ReserveGrid OS v1.0.1

ReserveGrid OS v1.0.1 — Temper

Hardening release following a full deep scan audit of the v1.0.0 codebase. 22 findings resolved across P0 (critical), P1 (important), and P2 (pre-pilot) priorities. Every finding has a compile verified fix and a DEVLOG entry. 453 tests pass, zero failures.

Audit scope

Two deep scan reports (2026-04-02) examined the full workspace for protocol safety gaps, async correctness issues, silent error drops, hardcoded configuration, race conditions, and missing test coverage. Findings were triaged into four priority tiers (P0 through P3). All P0, P1, and P2 items are resolved in this release. P3 items are scoped for v1.1.x.

License key signing

rg-auth now generates Ed25519 signed license keys in the veldra_lic_<base64url_payload>.<base64url_sig> format, replacing the legacy veldra_<hex> random keys. The payload embeds org, tier, expiry, and feature flags. Validation is a three step process: signature verification, expiry check, then DB revocation check. When the signing key is absent, rg-auth falls back to DB only validation for backward compatibility (removal planned for v1.1).

rg-feed-server validates keys offline using the Ed25519 public key, eliminating the runtime dependency on rg-auth for feed authentication. Tier gating enforces that only observe_paid and inline_licensed keys receive feed access.

rg-desktop embeds the public key at compile time via VELDRA_LICENSE_PUBKEY and persists the active license key to ~/.config/reservegrid/desktop.toml across restarts.

Protocol safety

SV2 frames carrying unsupported extension types are now rejected at all three dispatch points in the handler (SetupConnection, OpenMiningChannel, SubmitShares). Previously these were silently passed through, which could cause downstream parsing failures.

Codec decode failures now send a proper error frame to the peer before disconnecting. Three decode sites (SetupConnection, OpenStandardMiningChannel, SubmitSharesStandard) previously dropped the connection without notifying the client.

Six timing parameter cross-validation checks run at gateway startup to catch misconfigured timeout relationships (for example, heartbeat interval must be less than channel open timeout).

Async correctness

WAL writes and verdict log I/O are moved to spawn_blocking to avoid blocking the tokio executor on synchronous file operations. Nine silent try_send channel drops in the share handler now emit structured warnings with the channel name and drop count. Fifteen silent let _ = error drops across four crates (pool-verifier, sv2-gateway, rg-auth, verifier-stream) are replaced with triaged error handling: warnings for must-know failures, intentional ignores documented for benign cases.

Robustness

Health server bind failure is now non-fatal. If the metrics endpoint cannot bind (for example, port conflict), the gateway logs a warning and continues without the health endpoint rather than aborting.

The in-memory verdict log is now bounded at both push sites. Previously, only one of two push locations enforced the cap, allowing unbounded growth through the other path. The maximum is configurable via VELDRA_VERDICT_LOG_MAX_ENTRIES (default 1000).

TOCTOU races in WAL open and verdict log rotation are eliminated by replacing path.exists() guards with direct open and ENOENT handling.

SQLite integrity check (PRAGMA integrity_check) runs on rg-auth startup and aborts if the database is corrupt.

Configurability

Four previously hardcoded timeouts are now config fields in the gateway TOML:

Field	Section	Default	Purpose
reconnect_delay_ms	[verifier]	2000	Delay between verifier reconnect attempts
heartbeat_interval_ms	[verifier]	5000	Verifier heartbeat send interval
channel_open_timeout_ms	[gateway]	30000	Maximum wait for mining channel open
VELDRA_MEMPOOL_TIMEOUT_MS	env var	900	Mempool HTTP client timeout

Connection limits added to rg-feed-server: VELDRA_FEED_MAX_CONNECTIONS (default 256) and max_connections_per_ip default changed from 0 (unlimited) to 16.

Multi-gateway support

gateway_instance_id is included in the TemplatePropose protocol message, allowing the verifier to distinguish proposals from different gateway instances. The field is Option<String> with serde(default) for backward compatibility with older gateways. Verifier side filtering is available but not enforced by default (requires coordinated configuration).

Desktop auto-updater

The Tauri auto-updater is now fully configured. The updater signing keypair is generated, the public key is embedded in tauri.conf.json, and the release-desktop.yml workflow signs update bundles. Existing v1.0.0 installations must manually install v1.0.1 once (the v1.0.0 build shipped with an empty updater pubkey). After v1.0.1, all future releases auto-update.

Deployment

Fly.io deploy tooling simplified with scripts/fly-deploy.sh. The root Dockerfile is renamed to Dockerfile.gateway to prevent flyctl from auto-discovering it instead of the service specific Dockerfiles.

Production Ed25519 keypair generated for license signing. VELDRA_LICENSE_SIGNING_KEY is set on Fly (rg-auth), VELDRA_LICENSE_PUBKEY is set as a GitHub Actions secret and on the feed server.

Test results

453 tests across 12 crates, zero failures. 7 new tests added for the rg-auth email module covering SMTP config parsing, dev mode send, and all five email template body functions.

cargo test --workspace --exclude rg-desktop
    Finished test profile
     Running 453 tests
     0 failures

Stale count correction

Reason code count corrected from "34" to "73" (15 VerdictReason + 58 GatewayReason) across 17 files including websites, i18n JSON, documentation, and the pitch deck. The count drifted when security hardening sessions added new GatewayReason variants without updating external materials.

New environment variables

Variable	Service	Default	Purpose
VELDRA_LICENSE_SIGNING_KEY	rg-auth	(required)	Ed25519 seed for license key signing
VELDRA_LICENSE_PUBKEY	rg-feed-server, rg-desktop	(required)	Ed25519 pubkey for offline verification
VELDRA_VERDICT_LOG_MAX_ENTRIES	pool-verifier	1000	In-memory verdict log cap
VELDRA_MEMPOOL_TIMEOUT_MS	pool-verifier	900	Mempool HTTP client timeout
VELDRA_FEED_MAX_CONNECTIONS	rg-feed-server	256	Maximum concurrent feed connections

Known limitations

Unchanged from v1.0.0:

• Extended channels and vardiff remain deferred to v1.1 (PB-6)
• Rate limiter state is in-process only (shared state deferred to v1.1)
• Sustained load testing (hours) and two-host network latency benchmarks have not been performed
• Legacy DB-only key validation fallback in rg-auth will be removed in v1.1

Upgrade from v1.0.0

1. Set VELDRA_LICENSE_SIGNING_KEY on rg-auth (Fly secret or env var)
2. Set VELDRA_LICENSE_PUBKEY on rg-feed-server and as a GitHub Actions secret for desktop builds
3. Review new configurable timeouts in gateway TOML if using non-default values
4. Desktop users: manually install v1.0.1 once to enable auto-update for future releases

See CHANGELOG.md for the complete list of changes.