luke/mattertimectl, branch mainUnnamed repository; edit this file 'description' to name the repository.
https://src.nth.io/luke/mattertimectl/atom?h=main2026-07-29T02:31:24+00:00README: add CLI command/option tables near the top; tighten design principles2026-07-29T02:31:24+00:00Luke Hoerstenluke@hoersten.org2026-07-29T02:31:24+00:00urn:sha1:5c81b970819e8d38413a5dc02d56b7f182715e8aREADME: link the www.nth.io/mattertimectl website2026-07-29T02:27:53+00:00Luke Hoerstenluke@hoersten.org2026-07-29T02:27:53+00:00urn:sha1:a35610f29ec870695339015ef5bd4d3ab2ade3c2README: note macOS support and that commissioning is a manual on-box step2026-07-29T02:08:01+00:00Luke Hoerstenluke@hoersten.org2026-07-29T02:08:01+00:00urn:sha1:89bd766ffbf5435bc1d1bc09cc5a3c73ac7ba940Remove old-implementation references from source doc comments2026-07-29T01:31:54+00:00Luke Hoerstenluke@hoersten.org2026-07-29T01:31:54+00:00urn:sha1:62be4f09ed833ed2946361f17576770163896d45Drop TypeScript-implementation references from README2026-07-29T01:27:35+00:00Luke Hoerstenluke@hoersten.org2026-07-29T01:27:35+00:00urn:sha1:459a84eb6ac76dbb671e516956d2e883e2817600Rename project to mattertimectl; default fabric label to Matter Time Controller2026-07-29T01:13:03+00:00Luke Hoerstenluke@hoersten.org2026-07-29T01:13:03+00:00urn:sha1:3a535a57c1b5fa48d5495c31d308b42943f92583
- Rename crate, binary, and repo from mattertimesync to mattertimectl
- Change default fabricLabel to "Matter Time Controller"
- Point README at src.nth.io as the main repo, GitHub as the mirror
Merge the two device state files and reduce mutation2026-07-28T23:09:57+00:00Luke Hoerstenluke@hoersten.org2026-07-28T23:09:57+00:00urn:sha1:cf5eabb9647e6d53ec29a3f7de599a38dbfd5490
The registry (device names) and service-state (sync results) were two
JSON files keyed the same way, split only for a TypeScript-compatibility
that is moot now that the fabric identity cannot migrate between
implementations. Merge them into one devices.json with a DeviceRecord per
node, which also removes the parallel-map join in status and collapses the
per-command load/store pairs. identity.json stays separate as a write-once
secret.
Also, from a reduction/immutability review:
- Fix with_timeout passing a literal "{what}" instead of the error context
- Drop needless mut: CompactDuration and parse_wall_clock become immutable
expressions; run_status filters with a predicate instead of a mutator;
sync_one extracts write_zone_and_dst; InspectOutcome gains Default plus a
failed() constructor
- Share a join_ids helper and a devices_path helper; add IdentityReport
From; minor combinator tidy-ups
35 unit tests, clippy clean.
Split the controller operations into a submodule2026-07-28T22:42:46+00:00Luke Hoerstenluke@hoersten.org2026-07-28T22:42:46+00:00urn:sha1:4129dcaeceab060d9f1cac599e9e29cab0f44fd7
controller.rs had grown to ~1400 lines gluing the one-shot stack harness
and persistent-identity lifecycle to the four on-wire operations. Move the
operations (commission, sync, inspect, decommission, plus connect and the
timeout helper) into controller/ops.rs; the harness, identity/fabric
bootstrap, KV store, and locking stay in controller/mod.rs. ops.rs sees the
parent module private items via use super::*, so no visibility changes were
needed, and pub use ops::* keeps the existing controller::* paths.
No behavior change. 36 unit tests, clippy clean.
Address remaining audit findings: input hardening and cleanup2026-07-28T22:38:06+00:00Luke Hoerstenluke@hoersten.org2026-07-28T22:38:06+00:00urn:sha1:29943e536f2be420a9d4042cd26d7b7eddf71438
Security:
- SNTP replies must echo a random nonce in their originate timestamp, and
unsynchronized (LI=3) or invalid-stratum servers are rejected, so an
off-path spoofer cannot defeat the clock-trust gate
- The storage directory is created 0700 but an existing one is tightened
only when it is provably ours (holds our artifacts or is empty); a
misconfigured path like /tmp under root is left alone with a warning
- Device-supplied vendor/product names are stripped of control characters
at ingestion so a device cannot inject terminal escapes
Cleanup:
- ensure_fabric splits into decision logic plus bootstrap_fabric
- read_device_names merges the two name readers; a From impl replaces the
hand-mapped IdentityReport; run_sync uses map/transpose with an extracted
manual_instant; pick_interface runs once; print_json escapes its fallback;
device_name dedups the vendor/product join; identity_status ignores
leftover .tmp blobs; dead parameters and repeated random-id code removed
36 unit tests, clippy clean.
Harden against untrusted input and reduce controller boilerplate2026-07-28T22:18:43+00:00Luke Hoerstenluke@hoersten.org2026-07-28T22:18:43+00:00urn:sha1:28a660e8bacac84523601f67547b2671058d9b20
Security:
- Epoch conversions no longer panic on out-of-range values: a device may
report any u64 as its clock, so to_timestamp is fallible (rendered
labeled-raw), from_timestamp clamps a pre-epoch host clock to zero (a
Pi with no RTC reads 1970 early after boot), and delta arithmetic
saturates. Fixes crashes in inspect and status
- Identity Debug redacts the root CA private key so no stray {:?} leaks it
- fsync the temp file before rename, so a power loss cannot surface an
empty identity.json
- Document in the README that device attestation is not verified, the NTP
servers contacted, and the at-rest key
Cleanup:
- A MatterCtx extension trait replaces the repeated map_err/anyhow closure
at every rs-matter call site with .ctx("what")
- SyncOutcome::failed/skipped constructors collapse two large literals
- read_our_fabric_entry shares the fabric-filtered read across the label,
decommission, and inspect paths
36 unit tests, clippy clean.