chore(srtla-send-rs): set SRTLA_CUTOVER_VERSION to 2026.6.2

[andrescera]

IGNORE<< I miss clicked

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds atomic telemetry file output (ADR-001 JSON schema), a SIGHUP reload guard that refuses zero-valid-IP reloads, 32-byte NAT padding for SRTLA control packets, --dry-run/--verbose/--stats-file CLI flags, connection-pool file-order rebuild, SIGTERM/SIGINT graceful shutdown, a new @ceralive/srtla-send TypeScript binding, and overhauled CI/CD pipelines including a dedicated release workflow and npm OIDC publish workflow. CONN_TIMEOUT is changed from 5 to 15 seconds.

Changes

Rust Sender Core

Layer / File(s)	Summary
Toolchain pin, deny.toml, version bump, gitignore rust-toolchain.toml, deny.toml, Cargo.toml, .gitignore	Pins nightly toolchain to nightly-2026-06-12, adds cargo-deny supply-chain enforcement (RUSTSEC advisory ignore + crates.io-only sources), bumps crate version to 2026.6.1, and ignores .omo//test-results/.
Control-packet 32-byte NAT padding src/connection/packet_io.rs, src/connection/mod.rs, src/connection/batch_send.rs	Adds MIN_CONTROL_PKT_LEN = 32 and send_control_padded; all keepalive/SRTLA/REG2 sends route through it. DATA frames are explicitly documented as non-padded.
CONN_TIMEOUT bump to 15s src/protocol/constants.rs	Changes CONN_TIMEOUT from 5 to 15 seconds with a parity-contract comment; adds #[allow(dead_code)] annotations to several protocol constants.
Telemetry file module (ADR-001) src/lib.rs, src/telemetry_file.rs, tests/fixtures/telemetry-golden.json	Adds TelemetryConn, build_telemetry_json (bytes/s → bits/s ×8 conversion), conns_from_stats (weight normalization), write_atomic (fsync+rename), and TelemetryWriter with RAII Drop cleanup. Golden fixture populated.
SIGHUP reload guard src/sender/reload.rs	New module defining ReloadRefusal (NotFound, Empty, NoValidIps), IpReload (Apply/Refuse), analyze_ip_reload_text (pure), and analyze_ip_reload (filesystem wrapper).
Connection pool file-order rebuild src/sender/connections.rs, src/sender/housekeeping.rs	Refactors apply_connection_changes to rebuild the live pool in ips-file order using label-keyed HashMaps, preserving survivors without re-handshake and resetting last_selected_idx on reorder. Empty-pool guard added to handle_housekeeping.
Sender lifecycle integration src/sender/mod.rs	run_sender_with_config gains telemetry: Option<TelemetryWriter>, periodic telemetry tick, tolerant empty-pool startup, guarded probing, SIGHUP refactored through analyze_ip_reload, and SIGTERM/SIGINT clean-exit branches.
CLI --dry-run, --verbose, --stats-file src/main.rs	Adds --verbose, --dry-run, --stats-file, --stats-file-interval to Cli; DryRunReport + dry_run_resolve perform DNS resolution without socket binding; main constructs optional TelemetryWriter and removes stats files on shutdown.
EDPF/IoDS selection cleanup src/sender/selection/edpf.rs, src/sender/selection/iods.rs, src/sender/selection/mod.rs, src/sender/status.rs	Collapses nested if let blocks into single short-circuit conditions; reformats function signatures and test assertions. No behavior change.
Deterministic timing seam src/test_helpers.rs	Adds advance_test_clock(by: Duration) as the canonical seam for #[tokio::test(start_paused = true)] tests.
Rust unit test suite src/tests/connection_tests.rs, src/tests/integration_tests.rs, src/tests/protocol_tests.rs, src/tests/registration_tests.rs, src/tests/sender_tests.rs	Replaces wall-clock sleeps with deterministic timing; adds tests for control padding, CONN_TIMEOUT pin, protocol encode/decode/malformed, REG1→REG3 handshake, pool reload ordering, socket-identity parity, and ACK/NAK attribution.
Outer integration test suites tests/dry_run.rs, tests/signal_parity.rs, tests/telemetry_edge_cases.rs, tests/telemetry_fixture_parity.rs, tests/netns_pr19_parity.rs	Adds CLI dry-run contract tests, Unix signal parity tests (SIGHUP/SIGTERM/SIGINT), ADR-001 telemetry serializer boundary tests, Rust↔TS golden-fixture byte-identity test, and optional Linux netns keepalive/jitter tests.
Documentation AGENTS.md, README.md	AGENTS.md rewritten as a project-specific contributor guide (parity contract, anti-patterns, hardening tasks). README.md expands CI/CD, CLI options, operational behavior, and protocol transport note.

---

TypeScript @ceralive/srtla-send Binding

Layer / File(s)	Summary
Package manifest and tooling bindings/typescript/package.json, bindings/typescript/tsconfig.json, bindings/typescript/tsconfig.build.json, bindings/typescript/biome.json, bindings/typescript/.*	Creates the ESM package with subpath exports (., ./sender, ./telemetry), TypeScript ES2022/NodeNext config, Biome linting, and npm publish config.
Sender module bindings/typescript/src/sender/index.ts, bindings/typescript/src/sender/index.test.ts, bindings/typescript/src/index.ts	Adds Zod schema for srtla_send options, buildSrtlaSendArgs (positional + conditional flags), getSrtlaSendExec (resolution chain), spawnSrtlaSend, sendSrtlaSendHup, isSrtlaSendRunning; plus test suite.
Telemetry module bindings/typescript/src/telemetry/index.ts, bindings/typescript/src/telemetry/index.test.ts, bindings/typescript/tests/telemetry-reader.test.ts, bindings/typescript/tests/fixtures/telemetry-golden.json	Adds connectionTelemetrySchema, telemetrySchema (literal schema_version: 1), readTelemetry (non-throwing), watchTelemetry (polling + stale flag + stop()), senderTelemetryPath; golden fixture; schema edge-case and round-trip test suites.

