is aborted (504). Default 600. Also bounds the withheld-blob classification walk (on both the upload-pack serve and receive-pack replication paths) and the push-side pin-candidate discovery (`rev-list` / `cat-file`), each reaped via process-group teardown at the deadline. On the path-scoped upload-pack path the classification walk and the pack serve share ONE deadline, so this value bounds their combined duration rather than granting each stage a full budget: a walk that consumes it leaves the serve nothing and the clone gets a 504. Serving large path-scoped repos may therefore need a higher value than they did when each stage was budgeted separately. Accepted range is 1 to 3153600000 (100 years), since the node derives deadlines from this value and a larger one cannot be represented. |
 | `GITLAWB_GIT_ACQUIRE_TIMEOUT_SECS` | Max seconds the storage-acquisition phase (Tigris HEAD/GET, push advisory-lock) of a served git op may run before the request is shed with a 503, separate from the git-run timeout. The concurrency permit is released on expiry so a stalled backend cannot pin the pool. Default 30. |

crates/gitlawb-attest/src/attestation.rs

@@ -539,6 +539,43 @@ mod tests {
         assert!(matches!(err, Error::Signature(_)));
     }
 
+    /// The identity-point forgery must be rejected: the shared attestation
+    /// verifier is a cert-bound provenance gate, so accepting the weak-key
+    /// signature would let anyone mint a forged attestation that verifies.
+    /// Strict verification rejects small-order public keys and R (the identity
+    /// point here), which ordinary verification does not.
+    #[test]
+    fn verify_rejects_identity_point_forgery() {
+        let cert_hash = sample_cert_hash();
+        let mut att = dummy_attestation(&fresh(), cert_hash);
+
+        // Public key A = identity point (0,1); signature R = identity, S = 0.
+        // The equation `[S]B = R + [k]A` then holds for any k and any message.
+        let identity = [
+            1u8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+            0, 0, 0, 0,
+        ];
+        let mut buf = Vec::with_capacity(34);
+        buf.extend_from_slice(&ED25519_MULTICODEC);
+        buf.extend_from_slice(&identity);
+        att.signer = format!(
+            "did:key:{}",
+            multibase::encode(multibase::Base::Base58Btc, &buf)
+        );
+        let mut sig = [0u8; 64];
+        sig[..32].copy_from_slice(&identity);
+        att.sig = B64U.encode(sig);
+
+        let err = att.verify_signature(cert_hash).unwrap_err();
+        match err {
+            Error::Did(msg) => assert!(
+                msg.contains("small-order"),
+                "identity-point signer must be refused as a small-order key, got: {msg}"
+            ),
+            other => panic!("expected Error::Did for an identity-point signer, got {other:?}"),
+        }
+    }
+
     /// A payload that happens to contain a `cert_hash` field of its own does
     /// not interfere with the outer binding: the attestation envelope's
     /// `cert_hash` is the only field consulted by `verify_signature`, and the

crates/gitlawb-core/src/identity.rs

@@ -77,6 +77,14 @@ impl Keypair {
 }
 
 /// Verify an Ed25519 signature.
+///
+/// Strict verification: rejects small-order `R` and small-order public keys
+/// (the identity point, and any point of low order). Ordinary `verify` accepts
+/// a signature forged with the identity point as the public key plus
+/// `R = identity, S = 0`, which verifies for *any* message. `identity::verify`
+/// is the shared primitive behind HTTP request authentication, UCANs, and
+/// certificates, so weak-key acceptance is an authentication bypass, not a
+/// malleability nuance.
 pub fn verify(verifying_key: &VerifyingKey, msg: &[u8], sig_bytes: &[u8; 64]) -> Result<()> {
     let sig = Signature::from_bytes(sig_bytes);
     verifying_key
@@ -208,6 +216,38 @@ mod tests {
         );
     }
 
+    /// The identity-point forgery: with public key A = identity, R = identity,
+    /// and S = 0, the equation `[S]B = R + [k]A` holds for every message,
+    /// because `[k]·identity = identity`. Ordinary (non-strict) Ed25519
+    /// verification accepts it, so the shared `verify` primitive must use
+    /// strict verification, which rejects small-order R and public keys.
+    #[test]
+    fn verify_rejects_identity_point_forgery() {
+        use ed25519_dalek::Verifier;
+        // The identity point (0,1) compresses to y = 1 with sign bit 0.
+        let identity = [
+            1u8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+            0, 0, 0, 0,
+        ];
+        let vk = VerifyingKey::from_bytes(&identity).expect("identity point is on the curve");
+        let mut sig_bytes = [0u8; 64];
+        sig_bytes[..32].copy_from_slice(&identity);
+        let msg = b"arbitrary message the key owner never signed";
+
+        // Prove the forged signature satisfies the ordinary verification
+        // equation, so the strict check below is what actually defends the
+        // boundary (not a signature that was already invalid everywhere).
+        assert!(
+            vk.verify(msg, &Signature::from_bytes(&sig_bytes)).is_ok(),
+            "identity-point forgery must satisfy ordinary verification (this is why strict is needed)"
+        );
+
+        assert!(
+            verify(&vk, msg, &sig_bytes).is_err(),
+            "strict verification must reject the identity-point forgery"
+        );
+    }
+
     #[test]
     fn verify_rejects_weak_key_signature() {
         // Regression guard for strict verification: a signature forged under a

crates/gitlawb-node/Cargo.toml

@@ -75,6 +75,7 @@ alloy = { version = "1", default-features = false, features = [
     "network",
     "rpc-types-eth",
 ] }
+rand = { workspace = true }
 libp2p-dns = { version = "0.45.0", features = ["tokio"] }
 
 [dev-dependencies]