Most of this week's work went to two places. The existing networking and crypto layers went deeper: pktkit-rs's virtual TCP picked up most of the algorithms modern Linux runs, and purecrypto spent the week testing itself against other TLS implementations. Four new repositories also appeared: Lode, a systems language compiled by latticefoundry; cadlab, headless electronics CAD; polyclip, the exact polygon geometry cadlab needs; and dnsbox, a DNS message library. The hardware compiler reticle, two weeks old, made an FPGA appear to an operating system as a USB serial port.

pktkit-rs: a virtual TCP that keeps up with Linux

pktkit-rs is the zero-copy L2/L3/L4 toolkit for virtual network topologies (switches, NAT, a userspace TCP/IP, WireGuard, OpenVPN). It had 180 commits this week, and four releases went out, v0.1.8 to v0.1.11. Most of the work was on vtcp, its TCP engine, which now has much of what a current Linux stack does:

• Congestion control — CUBIC (RFC 9438) with HyStart++ (RFC 9406) as the new default, and BBR (draft-ietf-ccwg-bbr) on delivery-rate estimation, with paced sending on by default.
• Loss recovery — RACK-TLP (RFC 8985), Proportional Rate Reduction (RFC 6937), D-SACK (RFC 2883), and undoing spurious loss responses (RFC 3708, 3522, 5682, 4015).
• ECN — classic (RFC 3168) and Accurate ECN (RFC 9768), carried through NAT and fragment reassembly; the impairment layer can now mark packets CE to exercise it.
• Path and connection setup — PLPMTUD with black-hole detection (RFC 4821), TCP Fast Open (RFC 7413), timestamps by default, Linux-style delayed and quick ACKs, and send/receive buffers that auto-tune the way Linux's do.
• Observability — TcpInfo, a snapshot of a connection's internals, including what the handshake agreed on.

None of this was taken on trust: an interop suite now runs vtcp against a real Linux TCP inside QEMU, under KVM in CI. It turned up details such as AccECN misreading Linux's thinned ACKs as all-CE, which were then fixed. The rest of the week was a hardening pass over the other modules. NAT drops forged sources (RFC 2827/3704) and caps what one inside namespace can hold. The L2 hub got port security and stopped double-tagged frames from hopping VLANs. OpenVPN wipes key-exchange secrets after use, and WireGuard bounds session state per peer. Several modules' internals were also made private ahead of a stable API.

purecrypto: an interop matrix against eight TLS stacks

purecrypto, the pure-Rust crypto and TLS/DTLS/QUIC floor of the stack, released v0.9.5 to v0.9.9 (225 commits, the most of any repository this week). The week had two halves.

The first was interoperability. A TLS 1.3 test matrix framework now has adapters for OpenSSL, BoringSSL, wolfSSL, Mbed TLS, GnuTLS and LibreSSL. CI jobs run it against Apple's Network.framework on macOS and against Windows SChannel. QUIC v1 is tested against quic-go and OpenSSL in both roles, and Encrypted Client Hello against BoringSSL. Features landed along the way: DTLS 1.3 client certificates, session resumption and 0-RTT, DTLS connection IDs (RFC 9146), QUIC version negotiation and QUIC v2 (RFC 9368/9369), external PSKs, compressed client certificates (RFC 8879, brotli and zstd), and the secp521r1 and RFC 10024 NIST-curve ML-KEM hybrid groups.

The second was performance, more than eighty perf: commits across the library. Safegcd constant-time scalar inversion went into P-256 and secp256k1, AES got a bitsliced Boyar–Peralta S-box, hardware POLYVAL now backs GCM-SIV, Ed448 has fixed-window scalar multiplication, and QUIC packets are keyed once per key rather than once per packet. Each landing was then rechecked under the Valgrind constant-time harness, which found three issues that were fixed the same day.

Lode: a new language, compiled by latticefoundry

Lode (new on Tuesday, 109 commits) is "a systems programming language taking the best of Rust, Zig and Go, each pushed to its limit." The design goals in the README are memory safety and data-race freedom at compile time without lifetime annotations, no undefined behaviour in safe code, no runtime, compile-time evaluation for generics and formatting, and opt-in green threads and channels. The compiler backend is latticefoundry, taken from crates.io releases only.

