Last updated: 2026-06-07

Clean-CTX is designed for air-gapped environments with restrictive firewall and DLP (Data Loss Prevention) requirements. The binary has zero network dependencies and zero runtime dependencies, making it suitable for deployment in classified, regulated, or sandboxed environments.

The binary is a single statically-linked executable. To verify integrity:

# SHA-256 checksum after build
sha256sum target/release/clean-ctx.exe

The Rust toolchain is pinned in rust-toolchain.toml (or via rustup default 1.85). Given the same toolchain and dependencies:

cargo build --release --locked

The --locked flag prevents dependency resolution drift by using the exact versions in Cargo.lock.

# Copy the single binary to the target machine
scp target/release/clean-ctx user@target:~/bin/

# Verify it starts
echo '{}' | ~/bin/clean-ctx
# Output: (no response — ctrl-c to exit)

FROM rust:1.85-slim AS builder
WORKDIR /build
COPY . .
RUN cargo build --release

FROM scratch
COPY --from=builder /build/target/release/clean-ctx /clean-ctx
ENTRYPOINT ["/clean-ctx"]

The binary works on --read-only filesystems because BPE data is embedded at compile time (F-22).

services:
  clean-ctx:
    build: .
    image: clean-ctx:latest
    read_only: true
    stdin_open: true
    tty: true

1. Run with minimal OS privileges — the binary needs only:

   • Read access to the source code directory
   • Write access to stdout (already granted by the parent process)
   • No file system writes for its own operation

2. Pin the binary version — use cargo build --release --locked with the committed Cargo.lock to ensure deterministic builds

3. Run cargo audit regularly — as part of CI, or manually:

   cargo install cargo-audit --locked
   cargo audit

4. Run cargo deny check regularly — to enforce license policies and ban unsafe dependencies:

   cargo install cargo-deny --locked
   cargo deny check

5. Verify no new dependencies — compare Cargo.lock against the last approved baseline before each release

1. Download all crate dependencies to an air-gapped mirror or vendored directory:

   mkdir -p vendor
   cargo vendor --locked vendor/

2. Build with offline mode:

   cargo build --release --locked --offline

3. The resulting binary is fully self-contained and requires no network access.

This project has no external vulnerability reporting process yet. For security issues:

1. Open an issue on the GitHub repository with:

   • Component and version affected
   • Type of vulnerability
   • Steps to reproduce
   • Proof-of-concept (if available)

2. For critical vulnerabilities, contact the maintainers directly through GitHub.

Generated via cargo install cargo-bom or cargo sbom:

# Generate SPDX SBOM
cargo install cargo-bom
cargo bom --output-path docs/sbom.spdx.json

All dependencies are MIT or Apache-2.0 licensed. Zero GPL or AGPL dependencies.

The tree-sitter-html crate (added in Phase 2) is the only dependency introduced by the Meta-Layer. It is:

• Parse-only — receives HTML content and returns a syntax tree; no file I/O, no network calls
• Memory-safe — written in safe Rust with the same tree-sitter runtime used by the TypeScript and C# grammars
• Pinned version — =0.20.0 in Cargo.toml prevents automatic upgrades that could introduce behavioral changes
• Audit-friendly — cargo audit covers it alongside all other dependencies

CC0-1.0 Universal — Dedicated to the public domain.