Hardening: CBOR and pack corruption tests, index bounds validation, concurrent HTTP push test, 1 GiB benchmark (spec 0.6q) 2b872d074ddb

    fn xorshift(state: &mut u64) -> u64 {

        *state ^= *state << 13;

        *state ^= *state >> 7;

        *state ^= *state << 17;

        *state

    }

    fn random_value(seed: &mut u64, depth: u32) -> Value {

        match xorshift(seed) % if depth > 4 { 5 } else { 7 } {

            0 => Value::Uint(match xorshift(seed) % 4 {

                0 => xorshift(seed) % 24,

                1 => xorshift(seed) % 256,

                2 => xorshift(seed) % 65536,

                _ => xorshift(seed),

            }),

            1 => Value::Bool(xorshift(seed).is_multiple_of(2)),

            2 => Value::Null,

            3 => {

                let n = (xorshift(seed) % 40) as usize;

                Value::Bytes((0..n).map(|_| (xorshift(seed) & 0xff) as u8).collect())

            }

            4 => {

                let n = (xorshift(seed) % 12) as usize;

                Value::Text((0..n).map(|_| char::from_u32((xorshift(seed) % 0x24f) as u32 + 1).unwrap_or('x')).collect())

            }

            5 => {

                let n = (xorshift(seed) % 5) as usize;

                Value::Array((0..n).map(|_| random_value(seed, depth + 1)).collect())

            }

            _ => {

                let n = (xorshift(seed) % 5) as usize;

                let mut m = std::collections::BTreeMap::new();

                for _ in 0..n {

                    m.insert(xorshift(seed) % 300, random_value(seed, depth + 1));

                }

                Value::Map(m)

            }

        }

    }

    /// Random values round-trip and re-encode identically (canonical form).

    #[test]

    fn random_values_round_trip() {

        let mut seed = 0x2545f4914f6cdd1du64;

        for _ in 0..2000 {

            let v = random_value(&mut seed, 0);

            let b = encode(&v);

            let back = decode(&b).unwrap();

            assert_eq!(back, v);

            assert_eq!(encode(&back), b);

        }

    }

    /// Random bytes and mutated encodings never panic; whatever decodes is

    /// canonical, so re-encoding it reproduces the input exactly.

    #[test]

    fn random_and_mutated_input_never_panics() {

        let mut seed = 0xdeadbeefcafef00du64;

        for _ in 0..3000 {

            let n = (xorshift(&mut seed) % 64) as usize;

            let bytes: Vec<u8> = (0..n).map(|_| (xorshift(&mut seed) & 0xff) as u8).collect();

            if let Ok(v) = decode(&bytes) {

                assert_eq!(encode(&v), bytes, "accepted input must be canonical: {bytes:02x?}");

            }

        }

        for _ in 0..3000 {

            let v = random_value(&mut seed, 0);

            let mut b = encode(&v);

            if b.is_empty() {

                continue;

            }

            match xorshift(&mut seed) % 3 {

                0 => {

                    let at = (xorshift(&mut seed) as usize) % b.len();

                    b[at] ^= 1 << (xorshift(&mut seed) % 8);

                }

                1 => {

                    let keep = (xorshift(&mut seed) as usize) % b.len();

                    b.truncate(keep);

                }

                _ => {

                    let at = (xorshift(&mut seed) as usize) % b.len();

                    b.insert(at, (xorshift(&mut seed) & 0xff) as u8);

                }

            }

            if let Ok(v2) = decode(&b) {

                assert_eq!(encode(&v2), b, "accepted mutation must be canonical");

            }

        }

        // Deep nesting is refused rather than overflowing the stack.

        let mut deep = vec![0x81u8; 100_000];

        deep.push(0x00);

        assert!(matches!(decode(&deep), Err(CborError::Unsupported(_))));

        // Lengths beyond the input are refused without allocating them.

        assert!(matches!(decode(&[0x5b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff]), Err(CborError::LengthOverflow) | Err(CborError::UnexpectedEnd)));

    }

/// Benchmark, not a gate: `cargo test --release -p oxy-core --lib bench_one_gibibyte -- --ignored --nocapture`.

