fix: close rust and fuse scope-exit read-revocation bypasses

.github/workflows/desktop-e2e.yml

@@ -281,6 +281,7 @@ jobs:
           REDIS_HOST=localhost
           REDIS_PORT=6379
           TEST_LOGIN_SECRET=e2e-test-secret-ci-only
+          ACCESS_TOKEN_TTL=2h
           ENVEOF
           echo "IDENTITY_JWT_PRIVATE_KEY=${{ secrets.IDENTITY_JWT_PRIVATE_KEY }}" >> apps/api/.env
 
@@ -343,6 +344,9 @@ jobs:
           REDIS_HOST: localhost
           REDIS_PORT: 6379
           TEST_LOGIN_SECRET: e2e-test-secret-ci-only
+          # Long TTL: the headless desktop binary holds one token for the whole
+          # suite and cannot silently refresh; 15m expires mid-run on macOS.
+          ACCESS_TOKEN_TTL: 2h
           IDENTITY_JWT_PRIVATE_KEY: ${{ secrets.IDENTITY_JWT_PRIVATE_KEY }}
 
       - name: Start API server (Windows)

.planning/ROADMAP.md

@@ -73,7 +73,7 @@
 - [x] **Phase 71: Share-Invite Security and IPNS Data-Integrity (API)** — Validate sharer root ownership via `ipns_records` creator marker, apply-or-reject later invite grants, `claim_count` CHECK folded into the greenfield cutover, first-publish INSERT-race 409, same-seq CID equivocation hard-guard, direct bulk-revoke DELETE, `ShareInviteService` lifecycle unit coverage, plus a full share-plane rename purging "descriptor" (D-10). Root-uniqueness index dropped (D-03; already covered by vault uniqueness). (completed 2026-07-09)
 - [x] **Phase 72: SDK Write-Plane Durability and Correctness** — Delete drops the removed child's `WriteChildRef`, fail-closed `getWriteBodyParams` on transient resolve miss, restore-to-different-parent re-homing, `SealedChildRef` size/modifiedAt mirror refresh, legacy `moveInSharedFolder` branch removal, write-plane helper dedup, and two write-chain test-fidelity fixes (8 todos) (completed 2026-07-10)
 - [x] **Phase 73: Shared Write/Navigation Correctness (Web)** — Preserve nested write capability across navigate-up/breadcrumb restore, invalidate stale nav-stack child snapshots, gate the non-listing read facades with the ROT-07 floor, give WRITE-03 refresh-access a live production trigger, and route drag-payload kind through the resolved listing, plus fold in the tangential nav-hook dedup and dead getShareKeys/folder-IPNS path cleanup in the same subsystem (7 todos) (completed 2026-07-10)
-- [ ] **Phase 74: Rust and FUSE Rotation-Revocation Soundness** — Deep scope-exit key refresh across all intermediate inodes, desktop grant re-mint seam, WinFsp dest-gating parity (3 todos; closes remaining Rust-side revocation bypasses)
+- [x] **Phase 74: Rust and FUSE Rotation-Revocation Soundness** — Deep scope-exit key refresh across all intermediate inodes, desktop grant re-mint seam, WinFsp dest-gating parity (3 todos; closes remaining Rust-side revocation bypasses) (completed 2026-07-11)
 - [ ] **Phase 75: Cross-Language IPNS and Node-Codec Verification Parity** — Strict RFC3339 + ValidityType==0 enforcement, KAT IV-encoding pin, UUID AAD acceptance parity, all Rust↔TS vector-locked (4 todos)
 - [ ] **Phase 76: FUSE Durability and TEE Write-Path Hardening** — Vault-init publish preflight, deferred Phase 69 publish/concurrency items, TEE republish/renew error handling + later-EOL invariant (4 todos)
 - [ ] **Phase 77: Crypto Hygiene and Terminology Canonicalization** — Error-path zeroization, base64 helper dedup, `encryptedIpnsPrivateKey` field renames, dead share-scaffolding retirement, root-ownership helper extract (12 todos; mechanical, no behavior change)
@@ -912,11 +912,30 @@ Plans:
 2. Desktop `query_grants_rooted_at` returns live grants and retained recipients keep access post-rotation (desktop-e2e distinguishes retained vs revoked)
 3. WinFsp overwrite-rename cannot bypass the scope-exit gate; behavior matches the fuser path (Windows CI green)
 
-**Plans:** 13/13 plans complete
-
 Plans:
 
