example-apps: review of the audit fixes — one was a regression, one was half a fix

Re-checking the audit commits by ATTACK and MUTATION rather than by "the gate
is green" found two defects in the fixes themselves. Both are corrected here.

1. The watchdog change was a REGRESSION. Replacing `kill -9 $$` with
   `kill -TERM $$` plus a TERM trap does nothing in the case a watchdog exists
   for: bash DEFERS a trapped signal until the running foreground command
   returns, and in a real hang that is never. Measured on a copy of a real
   smoke script — watchdog fired at t=2 s, the trap ran at t=30 s, only once
   the blocking command ended by itself. So the previous version at least
   killed the script; mine killed nothing.
   Cleanup is now the WATCHDOG's job, since the script provably cannot do it:
   it kills the script's other children (`pgrep -P $$`, skipping itself), runs
   `cleanup`, and only then SIGKILLs the script. Verified end to end against an
   injected foreground hang: timed out on schedule, no orphaned processes, temp
   dir removed. (`kill -9 -$$` remains out: a smoke shares check-apps.sh's
   process group and would take the gate with it.)

2. The timecapsule overflow fix only MOVED the panic. Saturating `publishTime`
   left `formatUtc` casting a saturated timestamp's year into a u32, so a
   capsule claiming round 2^63 still aborted `info` with SIGABRT. The lesson is
   the general one: a clamp is not a fix until every consumer of the clamped
   value is total too. `formatUtc` now refuses to render outside the printable
   calendar. Verified by attack (rounds 0, 2^63, 2^64-1 → exit 1/3, never 134)
   and pinned by a new smoke case that is mutation-checked: with the guard
   removed the smoke fails with exactly that panic.

Also, smaller, from the same pass:
- getTask wrote its 404 through `jsonError` while holding the lock — the very
  pattern the audit fixed elsewhere, and inconsistent with every sibling
  handler, all of which unlock first. Now it unlocks first too.
- raft-kv's smoke cleanup named `n*/raft.kv` and `*.log`, so `raft.kv.lock`
  and `status.out` kept a temp directory alive after every run (two per gate
  pass). It now clears the directory it made.
- ssh-demo's new exclusive create turned a stale temp file into a permanent
  failure once a pid was reused; it unlinks first, which does not weaken the
  symlink guard (unlink removes the link, and a re-planted one still fails
  `exclusive`).
- timecapsule's README records that keygen refuses to overwrite a keypair.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: zaxified

example-apps/http-service/smoke.sh

@@ -34,13 +34,20 @@ cleanup() {
     rmdir "$WORK" 2>/dev/null || true
 }
 trap cleanup EXIT
-# A timeout must run cleanup, not just die: SIGKILL on $$ cannot be trapped
-# and would orphan the child processes (still bound to the port) and $WORK.
-# The watchdog sends SIGTERM instead; this handler prints and exits, so the
-# EXIT trap above fires and kills the tracked PIDs.
-trap 'echo "smoke: TIMED OUT" >&2; exit 124' TERM
 
-( sleep 60; kill -TERM $$ 2>/dev/null ) &
+( sleep 60
+  echo "smoke: TIMED OUT" >&2
+  # ⚠ CLEANUP IS THE WATCHDOG'S JOB ON THIS PATH, because the script provably
+  # cannot do it. SIGKILL cannot be trapped, and a SIGTERM trap is DEFERRED
+  # until the foreground command returns — which, in the hang a watchdog exists
+  # for, is never. Measured: watchdog fired at t=2 s, the TERM trap ran at
+  # t=30 s, only once the blocking command ended by itself. So kill the
+  # script's other children here, run cleanup here, and SIGKILL the script
+  # last. (`kill -9 -$$` is not an option: a smoke test shares check-apps.sh's
+  # process group, so that would kill the gate too.)
+  for p in $(pgrep -P $$ 2>/dev/null); do [ "$p" = "$BASHPID" ] || kill -9 "$p" 2>/dev/null; done
+  cleanup
+  kill -9 $$ 2>/dev/null ) &
 PIDS+=($!)
 
