Skip to content

MFA-Forge v1.0.2

Latest
Latest

Choose a tag to compare

View all tags
@wnunezc wnunezc released this 20 Jun 12:50
v1.0.2
This tag was signed with the committer’s verified signature.
wnunezc Walter Nuñez
GPG key ID: 1A9506A1E1CA15FC
Verified
Learn about vigilant mode.
563dd68
This commit was signed with the committer’s verified signature.
wnunezc Walter Nuñez
GPG key ID: 1A9506A1E1CA15FC
Verified
Learn about vigilant mode.

MFA-Forge v1.0.2

Changes

  • keep the Win32 owner thread responsive while agent and MCP wait for stdio
  • add bounded Windows Hello and native prompt supervision
  • expose additive process, instance and session identity in health responses
  • harden the persistent workspace engine against dead or unresponsive child processes
  • use a vendored winit 0.30.13 Windows patch to avoid mixed-DPI drag flicker and oversized window growth until the upstream fix is released
  • add CI guardrails for localization keys, public API documentation debt and production panic boundaries

Temporary dependency patch

MFA-Forge 1.0.2 overrides winit through [patch.crates-io] and uses
vendor/winit-0.30.13-dpi-drag. The vendored copy is based on the official
winit 0.30.13 source with a narrow Windows WM_DPICHANGED change for
mixed-DPI monitor drags. This reduces release risk for the Windows desktop
hotfix, but it is still a temporary non-upstream dependency. Replace it with the
official crates.io version as soon as the upstream project publishes the fix.

Issue closure matrix

Issue Closure evidence
#1 Extensive improvement rules Addressed as the 1.0.2 architecture audit plus targeted implementation: lifecycle blocking removed, native waits bounded, public health/session identity expanded, secret-safe audit boundaries preserved, app-data preferences moved behind storage, oversized storage/update/dialog responsibilities split, and release discipline documented. Requirements unrelated to MFA-Forge's current scope remain non-applicable rather than implemented as speculative features.
#2 Agent/MCP unresponsive after unlock Fixed by the shared stdio runtime, dedicated stdin reader, Win32 message pumping while idle, EOF/error/close handling, bounded Windows Hello/native waits, persistent engine hardening, one-hour soak evidence, and no new WER Application Hang 1002 during validation.
#3 Move audit/preferences/GUI file access behind ports GUI preferences and main-window state path now use mfa_forge_storage::app_data / preferences; audit JSONL append/read/summarize/compact now lives in mfa_forge_storage::audit_log, while GUI keeps only audit-entry semantics/redaction.
#4 Split oversized modules by existing responsibilities Storage repository IO, directory-registry normalization and history helpers were split into private modules; GUI update actions moved to app_actions::update; update dialog moved to dialogs::update. Large inline test sections remain where they need private access; they are not product runtime responsibilities.
#5 Reduce cryptographic test contention Tests now use a fast-test-kdf feature only in test builds/dev-dependencies, while production builds continue to use Argon2id 64 MiB / 3 iterations. A dedicated test asserts production-strength parameters remain available.

Test timing evidence

Initial timing on the Windows host before test KDF isolation showed repeated
Argon2 contention: mfa-forge-storage about 128.6s, mfa-forge-application
about 168.6s, and GUI MCP timing exceeded the 180s measurement window while
contending for Cargo/test locks.

After isolating fast test KDF parameters from production builds:

  • cargo test -p mfa-forge-storage: 1.46s
  • cargo test -p mfa-forge-application: 4.61s
  • cargo test -p mfa-forge-gui agent::mcp: 10.25s

Validation required before publication

  • full Rust quality gates
  • persistent agent and MCP Windows smoke
  • one-hour active soak without new Application Hang event 1002
  • optional extended eight-hour soak after the blocking release gates
  • installed upgrade from 1.0.1 to 1.0.2
  • GUI language smoke in English, Español, Français, हिन्दी and 中文
  • GitHub workflow_dispatch build artifact validated without publishing a release

Publication boundary

1.0.2 is the approved GitHub release line. GitHub publication uses tag
v1.0.2, MSI asset MFA-Forge-1.0.2-x64.msi, and checksum asset
MFA-Forge-1.0.2-x64.msi.sha256.txt. Winget publication is a separate PR
against microsoft/winget-pkgs; until that PR is accepted, winget may still
show wnunezc.MFA-Forge 1.0.1.

Assets

  • MFA-Forge-1.0.2-x64.msi
  • MFA-Forge-1.0.2-x64.msi.sha256.txt
Assets 4
Loading