/// Commits, stores, clones, and reads back a 1 GiB incompressible file.

#[test]

#[ignore]

fn bench_one_gibibyte_file() {

    hermetic();

    // /tmp is often a small tmpfs; `OXY_BENCH_DIR` picks a roomier disk.

    let dir = match std::env::var_os("OXY_BENCH_DIR") {

        Some(d) => tempfile::tempdir_in(d).unwrap(),

        None => tempfile::tempdir().unwrap(),

    };

    let root = dir.path();

    let repo = Repo::init(&root.join("r")).unwrap().with_home(root.join("home"));

    let size = 1usize << 30;

    let mut data = vec![0u8; size];

    let mut x = 0x9e3779b97f4a7c15u64;

    for chunk in data.chunks_mut(8) {

        x ^= x << 13;

        x ^= x >> 7;

        x ^= x << 17;

        let b = x.to_le_bytes();

        chunk.copy_from_slice(&b[..chunk.len()]);

    }

    let t = std::time::Instant::now();

    write(&root.join("r"), "big.bin", &data);

    eprintln!("write 1 GiB to disk: {:.2?}", t.elapsed());

    let t = std::time::Instant::now();

    let h = repo.commit("big", &[]).unwrap();

    eprintln!("commit (chunk + hash + store): {:.2?}", t.elapsed());

    let t = std::time::Instant::now();

    assert!(!repo.snapshot("status").unwrap().changed);

    eprintln!("status on a clean 1 GiB working copy: {:.2?}", t.elapsed());

    let t = std::time::Instant::now();

    let objects = repo.store().list().unwrap().len();

    eprintln!("objects stored: {objects} ({:.2?} to list)", t.elapsed());

    let t = std::time::Instant::now();

    let g = repo.gc(true).unwrap();

    eprintln!("gc (pack): {:.2?} {g:?}", t.elapsed());

    let t = std::time::Instant::now();

    let clone = Repo::clone(&root.join("r").to_string_lossy(), &root.join("c")).unwrap();

    eprintln!("clone (fetch + checkout): {:.2?}", t.elapsed());

    let t = std::time::Instant::now();

    let back = fs::read(root.join("c/big.bin")).unwrap();

    assert_eq!(blake3::hash(&back), blake3::hash(&data));

    eprintln!("read back and verify: {:.2?}", t.elapsed());

    assert_eq!(clone.bookmark_heads().unwrap(), vec![h]);

    let store_bytes: u64 = walkdir_size(&root.join("r/.oxy/objects"));

    eprintln!("store size: {:.1} MiB for 1 GiB of data", store_bytes as f64 / (1024.0 * 1024.0));

}

fn walkdir_size(p: &Path) -> u64 {

    let mut total = 0;

    if let Ok(rd) = fs::read_dir(p) {

        for e in rd.flatten() {

            let path = e.path();

            if path.is_dir() {

                total += walkdir_size(&path);

            } else if let Ok(m) = fs::metadata(&path) {

                total += m.len();

            }

        }

    }

    total

}

/// Largest object a pack entry may claim; anything bigger is corruption,

/// and refusing it keeps a bad index from driving huge allocations.

const MAX_OBJECT_LEN: u32 = 1 << 30;

        let pack_len = fs::metadata(pack_path)?.len();

            let entry = PackEntry {

            };

            if entry.stored_len > MAX_OBJECT_LEN || entry.raw_len > MAX_OBJECT_LEN || entry.offset.saturating_add(entry.stored_len as u64) > pack_len {

                return Err(bad("index entry points outside the pack"));

            }

            entries.push(entry);

    fn xorshift(state: &mut u64) -> u64 {

        *state ^= *state << 13;

        *state ^= *state >> 7;

        *state ^= *state << 17;

        *state

    }

    /// Random corruption of pack and index files never panics: reads fail

    /// with an error or the store refuses to open, and untouched objects

    /// stay readable when the index survives.

