v0.34.15

AGENTS.md

@@ -1,6 +1,6 @@
 # RustProxy source and documentation maintenance
 
-Current source version: **0.34.14**. The Cargo package and binary are named `rust-proxy`.
+Current source version: **0.34.15**. The Cargo package and binary are named `rust-proxy`.
 
 Before editing, read [README.md](README.md), [ROADMAP.md](ROADMAP.md), the relevant [documentation guide](docs/README.md) and the actual code and tests. Historical release experiments are not current specifications. Use the bundled `src/admin/openapi.json` for API routes and payloads; the source implementation is authoritative for runtime behavior.
 
@@ -12,6 +12,13 @@ Before editing, read [README.md](README.md), [ROADMAP.md](ROADMAP.md), the relev
 - Keep per-component optional defaults accurate (for example COLD off, Prometheus off, backend `tls_verify` off unless explicitly set, and optional Web Server `sendfile` off). Mark source-only or untested changes accordingly.
 - Maintain existing `langs/*.json` packs; `build.rs` discovers available locales. Do not add credentials, databases, real certificates, environment secrets or build artifacts to source archives.
 
+## Authentication provider extension contract
+
+- Keep provider implementations isolated under `src/<provider>/mod.rs` and `tests.rs`; the request pipeline only sees the object-safe `auth_provider::Provider` trait and the single `CompiledFrontend.auth_provider` slot. Preserve existing Vhost JSON fields on upgrades.
+- Prefer the shared `forward_auth::Adapter` transport for compatible HTTP verifiers, and reserve protected-host callback routes through `reserved_path` / `serve_reserved` only when required.
+- Return fail-closed provider errors using `auth_provider::gateway_failure` and one `src/admin/web/error_auth_provider.html` template (with escaped provider names); never create a separate HTML file per vendor or expose backend diagnostics to clients. `AuthenticationResponse` prevents custom Vhost error pages from overriding auth errors/redirects, and `Identity` / `CookieSink` keep identities and cookies request-scoped.
+- Update the Vhost selector, mutual-exclusion validation, config compiler, docs and provider tests together. Prove access/denial, redirects, header stripping, timeouts, and reserved routes with real verifiers before deployment.
+
 ## Engineering safeguards
 
 - Keep proxy traffic independent of control-plane database/provider calls. Prefer asynchronous streaming, bounded queues, resource limits and explicit cancellation. Hold backend permits for the entire body or tunnel lifetime.