v0.31.2

docs/API_ACCESS.md

@@ -132,7 +132,7 @@ promise to erase browser/OS screenshots or data intentionally downloaded by an a
 ## First build / offline assets (fixed in 0.7.2)
 
 No `SWAGGER_UI_DOWNLOAD_URL` environment variable or `.cargo/config.toml` is required.
-The default is Swagger UI **5.32.11**, selected by `scripts/build/swagger_assets.py` and
+The default is Swagger UI **5.33.1**, selected by `scripts/build/swagger_assets.py` and
 called from this application's `build.rs`. The former `utoipa-swagger-ui` adapter
 is removed: there is no separate dependency build silently choosing its older
 historical browser default. Direct Cargo builds using `--manifest-path` use the
@@ -160,10 +160,10 @@ release binaries**, served behind the existing admin guard. No runtime download,
 CDN, public asset endpoint or alternate authentication mechanism was introduced.
 
 An offline or GitHub-restricted build can use a reviewed local copy of the same
-GitHub **tag archive**, with its original `swagger-ui-5.32.11/` directory structure:
+GitHub **tag archive**, with its original `swagger-ui-5.33.1/` directory structure:
 
 ```bash
-export SWAGGER_UI_DOWNLOAD_URL=file:///srv/build-assets/swagger-ui-5.32.11.zip
+export SWAGGER_UI_DOWNLOAD_URL=file:///srv/build-assets/swagger-ui-5.33.1.zip
 # Optional: require the archive digest independently verified by your build team.
 # export SWAGGER_UI_ARCHIVE_SHA256=<64-hex-digit-verified-digest>
 bash dev.sh check
@@ -237,4 +237,4 @@ unchanged. No configuration schema migration is needed for existing header rules
 - Swagger UI configuration: https://swagger.io/docs/open-source-tools/swagger-ui/usage/configuration/
 - Cargo configuration discovery: https://doc.rust-lang.org/cargo/reference/config.html
 - Cargo build scripts: https://doc.rust-lang.org/cargo/reference/build-scripts.html
-- Pinned browser release: https://github.com/swagger-api/swagger-ui/tree/v5.32.11
+- Pinned browser release: https://github.com/swagger-api/swagger-ui/tree/v5.33.1

docs/TEST_REPORT.md

@@ -1,4 +1,16 @@
-# Verification report - RustProxy 0.31.1
+# Verification report - RustProxy 0.31.2
+
+## 0.31.2 — stable library upgrade candidate (2026-10-10)
+
+- **Source basis:** shipped RustProxy 0.31.1 archive, without local Git history; no confirmation of current remote `master`.
+- **Changed dependency branches:** Rust 1.99 (manifest and Docker builders), SQLx 0.9, Argon2 0.6, Rand 0.10, rcgen 0.14, Tower HTTP 0.7, Brotli 9 and sysinfo 0.39; HTTP/3 hpx-h3 is pinned to reviewed 2.5.20. Existing SemVer-compatible crates remain range-defined for a full `cargo update`. Embedded Swagger UI is pinned to upstream 5.33.1.
+- **Code adaptations:** secure RNG API, Argon2 PHC generation/verification and TLS certificate signing key representation. No intended changes to JSON schema, SQLite schema 9, cache format, credential storage, TLS policy, or proxy traffic processing.
+- **Executed locally:** `./dev.sh test` passed all offline code/API/SQLite/upgrade/security/translation/UI/Node/documentation checks; then exited 127 because Rust/Cargo is absent. `cd docker-agent && go test ./...` passed. `python3 tools/checks/dependency_upgrade_0312.py` reports PENDING for the old lockfile. Python compilation and Bash syntax checks passed. This does not prove a Rust build.
+- **CRITICAL:** This sandbox has no Rust/Cargo/rustfmt and cannot reach the crates registry. The existing `Cargo.lock` carries the previous dependency graph: only the root package version has been updated, with all third-party resolved entries left untouched. It is **NOT the resolved lockfile for 0.31.2** and `--locked` is expected to reject it until `cargo update` runs. Do not treat this source package as a built or production-accepted release. Do not fake checksums or mark compilation/tests as passing.
+- **Required on a Rust 1.99 build host:** run `cargo update`, review and commit the newly resolved `Cargo.lock`, `cargo metadata --locked`, `cargo fmt --all -- --check`, `cargo clippy --locked --all-targets -- -D warnings`, `./dev.sh check`, `./dev.sh test`, `./dev.sh release`, plus `cargo audit` when installed. Fix all compilation/API errors revealed by real Cargo before approving a release.
+- **Runtime regression gate:** real H1/H2/h2c/H3 QUIC, WebSocket, TLS and certificates, SQLite upgrade/backup/restore with preexisting data, sessions/Basic Auth/API security, SSE and panel on Safari behind reverse proxy, cache HOT/COLD and BAN/PURGE, and zstd/br/gzip negotiation. Compare load/RSS and avoid overwriting production data.
+
+# Historical verification records (0.31.1 and earlier)
 
 ## 0.31.1 — mobile/reverse-proxy dashboard startup (2026-10-10)