Skip to content

Commit 9d6aea2

Browse files
mivertowskiclaude
mivertowski
and
claude
committed
Release v0.3.1: Enterprise readiness with security, auth, and observability
Version bump to 0.3.1 with comprehensive enterprise features: **Security:** - Real cryptography: AES-256-GCM, ChaCha20-Poly1305, Argon2 key derivation - Secrets management: SecretStore trait, key rotation, caching - K2K message encryption with forward secrecy - TLS/mTLS support with rustls, certificate rotation, SNI **Authentication & Authorization:** - ApiKeyAuth and JwtAuth providers - ChainedAuthProvider for fallback chains - RBAC with deny-by-default PolicyEvaluator - Multi-tenancy with ResourceQuota and TenantContext **Observability:** - OpenTelemetry OTLP export to Jaeger/Honeycomb/Datadog - Structured logging with trace correlation - Alert routing with deduplication (Slack/Teams/PagerDuty) - Remote audit sinks (Syslog, CloudWatch, Elasticsearch) **Rate Limiting:** - TokenBucket, SlidingWindow, LeakyBucket algorithms - RateLimiterBuilder with fluent configuration **Operational:** - Operation timeouts with deadline propagation - Automatic recovery with configurable policies per failure type Feature flags: crypto, auth, tls, rate-limiting, alerting, enterprise Test count increased from 825+ to 900+ tests. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent a6c95b6 commit 9d6aea2

