test(client),ci: fuzz frame parsers, VT-x classifier tests, smoke + CI hardening

- proptest-fuzz the untrusted frame parsers (sbx/ai/perm/users/decode_msg) so
  a hostile relay/peer can never panic a client; fixes a decode_msg timestamp
  byte-slice that panicked on a non-ASCII stamp (now char-boundary safe)
- extract a pure classify_vtx_holders() out of vtx_holders() and unit-test the
  KVM/QEMU/multipass detection and stoppability rules
- headless cross-stack smoke test (smoke-e2e.sh): real relay + two TUI clients
  in tmux, asserting SRP join, Fernet chat round-trip, and command dispatch
- CI: macOS matrix for the Rust client, cargo-audit + pip-audit, gitleaks
  secret scan, llvm-cov/pytest-cov coverage, and a smoke-test job

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

This commit is contained in:

leetcrypt

2026-06-04 22:56:00 -07:00

parent dc23e0b44e

commit 01e607dced

6 changed files with 600 additions and 10 deletions

									
										hh/Cargo.toml
									
		+4
		
												View File
												
				@@ -48,3 +48,7 @@ serde_json = "1"

				# cli / errors

				clap = { version = "4", features = ["derive"] }

				anyhow = "1"

				[dev-dependencies]

				# property-based fuzzing of the frame parsers (attacker-controlled JSON)

				proptest = "1"