v0.25.0

docs/TODO.md

@@ -0,0 +1,19 @@
+# RustProxy TODO
+
+This file contains open work that remains after the current RustProxy 0.25 Web Server implementation.
+
+## Web Server follow-up
+
+- Multipart byte-range responses if required; current single-range/If-Range support remains the default scope.
+- Named locations only if they can reuse the existing vhost/location router rather than introduce a second router.
+- Optional PHP `PATH_INFO` script/path splitting after a confinement-safe rule is defined.
+- Additional FastCGI observability (bounded active/error/latency counters) without per-script labels.
+- A race-resistant non-Unix filesystem confinement implementation before enabling the Web Server on non-Unix targets.
+
+## Release acceptance
+
+- Run `./dev.sh fmt`, `./dev.sh check` and `./dev.sh test` on a host with the stable Rust toolchain.
+- Run live static-file acceptance over HTTP/1.1, HTTP/2 and HTTP/3, including ACL/auth/custom-error/header behavior.
+- Run a real PHP-FPM acceptance matrix over a Unix socket and loopback TCP, including `index.php`, front-controller `try_files`, POST bodies, timeouts and source-disclosure failure tests.
+
+Completed release work belongs in `CHANGELOG.md`; planned version work belongs in `ROADMAP.md`; implementation/audit evidence belongs in the matching audit document.