Prototype & Research Gift

Safe Time Bridge

A tested Year 2038 time-authority prototype in Safe Rust — with two research gifts, honest limits, and source you can check.

The problem

Many systems store time as a signed 32-bit number that overflows on January 19, 2038. Rewriting that code is often impossible: the systems are old, embedded, or proprietary. The question this work asks is whether such a system can keep working past 2038 without rewriting it.

The idea, and where it came from

The approach moves the authority for "what time it is" into one small, memory-safe component — a Time Proxy — and delivers time to the legacy program through a small adapter, so the program itself is minimally changed. The two research gifts that opened this line of work are recorded in the paper below, as first written on October 10, 2026, with their limits intact.

The central technique is not new. The 28-year date shift was patented during Y2K remediation (US Patent 5,852,824, filed 1997, now expired) and sold commercially in 1999. This work arrived at the same shift independently and adds the safety engineering around it. That history is credited in full in the paper and in the code's PRIOR_ART.md.

What was built, and tested

A working prototype (v0.13), built and verified on October 14–15, 2026:

A time authority that checks its own clock, anchors its readings with RFC 3161 timestamps, and declares a fault rather than reporting a wrong or stalled time.
A time-shift helper that lets programs doing internal date math keep working through 2066 (or 2094), with time that never runs backward and that fails closed when the authority is unreachable.
Boundary translators and a safe migration tool for data entering, leaving, and stored by the program.
time_scan, a deterministic scanner that finds where a program handles time and classifies each finding, so the exposure can be assessed before anything is changed.

All 52 automated tests pass, and seven scripted demonstrations run from a clean copy. The recorded output is included in the download.

In one demonstration, a program without the helper reported the same permit as both valid and expired — “EXPIRED (49 days left)” — because part of its data had overflowed and part had not. Output that looks correct is not proof that a system handles 2038 correctly. This work is built to show the difference, not hide it.

Honest limits

These are stated plainly so the results can be trusted:

Tested on model programs, not yet real legacy software. That is the largest gap.
The timestamp authority in the demo is local, so its agreement is not independent verification. A deployment needs an external authority.
TPM hardware attestation was not run (no hardware available), and the scanner is a triage aid, not a proof.

The full list of limits and everything not yet executed is in the paper and the code's STATUS files.

Read and verify

The paper contains both research gifts, what was built, the verified results, the findings, the limits, and how to reproduce everything. The download package contains the paper, the complete source, and checksums.

Read the paper (PDF)Download the full package (.zip)

SHA-256 fingerprints — check a download with sha256sum:

paper (PDF): 29442625c836a102a774cc7ad1f64cc64e11dcd9160b9a5d73f29fedf36bd70a
package (.zip): d127839fe83758d3d1d4cf18d40cec266eea713ebff2d3c24f26c2fb34bf4240
source inside the package (safe_time_bridge_v0_13.zip): c1d530f6b0b34ddd5dd71cc4edf766bb280a18a1993297c6eef7e1dfd34e3603

License

The source code is licensed under MIT OR Apache-2.0 (see the project's Cargo.toml). The research gifts and the text of this page are licensed under CC BY-SA 4.0.