0.27.2

docs/V0.27.2_IMPLEMENTATION.md

@@ -0,0 +1,27 @@
+# RustProxy 0.27.2 implementation note
+
+## Scope
+
+0.27.2 is a focused ACME runtime repair. It keeps SQLite schema 8 and the saved configuration format unchanged.
+
+## Managed Certbot relocation bug
+
+0.27.1 creates the private environment under `<data-dir>/acme-python.installing`, installs Certbot and its DNS plugins there, validates it, and then atomically renames the directory to `<data-dir>/acme-python`.
+
+Python virtual-environment console scripts created by pip contain an absolute interpreter path in their shebang. After the directory rename, `bin/certbot` can still point at the removed `acme-python.installing/bin/python`. Executing that console script can therefore fail with a local `OSError`; the private worker intentionally reduced such errors to `acme.local_io_or_json_error`, which hid the relocation detail from the UI.
+
+## Repair
+
+Managed-environment validation now runs Certbot as:
+
+```text
+<data-dir>/acme-python/bin/python -I -m certbot --version
+```
+
+ACME issuance and renewal use the same final interpreter with `-m certbot`. The provider worker receives the managed interpreter path from RustProxy and no longer depends on the relocated pip console-script shebang.
+
+The existing system/distribution Certbot fallback continues to execute its discovered `certbot` program normally.
+
+## Upgrade behavior
+
+No ACME profile, account, certificate or credential migration is required. An `acme-python` environment created by 0.27.1 can be reused as-is because 0.27.2 bypasses the stale console-script shebang and imports Certbot from the environment's installed Python modules.