audit: fork landscape, novel libraries, and upstream PR opportunities

[Jesssullivan]

Fork Landscape

cmux is built from 7 repositories. This issue tracks the full fork topology, novel libraries, and opportunities for upstreamable contributions.

Repository Map

Component	Repository	Type	Divergence
cmux	Jesssullivan/cmux	Fork of manaflow-ai/cmux	2,714 commits ahead
ghostty	Jesssullivan/ghostty	Fork of ghostty-org/ghostty	222 commits ahead
bonsplit	Jesssullivan/bonsplit	Fork of manaflow-ai/bonsplit	1 commit ahead
zig-ctap2	Jesssullivan/zig-ctap2	Novel library	50 commits
zig-crypto	Jesssullivan/zig-crypto	Novel library	4 commits
zig-keychain	Jesssullivan/zig-keychain	Novel library	15 commits
homebrew-cmux	manaflow-ai/homebrew-cmux	Tracking	2 commits behind

Novel Libraries (Tier 1 — Ready to Publish)

These are standalone, dual-licensed (Zlib/MIT) Zig libraries with no cmux-specific dependencies:

• zig-ctap2 — FIDO2/CTAP2 USB HID in pure Zig. Direct YubiKey/SoloKeys communication. macOS (IOKit) + Linux (hidraw). 16 C FFI functions, property-based tests, PIN protocol v2.
• zig-keychain — Cross-platform secrets storage. macOS Security.framework + Linux libsecret/D-Bus. 4 C FFI functions with upsert semantics.
• zig-crypto — Minimal crypto primitives. SHA-256, HMAC, AES-256-CBC, PBKDF2, CSPRNG, ECDH P-256, Ed25519. 19 exported C functions.

Ghostty Fork PRs (Tier 2 — Rebase onto Upstream)

Changes in Jesssullivan/ghostty that are generally useful:

Change	Commits	Effort	Value
OSC 99 kitty notification parser	2033ffebc, a75615992	Low	Medium — generic terminal sequence
macOS display link restart fix	05cf31b38	Very Low	Medium — fixes rare vsync hang
macOS resize stale-frame mitigation	a3588ac53, 9ba54a68c	Medium	Medium — UX improvement
Linux embedded platform variant	e109d653c	Low	Medium — follows visionOS pattern

Fork-only changes documented in docs/ghostty-fork.md.

CI/Template Patterns (Tier 3 — Share as Reference)

• Upstream sync workflow (.github/workflows/upstream-sync.yml) — Conflict classification with risk assessment. Reusable by any fork.
• QEMU distro testing (nix/tests-distro.nix + test-distro.yml) — Package install verification via nix-vm-test VMs. Novel for terminal CI.
• libghostty.nix — Standalone Nix derivation for building libghostty without full app. Useful once libghostty stabilizes in nixpkgs.

Action Items

• Publish zig-ctap2, zig-keychain, zig-crypto as standalone repos (already are — add proper README badges, CI status)
• Open ghostty-org/ghostty PR: OSC 99 kitty notification parser
• Open ghostty-org/ghostty PR: macOS display link restart fix
• Open ghostty-org/ghostty PR: macOS resize stale-frame mitigation
• Contribute Rocky 10 support to numtide/nix-vm-test (see ci(distro): Rocky 10 — track upstream nix-vm-test support #187)
• Publish upstream-sync.yml as reusable workflow template