---

CI/CD Pipelines and Deb Packaging

Layer / File(s)	Summary
ci/build-deb.sh ci/build-deb.sh, .github/workflows/build-debian.yml	New deterministic Debian packaging script that reads version from Cargo.toml, writes DEBIAN/control (with Conflicts/Replaces via SRTLA_CUTOVER_VERSION), performs glob self-test, and conditionally builds/validates with dpkg-deb. Old build-debian.yml removed.
ci.yml updates .github/workflows/ci.yml	Uses rust-toolchain.toml pinning for the main test job, adds cargo-deny supply-chain check, adds build-deb matrix job (arm64/amd64), and fixes test-stable/test-beta/windows/macOS jobs to use explicit cargo +<channel> invocations.
release.yml .github/workflows/release.yml	New tag-triggered workflow that cross-builds srtla_send for arm64/amd64, packages .deb via ci/build-deb.sh, computes SHA-256 checksums, verifies both arch artifacts with filename-glob gate, and attaches to the GitHub release.
publish-bindings.yml .github/workflows/publish-bindings.yml	New bindings-v*-triggered workflow that verifies tag/package.json version parity, typechecks/tests/builds, guards against .ts source in tarball, selects latest/next dist-tag, and publishes via npm OIDC with optional dry-run.

Sequence Diagram(s)

sequenceDiagram
    participant CLI as srtla_send CLI
    participant main
    participant dry_run_resolve
    participant run_sender_with_config
    participant TelemetryWriter
    participant analyze_ip_reload
    participant apply_connection_changes

    CLI->>main: --dry-run flag
    main->>dry_run_resolve: ips_file, host, port
    dry_run_resolve-->>main: DryRunReport (no sockets bound)
    main-->>CLI: exit 0

    CLI->>main: normal run + --stats-file
    main->>run_sender_with_config: telemetry: Some(TelemetryWriter)
    run_sender_with_config->>TelemetryWriter: publish initial snapshot
    loop periodic tick
        run_sender_with_config->>TelemetryWriter: publish(shared_stats)
    end
    run_sender_with_config->>analyze_ip_reload: on SIGHUP
    analyze_ip_reload-->>run_sender_with_config: Apply(ips) or Refuse(reason)
    run_sender_with_config->>apply_connection_changes: new_ips (file order)
    apply_connection_changes-->>run_sender_with_config: survivors preserved, new conns added
    run_sender_with_config-->>main: Ok(()) on SIGTERM/SIGINT
    main->>TelemetryWriter: remove (unlink .json + .tmp)

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

• irlserver/srtla_send#11: Directly related — this PR changes CONN_TIMEOUT in the same src/protocol/constants.rs file where PR #11 first introduced/set that constant.
• irlserver/srtla_send#3: Directly related — both PRs modify apply_connection_changes in src/sender/connections.rs, with this PR refactoring the pool-rebuild logic PR #3 established.
• irlserver/srtla_send#7: Directly related — this PR's control-send path updates (writing last_sent after padded sends in send_srtla_packet) continue the last_keepalive_ms → last_sent connection-tracking refactor from PR #7.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

[coderabbitai]

Actionable comments posted: 13

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/main.rs (1)

42-42: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Keep the help usage in the CeraLive positional order.

The CLI parses the right positionals, but the usage string advertises [OPTIONS] first. The contract requires the user-facing form to be srtla_send SRT_LISTEN_PORT SRTLA_HOST SRTLA_PORT BIND_IPS_FILE [OPTIONS].

Proposed fix

-    override_usage = "srtla_send [OPTIONS] SRT_LISTEN_PORT SRTLA_HOST SRTLA_PORT BIND_IPS_FILE"
+    override_usage = "srtla_send SRT_LISTEN_PORT SRTLA_HOST SRTLA_PORT BIND_IPS_FILE [OPTIONS]"

As per coding guidelines, src/main.rs must keep the CLI positional order exactly as srtla_send <SRT_LISTEN_PORT> <SRTLA_HOST> <SRTLA_PORT> <BIND_IPS_FILE> [OPTIONS].

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main.rs` at line 42, The override_usage string in src/main.rs incorrectly
places [OPTIONS] before the positional arguments. Reorder the override_usage
assignment to move the positional arguments (SRT_LISTEN_PORT, SRTLA_HOST,
SRTLA_PORT, BIND_IPS_FILE) before [OPTIONS], and wrap each positional argument
name in angle brackets to match the required format: srtla_send
<SRT_LISTEN_PORT> <SRTLA_HOST> <SRTLA_PORT> <BIND_IPS_FILE> [OPTIONS].

Source: Coding guidelines

🧹 Nitpick comments (2)

bindings/typescript/src/sender/index.ts (1)

44-46: ⚡ Quick win

Emit --stats-file-interval only when statsFile is also set.

--stats-file-interval is emitted whenever statsFileInterval is defined, even if statsFile is not set. Semantically, the interval has no effect without a stats file to write to. While the Rust CLI likely ignores the orphaned flag, the binding should guard the emission:

if (options.statsFile && options.statsFileInterval !== undefined) {
    args.push('--stats-file-interval', String(options.statsFileInterval));
}

This prevents passing meaningless flags and improves clarity.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindings/typescript/src/sender/index.ts` around lines 44 - 46, The
conditional check for emitting the --stats-file-interval flag only validates
that statsFileInterval is defined, but this flag is meaningless without a
corresponding stats file. Update the condition that guards the args.push call
for --stats-file-interval to require both options.statsFile to be set AND
options.statsFileInterval to be defined before emitting the flag, preventing
orphaned flags from being passed to the underlying command.

bindings/typescript/.npmignore (1)

1-12: 💤 Low value

Consider removing .npmignore or clarifying the comment.

