vipirc 0.5.0 — release validation
Generated: 2026-10-27T05:11:31.233542+00:00
Result: PASS for the explicitly described Linux release gates.

RELEASE IDENTITY

Executable SHA256: f36224725d55121bfab6f9f6176b1586f981fe3b30364bd1753f319f39d6fb55
Executable size: 432,208 bytes (unstripped, dynamically linked).
Version: vipirc 0.5.0; ThatIAm.vip / www.thatiam.vip; designed by remfan1994.
The supplied IALA license is preserved byte for byte.
License SHA256: 16f5cc0b2a43d1c2f85b0f1a0c44a20de73bf4e5dcf6b6597ee9e544d2955e41

The source is C11 with wide-character curses and OpenSSL-compatible TLS.
The executable needs no Python runtime. GnuPG is an optional executable
dependency for encrypted password files; no GPG library is linked.
This validation ran on Linux-6.18.55-x86_64-with-glibc2.39, x86_64.
The toolchain was GCC 13.3.0; the local TLS library was OpenSSL 3.0.13.
The prebuilt executable requires the x86-64 Linux ABI, glibc symbol versions
through 2.34, ncursesw/tinfo ABI 6, and OpenSSL ABI 3. Libraries are not bundled.
Build from source for another architecture, BSD, or an incompatible Linux ABI.

USER-VISIBLE CHANGES VERIFIED

The global header keeps seven category destinations in this exact order:
vipirc, Servers, Channels, Queries, File transfers, Mentions, Unread views.
Opening ChanServ from Queries 2 leaves that category and count in the header.
Query: ChanServ appears separately below it. Positive counts may update;
the destination identity and traversal order do not become the current chat.
Empty categories remain reachable, and narrow screens scroll the selector.

Tab advances, Shift-Tab reverses and wraps, and Enter opens the selected
destination. Secondary screens retain the same selector; Escape returns to
chat. Ordinary main-screen editing keys return to the draft, with hjkl as
text. The vipirc panel contains live diagnostics, Settings, Manual, Command.
Clear and Send are below the fixed input field; /clearinput clears a draft.

Command has its own editor and per-server bounded memory-only history.
Typing slash at chat caret zero opens it, while pasted slash remains data.
Right completes command names; Up/Down recalls matching accepted commands.
Command cancellation/execution preserves the separate chat draft and caret.
Sensitive command forms are omitted from history. Paste cannot execute a
command or approve a multi-message send; split consent defaults to No.

Settings exposes private plaintext files, GPG files, or explicitly chosen
inline plaintext credentials for SASL and server PASS. One nonempty source
per credential is required, with no fallback. Inline values preserve every
byte after '=' and are masked in the panel. Configs containing them require
owned regular files with mode 0600/0400; generated saves use 0600 atomically.
The helper runs after verified TLS, without a shell or terminal prompt,
with bounded output, an integrity requirement, cancellation and a 5-second
deadline. It needs an already available unlocked agent. Test mode never
opens credential files, runs GPG, or connects to the configured network.

FINAL BUILD AND ORDINARY REGRESSION

PASS: clean all-source build with
  -O2 -std=c11 -Wall -Wextra -Wpedantic -Wformat=2 -Wshadow -Wconversion -Werror
The independent clean executable is byte-identical to the tested binary.
All 23 build/install checks passed. A DESTDIR installation contained exactly
the 10 specified files with correct bytes and modes; uninstall removed them.
No system installation was performed. The man page formatted without groff
warnings. The embedded manual exactly matches doc/manual.txt (66,686 bytes).

PASS: all 10 C suites and 18 Python invocations of the check target.
Core coverage: protocol, editor, command catalog/history, configuration,
credentials, masked credential fields, application state/authentication,
server-session client model, DCC, and actual rendered mouse-hit snapshots.
PTY coverage includes welcome/job controls, Ctrl-D/EOF and a real shell,
offline simulation, byte limits, fixed-height editing, UTF-8 and ASCII,
settings, ordinary chat, multi-server routing, transfers, the fixed global
selector, the exact two-query/ChanServ case, command history and integration.
Network fixtures use loopback only, including verified TLS, SASL and DCC.

RESIZE FAILURE REPRODUCED AND FIXED

A pre-release long run stopped at 283 seconds after a test screen-model
reconstruction failed. That attempt remains failed; its exact rare timing
was not established by a short random retry. Subsequent deterministic
testing proved a real related event-loop defect: SIGWINCH handled just
before poll could leave the idle client at the old layout until a key.