    #[test]

    fn corrupted_packs_and_indexes_fail_cleanly() {

        let dir = tempfile::tempdir().unwrap();

        let objects = dir.path().join("objects");

        let s = Store::open(&objects).unwrap();

        let mut refs = Vec::new();

        let mut seed = 0x9e3779b97f4a7c15u64;

        for i in 0..40u32 {

            let len = (xorshift(&mut seed) % 5000) as usize;

            let mut body = vec![0u8; len];

            for b in body.iter_mut() {

                *b = if i % 2 == 0 { (xorshift(&mut seed) & 0xff) as u8 } else { b'a' + (i % 26) as u8 };

            }

            refs.push(s.put(ObjectType::Chunk, &body).unwrap());

        }

        s.pack_loose().unwrap();

        let pack = fs::read_dir(&objects).unwrap().filter_map(|e| e.ok().map(|e| e.path())).find(|p| p.extension().is_some_and(|x| x == "pack")).unwrap();

        let idx = pack.with_extension("idx");

        let pristine_pack = fs::read(&pack).unwrap();

        let pristine_idx = fs::read(&idx).unwrap();

        for round in 0..300u32 {

            let (path, pristine) = if round % 2 == 0 { (&pack, &pristine_pack) } else { (&idx, &pristine_idx) };

            let mut data = pristine.clone();

            match xorshift(&mut seed) % 4 {

                0 => {

                    let at = (xorshift(&mut seed) as usize) % data.len();

                    data[at] ^= 1 << (xorshift(&mut seed) % 8);

                }

                1 => {

                    let at = (xorshift(&mut seed) as usize) % data.len();

                    data[at] = (xorshift(&mut seed) & 0xff) as u8;

                }

                2 => {

                    let keep = (xorshift(&mut seed) as usize) % data.len();

                    data.truncate(keep);

                }

                _ => {

                    let at = (xorshift(&mut seed) as usize) % data.len();

                    let n = ((xorshift(&mut seed) % 8) + 1) as usize;

                    for k in 0..n.min(data.len() - at) {

                        data[at + k] = 0xff;

                    }

                }

            }

            fs::write(path, &data).unwrap();

            // Opening may refuse a broken index; a store that opens must

            // either return each object intact or report it corrupt/missing.

            if let Ok(s2) = Store::open(&objects) {

                for r in &refs {

                    match s2.get(r) {

                        Ok((ty, body)) => assert_eq!(hash_object(ty, &body), *r, "a returned object always matches its reference"),

                        Err(StoreError::Corrupt(..)) | Err(StoreError::NotFound(_)) | Err(StoreError::Io(_)) => {}

                        Err(e) => panic!("unexpected error {e}"),

                    }

                }

            }

            fs::write(path, pristine).unwrap();

        }

        // Restored files read back in full.

        let s3 = Store::open(&objects).unwrap();

        for r in &refs {

            let (ty, body) = s3.get(r).unwrap();

            assert_eq!(hash_object(ty, &body), *r);

        }

    }

/// Eight clones push independent changes at the same moment. The server

/// serialises pushes per repository, so every push either lands or is

/// refused because the bookmark moved, and a pull-then-push retry lands it.

#[test]

fn concurrent_pushes_are_serialised() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let served = root.join("served");

    Repo::init(&served.join("origin")).unwrap();

    let base = start(&served, vec![]);

    let url = format!("{base}/origin");

    const N: usize = 8;

    let mut clones = Vec::new();

    for i in 0..N {

        let path = root.join(format!("c{i}"));

        Repo::clone(&url, &path).unwrap();

        clones.push(path);

    }

    let barrier = std::sync::Arc::new(std::sync::Barrier::new(N));

    let mut handles = Vec::new();

    for (i, path) in clones.into_iter().enumerate() {

        let barrier = barrier.clone();

        handles.push(std::thread::spawn(move || {

            let repo = Repo::open(&path).unwrap();

            write(&path, &format!("file-{i}.txt"), format!("from clone {i}\n").as_bytes());

            let h = repo.commit(&format!("change {i}"), &[]).unwrap();

            barrier.wait();

