RustProxy/docs/TEST_REPORT.md

Verification report - RustProxy 0.31.4

0.31.4 reissue - origin protection and one-field administration public URL (2026-10-11)

• Reissue verification (2026-10-11): rebased the complete previously prepared simplified-config source onto release identifier 0.31.4 in the manifest, existing resolved-lock snapshot package entry, OpenAPI, source/version checks, documentation and deterministic ZIP metadata. Merged the panel Origin and one-field config release notes; no backend validation logic changes were introduced during this renumbering.

• PASS — executed for this reissue: version_contracts.py, docs_check.py, langs_check.py, check_source.py, release_smoke.py, security_contracts.py, dependency_upgrade_0312.py, rust_module_contracts.py, system_info_no_subprocess_contracts.py, source_module_contracts.py, memory_contracts.py, web_server_contracts.py, admin_surface_audit_0310.py, security_dependency_contracts.py; 15 standalone Node frontend/simulation scripts (including the updated original 53-case and expanded 61-case administration simulations and 9 UI scenarios); go test ./... for docker-agent; bash -n dev.sh and OpenAPI JSON parsing.

• Not executed for this reissue: full Rust compile/test/release (cargo and rustc absent), real mobile Safari/Chrome or live reverse-proxy verification. Passing Node simulations is not proof of compiled Rust behavior. The inherited Cargo.lock requires verification and/or re-resolution on the declared Rust 1.99+ toolchain.

• Scope: panel administration settings/config and narrow self-admin cookie opt-in only. allowed_hosts stores only additional DNS hostnames; the HTTPS pin contributes its hostname to the active/desired Host allowlist without persisting a duplicate.

• Compatibility: older configurations with a duplicate hostname remain valid; validation canonicalizes the in-memory config and the next save omits the duplicate without an automatic SQLite migration; changing/removing the pin does not silently retain a stale implicit hostname.

• Security: Host, single forwarded Host, trusted reverse proxy, first-hop HTTPS, CSRF and Origin/cross-site guard rules are unchanged. No SQLite schema migration, TLS listener or other vhost route changes.

• PASS — source/release gates: version_contracts.py, rust_module_contracts.py, check_source.py, release_smoke.py, docs_check.py, langs_check.py, security_contracts.py, admin_surface_audit_0310.py, security_dependency_contracts.py, and dependency_upgrade_0312.py; SQLite schema-9/upgrade smoke and the source/HTML/Reader/translation checks also passed.

• PASS — focused simulated regressions: admin_public_origin_0314_config_sim.mjs: 61/61 local Node HTTP guard-simulation assertions, comprising 37 cases and 24 repeated session GETs. Invalid forwarded-proto on 3/12 unpinned GETs produced 403; with a pinned HTTPS public URL and no duplicate DNS allowlist entry, the same sequence produced 0/12. This simulation is not compiled RustProxy and cannot prove actual mobile/proxy headers.

• PASS — real frontend helper/UI checks: admin_panel_config_0314_ui_test.mjs: 9/9 settings-normalization scenarios plus form/HTML/locale/OpenAPI consistency; panel_cache_http_0310_ui_test.mjs also executes the updated real administration form callback with a duplicated legacy hostname and verifies it is omitted on save.

• PASS — other standalone checks: all 14 bundled Node UI/simulation scripts, memory model (300,000 simulated PURGEs), 2,000 HTTP requests to a Python mock peer (not RustProxy), and cd docker-agent && go test ./....

• Harness and compiler limitations: an initial ./dev.sh test run exposed a legacy UI-test harness that lacked the new form helper; the harness was corrected and passed separately. A subsequent monolithic run exceeded the execution time limit after the memory/load-model stage, so no complete ./dev.sh test success is claimed. ./dev.sh check exited 127 because cargo/rustc are not installed. New Rust tests in src/settings/tests.rs and src/admin/tests/part_11.rs were not compiled/executed. The inherited Cargo.lock still needs resolution on Rust 1.99+; live mobile and real reverse-proxy acceptance remain OPEN.

Earlier 0.31.4 validation baseline (2026-10-11)

• User scope: admin panel only; public vhosts, proxy forwarding, streams and database migrations are unchanged. The 0.31.3 BFCache/session resume and visible retry protections are retained.
• Source correction: optional administration.public_origin pins a browser-facing HTTPS panel origin to a configured DNS allowlist; it takes effect after restart and only with a trusted last-hop proxy. It accepts bounded X-Forwarded-Proto: https, http without relying on an ambiguous forwarded-proto element for the expected origin. Without the pin, 0.31.3's strict handling remains.
• Security: actual Host is validated, forwarded Host must be single/matching, the protocol's first hop must be HTTPS, and Origin, cross-site and CSRF checks remain. Untrusted peers and credential-bearing certificate automation retain their previous scheme validation. The earlier build required explicit allowed_hosts; the reissue now derives the pinned hostname without wildcard trust.
• Node HTTP guard simulation (not compiled RustProxy): PASS, 53/53 assertions, including 29 individual scenarios and 24 repeated session GETs: without the pin and with intentionally malformed XFP every fourth request, 3/12 GETs returned 403; with an explicit pin and otherwise identical simulated headers, 0/12 returned 403. tools/checks/admin_public_origin_0314_sim.mjs checks relevant code anchors and operates a local Node HTTP test peer. This does not confirm production headers or backend runtime behavior.
• PASS (2026-10-11): ./dev.sh test passed every available Rust-independent stage: source-module boundaries, version/contracts, SQLite schema-9 migrations and upgrade, security source/dependency checks, 300,000 PURGE-model iterations, 2,000 real HTTP requests to a Python test peer, all bundled Node/browser UI regressions (including BFCache/resume), 0.31.4 HTTP simulation, documentation and both language packs. Exit 127 at the missing Rust/Cargo toolchain guard only. The simulated peer is not a running RustProxy binary. ./dev.sh check likewise exits 127 due to missing Cargo.
• PASS: (cd docker-agent && go test ./...), node --check tools/checks/admin_public_origin_0314_sim.mjs; source-package size/integrity checks are performed separately.
• Rust regression tests added, NOT EXECUTED: src/settings/tests.rs and src/admin/tests/part_11.rs cover pin validation, restart, strict opt-out, session Secure cookie, CSRF, foreign Origin, cross-site, host spoofing and untrusted peers.
• Remaining release gate OPEN: the sandbox has no Rust/Cargo/rustfmt and the inherited lockfile remains unresolved against 0.31.2+ dependencies. Before production use: resolve on Rust 1.99+, format, clippy, test/build, then capture actual mobile Safari/Chrome and reverse-proxy traffic and run the acceptance matrix in IMPLEMENTATION_0.31.4.md. No claim is made that the original field auth.invalid_origin was directly observed or eliminated.