A temporary test interposer changes the real controlling PTY geometry at
that exact seam and confirms the signal is handled before poll. The old
candidate emitted no redraw bytes for 3.2 seconds; the fixed candidate
redrew without keyboard or network input at approximately 0.98 seconds,
within the existing one-second idle wait. Draft and caret remained intact.
The permanent controls regression also bounds poll calls and client CPU.

The fix checks curses' internal queue nonblockingly after every wait, retains
the 512-event batch bound and network/transfer fairness, and does not add a
busy loop, signal-handler curses calls, or descriptors. The final suite
reruns use this fixed executable. The longevity/benchmark driver now uses
real temporary geometry changes to reconstruct its deliberately skipped VT
output, rather than treating an unchanged-size signal as a portable repaint
request. Original failed evidence and both deterministic probe results remain
in test-results; passing final results never replace an interrupted run.

A separate compact-screen Clear-click test failed once. Focused ordinary,
sanitizer, traced, and repeated real-resize runs subsequently passed. Tracing
proved that its test helper generated duplicate resize events by combining
TIOCSWINSZ with a redundant explicit SIGWINCH. Only that extra test signal
was removed; every click/draft/caret assertion and production stale-click
guard remains. The exact event sequence causing the first failed click was
not established. Its original failure and diagnostic traces remain available.

A later test-driver assertion checked the return from Manual before the PTY
had delivered the complete redraw. Controlled 128-byte reads reproduced the
partial frame; reading the remaining output, with no extra key or signal,
restored the correct chat frame and draft. The helper now waits for the
whole required state. The settled ordinary, sanitizer, and UI gates use
the corrected test source; no application change was required for this case.

INLINE CREDENTIAL BOUNDARIES

Final review found that inline credential parsing could strip two trailing
carriage returns before LF, or a bare carriage return at EOF, silently
changing the intended value. The parser now removes exactly one CR only
when paired with LF; any remaining control byte reaches normal validation
and is rejected. Accepted spaces, '#', ';', '=', and UTF-8 bytes are retained.

The new table-driven regression fails the old parser and passes this build:
16 cases across password/server_password plus 3 ordinary-field whitespace
compatibility cases. Rejection preserves the destination configuration.
The intermediate candidate's long run was deliberately stopped when this
separate issue was found. That partial run is not a completed longevity pass.
All final whole-client gates use the corrected executable identified above.

SANITIZERS AND REAL GPG

PASS: all 10 core suites and 11 full application suites under AddressSanitizer,
UndefinedBehaviorSanitizer, and LeakSanitizer. No diagnostic files and no
skipped gates. The new idle-resize regression also passed instrumented.
After the test-only Manual wait correction, all 11 application suites ran
again. The unchanged 10 core results were retained only after verifying
their exact binaries, C test sources, runtime dependencies, and original logs.
The sanitizer executable has its own recorded hash and is not the shipped
optimized executable; its memory/timing measurements are not benchmarks.

PASS: 9 real GnuPG 2.4.4 cases, each run with normal and sanitized credential
probes in a disposable private keyring/agent: locked-agent rejection,
cached private key, ASCII armor, tampering, output limit, multiline output,
unencrypted literal packet, legacy CAST5 without integrity, and cached
symmetric decryption. These cases were rerun after the final parser
correction, and their source/test hashes are checked before packaging.

Additional credential tests cover helper timeout/cancel, partial output,
missing/invalid status, nonzero exit, 64 cancellation cycles, 16-child bound,
missing executable, executable-text rejection without shell fallback,
inherited descriptor isolation, masked display, exact literal-space saves,
and clearing temporary credentials on replacement, cancellation and saving.

STRESS AND FAILURE PATHS

PASS: 12 complete UI stress groups, no skipped groups.
 3,600 seeded editor operations across UTF-8/ASCII and terminal variations
 240 modal terminal-geometry changes
 12 maximum-draft cycles, 163,840 accepted paste bytes
 192 switches across 8 sessions, including 64 stale-click batches
 48 wide-glyph caret checks and 8 live-overlay disconnect cases
 No unintended sends, lost drafts/carets, unreviewed peer connections,
 unreviewed destination creation, or terminal-restoration failures.