When package.json has a "files" field, it acts as an allowlist and takes precedence, making .npmignore (a denylist) redundant. The comment on line 2 says "This complement" but .npmignore doesn't actually complement the files field—the files field is the single source of truth for what ships. Having both is harmless but adds maintenance surface.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindings/typescript/.npmignore` around lines 1 - 12, The `.npmignore` file is
redundant because the `files` field in package.json acts as an allowlist and
takes precedence over `.npmignore` as the single source of truth for what gets
shipped to npm. Remove the `.npmignore` file entirely to eliminate maintenance
surface and confusion, since the `files` field in package.json already defines
what should be included in the npm tarball. If the intent is to keep the file,
update the misleading comment on line 2 that claims `.npmignore` "complements"
the `files` field—clarify instead that the `files` field is the actual source of
truth and that `.npmignore` is not necessary.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 20-25: GitHub Actions are currently using mutable version tags
(`@v4`, `@v1`, etc.) which pose a supply-chain security risk. In
.github/workflows/ci.yml, pin the actions/checkout@v4 action at line 21 and
actions-rust-lang/setup-rust-toolchain@v1 action at line 24, along with the
remaining actions at lines 85, 91, and 115 to their full immutable commit SHAs.
Similarly, in .github/workflows/release.yml, pin all uses entries at lines 31,
35, 68, 82, and 112 to their full commit SHAs. For each action, replace the
mutable tag (e.g., `@v4`) with the complete commit SHA (a 40-character hash) to
ensure supply-chain security and prevent unexpected changes.

In @.github/workflows/publish-bindings.yml:
- Around line 64-73: The tag/package version equality check in the "Verify tag
matches package version" step does not validate the required CalVer format for
bindings tags. Add validation to ensure the extracted TAG variable matches the
CalVer pattern bindings-vYYYY.M.P with optional -rc.N suffix using a regex
pattern match. This prevents publishing if package.json is accidentally set to
an invalid version format that still matches a malformed tag. Add the format
validation as an additional conditional check in the run script before or
alongside the existing equality check.
- Around line 47-56: Replace the mutable action version tags with pinned full
commit SHAs across all three actions (actions/checkout, oven-sh/setup-bun, and
actions/setup-node) to lock in specific versions. Additionally, add
persist-credentials: false to the actions/checkout step configuration to prevent
persisting checkout credentials and reduce the supply-chain blast radius for
this npm publishing workflow.
- Around line 87-95: The tarball guard in the publish-bindings.yml workflow at
the "Tarball guard — only compiled dist/ ships" step currently only rejects
TypeScript source files (matching `\.ts$` excluding `\.d\.ts$`), but it should
also reject compiled test files like `.test.js` artifacts. Extend the grep
condition to also detect and block compiled test files to prevent them from
being shipped in the tarball, ensuring compliance with the `files: ["dist"]`
publish contract that prohibits test artifacts.
- Around line 107-125: The npm publish step in the "Publish to npm via OIDC
trusted publishing" task lacks a guard to prevent real publishes on non-tag
refs. Add a check before the actual npm publish command that verifies github.ref
matches the refs/tags/bindings-v* pattern when FORCE_DRY_RUN is false. If the
ref does not match this pattern and it's not a dry-run, the step should exit
with an error to prevent unintended publishes from manual workflow dispatch on
arbitrary branches. Only allow the real npm publish (without --dry-run flag) to
proceed when running on a properly tagged ref.

In @.github/workflows/release.yml:
- Around line 12-14: Apply least-privilege token permissions across two workflow
files. In `.github/workflows/release.yml#L12-L14`, remove the workflow-level
`permissions` block containing `contents: write` and instead add job-level
`permissions` blocks: set `contents: read` for the `build-deb` job and
`contents: write` for the `release` job. In `.github/workflows/ci.yml#L9-L17`,
add an explicit `permissions` block at the workflow level with at least
`contents: read` to prevent the CI workflow from inheriting default mutable
repository permissions.

In `@AGENTS.md`:
- Line 3: Remove the Parent reference line that contains the path to the parent
workspace (../AGENTS.md) from line 3 of the AGENTS.md file. This external parent
reference violates Rule D because it references a path above the repository root
that doesn't exist in CI environments, making the link broken when the
repository is built and tested standalone. Delete the entire Parent line to
ensure the document is self-contained within the srtla-send-rs repository.

In `@bindings/typescript/src/telemetry/index.ts`:
- Around line 57-59: The schema definitions for window and in_flight fields are
currently using z.number().int() which allows negative values. Add non-negative
constraints to both the window and in_flight field definitions by appending
.nonnegative() (or .min(0)) to enforce that these values must be greater than or
equal to zero, preventing malformed snapshots with negative values from parsing
as valid telemetry.

In `@Cargo.toml`:
- Line 7: The version field in Cargo.toml has been manually bumped to 2026.6.1,
but according to coding guidelines, version management is handled automatically
by the release process and should not be manually modified. Revert the version
back to 3.0.0 in the Cargo.toml file to comply with the automated version
management workflow and prevent conflicts with the release automation.

