# RustProxy TODO

This file contains open work that remains after the current RustProxy 0.25 Web Server implementation.

## Web Server follow-up

- Multipart byte-range responses if required; current single-range/If-Range support remains the default scope.
- Named locations only if they can reuse the existing vhost/location router rather than introduce a second router.
- Optional PHP `PATH_INFO` script/path splitting after a confinement-safe rule is defined.
- Additional FastCGI observability (bounded active/error/latency counters) without per-script labels.
- A race-resistant non-Unix filesystem confinement implementation before enabling the Web Server on non-Unix targets.

## Release acceptance

- Run `./dev.sh fmt`, `./dev.sh check` and `./dev.sh test` on a host with the stable Rust toolchain.
- Run live static-file acceptance over HTTP/1.1, HTTP/2 and HTTP/3, including ACL/auth/custom-error/header behavior.
- Run a real PHP-FPM acceptance matrix over a Unix socket and loopback TCP, including `index.php`, front-controller `try_files`, POST bodies, timeouts and source-disclosure failure tests.

Completed release work belongs in `CHANGELOG.md`; planned version work belongs in `ROADMAP.md`; implementation/audit evidence belongs in the matching audit document.