Sprint 334: Hardening Swarm Quorums, State Persistence, and Resource Quotas in v2.21.4-security 🔒

1. Crash-Resilient Peer Revocation & Admission Gate (C4)

Previously, revoked peer keys were held entirely in volatile memory. If a node restarted, the revocation list was cleared, leaving the cluster vulnerable to re-admission of compromised nodes.

In v2.21.4-security, revoked keys are serialized to revoked_keys.json immediately upon revocation. Under the Robustness Rule, all disk I/O operations are wrapped in safe Result handling—ensuring that missing permissions, full disks, or corrupted JSON files log warnings but never panic or crash the server.

Additionally, a strict Registration Gate has been integrated into knc_mesh_peers?action=register. The incoming peer key and capabilities are cross-referenced with the revocation registry prior to admission, rejecting blacklisted peers with -32001 Unauthorized.

2. Swarm Quorum Härtung (C3)

Audit point C3 highlighted a critical flaw in how quorum thresholds were calculated. In both knc_swarm_quorum and knc_mesh_revoke_peer, the denominator of active nodes inadvertently included peers marked as Evicted or Stale, allowing offline or untrusted nodes to dilute the consensus target.

This has been corrected by strictly filtering the active peer map: only nodes with an active status are counted towards the quorum base. The system now enforces a hardened consensus threshold calculation: (active_nodes / 2) + 1.

3. Full Stack-Traversal Memory Estimation (A4)

To prevent runaway memory consumption, isolates restrict heap allocations to 16 MiB. However, the memory estimator was limited by a .take(64) cap, leaving deep stacks uninspected and creating a vector for stack-based memory exhaustion.

We removed the restriction, converting the algorithm to traverse the entire stack slice via a cumulative heap counter. Deep nested values are now fully counted, preventing memory escapes.

4. Customizable Tenant Isolate Quotas (A5)

Multi-tenant deployments require fine-grained resource allocations. We extended VMIsolate with a configurable quota property, enabling host orchestrators to launch sandboxed scripts with specialized instruction and memory limits:

let quota = IsolateQuota {
    max_opcodes: 50_000,
    max_memory_bytes: 1024 * 1024, // 1 MiB
};
let isolate = VMIsolate::new(instructions, constants).with_quota(quota);

5. Verified via Quality Gates

A new automated suite (tests/security_audit_sprint334_tests.rs) has been added, validating all security fixes. The quality gates verify that all changes pass the strict zero clippy warning baseline and compile cleanly under the production-ready v2.21.4-security tag.