# RustProxy 0.23.1 specification audit

## Scope

0.23.1 is a patch release on top of 0.23.0. It adds live operational charts to the existing Cache and Transform workspaces without changing proxy-path behavior, configuration schemas or administration API payloads. The 0.23.0 Certificate API, Bearer-token scoping, `--livelogs` and four-page Cache settings contracts remain unchanged.

## Cache live activity chart

- The Cache workspace contains one full-width `<details>` chart and leaves it collapsed by default.
- The chart uses the existing authenticated `/api/cache` refresh path and the selected vhost scope; it does not add a new endpoint or proxy-path query.
- HIT, MISS and BYPASS cumulative counters are converted in the browser to per-second rates from consecutive samples.
- The chart keeps at most 60 in-memory samples, reuses the dashboard SVG grid/line styling and resets history when the selected scope changes or the administration session is reset.
- The existing 3-second Live toggle remains the refresh cadence; disabling Live stops automatic chart updates together with the rest of the Cache workspace.

## Transform live activity chart

- The Transform workspace contains one matching full-width `<details>` chart and leaves it collapsed by default.
- The chart uses the existing authenticated `/api/transform` payload and selected vhost scope.
- Applied transformations, transformed cache HITs, skipped/fail-open responses and errors are converted from cumulative counters to per-second rates between samples.
- The chart keeps at most 60 in-memory samples, uses the existing dashboard chart visual language and resets history on scope/session changes.
- No transformation body, request body, cache object body or unbounded request-derived label is loaded into the chart.

## Retained 0.23.0 contracts

- Certificate API credentials remain Key ID + Bearer Token, hash-only at rest and restricted to deploy/reload.
- `rust-proxy --livelogs` remains a bounded structured all-vhost live stream with explicit lag reporting.
- Cache settings remain one atomic document split visually into General, Resilience, Cold cache and Static & diagnostics pages.

## Open release-host gate

Rust-independent source, language, JavaScript, packaging and release-smoke checks are part of this source delivery. A compiler-enabled release host must still run `./dev.sh check`, `./dev.sh test`, a release build and live browser acceptance with sustained Cache/Transform traffic before production deployment.