In `@src/sender/connections.rs`:
- Around line 42-83: The issue is that stale sequence entries are removed from
seq_tracker before validating whether the new connections can be successfully
created, and the connection pool is rebuilt regardless. If all new connections
fail (resulting in empty fresh HashMap) while the current pool is non-empty,
this causes all working uplinks to be dropped. Move the loop that calls
seq_tracker.remove_connection for each conn_id in removed_conn_ids to execute
only after the fresh HashMap is populated and validated. Additionally, add a
guard condition that returns early without mutating the connection pool when
new_ip_list is non-empty but fresh ends up empty (indicating connection creation
failed) while the current connections pool is non-empty, preventing the
transition from a healthy pool to an empty one due to failed replacement
creation.

In `@src/telemetry_file.rs`:
- Around line 193-206: The write_tmp function creates a temporary file at a
predictable path using File::create(tmp), which follows symlinks and is
vulnerable to symlink-clobbering attacks if the stats directory is
world-writable and the process has elevated privileges. Fix this by modifying
the file creation in write_tmp to use no-follow or create-new semantics, or
alternatively use OpenOptions to create the file with OpenFlags that prevent
symlink following. Ensure the temporary file cannot be hijacked by an
attacker-controlled symlink before the atomic rename in write_atomic completes.
- Around line 249-253: The publish() method performs blocking filesystem I/O
operations (write_atomic and sync_all) directly within the async sender loop,
which can stall UDP packet forwarding on slow storage. Move the blocking I/O off
the Tokio event loop by either wrapping the publish() call with
tokio::task::spawn_blocking in the caller at src/sender/mod.rs, or by creating a
dedicated telemetry worker thread that receives stats snapshots asynchronously
and handles the atomic writes independently. This ensures the async sender loop
remains non-blocking and responsive to UDP packet forwarding.
- Around line 508-524: The spin-wait loop that checks
writes.load(Ordering::Relaxed) > 0 currently executes after the 1000 read
attempts, allowing all reads to potentially complete before the writer thread
has even started. Move the bounded spin-wait loop (the 0..100 iteration that
waits for writes > 0) to execute before the parse_errors loop (the 0..1000
iteration). This ensures the writer thread has performed at least one write
before the concurrent read sampling begins, properly exercising the concurrent
publish/read behavior the test is intended to validate.

---

Outside diff comments:
In `@src/main.rs`:
- Line 42: The override_usage string in src/main.rs incorrectly places [OPTIONS]
before the positional arguments. Reorder the override_usage assignment to move
the positional arguments (SRT_LISTEN_PORT, SRTLA_HOST, SRTLA_PORT,
BIND_IPS_FILE) before [OPTIONS], and wrap each positional argument name in angle
brackets to match the required format: srtla_send <SRT_LISTEN_PORT> <SRTLA_HOST>
<SRTLA_PORT> <BIND_IPS_FILE> [OPTIONS].

---

Nitpick comments:
In `@bindings/typescript/.npmignore`:
- Around line 1-12: The `.npmignore` file is redundant because the `files` field
in package.json acts as an allowlist and takes precedence over `.npmignore` as
the single source of truth for what gets shipped to npm. Remove the `.npmignore`
file entirely to eliminate maintenance surface and confusion, since the `files`
field in package.json already defines what should be included in the npm
tarball. If the intent is to keep the file, update the misleading comment on
line 2 that claims `.npmignore` "complements" the `files` field—clarify instead
that the `files` field is the actual source of truth and that `.npmignore` is
not necessary.

In `@bindings/typescript/src/sender/index.ts`:
- Around line 44-46: The conditional check for emitting the
--stats-file-interval flag only validates that statsFileInterval is defined, but
this flag is meaningless without a corresponding stats file. Update the
condition that guards the args.push call for --stats-file-interval to require
both options.statsFile to be set AND options.statsFileInterval to be defined
before emitting the flag, preventing orphaned flags from being passed to the
underlying command.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bc342eb0-b93c-418c-bc78-f7f13e852e06

📥 Commits

Reviewing files that changed from the base of the PR and between 80cd0c4 and e5c8090.

⛔ Files ignored due to path filters (2)

• Cargo.lock is excluded by !**/*.lock
• bindings/typescript/bun.lock is excluded by !**/*.lock

📒 Files selected for processing (52)

• .github/workflows/build-debian.yml
• .github/workflows/ci.yml
• .github/workflows/publish-bindings.yml
• .github/workflows/release.yml
• .gitignore
• AGENTS.md
• Cargo.toml
• README.md
• bindings/typescript/.gitignore
• bindings/typescript/.npmignore
• bindings/typescript/.npmrc
• bindings/typescript/biome.json
• bindings/typescript/package.json
• bindings/typescript/src/index.ts
• bindings/typescript/src/sender/index.test.ts
• bindings/typescript/src/sender/index.ts
• bindings/typescript/src/telemetry/index.test.ts
• bindings/typescript/src/telemetry/index.ts
• bindings/typescript/tests/fixtures/telemetry-golden.json
• bindings/typescript/tests/telemetry-reader.test.ts
• bindings/typescript/tsconfig.build.json
• bindings/typescript/tsconfig.json
• ci/build-deb.sh
• deny.toml
• rust-toolchain.toml
• src/connection/batch_send.rs
• src/connection/mod.rs
• src/connection/packet_io.rs
• src/lib.rs
• src/main.rs
• src/protocol/constants.rs
• src/sender/connections.rs
• src/sender/housekeeping.rs
• src/sender/mod.rs
• src/sender/reload.rs
• src/sender/selection/edpf.rs
• src/sender/selection/iods.rs
• src/sender/selection/mod.rs
• src/sender/status.rs
• src/telemetry_file.rs
• src/test_helpers.rs
• src/tests/connection_tests.rs
• src/tests/integration_tests.rs
• src/tests/protocol_tests.rs
• src/tests/registration_tests.rs
• src/tests/sender_tests.rs
• tests/dry_run.rs
• tests/fixtures/telemetry-golden.json
• tests/netns_pr19_parity.rs
• tests/signal_parity.rs
• tests/telemetry_edge_cases.rs
• tests/telemetry_fixture_parity.rs

💤 Files with no reviewable changes (1)

• .github/workflows/build-debian.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Check both workflow files for action pinning
echo "=== ci.yml ===" 
cat -n .github/workflows/ci.yml | head -130

echo -e "\n=== release.yml ===" 
cat -n .github/workflows/release.yml | head -120

Repository: irlserver/srtla_send

Length of output: 10564

---

Pin all GitHub Actions to immutable commit SHAs across CI and release workflows. GitHub Actions using mutable version tags (@v4, @v1, @v2) can change unexpectedly and pose a supply-chain risk.

