Prototype & Research Gift

Safe Time Bridge

A tested Year 2038 time-authority prototype in Safe Rust — with two research gifts, honest limits, and source you can check.

The problem

Many systems store time as a signed 32-bit number that overflows on January 19, 2038. Rewriting that code is often impossible: the systems are old, embedded, or proprietary. The question this work asks is whether such a system can keep working past 2038 without rewriting it.

The idea, and where it came from

The approach moves the authority for "what time it is" into one small, memory-safe component — a Time Proxy — and delivers time to the legacy program through a small adapter, so the program itself is minimally changed. The two research gifts that opened this line of work are recorded in the paper below, as first written on October 10, 2026, with their limits intact.

The central technique is not new. The 28-year date shift was patented during Y2K remediation (US Patent 5,852,824, filed 1997, now expired) and sold commercially in 1999. This work arrived at the same shift independently and adds the safety engineering around it. That history is credited in full in the paper and in the code's PRIOR_ART.md.

What was built, and tested

A working prototype (v0.14), built and verified on October 14–15, 2026:

A time authority that checks its own clock, anchors its readings with RFC 3161 timestamps, and declares a fault rather than reporting a wrong or stalled time.
A time-shift helper that lets programs doing internal date math keep working through 2066 (or 2094). Time never runs backward for the program, and the program never sees a time from its future. When the helper cannot give the program a time it can trust, it stops the program: a full stop, never an error value the program might misread.
A guard and a launcher. Every C-library clock, file time, and timed wait reads in the program’s shifted time; a kernel filter catches programs that ask the kernel for the time directly; child programs inherit the shift; and stb_run refuses, before it starts, any program the helper cannot reach.
Boundary translators and a safe migration tool for data entering, leaving, and stored by the program.
time_scan, a deterministic scanner that finds where a program handles time and classifies each finding, so the exposure can be assessed before anything is changed.

All 60 automated tests pass, and eight scripted demonstrations run from a clean copy. The recorded output is included in the download.

In one demonstration, a program without the helper reported the same permit as both valid and expired — “EXPIRED (49 days left)” — because part of its data had overflowed and part had not. Output that looks correct is not proof that a system handles 2038 correctly. This work is built to show the difference, not hide it.

Honest limits

These are stated plainly so the results can be trusted:

Tested on model programs, not yet real legacy software. That is the largest gap. No 32-bit build of the helper exists yet, so nothing 32-bit, the real target, has been run.
The timestamp authority in the demo is local, so its agreement is not independent verification. A deployment needs an external authority.
TPM hardware attestation was not run (no hardware available), and the scanner is a triage aid, not a proof.

The full list of limits and everything not yet executed is in the paper and the code's STATUS files.

Read and verify

The paper contains both research gifts, what was built through v0.13, the verified results, the findings, the limits, and how to reproduce everything. The download package contains the paper, the complete v0.14 source, and checksums; the source’s STATUS_v0_14.md records what changed after the paper.

Read the paper (PDF)Download the full package (.zip)

SHA-256 fingerprints — check a download with sha256sum:

paper (PDF): 29442625c836a102a774cc7ad1f64cc64e11dcd9160b9a5d73f29fedf36bd70a
package (.zip): d7e7136feb4dee1281547c6df158fbc5fa2b1aa65e4c77d8ac0dfaee69876c1a
source inside the package (safe_time_bridge_v0_14.zip): 617e9943feb7cf159c23698e480b2b817b79e2c7b21b16c7168452028466c485

License

The source code is licensed under the GNU General Public License v3.0 only (GPL-3.0-only; see the project’s Cargo.toml and LICENSE). Anyone may use, study, change, and share it; anyone who distributes a changed version must release its source under the same license. The research gifts and the text of this page are licensed under CC BY-SA 4.0.