-- [ ] TBD (run /gsd-plan-phase 74 to break down)
+- [x] 74-01-PLAN.md
+
+7/7 plans complete
+
+6/7 plans executed
+
+5/7 plans executed
+
+4/7 plans executed
+
+3/7 plans executed
+
+2/7 plans executed
+
+- [x] 74-02-PLAN.md
+- [x] 74-03-PLAN.md
+- [x] 74-04-PLAN.md
+- [x] 74-05-PLAN.md
+- [x] 74-06-PLAN.md
+- [x] 74-07-PLAN.md
+
+1/7 plans executed
 
 ### Phase 75: Cross-Language IPNS and Node-Codec Verification Parity
 

.planning/STATE.md

@@ -2,19 +2,19 @@
 gsd_state_version: 1.0
 milestone: v2.0
 milestone_name: Metadata and Sharing Refactor
-current_phase: 71
-current_phase_name: API
-status: executing
-stopped_at: Completed 72-10-PLAN.md
-last_updated: "2026-07-10T23:56:41.923Z"
-last_activity: 2026-07-10
-last_activity_desc: Phase 70.1 complete, transitioned to Phase 71
+current_phase: 74
+current_phase_name: Rust and FUSE Rotation-Revocation Soundness
+status: verifying
+stopped_at: Phase 74 verified human_needed (2 CI-gated legs pending)
+last_updated: "2026-07-11T11:28:37.406Z"
+last_activity: 2026-07-11
+last_activity_desc: Phase 74 learnings extracted (74-LEARNINGS.md)
 progress:
   total_phases: 22
-  completed_phases: 15
-  total_plans: 189
-  completed_plans: 188
-  percent: 68
+  completed_phases: 17
+  total_plans: 195
+  completed_plans: 195
+  percent: 77
 ---
 
 # Project State
@@ -24,14 +24,21 @@ progress:
 See: .planning/PROJECT.md (updated 2026-06-27)
 
 **Core value:** Zero-knowledge privacy -- files encrypted client-side, server never sees plaintext
-**Current focus:** Phase 73 — shared-write-navigation-correctness-web
+**Current focus:** Phase 74 — Rust and FUSE Rotation-Revocation Soundness
 
 ## Current Position
 
-Phase: 71 — Share-Invite Security and IPNS Data-Integrity (API)
-Plan: Not started
-Status: Executing Phase 73
-Last activity: 2026-07-10 — Phase 70.1 complete, transitioned to Phase 71
+Phase: 74 (Rust and FUSE Rotation-Revocation Soundness) — VERIFIED human_needed (NOT marked complete)
+Plan: 7 of 7 executed + committed
+Status: All 7 plans done; verification = human_needed. 21/21 must-haves code-verified; all local test suites pass (SC1 27/27+370/370+17/17, SC2 15/15+10/10 / fuse 117/117). SC3 code source-verified (D-15d parity). Two CI-gated legs pending (see Blockers).
+Last activity: 2026-07-11 — Phase 74 learnings extracted (74-LEARNINGS.md)
+
+## Phase 74 Blockers (CI-gated verification, not code gaps)
+
+Recorded per GSD human_needed handling. Both are infra limitations that cannot run on this macOS host — routed to `74-UAT.md`, not treated as gaps. Phase 74 stays open pending these; run `/gsd-verify-work 74` after CI confirms.
+
+1. Windows CI (`Cargo Check & Test (Windows)`) must compile 74-06's `#[cfg(windows)]` WinFsp rename dest-gate and pass its two new tests — cannot build winfsp on macOS.
+2. Desktop-e2e 3-platform matrix (`desktop-e2e` workflow) must run 74-07's live-mount Part C (SC1+SC2 deep decryptability / retained-vs-revoked) and Part D (SC3 WinFsp overwrite-rename) — needs a built desktop binary + real FUSE/WinFsp mount. Also confirms Part A's pre-existing Bob assertion still holds (static analysis: likely a false alarm).
 
 Progress: `██████████` 79 / 79 plans (100%)
 
@@ -266,6 +273,13 @@ Items acknowledged and deferred at v1.1 milestone close on 2026-06-27. None are
 | Phase 72 P08 | 15min | 2 tasks | 1 files |
 | Phase 72 P09 | 8min | 1 tasks | 5 files |
 | Phase 72 P10 | 10min | 2 tasks | 3 files |
+| Phase 74 P01 | 20min | 2 tasks | 1 files |
+| Phase 74 P04 | 15min | 2 tasks | 2 files |
+| Phase 74 P06 | 45min | 2 tasks | 3 files |
+| Phase 74 P74-03 | 20min | 2 tasks | 2 files |
+| Phase 74 P05 | 25min | 2 tasks | 2 files |
+| Phase 74 P02 | 12min | 2 tasks | 4 files |
+| Phase 74 P07 | 40min | 2 tasks | 5 files |
 