Pin every uses: entry to full commit SHAs:

• .github/workflows/ci.yml: Lines 21, 24, 85, 91, 115
• .github/workflows/release.yml: Lines 31, 35, 68, 82, 112

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 20-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

📍 Affects 2 files

• .github/workflows/ci.yml#L20-L25 (this comment)
• .github/workflows/release.yml#L30-L36

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 20 - 25, GitHub Actions are currently
using mutable version tags (`@v4`, `@v1`, etc.) which pose a supply-chain security
risk. In .github/workflows/ci.yml, pin the actions/checkout@v4 action at line 21
and actions-rust-lang/setup-rust-toolchain@v1 action at line 24, along with the
remaining actions at lines 85, 91, and 115 to their full immutable commit SHAs.
Similarly, in .github/workflows/release.yml, pin all uses entries at lines 31,
35, 68, 82, and 112 to their full commit SHAs. For each action, replace the
mutable tag (e.g., `@v4`) with the complete commit SHA (a 40-character hash) to
ensure supply-chain security and prevent unexpected changes.

Source: Linters/SAST tools

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin publish-workflow actions and avoid persisting checkout credentials.

This workflow can publish to npm, so mutable action tags (@v4, @v2) and persisted checkout credentials expand the release supply-chain blast radius. Pin these actions to full commit SHAs and set persist-credentials: false for checkout.

Hardening sketch

-      - uses: actions/checkout@v4
+      - uses: actions/checkout@<full-commit-sha>
+        with:
+          persist-credentials: false
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@<full-commit-sha>
         with:
           bun-version: latest
 
       # npm (not bun) performs the publish: it speaks OIDC trusted publishing.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@<full-commit-sha>

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 47-47: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 47-47: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 49-49: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 54-54: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 49-49: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

---

[error] 54-54: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-bindings.yml around lines 47 - 56, Replace the
mutable action version tags with pinned full commit SHAs across all three
actions (actions/checkout, oven-sh/setup-bun, and actions/setup-node) to lock in
specific versions. Additionally, add persist-credentials: false to the
actions/checkout step configuration to prevent persisting checkout credentials
and reduce the supply-chain blast radius for this npm publishing workflow.

Source: Linters/SAST tools

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate the bindings-vYYYY.M.P[-rc.N] shape before publishing.

The guard checks tag/package equality, but not the required CalVer tag format. If package.json is accidentally bumped to an invalid version shape, a matching malformed bindings-v* tag can still publish.

Suggested guard

           TAG="${GITHUB_REF#refs/tags/bindings-v}"
           PKG="$(node -p "require('./package.json').version")"
           echo "tag=$TAG package=$PKG"
+          if ! echo "$TAG" | grep -Eq '^[0-9]{4}\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$'; then
+            echo "::error::tag bindings-v$TAG must match bindings-vYYYY.M.P or bindings-vYYYY.M.P-rc.N"
+            exit 1
+          fi
           if [ "$TAG" != "$PKG" ]; then
             echo "::error::tag bindings-v$TAG does not match package.json version $PKG"
             exit 1

As per coding guidelines, “Binding publish workflow publish-bindings.yml tags must use bindings-vYYYY.M.P format (CalVer, distinct from v* release tags)”.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: Verify tag matches package version
	if: startsWith(github.ref, 'refs/tags/bindings-v')
	run: |
	TAG="${GITHUB_REF#refs/tags/bindings-v}"
	PKG="$(node -p "require('./package.json').version")"
	echo "tag=$TAG package=$PKG"
	if [ "$TAG" != "$PKG" ]; then
	echo "::error::tag bindings-v$TAG does not match package.json version $PKG"
	exit 1
	fi
	- name: Verify tag matches package version
	if: startsWith(github.ref, 'refs/tags/bindings-v')
	run: |
	TAG="${GITHUB_REF#refs/tags/bindings-v}"
	PKG="$(node -p "require('./package.json').version")"
	echo "tag=$TAG package=$PKG"
	if ! echo "$TAG" | grep -Eq '^[0-9]{4}\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$'; then
	echo "::error::tag bindings-v$TAG must match bindings-vYYYY.M.P or bindings-vYYYY.M.P-rc.N"
	exit 1
	fi
	if [ "$TAG" != "$PKG" ]; then
	echo "::error::tag bindings-v$TAG does not match package.json version $PKG"
	exit 1
	fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-bindings.yml around lines 64 - 73, The tag/package
version equality check in the "Verify tag matches package version" step does not
validate the required CalVer format for bindings tags. Add validation to ensure
the extracted TAG variable matches the CalVer pattern bindings-vYYYY.M.P with
optional -rc.N suffix using a regex pattern match. This prevents publishing if
package.json is accidentally set to an invalid version format that still matches
a malformed tag. Add the format validation as an additional conditional check in
the run script before or alongside the existing equality check.

Source: Coding guidelines

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Make the tarball guard reject compiled tests, not just .ts sources.