It already compiles a growing subset to static x86-64 Linux executables, and the week's log reads like a language being filled in: arrays and slices with indexing proven in bounds (no run-time check), structs with value semantics, enums with exhaustive match, errors with throws/try/defer/errdefer, methods with inout/sink parameter conventions, a never type, generics, user traits and impl blocks, comptime evaluation, and format strings checked when compiling. The standard library is written in Lode, down to the syscall in std/os. Hello world went from 1,049 bytes to 841, then 655, then 577. The README says it makes exactly two system calls, write and exit.

latticefoundry itself (162 commits) gained RISC-V RV64GC, AVR5 and wasm32 backends, the Win64 calling convention, a constant-time verifier for secret values, and disassemblers for Thumb-2 and WebAssembly. It also switched to the stack's own assembler and linker, rsasm and qld. Its C driver lf-cc reached the milestone of building Lua, SQLite, gzip and bzip2 against real glibc headers, and the docs describe a build of GNU coreutils.

cadlab and polyclip: electronics CAD without a GUI

cadlab (new on Saturday, 100 commits) is "headless electronics CAD, written in Rust, designed to be driven by programs and AI agents." It covers the path from parts and BOM to netlist, board layout, autorouting, DRC and fab outputs. The README says the aim is to cover what KiCad and freerouting do today, minus the interactive UI. The same typed command registry sits behind a Rust library, a CLI and an MCP server, so an agent has the same commands and validation as the shell. Its rules: the netlist is the source of truth, coordinates are integer nanometres, and output is byte-for-byte deterministic, router included.

The log runs from M0 to M9 in two days. It has parts research through DigiKey, Mouser and Nexar providers; ERC and schematic auto-layout; a board model with zones, DRC and Gerber X2/X3, drill, pick-and-place and IPC-D-356A output; fab profiles from JLCPCB and PCBWay to OSH Park and Aisler; a grid autorouter with negotiated congestion, then push-and-shove, gridless search, differential pairs and length-tuning meanders; and KiCad, Specctra DSN/SES, IPC-2581C, STEP and IDF import or export. KiCad is used only as a verification oracle, never as a code source. 3D model import goes through oxideav-mesh3d, alongside the new oxideav-step STEP reader.

polyclip (new the same day, 93 commits, v0.0.1 → v0.0.5) is the geometry under it. It does exact integer 2D polygon booleans, offsetting, arc approximation, distance queries, fracture and triangulation. It uses i64 coordinates with exact i128 predicates, snap rounding with valid output guaranteed, and canonical results that are bit-identical across platforms. It was built for cadlab's zone fills and DRC, and the week added an incremental ZoneFill refill, arc-preserving booleans, Prepared geometries for repeated DRC queries, and parallel noding and sweeps. Two rounds of adversarial review also found bugs, which were fixed.

reticle: an FPGA that enumerates as a serial port

reticle, the from-scratch VHDL/Verilog toolchain, continued at 117 commits with a concrete target. A CDC ACM USB serial port IP, which "the operating system's own driver binds," was placed and routed by reticle's own ECP5 flow onto a Cynthion board. It now carries 64-byte packets and sends SERIAL_STATE. A 6502 monitor example then uses it as its console. Underneath, the ECP5 model gained distributed-RAM slices and more of the die's edges, a USB full-speed host behind a ULPI transceiver arrived, and synthesis can now prove a mapped netlist equivalent to what it was mapped from. Many of the commits correct the documentation's own claims against measurements.

dnsbox: DNS messages, zero-copy

dnsbox (new on Sunday, 77 commits) is zero-copy DNS message parsing and building, no_std and #![forbid(unsafe_code)]. It covers EDNS(0), DNSSEC validation with denial-of-existence proofs and the chain of trust, ZONEMD, SVCB/HTTPS, TSIG, SIG(0), UPDATE, zone transfers and zone files, plus the long tail of record types. The week also included an API review, a security audit with fuzz targets for the trust decisions, an interop corpus from BIND, ldns, dnspython and live captures, and CI jobs against Knot DNS 3.5 and Unbound 1.19.

Also this week

• catcard — threshold signing on the Coldcard firmware, through tsslib-rs (which released v0.2.11–v0.2.14 with a compact binary encoding and one fewer signing round). The firmware also gained loadable apps: Flappy Cat, Block Mine and Block Cutter.
• nixvm — the syscall-level Linux sandbox's x86 interpreter reached x86-64-v3 (AVX, AVX2, FMA, BMI, XSAVE), with Linux-accurate signal frames and a working controlling terminal.
• rsemu — a new machine, alphard-navi: the Toyota Alphard navigation computer on an R-Car H1, running its four Cortex-A9s and booting the SD card through to the osloader splash screen.
• kataan — the JavaScript engine is down to one engine. The tree-walker's AST executor was deleted, and a VM refusal is now an error rather than a fallback.
• qld (v0.1.1, now "alpha"), rsasm and rustygo, the Go-to-Rust compiler, which now runs the Go standard library's own tests and calls functions through reflection.
• fullrust retired its cargo-fullrust/purestd path and now covers tokio "full" (process, signal, Unix sockets).
• oxideav-render-vulkan — a new wgpu-based GPU renderer for oxideav, with a compute path tracer checked against the CPU renderer.
• odock — an open-hardware USB-C deck (10 Gbps first, USB4 later, RP2350 on board), with placement and routing written as scripts.

Next week

Lode moves on to its next milestones on top of latticefoundry. cadlab and polyclip keep trading requirements: the zone-fill corpus is already a benchmark. dnsbox is heading toward 1.0, and reticle toward more of the ECP5 and USB. pktkit-rs and purecrypto continue the hardening and interop work they started this week.