 fail() {

example-apps/http-service/src/main.zig

@@ -315,15 +315,21 @@ fn getTask(ctx: *router.Ctx) anyerror!void {
     const id = parseId(ctx) orelse return jsonError(ctx, 400, "bad task id");
     var aw: std.Io.Writer.Allocating = .init(app.gpa);
     defer aw.deinit();
-    {
-        appLock(app);
-        defer app.lock.unlock();
-        const idx = findTaskIndex(app, id) orelse return jsonError(ctx, 404, "no such task");
-        // Render under the lock (a concurrent DELETE could free the title);
-        // write to the socket after unlocking, same reason as listTasks.
-        var jw: std.json.Stringify = .{ .writer = &aw.writer, .options = .{} };
-        try writeTaskJson(&jw, &app.tasks.items[idx]);
-    }
+    // Render under the lock (a concurrent DELETE could free the title); every
+    // response byte — including the 404 — is written after unlocking, which is
+    // what the other handlers do and what makes the rule easy to keep.
+    appLock(app);
+    const idx = findTaskIndex(app, id) orelse {
+        app.lock.unlock();
+        return jsonError(ctx, 404, "no such task");
+    };
+    var jw: std.json.Stringify = .{ .writer = &aw.writer, .options = .{} };
+    writeTaskJson(&jw, &app.tasks.items[idx]) catch |err| {
+        app.lock.unlock();
+        return err;
+    };
+    app.lock.unlock();
+
     ctx.res.setStatus(200);
     try ctx.res.setHeader("Content-Type", "application/json");
     try ctx.res.writer().writeAll(aw.written());

example-apps/mls-chat/smoke.sh

@@ -22,15 +22,22 @@ cleanup() {
     rmdir "$WORK" 2>/dev/null || true
 }
 trap cleanup EXIT
-# A timeout must run cleanup, not just die: SIGKILL on $$ cannot be trapped
-# and would orphan the child processes (still bound to the port) and $WORK.
-# The watchdog sends SIGTERM instead; this handler prints and exits, so the
-# EXIT trap above fires and kills the tracked PIDs.
-trap 'echo "smoke: TIMED OUT" >&2; exit 124' TERM
 
 # A watchdog, because every failure mode of a multi-process script that is not
 # an assertion is a hang. 60s is ~20x the run.
-( sleep 60; kill -TERM $$ 2>/dev/null ) &
+( sleep 60
+  echo "smoke: TIMED OUT" >&2
+  # ⚠ CLEANUP IS THE WATCHDOG'S JOB ON THIS PATH, because the script provably
+  # cannot do it. SIGKILL cannot be trapped, and a SIGTERM trap is DEFERRED
+  # until the foreground command returns — which, in the hang a watchdog exists
+  # for, is never. Measured: watchdog fired at t=2 s, the TERM trap ran at
+  # t=30 s, only once the blocking command ended by itself. So kill the
+  # script's other children here, run cleanup here, and SIGKILL the script
+  # last. (`kill -9 -$$` is not an option: a smoke test shares check-apps.sh's
+  # process group, so that would kill the gate too.)
+  for p in $(pgrep -P $$ 2>/dev/null); do [ "$p" = "$BASHPID" ] || kill -9 "$p" 2>/dev/null; done
+  cleanup
+  kill -9 $$ 2>/dev/null ) &
 WATCHDOG=$!
 PIDS+=("$WATCHDOG")
 

example-apps/raft-kv/smoke.sh

@@ -19,19 +19,30 @@ WORK="$(mktemp -d)"
 PIDS=()
 cleanup() {
     for pid in ${PIDS+"${PIDS[@]}"}; do kill -9 "$pid" 2>/dev/null || true; done
-    rm -f "$WORK"/n*/raft.kv "$WORK"/*.log 2>/dev/null || true
+    # Everything, not a named subset: the node dirs also hold `raft.kv.lock`,
+    # and $WORK holds `status.out` — naming only `raft.kv` and `*.log` left a
+    # temp directory behind on EVERY run (measured: one per smoke, so two per
+    # gate pass). Per-file rm + rmdir, never `rm -rf` on a variable.
+    rm -f "$WORK"/n*/* "$WORK"/* 2>/dev/null || true
     rmdir "$WORK"/n* "$WORK" 2>/dev/null || true
 }
 trap cleanup EXIT
-# A timeout must run cleanup, not just die: SIGKILL on $$ cannot be trapped
-# and would orphan the child processes (still bound to the port) and $WORK.
-# The watchdog sends SIGTERM instead; this handler prints and exits, so the
-# EXIT trap above fires and kills the tracked PIDs.
-trap 'echo "smoke: TIMED OUT" >&2; exit 124' TERM
 
