[package]
name = "tibet-trust-kernel"
version = "1.0.0-alpha.5"
edition = "2021"
description = "Zero-trust security foundation — AES-256-GCM encryption, SHA-256 integrity, sandboxed execution, cross-machine memory transport. For finance, IoT, AI, databases, anything zero-trust."
license = "MIT"
authors = ["Jasper van de Meent <jasper@humotica.com>", "Root AI <root_idd@humotica.nl>"]
keywords = ["zero-trust", "encryption", "userfaultfd", "cross-machine", "tibet"]
categories = ["cryptography", "hardware-support", "memory-management"]
repository = "https://github.com/Humotica/tibet-trust-kernel"
homepage = "https://ainternet.org"
readme = "README.md"
# publish = true  # Hardware test passed — P520 ↔ DL360 10Gbps verified

[package.metadata.docs.rs]
features = ["kvm"]

# NOTE: The `kvm` feature enables real kernel isolation via Ignition
# (https://lttle.cloud / https://github.com/nicholasgasior/ignition)
# Ignition is not yet on crates.io — use path/git dependency when building with KVM:
#   ignition = { git = "https://github.com/nicholasgasior/ignition" }

[features]
default = ["simulation", "cluster", "llm"]
simulation = []                    # Simulated KVM — for testing without hardware
kvm = []                           # Real Ignition KVM — requires /dev/kvm
cluster = []                       # Cross-machine RAM RAID-0 + ClusterMux transport
quic = ["cluster", "dep:quinn", "dep:rustls", "dep:rcgen"]  # QUIC transport — multi-stream, 0-RTT
llm = ["cluster"]                  # LLM Memory Mapper (DIME aperture) — implies cluster
full = ["cluster", "llm", "quic"]  # All features

[dependencies]
userfaultfd = "0.8.1"
libc = "0.2"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
tokio = { version = "1.0", features = ["full"] }
chrono = { version = "0.4", features = ["serde"] }

# Airlock Bifurcatie — echte crypto
aes-gcm = "0.10"           # AES-256-GCM via AES-NI (core::arch::x86_64::_mm_aesenc_si128)
x25519-dalek = { version = "2", features = ["static_secrets"] }  # X25519 key agreement
sha2 = "0.10"               # SHA-256
hkdf = "0.12"               # HKDF-SHA256 per-block key derivation
rand = "0.8"                # OsRng voor nonces en ephemeral keys
rayon = "1.10"              # Multi-core parallel sealing/opening

# QUIC transport — no head-of-line blocking, multi-stream, 0-RTT
quinn = { version = "0.11", optional = true }
rustls = { version = "0.23", optional = true, default-features = false, features = ["ring", "std"] }
rcgen = { version = "0.13", optional = true }  # Self-signed certs for internal links

# Real KVM backend — when ignition is published to crates.io:
# ignition = { version = "0.1", optional = true }

[[bin]]
name = "tibet-bench"
path = "src/bin/tibet_bench.rs"

[[bin]]
name = "dual-kernel-demo"
path = "src/bin/dual_kernel_demo.rs"

[[bin]]
name = "cluster-paging-demo"
path = "src/bin/cluster_paging_demo.rs"

[[bin]]
name = "cluster-transport-demo"
path = "src/bin/cluster_transport_demo.rs"

[[bin]]
name = "portmux-xdp-demo"
path = "src/bin/portmux_xdp_demo.rs"

[[bin]]
name = "ram-raid-cluster-demo"
path = "src/bin/ram_raid_cluster_demo.rs"

[[bin]]
name = "llm-mapper-demo"
path = "src/bin/llm_mapper_demo.rs"

[[bin]]
name = "gguf-raid-test"
path = "src/bin/gguf_raid_test.rs"

[[bin]]
name = "overlay-mux-demo"
path = "src/bin/overlay_mux_demo.rs"
# Uses OverlayMux + OverlayMuxServer which are cfg(feature = "quic") gated.
# Without this marker, default-features builds (and cargo publish verify) fail.
required-features = ["quic"]

# Standalone OSAPI smoke binary — spawns only the v1.1 listeners (verdict + TAT),
# skips MUX/voorproever/archivaris init. Useful for live e2e demos and CI.
[[bin]]
name = "osapi-smoke"
path = "src/bin/osapi_smoke.rs"

[[bench]]
name = "airlock_bench"
harness = false

[[bench]]
name = "profile_bench"
harness = false

[[bench]]
name = "roi_bench"
harness = false

[[bench]]
name = "portmux_bench"
harness = false

[[bench]]
name = "xdp_bench"
harness = false

[[bench]]
name = "seccomp_zandbak_bench"
harness = false

[[bench]]
name = "snapshot_bench"
harness = false

[[bench]]
name = "upip_pager_bench"
harness = false

[[bench]]
name = "vmm_inject_bench"
harness = false

[[bench]]
name = "container_bench"
harness = false

[[bench]]
name = "ram_raid_bench"
harness = false

[[bench]]
name = "bifurcation_bench"
harness = false