6 files changed

Lines changed: 609 additions & 23 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 164 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,168 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [0.3.1] - 2026-01-19
11+
12+
### Added
13+
14+
#### Enterprise Security Features
15+
16+
- **Real Cryptography** (`ringkernel-core/src/security.rs`)
17+
- AES-256-GCM and ChaCha20-Poly1305 encryption algorithms
18+
- Proper nonce generation with `rand::thread_rng()`
19+
- Key derivation using Argon2id and HKDF-SHA256
20+
- Secure memory wiping with `zeroize` crate
21+
- Feature-gated via `crypto` feature flag
22+
23+
- **Secrets Management** (`ringkernel-core/src/secrets.rs`) - **NEW FILE**
24+
- `SecretStore` trait for pluggable secret backends
25+
- `InMemorySecretStore` for development/testing
26+
- `EnvVarSecretStore` for environment variable secrets
27+
- `CachedSecretStore` with TTL-based caching
28+
- `ChainedSecretStore` for fallback chains
29+
- `KeyRotationManager` for automatic key rotation
30+
- `SecretKey` and `SecretValue` types with secure memory handling
31+
32+
- **Authentication Framework** (`ringkernel-core/src/auth.rs`) - **NEW FILE**
33+
- `AuthProvider` trait for pluggable authentication
34+
- `ApiKeyAuth` for simple API key validation
35+
- `JwtAuth` for JWT token validation (RS256/HS256) - requires `auth` feature
36+
- `ChainedAuthProvider` for fallback authentication chains
37+
- `AuthContext` with identity and credential management
38+
- `Credentials` enum: ApiKey, Bearer, Basic, Certificate
39+
40+
- **Role-Based Access Control** (`ringkernel-core/src/rbac.rs`) - **NEW FILE**
41+
- `Role` enum: Admin, Operator, Developer, Viewer, Custom
42+
- `Permission` enum: Read, Write, Execute, Admin, Custom
43+
- `RbacPolicy` with subject-role-permission bindings
44+
- `PolicyEvaluator` with deny-by-default evaluation
45+
- `ResourceRule` for fine-grained resource access control
46+
47+
- **Multi-Tenancy Support** (`ringkernel-core/src/tenancy.rs`) - **NEW FILE**
48+
- `TenantContext` for request scoping with tenant ID
49+
- `TenantRegistry` for managing tenant configurations
50+
- `ResourceQuota` with limits for memory, kernels, message rate
51+
- `ResourceUsage` tracking with quota enforcement
52+
- `QuotaUtilization` for monitoring tenant resource usage
53+
54+
#### Enterprise Observability
55+
56+
- **OpenTelemetry OTLP Export** (`ringkernel-core/src/observability.rs`)
57+
- `OtlpExporter` for sending spans to OTLP endpoints
58+
- `OtlpConfig` with endpoint, headers, and transport configuration
59+
- Batch export with configurable interval and queue size
60+
- HTTP and gRPC transport options via `OtlpTransport` enum
61+
- Automatic retry with exponential backoff
62+
- `OtlpExporterStats` for monitoring export success/failure
63+
64+
- **Structured Logging** (`ringkernel-core/src/logging.rs`) - **NEW FILE**
65+
- `StructuredLogger` with multi-sink support
66+
- `LogLevel`: Trace, Debug, Info, Warn, Error, Fatal
67+
- `LogOutput`: Text, Json, Compact, Pretty
68+
- `TraceContext` for automatic trace_id/span_id injection
69+
- `LogConfig` with builder pattern and presets (development, production)
70+
- Built-in sinks: `ConsoleSink`, `MemoryLogSink`, `FileLogSink`
71+
- JSON structured output for log aggregation
72+
- Global logger functions: `init()`, `info()`, `error()`, etc.
73+
74+
- **Alert Routing System** (`ringkernel-core/src/alerting.rs`) - **NEW FILE**
75+
- `AlertSink` trait for pluggable alert destinations
76+
- `AlertRouter` for routing alerts based on severity
77+
- `WebhookSink` for Slack, Teams, PagerDuty (requires `alerting` feature)
78+
- `LogSink` and `InMemorySink` for testing/debugging
79+
- `DeduplicationConfig` for alert deduplication with time windows
80+
- `AlertSeverity`: Info, Warning, Error, Critical
81+
- `AlertRouterStats` for monitoring alert delivery
82+
83+
- **Remote Audit Sinks** (`ringkernel-core/src/audit.rs`)
84+
- `SyslogSink` for RFC 5424 syslog with configurable facility/severity
85+
- `CloudWatchSink` for AWS CloudWatch Logs integration
86+
- `ElasticsearchSink` for direct Elasticsearch indexing (requires `alerting` feature)
87+
- Async batch sending with configurable flush intervals
88+
89+
#### Enterprise Rate Limiting
90+
91+
- **Rate Limiting** (`ringkernel-core/src/rate_limiting.rs`) - **NEW FILE**
92+
- `RateLimiter` with pluggable algorithms
93+
- `RateLimitAlgorithm`: TokenBucket, SlidingWindow, LeakyBucket
94+
- `RateLimitConfig` with burst, window size, and rate configuration
95+
- `RateLimiterBuilder` with fluent configuration API
96+
- `RateLimitGuard` RAII wrapper for rate-limited operations
97+
- `SharedRateLimiter` for distributed rate limiting
98+
- `RateLimiterExt` trait for easy integration
99+
- `RateLimiterStatsSnapshot` for monitoring
100+
- Feature-gated via `rate-limiting` feature flag
101+
102+
#### Network Security
103+
104+
- **TLS Support** (`ringkernel-core/src/tls.rs`) - **NEW FILE**
105+
- `TlsConfig` with builder pattern for server/client configuration
106+
- `TlsAcceptor` for server-side TLS with rustls
107+
- `TlsConnector` for client-side TLS connections
108+
- `CertificateStore` with automatic rotation and hot reload
109+
- `SniResolver` for multi-domain certificate selection
110+
- mTLS (mutual TLS) with client certificate validation
111+
- `TlsVersion` enum: Tls12, Tls13
112+
- `TlsSessionInfo` for connection metadata
113+
- Feature-gated via `tls` feature flag
114+
115+
- **K2K Message Encryption** (`ringkernel-core/src/k2k.rs`)
116+
- `K2KEncryptor` for kernel-to-kernel message encryption
117+
- `K2KEncryptionConfig` with algorithm and key configuration
118+
- `K2KEncryptionAlgorithm`: Aes256Gcm, ChaCha20Poly1305
119+
- `EncryptedK2KMessage` with nonce and authentication tag
120+
- `EncryptedK2KEndpoint` wrapper for transparent encryption
121+
- `EncryptedK2KBuilder` for fluent endpoint creation
122+
- `K2KKeyMaterial` with secure key handling
123+
- Forward secrecy support with ephemeral keys
124+
- Feature-gated via `crypto` feature flag
125+
126+
#### Operational Excellence
127+
128+
- **Operation Timeouts** (`ringkernel-core/src/timeout.rs`) - **NEW FILE**
129+
- `Timeout` wrapper for async operations with deadlines
130+
- `Deadline` for absolute timeout tracking
131+
- `CancellationToken` for cooperative cancellation
132+
- `OperationContext` with deadline propagation
133+
- `timeout()` and `timeout_named()` helper functions
134+
- `with_timeout()` and `with_timeout_named()` for futures
135+
- `TimeoutStats` and `TimeoutStatsSnapshot` for monitoring
136+
137+
- **Automatic Recovery** (`ringkernel-core/src/health.rs`)
138+
- `RecoveryPolicy` enum: Restart, Migrate, Checkpoint, Notify, Escalate, Circuit
139+
- `FailureType` enum: Timeout, Crash, DeviceError, ResourceExhausted, QueueOverflow, StateCorruption
140+
- `RecoveryConfig` with builder pattern and per-failure-type policies
141+
- `RecoveryManager` for coordinating recovery actions
142+
- `RecoveryAction` with retry tracking and timestamps
143+
- `RecoveryResult` with success/failure details
144+
- `RecoveryStatsSnapshot` for monitoring recovery attempts
145+
- Automatic escalation after max retries exceeded
146+
- Configurable cooldown periods between recovery attempts
147+
148+
### Changed
149+
150+
- **Feature Flags** - New enterprise feature flags in `ringkernel-core/Cargo.toml`:
151+
- `crypto` - Real cryptography (AES-GCM, ChaCha20, Argon2)
152+
- `auth` - JWT authentication support
153+
- `rate-limiting` - Governor-based rate limiting
154+
- `alerting` - Webhook alerts via reqwest
155+
- `tls` - TLS support via rustls
156+
- `enterprise` - Combined feature enabling all enterprise features
157+
158+
- **Test Coverage** - Increased from 825+ to 900+ tests
159+
- 14 crypto tests for K2K encryption
160+
- 14 logging tests for structured logging
161+
- 15 recovery tests for automatic recovery
162+
- 13 TLS tests for certificate management
163+
- Plus tests for secrets, auth, RBAC, tenancy, rate limiting, alerting
164+
165+
### Fixed
166+
167+
- Fixed SpanStatus pattern matching for OTLP export
168+
- Fixed AttributeValue JSON serialization in observability
169+
- Fixed TraceId/SpanId Display formatting with hex output
170+
- Fixed reqwest blocking feature for webhook alerts
171+
10172
## [0.3.0] - 2026-01-17
11173