 # Everything here is bounded by client budgets, so anything long-running is a
 # hang. 90s is ~3x a slow full run.
-( sleep 90; kill -TERM $$ 2>/dev/null ) &
+( sleep 90
+  echo "smoke: TIMED OUT" >&2
+  # ⚠ CLEANUP IS THE WATCHDOG'S JOB ON THIS PATH, because the script provably
+  # cannot do it. SIGKILL cannot be trapped, and a SIGTERM trap is DEFERRED
+  # until the foreground command returns — which, in the hang a watchdog exists
+  # for, is never. Measured: watchdog fired at t=2 s, the TERM trap ran at
+  # t=30 s, only once the blocking command ended by itself. So kill the
+  # script's other children here, run cleanup here, and SIGKILL the script
+  # last. (`kill -9 -$$` is not an option: a smoke test shares check-apps.sh's
+  # process group, so that would kill the gate too.)
+  for p in $(pgrep -P $$ 2>/dev/null); do [ "$p" = "$BASHPID" ] || kill -9 "$p" 2>/dev/null; done
+  cleanup
+  kill -9 $$ 2>/dev/null ) &
 WATCHDOG=$!
 PIDS+=("$WATCHDOG")
 

example-apps/ssh-demo/smoke.sh

@@ -26,13 +26,20 @@ cleanup() {
     rmdir "$WORK" 2>/dev/null || true
 }
 trap cleanup EXIT
-# A timeout must run cleanup, not just die: SIGKILL on $$ cannot be trapped
-# and would orphan the child processes (still bound to the port) and $WORK.
-# The watchdog sends SIGTERM instead; this handler prints and exits, so the
-# EXIT trap above fires and kills the tracked PIDs.
-trap 'echo "smoke: TIMED OUT" >&2; exit 124' TERM
 
-( sleep 60; kill -TERM $$ 2>/dev/null ) &
+( sleep 60
+  echo "smoke: TIMED OUT" >&2
+  # ⚠ CLEANUP IS THE WATCHDOG'S JOB ON THIS PATH, because the script provably
+  # cannot do it. SIGKILL cannot be trapped, and a SIGTERM trap is DEFERRED
+  # until the foreground command returns — which, in the hang a watchdog exists
+  # for, is never. Measured: watchdog fired at t=2 s, the TERM trap ran at
+  # t=30 s, only once the blocking command ended by itself. So kill the
+  # script's other children here, run cleanup here, and SIGKILL the script
+  # last. (`kill -9 -$$` is not an option: a smoke test shares check-apps.sh's
+  # process group, so that would kill the gate too.)
+  for p in $(pgrep -P $$ 2>/dev/null); do [ "$p" = "$BASHPID" ] || kill -9 "$p" 2>/dev/null; done
+  cleanup
+  kill -9 $$ 2>/dev/null ) &
 PIDS+=($!)
 
 fail() {

example-apps/ssh-demo/src/main.zig

@@ -1314,6 +1314,13 @@ const Commands = struct {
             const p = std.fmt.bufPrint(&stdin_path_buf, "/tmp/ssh-demo-stdin-{d}-{d}", .{
                 std.os.linux.getpid(), self.runs,
             }) catch unreachable;
+            // Clear a stale file first. A previous incarnation holding this pid
+            // may have been SIGKILLed before its deferred delete ran, and an
+            // exclusive create would then fail on that path forever. Unlinking
+            // does not weaken the guard above: it removes the LINK, never its
+            // target, and a symlink re-planted between the two calls still
+            // meets `exclusive` and is refused.
+            std.Io.Dir.cwd().deleteFile(self.io, p) catch {};
             var f = std.Io.Dir.cwd().createFile(self.io, p, .{ .truncate = true, .exclusive = true }) catch |err| {
                 std.debug.print("ssh-demo: cannot create stdin temp {s}: {t}\n", .{ p, err });
                 return err;

