[Nic-dorman]

Linear issue

Closes V2-1735

Part of V2-1733, which tracks the same move across every affected WithAutonomi lockfile.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

This tier is proposed rather than asserted, and matches the earlier lockfile advisory moves (V2-1659). The change is lockfile only: tokio moves from 1.52.3 to 1.53.3, and only its version and checksum change. RUSTSEC-2026-0386 is informational ("unsound"). The safe AsyncFd constructors violate I/O safety, so closing a duplicated fd can lead to a use-after-free. It is Unix-only. The patched versions are 1.51.6 and 1.53.3 or later. No Autonomi protocol message changes.

Compatibility

• Wire: none.
• Storage: none.
• API: none. No manifest or source file is touched.

Semver impact

• breaking
• feature
• fix

Test evidence

cargo update --precise on cargo 1.97 also rewrote unrelated windows-sys edges, so the tokio version and checksum were edited by hand. The checksum is the one cargo itself resolved.

• cargo metadata --locked: pass

• cargo check --locked --all-targets: pass

• cargo audit: RUSTSEC-2026-0386 is present before the change and gone after. No new advisories.

• Prod compat smoke (2026-10-23) at the rebased head a9d90999. Run on Linux (dev2, stable 1.99.1) as a --locked release build of ant-cli. cargo tree -i tokio shows tokio v1.53.3, and the build log compiles only 1.53.3. Every step uses isolated XDG_DATA_HOME/XDG_CONFIG_HOME.

  • Daemon lifecycle, which covers tokio net and process spawn: node daemon start, then status over HTTP (running, same PID), then stop. All exit 0.
  • Mainnet downloads of two public canary files: 3cba93c8… (5,277,908 B, 4 chunks) in 17.0 s and ed120ab3… (16,666,151 B, 8 chunks) in 23.5 s. Both byte counts match.
  • Arbitrum One RPC: ant wallet balance for a freshly generated key returns 0.
  • Mainnet upload with that empty wallet: a 3 MiB file (3 chunks) collects real quotes on both payment paths. Each fails at payment, before any transaction, as expected: payment error: Insufficient tokens to pay for quotes. Have: 0 atto, need: … atto. That is the same wording as main.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert the single Cargo.lock commit. tokio goes back to 1.52.3.

🤖 Generated with Claude Code