12174
### Added
@@ -609,7 +771,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
609771
- CLAUDE.md with build commands and architecture overview
610772
- Code examples for all major features
611773

612-
[Unreleased]: https://github.com/mivertowski/RustCompute/compare/v0.3.0...HEAD
774+
[Unreleased]: https://github.com/mivertowski/RustCompute/compare/v0.3.1...HEAD
775+
[0.3.1]: https://github.com/mivertowski/RustCompute/compare/v0.3.0...v0.3.1
613776
[0.3.0]: https://github.com/mivertowski/RustCompute/compare/v0.2.0...v0.3.0
614777
[0.2.0]: https://github.com/mivertowski/RustCompute/compare/v0.1.3...v0.2.0
615778
[0.1.3]: https://github.com/mivertowski/RustCompute/compare/v0.1.2...v0.1.3

‎CLAUDE.md‎

Lines changed: 39 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -216,10 +216,37 @@ The following enterprise-grade features provide production-ready infrastructure:
216216
- **`CircuitBreaker`** - Fault tolerance with automatic recovery
217217
- **`DegradationManager`** - Graceful degradation with 5 levels (Normal → Critical)
218218
- **`KernelWatchdog`** - Stale kernel detection with heartbeat monitoring
219+
- **`RecoveryManager`** - Automatic recovery with configurable policies per failure type
219220