This only blocks TypeScript source files. If tsconfig.build.json ever emits dist/**/*.test.js or fixture files, they would pass this guard and ship despite the files: ["dist"] publish contract.

Suggested stricter guard

           npm pack --dry-run --json > /tmp/pack.json
           FILES="$(node -e 'const j=require("/tmp/pack.json"); for (const f of j[0].files) console.log(f.path)')"
           echo "$FILES"
           if echo "$FILES" | grep -E '\.ts$' | grep -vE '\.d\.ts$'; then
             echo "::error::tarball contains TypeScript source — only compiled dist/ may ship"
             exit 1
           fi
+          if echo "$FILES" | grep -E '(^|/)tests?/|\.test\.js$|fixtures/'; then
+            echo "::error::tarball contains tests or fixtures — only runtime dist artifacts may ship"
+            exit 1
+          fi

As per coding guidelines, TS binding package.json must list only dist/ so compiled tests never land in the published tarball.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: Tarball guard — only compiled dist/ ships
	run: |
	npm pack --dry-run --json > /tmp/pack.json
	FILES="$(node -e 'const j=require("/tmp/pack.json"); for (const f of j[0].files) console.log(f.path)')"
	echo "$FILES"
	if echo "$FILES" | grep -E '\.ts$' | grep -vE '\.d\.ts$'; then
	echo "::error::tarball contains TypeScript source — only compiled dist/ may ship"
	exit 1
	fi
	- name: Tarball guard — only compiled dist/ ships
	run: |
	npm pack --dry-run --json > /tmp/pack.json
	FILES="$(node -e 'const j=require("/tmp/pack.json"); for (const f of j[0].files) console.log(f.path)')"
	echo "$FILES"
	if echo "$FILES" | grep -E '\.ts$' | grep -vE '\.d\.ts$'; then
	echo "::error::tarball contains TypeScript source — only compiled dist/ may ship"
	exit 1
	fi
	if echo "$FILES" | grep -E '(^|/)tests?/|\.test\.js$|fixtures/'; then
	echo "::error::tarball contains tests or fixtures — only runtime dist artifacts may ship"
	exit 1
	fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-bindings.yml around lines 87 - 95, The tarball
guard in the publish-bindings.yml workflow at the "Tarball guard — only compiled
dist/ ships" step currently only rejects TypeScript source files (matching
`\.ts$` excluding `\.d\.ts$`), but it should also reject compiled test files
like `.test.js` artifacts. Extend the grep condition to also detect and block
compiled test files to prevent them from being shipped in the tarball, ensuring
compliance with the `files: ["dist"]` publish contract that prohibits test
artifacts.

Source: Coding guidelines

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Prevent manual dispatch from bypassing the tag/version publish gate.

workflow_dispatch can run on a branch, skips the tag-match guard at Lines 64-73, and will publish if dry_run=false. Refuse real publishes unless github.ref is a refs/tags/bindings-v* ref.

Suggested guard

           if [ "${FORCE_DRY_RUN}" = "true" ]; then
             echo "Dry-run forced — no publish."
             npm publish --access public --dry-run --tag "${{ steps.tag.outputs.dist_tag }}"
           else
+            case "${GITHUB_REF}" in
+              refs/tags/bindings-v*) ;;
+              *)
+                echo "::error::real publish is only allowed from bindings-v* tags"
+                exit 1
+                ;;
+            esac
             npm publish --access public --tag "${{ steps.tag.outputs.dist_tag }}"
           fi

As per coding guidelines, publishing is tied to bindings-vYYYY.M.P binding tags and package-version parity.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: Publish to npm via OIDC trusted publishing (or dry-run)
	env:
	FORCE_DRY_RUN: ${{ github.event.inputs.dry_run }}
	REPO_PRIVATE: ${{ github.event.repository.private }}
	run: |
	# Auth is the GitHub OIDC token (id-token: write) exchanged against the
	# trusted publisher on the npm package — no NPM_TOKEN. npm auto-generates
	# provenance for public repos but cannot for a private source repo, so
	# disable it explicitly while private (re-enables when the repo is public).
	if [ "${REPO_PRIVATE}" = "true" ]; then
	export NPM_CONFIG_PROVENANCE=false
	echo "Private source repo — provenance disabled."
	fi
	if [ "${FORCE_DRY_RUN}" = "true" ]; then
	echo "Dry-run forced — no publish."
	npm publish --access public --dry-run --tag "${{ steps.tag.outputs.dist_tag }}"
	else
	npm publish --access public --tag "${{ steps.tag.outputs.dist_tag }}"
	fi
	- name: Publish to npm via OIDC trusted publishing (or dry-run)
	env:
	FORCE_DRY_RUN: ${{ github.event.inputs.dry_run }}
	REPO_PRIVATE: ${{ github.event.repository.private }}
	run: |
	# Auth is the GitHub OIDC token (id-token: write) exchanged against the
	# trusted publisher on the npm package — no NPM_TOKEN. npm auto-generates
	# provenance for public repos but cannot for a private source repo, so
	# disable it explicitly while private (re-enables when the repo is public).
	if [ "${REPO_PRIVATE}" = "true" ]; then
	export NPM_CONFIG_PROVENANCE=false
	echo "Private source repo — provenance disabled."
	fi
	if [ "${FORCE_DRY_RUN}" = "true" ]; then
	echo "Dry-run forced — no publish."
	npm publish --access public --dry-run --tag "${{ steps.tag.outputs.dist_tag }}"
	else
	case "${GITHUB_REF}" in
	refs/tags/bindings-v*) ;;
	*)
	echo "::error::real publish is only allowed from bindings-v* tags"
	exit 1
	;;
	esac
	npm publish --access public --tag "${{ steps.tag.outputs.dist_tag }}"
	fi

🧰 Tools

🪛 zizmor (1.25.2)

[info] 122-122: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 122-122: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-bindings.yml around lines 107 - 125, The npm
publish step in the "Publish to npm via OIDC trusted publishing" task lacks a
guard to prevent real publishes on non-tag refs. Add a check before the actual
npm publish command that verifies github.ref matches the refs/tags/bindings-v*
pattern when FORCE_DRY_RUN is false. If the ref does not match this pattern and
it's not a dry-run, the step should exit with an error to prevent unintended
publishes from manual workflow dispatch on arbitrary branches. Only allow the
real npm publish (without --dry-run flag) to proceed when running on a properly
tagged ref.