PASS: 11,920 allocation checks with 12,000 injected ENOMEM failures.
PASS: 200,000 protocol/DCC mutation cases and 80,000 unique offers.
PASS: 60-second DCC engine run: 3,292 cycles,
 109,629 completed lifecycles and 835,395,982
 verified payload bytes; descriptors returned from 3 to 3.
PASS: 339 transport lifetimes, 2 MiB verified under backpressure, abrupt
 closure cases, and the real 30-second TLS handshake deadline.
PASS: storage faults (short write, fsync, rename), 7 writers x 20 catalog saves,
 400 symlink swaps and 400 ancestor swaps; descriptors 4 to 4, no children.
PASS: full-client descriptor limits 5/8/16 retained 1/4/8 healthy server
 connections using 4/7/11 descriptors, with no leaked failed-attempt fds.

Standalone allocation/DCC/transport probes compile neither ui.c nor config.c.
Their exact source/header dependency hashes match the earlier passing runs;
that reuse is explicit. Storage was rerun after the config.c correction.
Full-client UI, sanitizer, ordinary regression and descriptor-pressure gates
were rerun after both fixes. Earlier test-only
migration failures (obsolete form labels and a missing storage-probe link
dependency) remain documented; they are not reported as successful runs.

COMPLETED LONGEVITY RUN

Requested duration: 1,200 seconds; completed duration: 1200.008 s.
Eight verified-TLS loopback servers, 20 channels per server, bounded channel,
query and mention traffic, terminal edits, real resizes and reconnects.
Delivered chat lines: 6,400,640.
Actual resizes: 226; reconnects: 18.
Observed settled descriptors: 11 to 11.
No remaining resolver children. Draft preserved; unexpected sends: 0.
Client exit status: 0; terminal settings restored; binary/runtime/harness
hashes unchanged for the entire completed run.
Sampled client RSS range: 91,380–92,532 KiB under this deliberately
large 8-server retained-history workload; late-half range: 60 KiB.
Maximum measured PING round trip: 385.306 ms, including the
fixture, scheduler and concurrent validation load. This is not idle memory
or a controlled comparative performance measurement.

OPTIMIZED SYNTHETIC BENCHMARK

Run after the long workload, on the shipped optimized executable.
100,000 messages over 20 channels, 4 phases, plain IPv4 loopback.
Phase throughput range: 136,739.69–178,400.93 messages/second.
Total measured stress time: 0.619012 s.
Maximum command-probe latency: 74.683 ms.
That probe includes test-driver navigation, fixture and scheduler delay;
it does not measure raw keyboard-to-pixel latency alone.
Three separate idle processes, simultaneous 3.000 s window:
 summed RSS: 14,908 KiB; CPU: 0.000000 s.
Shared resident pages are counted once per process in summed RSS.
Three connected servers in one process: RSS 6,752 KiB;
 CPU 0.000000 s over 3.000 s.
CPU values come from process accounting ticks; zero means below measurement
resolution during the short window, not proof of literally no CPU use.
All background PINGs were answered; final redraw and normal shutdown passed.

LIMITS AND WHAT THIS DOES NOT CLAIM

Only Linux x86-64 was executed here. BSD portability is a design target;
native OpenBSD/FreeBSD/other BSD runs remain outstanding. No public IRC
network or real account was used. The test duration is 20 minutes, not days
or months. There is no measured ircii/irssi comparison and no claim of an
independent security audit, invulnerability, or universal terminal support.

Runtime bounds include 8 server sessions, 32 views per server, bounded history
(up to 8 MiB text per server), a 16 KiB/8,192-scalar draft, and 64 command-history
entries/64 KiB text per server. DCC supports active IPv4 SEND with explicit
consent; it is unencrypted peer traffic even when IRC uses TLS. There are
8 pending offers, 4 active transfers and 12 retained records. DCC CHAT,
resume and passive/reverse transfers are not implemented. See the complete
manual and SECURITY.md for precise behavior and tradeoffs.

REPRODUCTION AND EVIDENCE

  ./configure
  make
  make check
  make check-gpg
  make sanitize
  make check-stress
  make soak SOAK_SECONDS=1200
  python3 tests/bench.py --idle-instances 3 --shared-servers 3

Tests need their stated toolchain and local loopback/PTY facilities. GPG
tests use a disposable keyring and agent; an absent tool reports a skip,
which does not satisfy the recorded real-GPG release gate.
Reports, commands, hashes, raw logs and preserved fixture inputs are under
test-results/. Machine-readable top-level evidence: RELEASE.json.
Absolute paths in historical reports identify this build workspace; the
corresponding source/tests and copied evidence are included in the archive.
The frozen soak inputs are also copied to
test-results/release-050-ready-soak-inputs/.