220221
**Observability:**
221222
- **`PrometheusExporter`** - Prometheus metrics export
223+
- **`OtlpExporter`** - OpenTelemetry OTLP export to Jaeger/Honeycomb/Datadog
222224
- **`ObservabilityContext`** - Distributed tracing with spans
225+
- **`StructuredLogger`** - Multi-sink logging with trace correlation (JSON/Text output)
226+
- **`AlertRouter`** - Alert routing with deduplication and severity-based routing
227+
228+
**Security (feature-gated via `crypto`, `auth`, `tls`):**
229+
- **`MemoryEncryption`** - AES-256-GCM and ChaCha20-Poly1305 encryption
230+
- **`K2KEncryptor`** - Kernel-to-kernel message encryption with forward secrecy
231+
- **`SecretStore`** - Pluggable secrets management with key rotation
232+
- **`TlsConfig`/`TlsAcceptor`/`TlsConnector`** - TLS/mTLS with rustls and cert rotation
233+
- **`KernelSandbox`** - Kernel isolation and resource control
234+
235+
**Authentication & Authorization (feature-gated via `auth`):**
236+
- **`ApiKeyAuth`** - Simple API key validation
237+
- **`JwtAuth`** - JWT token validation (RS256/HS256)
238+
- **`ChainedAuthProvider`** - Fallback authentication chains
239+
- **`RbacPolicy`/`PolicyEvaluator`** - Role-based access control with deny-by-default
240+
241+
**Multi-tenancy:**
242+
- **`TenantContext`** - Request scoping with tenant ID
243+
- **`TenantRegistry`** - Tenant configuration management
244+
- **`ResourceQuota`** - Per-tenant limits (memory, kernels, message rate)
245+
246+
**Rate Limiting (feature-gated via `rate-limiting`):**
247+
- **`RateLimiter`** - TokenBucket, SlidingWindow, LeakyBucket algorithms
248+
- **`RateLimiterBuilder`** - Fluent configuration API
249+
- **`SharedRateLimiter`** - Distributed rate limiting
223250

224251
**Multi-GPU:**
225252
- **`MultiGpuCoordinator`** - Device selection with load balancing strategies
@@ -229,6 +256,7 @@ The following enterprise-grade features provide production-ready infrastructure:
229256
**Lifecycle:**
230257
- **`LifecycleState`** - Initializing → Running → Draining → ShuttingDown → Stopped
231258
- **`ShutdownReport`** - Final statistics on graceful shutdown
259+
- **`Timeout`/`Deadline`** - Operation timeouts with deadline propagation
232260