Source: Coding guidelines

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Revert the version bump; version management is automated by the release process.

As per coding guidelines, "Never bump the internal package version in Cargo.toml. This is handled automatically by the release process." Manual version changes risk conflicting with release automation and circumvent the governed version bump workflow.

🔄 Revert to 3.0.0

-version = "2026.6.1"
+version = "3.0.0"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	version = "2026.6.1"
	version = "3.0.0"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Cargo.toml` at line 7, The version field in Cargo.toml has been manually
bumped to 2026.6.1, but according to coding guidelines, version management is
handled automatically by the release process and should not be manually
modified. Revert the version back to 3.0.0 in the Cargo.toml file to comply with
the automated version management workflow and prevent conflicts with the release
automation.

Source: Coding guidelines

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Refuse all-replacement reloads when every new uplink fails to connect.

A SIGHUP file with parseable but unusable replacement IPs reaches Apply, then fresh can be empty while all current labels are removed. Because sequence entries are removed before that failure is known and connections is rebuilt anyway, a bad reload can drop every working uplink instead of keeping the existing pool.

Move stale-sequence removal until after the replacement viability check, and return without mutating the pool when an already-running sender would otherwise transition from non-empty to empty due only to failed new connection creation.

Suggested guard shape

-    let removed_conn_ids: SmallVec<u64, 4> = connections
-        .iter()
-        .filter(|c| !desired_labels.contains(c.label.as_str()))
-        .map(|c| c.conn_id)
-        .collect();
-    let removed = removed_conn_ids.len();
-    for conn_id in &removed_conn_ids {
-        seq_tracker.remove_connection(*conn_id);
-    }
+    let survivor_count = connections
+        .iter()
+        .filter(|c| desired_labels.contains(c.label.as_str()))
+        .count();

     let new_ip_list: SmallVec<IpAddr, 4> = desired
         .iter()
         .filter(|(_, label)| !current_labels.contains(label.as_str()))
         .map(|(ip, _)| *ip)
         .collect();
@@
     };
     let added = fresh.len();
+
+    if !connections.is_empty() && survivor_count == 0 && attempted_new > 0 && added == 0 {
+        warn!(
+            "refusing reload: all replacement uplinks failed to connect; keeping existing connections"
+        );
+        return;
+    }
+
+    let removed_conn_ids: SmallVec<u64, 4> = connections
+        .iter()
+        .filter(|c| !desired_labels.contains(c.label.as_str()))
+        .map(|c| c.conn_id)
+        .collect();
+    let removed = removed_conn_ids.len();
+    for conn_id in &removed_conn_ids {
+        seq_tracker.remove_connection(*conn_id);
+    }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Drop the leaving links' sequence entries so a stale NAK can't be
	// misattributed to whichever uplink later reuses that index.
	let removed_conn_ids: SmallVec<u64, 4> = connections
	.iter()
	.filter(|c| !desired_labels.contains(&c.label))
	.filter(|c| !desired_labels.contains(c.label.as_str()))
	.map(|c| c.conn_id)
	.collect();
	connections.retain(|c| desired_labels.contains(&c.label));
	// If connections were removed, reset selection state and clean up sequence tracker
	if connections.len() != old_len {
	info!("removed {} stale connections", old_len - connections.len());
	*last_selected_idx = None;
	// Remove entries for removed connections from the ring buffer
	for conn_id in removed_conn_ids {
	seq_tracker.remove_connection(conn_id);
	}
	let removed = removed_conn_ids.len();
	for conn_id in &removed_conn_ids {
	seq_tracker.remove_connection(*conn_id);
	}
	// Add new connections
	let mut seen = HashSet::<IpAddr>::new();
	let new_ips_needed: SmallVec<IpAddr, 4> = new_ips
	let new_ip_list: SmallVec<IpAddr, 4> = desired
	.iter()
	.copied()
	.filter(|ip| seen.insert(*ip))
	.filter(|ip| {
	let label = format!("{}:{} via {}", receiver_host, receiver_port, ip);
	!current_labels.contains(&label)
	})
	.filter(|(_, label)| !current_labels.contains(label.as_str()))
	.map(|(ip, _)| *ip)
	.collect();
	let attempted_new = new_ip_list.len();
	let mut fresh: HashMap<String, SrtlaConnection> = if new_ip_list.is_empty() {
	HashMap::new()
	} else {
	create_connections_from_ips(&new_ip_list, receiver_host, receiver_port)
	.await
	.into_iter()
	.map(|c| (c.label.clone(), c))
	.collect()
	};
	let added = fresh.len();
	if !new_ips_needed.is_empty() {
	let mut new_connections =
	create_connections_from_ips(&new_ips_needed, receiver_host, receiver_port).await;
	let added_count = new_connections.len();
	connections.append(&mut new_connections);
	let previous_order: SmallVec<u64, 4> = connections.iter().map(|c| c.conn_id).collect();
	let mut survivors: HashMap<String, SrtlaConnection> = std::mem::take(connections)
	.into_iter()
	.filter(|c| desired_labels.contains(c.label.as_str()))
	.map(|c| (c.label.clone(), c))
	.collect();
	if added_count > 0 {
	info!("added {} new connections", added_count);
	} else {
	warn!(
	"failed to add any new connections (attempted {})",
	new_ips_needed.len()
	);
	for (_, label) in &desired {
	if let Some(conn) = survivors.remove(label) {
	connections.push(conn);
	} else if let Some(conn) = fresh.remove(label) {
	connections.push(conn);
	}
	let survivor_count = connections
	.iter()
	.filter(|c| desired_labels.contains(c.label.as_str()))
	.count();
	let new_ip_list: SmallVec<IpAddr, 4> = desired
	.iter()
	.filter(|(_, label)| !current_labels.contains(label.as_str()))
	.map(|(ip, _)| *ip)
	.collect();
	let attempted_new = new_ip_list.len();
	let mut fresh: HashMap<String, SrtlaConnection> = if new_ip_list.is_empty() {
	HashMap::new()
	} else {
	create_connections_from_ips(&new_ip_list, receiver_host, receiver_port)
	.await
	.into_iter()
	.map(|c| (c.label.clone(), c))
	.collect()
	};
	let added = fresh.len();
	if !connections.is_empty() && survivor_count == 0 && attempted_new > 0 && added == 0 {
	warn!(
	"refusing reload: all replacement uplinks failed to connect; keeping existing connections"
	);
	return;
	}
	// Drop the leaving links' sequence entries so a stale NAK can't be
	// misattributed to whichever uplink later reuses that index.
	let removed_conn_ids: SmallVec<u64, 4> = connections
	.iter()
	.filter(|c| !desired_labels.contains(c.label.as_str()))
	.map(|c| c.conn_id)
	.collect();
	let removed = removed_conn_ids.len();
	for conn_id in &removed_conn_ids {
	seq_tracker.remove_connection(*conn_id);
	}
	let previous_order: SmallVec<u64, 4> = connections.iter().map(|c| c.conn_id).collect();
	let mut survivors: HashMap<String, SrtlaConnection> = std::mem::take(connections)
	.into_iter()
	.filter(|c| desired_labels.contains(c.label.as_str()))
	.map(|c| (c.label.clone(), c))
	.collect();
	for (_, label) in &desired {
	if let Some(conn) = survivors.remove(label) {
	connections.push(conn);
	} else if let Some(conn) = fresh.remove(label) {
	connections.push(conn);
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/sender/connections.rs` around lines 42 - 83, The issue is that stale
sequence entries are removed from seq_tracker before validating whether the new
connections can be successfully created, and the connection pool is rebuilt
regardless. If all new connections fail (resulting in empty fresh HashMap) while
the current pool is non-empty, this causes all working uplinks to be dropped.
Move the loop that calls seq_tracker.remove_connection for each conn_id in
removed_conn_ids to execute only after the fresh HashMap is populated and
validated. Additionally, add a guard condition that returns early without
mutating the connection pool when new_ip_list is non-empty but fresh ends up
empty (indicating connection creation failed) while the current connections pool
is non-empty, preventing the transition from a healthy pool to an empty one due
to failed replacement creation.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Harden the predictable .tmp publish path against symlink clobbering.