            // A push is refused either up front (the remote moved since the

            // clone's last fetch) or by the server's compare-and-swap; both

            // are answered by pulling and pushing again.

            for attempt in 0..(N * 4) {

                match repo.push("origin", false) {

                    Ok(r) if r.iter().all(|x| x.ok) => return (h, attempt),

                    Ok(_) => {}

                    Err(e) if e.to_string().contains("pull first") || e.to_string().contains("moved") => {}

                    Err(e) => panic!("clone {i}: {e}"),

                }

                repo.pull("origin").unwrap_or_else(|e| panic!("clone {i} pull: {e}"));

            }

            panic!("clone {i} never managed to push");

        }));

    }

    let mut hashes = Vec::new();

    let mut total_rejected = 0;

    for h in handles {

        let (hash, attempts) = h.join().unwrap();

        hashes.push(hash);

        total_rejected += attempts;

    }

    let origin = Repo::open(&served.join("origin")).unwrap();

    let mut heads = origin.bookmark_heads().unwrap();

    heads.sort();

    hashes.sort();

    assert_eq!(heads, hashes, "every independent change is a head");

    let snap = origin.load_state(&heads).unwrap().materialize();

    for i in 0..N {

        assert!(snap.files.contains_key(&format!("file-{i}.txt")));

    }

    assert!(!snap.is_conflicted());

    eprintln!("{total_rejected} pushes were refused for a moved bookmark and retried");

    // The operation log is a single chain: each accepted push builds on the last.

    let ops = origin.op_log().unwrap();

    assert!(ops.len() > N);

}

- [x] Hardening: property tests for the CBOR decoder and pack reader against random and mutated inputs; a concurrent-push test against the server; a 1 GB single-file benchmark for chunking and blobs. (Done: random/mutated CBOR never panics and accepted input is canonical; 300 rounds of pack/index corruption fail cleanly, with new index bounds checks; 8 concurrent HTTP pushes serialise with pull-and-retry; `bench_one_gibibyte_file` is an ignored release-mode test, run with `OXY_BENCH_DIR` on a real disk.)

- [ ] Performance follow-up from the 1 GiB benchmark: commit takes 5.6 s on tmpfs but 63 s on the SSD, and clone 49 s, because every object is written with its own fsync (13,715 chunks). Write committed and fetched objects straight into a pack with one fsync, or batch loose writes.

- [ ] Performance follow-up: `oxy status` re-hashes a clean 1 GiB working copy (2.4 s). Record size and mtime in the manifest and skip hashing files whose stat is unchanged (spec allows a stat cache).

- 2026-09-27 08:05 iteration 14: hardening (CBOR and pack fuzz-style tests, concurrent pushes, 1 GiB benchmark: write 0.7 s, commit 63 s on SSD / 5.6 s on tmpfs, status 2.4 s, clone 49 s, read back 1.0 s, store 1025.6 MiB, 13,715 objects). 110 tests, 1 ignored benchmark.

| **Status** | Draft 0.6q |

Object writes go to a temporary file, are `fsync`ed, and are renamed into place. Pack files are `fsync`ed before their index is written. An interrupted write can never corrupt an existing object. A reader MUST validate an index before trusting it: entries sorted and unique, each `offset + length` inside the pack, and lengths below an implementation limit (1 GiB), so a damaged index can neither drive out-of-bounds reads nor huge allocations; every object read is re-hashed regardless. The refs cache is derivable from the operation log and is rebuilt if missing.

*Changelog.* Draft 0.6q (2026-09-27): pack index validation rules (§13.1).

Draft 0.6p (2026-09-27): `oxy git fetch` and `oxy git push` against a Git remote through a mirror, with incremental import seeded by imported and exported commits (§23).