233261
```rust
234262
// Enterprise runtime usage
@@ -514,6 +542,14 @@ Main crate (`ringkernel`) features:
514542
CUDA-specific features:
515543
- `cooperative` - Enable CUDA cooperative groups for grid-wide synchronization (`grid.sync()`). Requires nvcc at build time for PTX compilation.
516544

545+
Core crate (`ringkernel-core`) enterprise features:
546+
- `crypto` - Real cryptography (AES-256-GCM, ChaCha20-Poly1305, Argon2)
547+
- `auth` - JWT authentication support (jsonwebtoken crate)
548+
- `rate-limiting` - Governor-based rate limiting
549+
- `alerting` - Webhook alerts via reqwest
550+
- `tls` - TLS support via rustls
551+
- `enterprise` - Combined feature enabling all enterprise features
552+
517553
Ecosystem crate (`ringkernel-ecosystem`) features:
518554
- `persistent` - Core persistent GPU kernel traits (backend-agnostic)
519555
- `persistent-cuda` - CUDA implementation of `PersistentHandle` via `CudaPersistentHandle`
@@ -557,8 +593,8 @@ let handle = CudaPersistentHandle::new(simulation, "fdtd_3d");
557593

558594
### Test Count Summary
559595

560-
825+ tests across the workspace:
561-
- ringkernel-core: 345 tests (including memory pool, analytics context, pressure reactions)
596+
900+ tests across the workspace:
597+
- ringkernel-core: 457 tests (including memory pool, analytics context, pressure reactions, enterprise security, auth, RBAC, tenancy, rate limiting, TLS, logging, alerting, recovery)
562598
- ringkernel-cpu: 11 tests
563599
- ringkernel-cuda: 52 tests (reduction cache, phases, K2K, persistent actors)
564600
- ringkernel-cuda-codegen: 190+ tests (loops, shared memory, ring kernels, K2K, envelope format, energy calculation, checksums, 120+ GPU intrinsics)
@@ -769,7 +805,7 @@ let _ = device.poll(wgpu::PollType::wait_indefinitely());
769805

770806
## Dependency Versions
771807

772-
Key workspace dependencies (as of v0.1.3):
808+
Key workspace dependencies (as of v0.3.1):
773809

774810
| Category | Package | Version | Notes |
775811
|----------|---------|---------|-------|

‎Cargo.toml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ members = [
2626
]
2727

2828
[workspace.package]
29-
version = "0.3.0"
29+
version = "0.3.1"
3030
edition = "2021"
3131
authors = ["Michael Ivertowski <mivertowski@outlook.com>"]
3232
license = "Apache-2.0"
@@ -90,18 +90,18 @@ aws-config = { version = "1.6", features = ["behavior-version-latest"] }
9090
bytes = "1.9"
9191

9292
# Internal crates - version must match workspace version for publishing
93-
ringkernel-core = { version = "0.3.0", path = "crates/ringkernel-core" }
94-
ringkernel-derive = { version = "0.3.0", path = "crates/ringkernel-derive" }
95-
ringkernel-cpu = { version = "0.3.0", path = "crates/ringkernel-cpu" }
96-
ringkernel-cuda = { version = "0.3.0", path = "crates/ringkernel-cuda" }
97-
ringkernel-wgpu = { version = "0.3.0", path = "crates/ringkernel-wgpu" }
98-
ringkernel-metal = { version = "0.3.0", path = "crates/ringkernel-metal" }
99-
ringkernel-codegen = { version = "0.3.0", path = "crates/ringkernel-codegen" }
100-
ringkernel-cuda-codegen = { version = "0.3.0", path = "crates/ringkernel-cuda-codegen" }
101-
ringkernel-wgpu-codegen = { version = "0.3.0", path = "crates/ringkernel-wgpu-codegen" }
102-
ringkernel-ir = { version = "0.3.0", path = "crates/ringkernel-ir" }
103-
ringkernel-wavesim = { version = "0.3.0", path = "crates/ringkernel-wavesim" }
104-
ringkernel-ecosystem = { version = "0.3.0", path = "crates/ringkernel-ecosystem" }
93+
ringkernel-core = { version = "0.3.1", path = "crates/ringkernel-core" }
94+
ringkernel-derive = { version = "0.3.1", path = "crates/ringkernel-derive" }
95+
ringkernel-cpu = { version = "0.3.1", path = "crates/ringkernel-cpu" }
96+
ringkernel-cuda = { version = "0.3.1", path = "crates/ringkernel-cuda" }
97+
ringkernel-wgpu = { version = "0.3.1", path = "crates/ringkernel-wgpu" }
98+
ringkernel-metal = { version = "0.3.1", path = "crates/ringkernel-metal" }
99+
ringkernel-codegen = { version = "0.3.1", path = "crates/ringkernel-codegen" }
100+
ringkernel-cuda-codegen = { version = "0.3.1", path = "crates/ringkernel-cuda-codegen" }
101+
ringkernel-wgpu-codegen = { version = "0.3.1", path = "crates/ringkernel-wgpu-codegen" }
102+
ringkernel-ir = { version = "0.3.1", path = "crates/ringkernel-ir" }
103+
ringkernel-wavesim = { version = "0.3.1", path = "crates/ringkernel-wavesim" }
104+
ringkernel-ecosystem = { version = "0.3.1", path = "crates/ringkernel-ecosystem" }
105105

106106
[profile.release]
107107
lto = true

0 commit comments

Comments
 (0)