Repository navigation
Tags
Tags
crew: a member's history, the cumulative limits, cabin crew and pay Part 117 was checked one duty at a time, so a pilot could fly every day of the month. Crew tracking needs the look-back limits of §117.23 (100 hours of flight time in any 672, 1,000 in 365 calendar days, 60 and 190 FDP hours in any 168 and 672) and the rest of §117.25(b) and (e), which only mean something against what the member has already flown. History is the seam: a tracking store answers block and duty time inside a window, the last duty, and the longest time free. Record is the exact form. Duty.Admits evaluates every limit where it is highest; for block time that can be a middle leg's arrival, because an old leg can leave the window between two arrivals, and a test pins that case. Cabin crew get 14 CFR 121.467(b), checked on the schedule because (b)(14) excuses an overrun beyond the carrier's control, and the minimum complement of §121.391(a). The text of all of it is the eCFR's of 15 October 2026. PayRules prices a duty the way North American agreements credit it: the greater of scheduled or actual block, a minimum per duty, a 1:3.5 trip rig and a 1:2 duty rig. APFA's public On-Duty Contract Guide states that rule in section 11.D, and a test uses its numbers. Premiums, per diem and deadhead credit are the agreement's numbers, the caller's. Every new test was watched to fail against a mutation of the rule it checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Index sold seats by pool: a flight's classes no longer cost a scan of… … the book SoldByClass walked every sold-class key the inventory held, matching a prefix, so a carrier with a filled book paid a scan of the whole for each flight it was asked about. wholesky's ops page asks for every flight of a carrier at once: a four-hundred-flight carrier on a filled world took minutes to answer, and the agent running it waited on the same call. The classes are indexed by pool now, kept in step with every sale, seed, release and reset; SoldByClass reads the pool's map. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
Harden every listener a stranger can reach: tokens required, idle rea…
…ped, bodies bounded
A security pass over wholesky's public deployment, which runs hundreds of
jetway nodes with two switch ports and a console proxy on the internet,
found the gaps a private deployment never meets. None of these change a
private deployment's behaviour unless it turns them on.
The by-hello TCP ingress took any peer that had no token at its word and
displaced the live session under that name: a stranger could hello as a
carrier and read its traffic. require_token refuses tokenless hellos; the
compare is constant time; idle_timeout reaps quiet links; max_connections
closes the door on newcomers instead of the process; sessions close when
the listener's context ends. transport.Server gets the same idle and
connection bounds. Sentinel framing checked its bound only after
buffering the whole stream; it checks while reading now.
The console gains http.admin_token: with it set, anything that changes
the system or reads its records needs a bearer; status, flights,
availability and health stay open. The server has read, idle and header
bounds, honours http.tls (parsed, never used), and warns when it serves
cleartext beyond loopback. A caller's ?limit no longer sizes an
allocation, departure-control bodies are bounded, and /api/stream holds
at most 256 subscribers.
Fuzzing every parser found two panics: ndc.soapBody indexed the original
bytes with offsets from strings.ToLower, whose output can be a different
length on invalid UTF-8; pnl.ParseName("") indexed an empty slice. The
harnesses stay, with the crashers as seeds.
store.Pruner lets a host retire records by its own policy: the memory
store had a size cap and a purge by update time, and a simulator running
250 carriers per machine needs to drop flown journeys as they fly.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
The desk runs the ground story
A node flying one of a world's carriers needed the carrier's side of the
day driven by hand. The desk now builds the departure's name list from
the node's own book, opens the flight at its station with it and copies
it to the configured addresses; and Run is the whole ground story at
once -- the list, every passenger accepted with a bag, the counter
closed, the cabin boarded, the door closed with the load, the closure's
messages (PFS, PTM, PSM, ETL, LDM, CPM) sent. Both are on the console
under /api/ops/flight/{flight}/{date}/{board}, so a timetable outside the
node -- a person, an agent, the world the carrier flies in -- keeps the
hours. Tested from two records in a store to a closed flight with a
loadsheet.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
gofmt node.go The links lock landed unformatted; CI's gofmt check caught it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
Guard the links map: a late link raced LivePeers A link added while running (ReloadPeers, v0.1.90) writes the node's map of dialled links while LivePeers, on another goroutine, ranges over it; the race detector found it in a world joining another. Reads snapshot the map under a lock; the write takes the same lock. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
Dial a link added while running, and honour its token ReloadPeers adds partners without a restart, but a link_dial peer added that way was built and never dialled: the links are started with the listeners in Start, and a late one waited for a restart that never came. The node keeps the context Start was given and dials a late link under it, when it holds the system; a reloaded peer's token is set on the listeners too. Tested with two switches that come up unaware of each other, are trunked at runtime with a token, and carry a message across. Two worlds joining over the internet is this, twice. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
The operations desk on the console: GET /api/ops A node that runs a carrier can now be asked what its desk knows: the schedule as loaded from the SSIM file, the slots the Network Manager has given its flights, how many movements it has filed and where they go. A plain gateway answers 404, the way the departures endpoints do without departure control. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
The operations desk: a node that runs a carrier, not only a gateway A bare jetwayd dialling a world as one of its carriers took the sells and flew nothing anyone could see: no departure control answered the airport's name lists, no MVT followed the aircraft's OOOI report. pkg/ops is the carrier's operations desk. It loads the schedule from the SSIM chapter 7 file, runs a dcs.Station as the gateway's Ground so the carrier's own PNL opens the flight with the schedule's aircraft, turns the datalink provider's departure and arrival reports into the MVTs (the AD with its ETA, the AA, delay code 93 against schedule) sent to the configured addresses over the configured link, and files the towers' and the Network Manager's messages against the callsign. The ops: block in the configuration wires it; the console's departure control pages show its station. The changelog catches up from v0.1.66 to here. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
Set a peer's link token at runtime A world handing one of its carriers to someone's own node needs the switch to start demanding a token for that peer now, not at the next boot, and to drop the link the world's own tenant holds so the new node takes the peer's place cleanly. Node.SetPeerToken does both on every hello-identified listener; "" clears it. Tested: a carrier admitted on its word is dropped when the token is set and comes back only with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EcjUj4wG4nicvJX2MhGn5x
PreviousNext