lib

commit ebc707fc8a09777ab0a637cba429e18a0aaaaac5
parent e1bdfa70090efc15c8592bca56beefde177121fa
Author: triesap <tyson@radroots.org>
Date:   Tue,  7 Jul 2026 09:26:47 +0000

transport: harden closeout source guards

- Add proxy and Reticulum message source-boundary witnesses.
- Ban the removed proxy transport literal across transport hardening sources.
- Replace a stale arbitrary Reticulum fixture with the canonical preview endpoint.
- Validate with fmt, transport tests, contract validation, and release preflight.

Diffstat:
M
crates/transport/tests/source_boundary.rs
 | 
45
+++++++++++++++++++++++++++++++++++++++++++++
M
crates/transport_nostr/tests/transport.rs
 | 
9
++++++---

2 files changed, 51 insertions(+), 3 deletions(-)
diff --git a/crates/transport/tests/source_boundary.rs b/crates/transport/tests/source_boundary.rs
@@ -18,6 +18,10 @@ const TRANSPORT_HARDENING_CRATE_SOURCE_ROOTS: &[&str] = &[
 
 const FORBIDDEN_TRANSPORT_CONCEPTS: &[ForbiddenConcept] = &[
     ForbiddenConcept {
+        pattern: "\"radrootsd_proxy\"",
+        reason: "proxy must use first-class RadrootsTransportKind::Proxy modeling",
+    },
+    ForbiddenConcept {
         pattern: "radrootsd.publish_proxy.v1",
         reason: "transport publish protocol v1 proxy identifiers are removed",
     },
@@ -116,6 +120,47 @@ fn transport_publish_capabilities_keep_readiness_and_usability_fields() {
     }
 }
 
+#[test]
+fn transport_hardening_sources_keep_proxy_and_reticulum_message_contracts() {
+    let crates_root = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .expect("transport crate parent");
+    let transport_kind = read_source(crates_root.join("transport/src/kind.rs").as_path());
+    for required in [
+        "Proxy,",
+        r#""proxy" => Ok(Self::Proxy)"#,
+        r#"Self::Proxy => "proxy".to_string()"#,
+    ] {
+        assert!(
+            transport_kind.contains(required),
+            "transport kind source must retain first-class proxy witness `{required}`"
+        );
+    }
+
+    let reticulum_source =
+        read_source(crates_root.join("transport_reticulum/src/lib.rs").as_path());
+    for required in [
+        "RETICULUM_PREVIEW_UNAVAILABLE_MESSAGE",
+        "Reticulum transport is configured for future compatibility, ",
+        "but this build does not implement Reticulum delivery.",
+    ] {
+        assert!(
+            reticulum_source.contains(required),
+            "Reticulum preview source must retain unavailable message witness `{required}`"
+        );
+    }
+
+    let protocol_source = read_source(
+        crates_root
+            .join("transport_publish_protocol/src/lib.rs")
+            .as_path(),
+    );
+    assert!(
+        protocol_source.contains("Reticulum transport is configured for future compatibility, but this build does not implement Reticulum delivery."),
+        "transport publish capabilities must retain the approved Reticulum unavailable message"
+    );
+}
+
 fn rust_source_files(root: &Path) -> Vec<PathBuf> {
     let mut paths = Vec::new();
     collect_rust_source_files(root, &mut paths);
diff --git a/crates/transport_nostr/tests/transport.rs b/crates/transport_nostr/tests/transport.rs
@@ -1681,8 +1681,11 @@ async fn outbox_publish_skips_non_nostr_targets() {
                 RadrootsTransportSatisfactionPolicy::all_accepted(),
                 vec![
                     nostr_target(RELAY_PRIMARY_WSS),
-                    RadrootsTransportTarget::new(RadrootsTransportKind::Reticulum, "reticulum:a")
-                        .expect("reticulum target"),
+                    RadrootsTransportTarget::new(
+                        RadrootsTransportKind::Reticulum,
+                        "reticulum:preview-unavailable",
+                    )
+                    .expect("reticulum target"),
                 ],
             ),
             1_000,
@@ -1728,7 +1731,7 @@ async fn outbox_publish_skips_non_nostr_targets() {
         .expect("targets");
     assert!(targets.iter().any(|target| {
         target.transport_kind == RadrootsTransportKind::Reticulum
-            && target.status == RadrootsOutboxDeliveryTargetStatus::DeferredUntilImplemented
+            && target.status == RadrootsOutboxDeliveryTargetStatus::PreviewUnavailable
     }));
 }