 ## Accumulated Context
 
@@ -586,15 +600,29 @@ Last session: 2026-06-28T18:09:45.156Z
 - [Phase ?]: 72-09: vault/index.ts's two root-key wraps (wrapKey(rootReadKey/rootWriteKey, userPublicKey)) left untouched — only the TEE ipns-key wrap was extracted
 - [Phase ?]: runFileVersionOp is not wrapped in withOperation itself -- each public method keeps its own withOperation(name) call for correct per-op telemetry attribution
 - [Phase ?]: write-body-params.ts standardizes the IPNS-resolve path on inline resolveIpnsRecord+fetchFromIpfs+JSON.parse (bin's pre-existing style) rather than client.ts's resolvePublishedNode wrapper, since the extra signatureVerified field was never consumed by getWriteBodyParams
+- [Phase ?]: 74-01: RotateReadResult.rotated_nodes (HashMap<String, RotatedNodeKey> keyed by ipns_name) surfaces every rotated node's post-rotation read key, populated at root/BFS-child/repair_dirty_node hooks; CommittedRotation stays host-agnostic
+- [Phase ?]: [Phase 74-04] No mock-HTTP crate exists in api-client dev-deps; added a minimal raw TcpListener capturing mock server in shares.rs test mod (mirrors fuse/delete.rs's spawn_mock_rotation_server) instead of pulling in wiremock/mockito
+- [Phase ?]: [Phase 74-04] update_grant accepts root_generation as u64 and formats to decimal string at the wire boundary, matching UpdateGrantDto's numeric-string contract
+- [Phase ?]: [Phase 74-06]: WinFsp handle_rename reordered to fuser D-15d pipeline (validate -> source-gate -> dest-gate -> mutate); new dest scope-exit gate closes T-74-09 overwrite-rename revocation bypass
+- [Phase ?]: [Phase 74-06]: crate::test_support cfg widened to any(feature=fuse, feature=winfsp) so WinFsp #[cfg(test)] can reuse make_test_fs_with_keypair; fuser-specific CaptureSender/reply_error_code stay fuse-gated
+- [Phase ?]: [Phase 74-06]: Did not add self-replace/kind-mismatch validation to WinFsp handle_rename (RESEARCH.md Todo 3 point 4 scoped it out-of-scope for SC3)
+- [Phase ?]: RotatedNodeKey exported from cipherbox_sdk::rotation (mod.rs re-export) — was engine.rs-internal, needed by grant_scope.rs's test (74-03)
+- [Phase ?]: grant_scope.rs refresh function extended to InodeKind::Root | Folder | File (was Root | Folder only) — files rotate too via mint_file_key_on_rotate/CRIT-1 (74-03)
+- [Phase 74]: RotationTransport::update_grant generation param typed u32 (matches RotationDeps::update_grant exactly); ApiClientTransport converts u32->u64 only at the cipherbox_api_client::shares::update_grant call boundary
+- [Phase 74]: delete_grant implemented for engine-contract completeness though is_revoked is structurally always false from collect_sent_shares (revoked shares hard-deleted server-side); no test asserts that branch firing through this path (T-74-14 accepted, not mitigated)
+- [Phase 74]: 74-02: RotatedNodeKey.sequenceNumber typed bigint (not the plan table's literal number) to match this file's existing IPNS sequence-number convention
+- [Phase 74]: 74-02: repairDirtyNode crash-resume path does not populate rotatedNodes (out of scope per plan's task action/acceptance_criteria) — Rust 74-01 folded it in; documented TS/Rust asymmetry for a future follow-up
+- [Phase ?]: [Phase 74-07] Combined the plan's deep leg and second-recipient leg into one Part C scenario (Eve revoked, Carol retained on the same grant root) -- the only construction matching 74-05's real re-mint semantics; revoked recipients in Parts C/D are explicitly DELETE'd pre-mutation since an active-but-untouched grantee is now correctly re-minted, not cut off
+- [Phase ?]: [Phase 74-07] Flagged (not fixed) that Part A's existing Bob assertion in shared-scope-exit-rotation.mts may no longer hold post-74-05 (an active never-revoked grantee is now re-minted rather than cut off) -- left untouched per the plan's explicit instruction; needs a live CI run to confirm
 
 ## Operator Next Steps
 
 - Run `/gsd-plan-phase 61` to begin Phase 61: AAD-Bound Seal Primitive and Cross-Language KAT
 
 ## Session
 
-**Last session:** 2026-07-10T15:32:28.115Z
-**Stopped at:** Completed 72-10-PLAN.md
+**Last session:** 2026-07-11T04:58:48.845Z
+**Stopped at:** Completed 74-02-PLAN.md
 **Resume file:** 
 
 None