example-apps/timecapsule/README.md

@@ -40,6 +40,8 @@ Then:
 
 ```sh
 ./zig-out/bin/timecapsule keygen --out alice        # alice.pk (share) + alice.sk (keep)
+# keygen refuses if alice.pk/alice.sk already exist — overwriting a secret key
+# orphans every capsule sealed to it, so it is never done silently.
 echo "the eagle lands at midnight" > msg.txt
 ./zig-out/bin/timecapsule seal --to alice.pk --at +2m --in msg.txt --out msg.tc
 ./zig-out/bin/timecapsule open --key alice.sk --in msg.tc --out msg.out

example-apps/timecapsule/smoke.sh

@@ -23,14 +23,22 @@ cleanup() {
     rmdir "$WORK" 2>/dev/null || true
 }
 trap cleanup EXIT
-# A timeout must run cleanup, not just die: SIGKILL on $$ cannot be trapped and
-# would orphan the `open --wait` child and $WORK. The watchdog sends SIGTERM;
-# this handler exits so the EXIT trap fires.
-trap 'echo "smoke: TIMED OUT" >&2; exit 124' TERM
 
 # A watchdog: the app is offline here (every beacon document comes from a
 # file), so anything long-running is a hang, not a download. 60s is ~20x.
-( sleep 60; kill -TERM $$ 2>/dev/null ) &
+( sleep 60
+  echo "smoke: TIMED OUT" >&2
+  # ⚠ CLEANUP IS THE WATCHDOG'S JOB ON THIS PATH, because the script provably
+  # cannot do it. SIGKILL cannot be trapped, and a SIGTERM trap is DEFERRED
+  # until the foreground command returns — which, in the hang a watchdog exists
+  # for, is never. Measured: watchdog fired at t=2 s, the TERM trap ran at
+  # t=30 s, only once the blocking command ended by itself. So kill the
+  # script's other children here, run cleanup here, and SIGKILL the script
+  # last. (`kill -9 -$$` is not an option: a smoke test shares check-apps.sh's
+  # process group, so that would kill the gate too.)
+  for p in $(pgrep -P $$ 2>/dev/null); do [ "$p" = "$BASHPID" ] || kill -9 "$p" 2>/dev/null; done
+  cleanup
+  kill -9 $$ 2>/dev/null ) &
 WATCHDOG=$!
 disown "$WATCHDOG"
 
@@ -128,4 +136,25 @@ wait "$WAITER"
 grep -q "waiting — round 1000" wait.log || fail "open --wait never announced it was waiting — did it wait at all?"
 cmp -s msg.txt waited.out || fail "--wait plaintext differs"
 
+# ── 6. a HOSTILE capsule must not crash the process ────────────────────────
+# The envelope's round field is 8 attacker-written bytes that no signature
+# covers on this path (`info` never reaches the AEAD tag). Patch a real capsule
+# to claim round 2^64-1 and to claim round 0. Both must produce a typed refusal
+# or a "still locked" verdict — never a panic. This case exists because the
+# first fix for it (saturating arithmetic) only MOVED the abort into the date
+# formatter, and nothing here would have noticed.
+# Offset 44 = capsule header (37) + the envelope's round_off (7).
+for hostile in ffffffffffffffff 0000000000000000; do
+    cp msg.tc hostile.tc
+    printf "$(echo "$hostile" | sed 's/../\\x&/g')" | dd of=hostile.tc bs=1 seek=44 conv=notrunc 2>/dev/null
+    set +e
+    "$BIN" info --in hostile.tc "${OFFLINE[@]}" > hostile.out 2>&1
+    rc=$?
+    set -e
+    case "$rc" in
+        1|3) ;;
+        *) fail "a capsule claiming round 0x$hostile made \`info\` exit $rc (134 = panic); output: $(cat hostile.out)" ;;
+    esac
+done
+
 echo "smoke: OK"

example-apps/timecapsule/src/beacon.zig

@@ -108,8 +108,22 @@ pub fn wallNow() i64 {
 
 /// `1997-08-29 02:14:00 UTC` — `datefmt`'s civil-calendar core does the
 /// date math; rendering stays here so the buffer is the caller's.
+///
+/// ⚠ TOTAL BY CONSTRUCTION. `unix` reaches here from `publishTime`, whose input
+/// round comes straight off a capsule an attacker writes, so it can be the
+/// saturated `i64` maximum. The civil conversion then yields a year no `u32`
+/// cast survives, and this aborted the process. Making `publishTime` saturating
+/// was not enough on its own — it only MOVED the panic here, which is the
+/// lesson worth keeping: a clamp is not a fix until every consumer of the
+/// clamped value is total too. Outside the printable calendar, say so instead.
+const min_printable_unix: i64 = -62135596800; // 0001-01-01T00:00:00Z
+const max_printable_unix: i64 = 253402300799; // 9999-12-31T23:59:59Z
+
 pub fn formatUtc(buf: []u8, unix: i64) []const u8 {
+    if (unix < min_printable_unix) return "before year 1 (malformed capsule)";
+    if (unix > max_printable_unix) return "after year 9999 (malformed capsule)";
     const p = datefmt.unixToParts(unix);
+    // Now in 1..9999 by the guard above, so the cast cannot trap.
     return std.fmt.bufPrint(buf, "{d:0>4}-{d:0>2}-{d:0>2} {d:0>2}:{d:0>2}:{d:0>2} UTC", .{
         @as(u32, @intCast(p.year)), p.month, p.day, p.hour, p.minute, p.second,
     }) catch unreachable;