luke/mattertimectl, branch mainUnnamed repository; edit this file 'description' to name the repository.
https://src.nth.io/luke/mattertimectl/atom?h=main2026-07-29T15:33:02Zconfig: make all fields and the file optional; add output format; default logLevel to warn2026-07-29T15:33:02ZLuke Hoerstenluke@hoersten.org2026-07-29T15:33:02Zurn:sha1:78772329dc625b76bc1cbca61e0ed4912e93e0c8
- timezone optional -> host system zone (jiff, macOS + Linux)
- storagePath optional -> platform data dir (/var/lib on Linux, ~/Library/Application Support on macOS)
- config file optional at the default path; explicit --config must still exist
- default logLevel changed from info to warn
- new output field (text|json) sets the default rendering so -j isn't needed per call
README: add CLI command/option tables near the top; tighten design principles2026-07-29T02:31:24ZLuke Hoerstenluke@hoersten.org2026-07-29T02:31:24Zurn:sha1:5c81b970819e8d38413a5dc02d56b7f182715e8aREADME: link the www.nth.io/mattertimectl website2026-07-29T02:27:53ZLuke Hoerstenluke@hoersten.org2026-07-29T02:27:53Zurn:sha1:a35610f29ec870695339015ef5bd4d3ab2ade3c2README: note macOS support and that commissioning is a manual on-box step2026-07-29T02:08:01ZLuke Hoerstenluke@hoersten.org2026-07-29T02:08:01Zurn:sha1:89bd766ffbf5435bc1d1bc09cc5a3c73ac7ba940Remove old-implementation references from source doc comments2026-07-29T01:31:54ZLuke Hoerstenluke@hoersten.org2026-07-29T01:31:54Zurn:sha1:62be4f09ed833ed2946361f17576770163896d45Drop TypeScript-implementation references from README2026-07-29T01:27:35ZLuke Hoerstenluke@hoersten.org2026-07-29T01:27:35Zurn:sha1:459a84eb6ac76dbb671e516956d2e883e2817600Rename project to mattertimectl; default fabric label to Matter Time Controller2026-07-29T01:13:03ZLuke Hoerstenluke@hoersten.org2026-07-29T01:13:03Zurn:sha1:3a535a57c1b5fa48d5495c31d308b42943f92583
- Rename crate, binary, and repo from mattertimesync to mattertimectl
- Change default fabricLabel to "Matter Time Controller"
- Point README at src.nth.io as the main repo, GitHub as the mirror
Merge the two device state files and reduce mutation2026-07-28T23:09:57ZLuke Hoerstenluke@hoersten.org2026-07-28T23:09:57Zurn:sha1:cf5eabb9647e6d53ec29a3f7de599a38dbfd5490
The registry (device names) and service-state (sync results) were two
JSON files keyed the same way, split only for a TypeScript-compatibility
that is moot now that the fabric identity cannot migrate between
implementations. Merge them into one devices.json with a DeviceRecord per
node, which also removes the parallel-map join in status and collapses the
per-command load/store pairs. identity.json stays separate as a write-once
secret.
Also, from a reduction/immutability review:
- Fix with_timeout passing a literal "{what}" instead of the error context
- Drop needless mut: CompactDuration and parse_wall_clock become immutable
expressions; run_status filters with a predicate instead of a mutator;
sync_one extracts write_zone_and_dst; InspectOutcome gains Default plus a
failed() constructor
- Share a join_ids helper and a devices_path helper; add IdentityReport
From; minor combinator tidy-ups
35 unit tests, clippy clean.
Split the controller operations into a submodule2026-07-28T22:42:46ZLuke Hoerstenluke@hoersten.org2026-07-28T22:42:46Zurn:sha1:4129dcaeceab060d9f1cac599e9e29cab0f44fd7
controller.rs had grown to ~1400 lines gluing the one-shot stack harness
and persistent-identity lifecycle to the four on-wire operations. Move the
operations (commission, sync, inspect, decommission, plus connect and the
timeout helper) into controller/ops.rs; the harness, identity/fabric
bootstrap, KV store, and locking stay in controller/mod.rs. ops.rs sees the
parent module private items via use super::*, so no visibility changes were
needed, and pub use ops::* keeps the existing controller::* paths.
No behavior change. 36 unit tests, clippy clean.
Address remaining audit findings: input hardening and cleanup2026-07-28T22:38:06ZLuke Hoerstenluke@hoersten.org2026-07-28T22:38:06Zurn:sha1:29943e536f2be420a9d4042cd26d7b7eddf71438
Security:
- SNTP replies must echo a random nonce in their originate timestamp, and
unsynchronized (LI=3) or invalid-stratum servers are rejected, so an
off-path spoofer cannot defeat the clock-trust gate
- The storage directory is created 0700 but an existing one is tightened
only when it is provably ours (holds our artifacts or is empty); a
misconfigured path like /tmp under root is left alone with a warning
- Device-supplied vendor/product names are stripped of control characters
at ingestion so a device cannot inject terminal escapes
Cleanup:
- ensure_fabric splits into decision logic plus bootstrap_fabric
- read_device_names merges the two name readers; a From impl replaces the
hand-mapped IdentityReport; run_sync uses map/transpose with an extracted
manual_instant; pick_interface runs once; print_json escapes its fallback;
device_name dedups the vendor/product join; identity_status ignores
leftover .tmp blobs; dead parameters and repeated random-id code removed
36 unit tests, clippy clean.