File::create(tmp) follows an attacker-controlled symlink at <stats-file>.tmp. If the stats path lives in a world-writable directory and srtla_send runs with elevated privileges, a local user can make the telemetry publish truncate or replace another file. Create the temp file with no-follow/create-new semantics, or use a safely-created same-directory temp file before the final rename.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/telemetry_file.rs` around lines 193 - 206, The write_tmp function creates
a temporary file at a predictable path using File::create(tmp), which follows
symlinks and is vulnerable to symlink-clobbering attacks if the stats directory
is world-writable and the process has elevated privileges. Fix this by modifying
the file creation in write_tmp to use no-follow or create-new semantics, or
alternatively use OpenOptions to create the file with OpenFlags that prevent
symlink following. Ensure the temporary file cannot be hijacked by an
attacker-controlled symlink before the atomic rename in write_atomic completes.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Move telemetry fsync/rename off the Tokio packet-forwarding loop.

publish() does blocking filesystem I/O plus sync_all(), and src/sender/mod.rs calls it directly from the async sender loop. On slow storage this can pause UDP handling; use a spawn_blocking publish path or a dedicated telemetry worker so atomic stats writes cannot stall live forwarding.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/telemetry_file.rs` around lines 249 - 253, The publish() method performs
blocking filesystem I/O operations (write_atomic and sync_all) directly within
the async sender loop, which can stall UDP packet forwarding on slow storage.
Move the blocking I/O off the Tokio event loop by either wrapping the publish()
call with tokio::task::spawn_blocking in the caller at src/sender/mod.rs, or by
creating a dedicated telemetry worker thread that receives stats snapshots
asynchronously and handles the atomic writes independently. This ensures the
async sender loop remains non-blocking and responsive to UDP packet forwarding.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Start the writer before the torn-read assertion loop.

This test can finish the 1000 read attempts before the writer thread performs its first write; the later spin-wait only proves a write happened after the sampling window. Wait for writes > 0 before entering the read loop so the test actually exercises concurrent publish/read behavior.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/telemetry_file.rs` around lines 508 - 524, The spin-wait loop that checks
writes.load(Ordering::Relaxed) > 0 currently executes after the 1000 read
attempts, allowing all reads to potentially complete before the writer thread
has even started. Move the bounded spin-wait loop (the 0..100 iteration that
waits for writes > 0) to execute before the parse_errors loop (the 0..1000
iteration). This ensures the writer thread has performed at least one write
before the concurrent read sampling begins, properly exercising the concurrent
publish/read behavior the test is intended to validate.