0.31.3 - invalid-Origin resume and mobile panel recovery (2026-10-11)

• Source: the uploaded RustProxy 0.31.2 ZIP plus the user's case description. No remote repository/history or real mobile network capture was provided.
• Reproduced in the original source: two overlapping session validations; a 403 during return-to-tab caused location.reload(); a concurrent successful validation cleared the recovery marker; another 403 could reload again. Separately, refresh tasks and SSE restarted before a resumed session was validated.
• Corrections: single-flight session verification and coalesced visibility/BFCache events; suspend polling and SSE until verified; visible localized retry on 403/network errors; unchanged login handling on 401; clear the startup recovery marker only after full initialization; stop refresh on startup failure. Invalid-Origin top-level HTML navigation returns an explicit 403 error page rather than raw JSON. Server Origin/CSRF/cross-site enforcement is unchanged; structured diagnostic logging redacts credentials and untrusted forwarding data.
• Regression coverage: tools/checks/origin_resume_0313_ui_test.mjs exercises actual JavaScript source against deterministic session API outcomes, repeated tab cycles, stale auth epoch, SSE suspension/resume, retry, 401 and startup marker. Rust unit/integration tests were added for blocked foreign origins, safe diagnostic values and readable 403 document handling, but cannot run here without Cargo.
• PASS (2026-10-11): tools/checks/origin_resume_0313_ui_test.mjs and all 11 other bundled Node UI tests; actual assembled dashboard bundle parsed by Node; original-source Node reproduction recorded the duplicate request/reload race.
• PASS (2026-10-11): source/module/version/security/dependency contracts, SQLite schema-9 migration and upgrade smoke (release_smoke.py), documentation/Reader (docs_check.py), language packs (langs_check.py), shell syntax and Go Docker Agent go test ./.... Memory workload simulated 300,000 PURGEs; 2,000 HTTP requests targeted a Python test peer, not the RustProxy executable.
• NOT VERIFIED: ./dev.sh check exits 127 because cargo/rustc are absent. ./dev.sh test passed all Rust-independent stages through docs/locales and reached the same missing-Cargo gate; it did not run Rust unit tests. No compiled RustProxy, iOS/Android browser, trusted reverse-proxy trace or production rollout was exercised.
• Verification limit: the new Rust tests are written but unexecuted; the lockfile is an inherited dependency snapshot, not a resolved 0.31.3 graph. The code has not passed a compiler-enabled release gate.
• Release gate remains OPEN: the local environment has no rustc/cargo/rustfmt. The inherited lockfile is unresolved for 0.31.2/0.31.3 dependency families. Run Cargo resolution, fmt, clippy, Rust tests and real admin/reverse-proxy/mobile acceptance on a Rust 1.99+ host before production release.

0.31.2 — stable library upgrade candidate (2026-10-10)

• Source basis: shipped RustProxy 0.31.1 archive, without local Git history; no confirmation of current remote master.
• Changed dependency branches: Rust 1.99 (manifest and Docker builders), SQLx 0.9, Argon2 0.6, Rand 0.10, rcgen 0.14, Tower HTTP 0.7, Brotli 9 and sysinfo 0.39; HTTP/3 hpx-h3 is pinned to reviewed 2.5.20. Existing SemVer-compatible crates remain range-defined for a full cargo update. Embedded Swagger UI is pinned to upstream 5.33.1.
• Code adaptations: secure RNG API, Argon2 PHC generation/verification and TLS certificate signing key representation. No intended changes to JSON schema, SQLite schema 9, cache format, credential storage, TLS policy, or proxy traffic processing.
• Executed locally: ./dev.sh test passed all offline code/API/SQLite/upgrade/security/translation/UI/Node/documentation checks; then exited 127 because Rust/Cargo is absent. cd docker-agent && go test ./... passed. python3 tools/checks/dependency_upgrade_0312.py reports PENDING for the old lockfile. Python compilation and Bash syntax checks passed. This does not prove a Rust build.
• CRITICAL: This sandbox has no Rust/Cargo/rustfmt and cannot reach the crates registry. The existing Cargo.lock carries the previous dependency graph: only the root package version has been updated, with all third-party resolved entries left untouched. It is NOT the resolved lockfile for 0.31.2 and --locked is expected to reject it until cargo update runs. Do not treat this source package as a built or production-accepted release. Do not fake checksums or mark compilation/tests as passing.
• Required on a Rust 1.99 build host: run cargo update, review and commit the newly resolved Cargo.lock, cargo metadata --locked, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, ./dev.sh check, ./dev.sh test, ./dev.sh release, plus cargo audit when installed. Fix all compilation/API errors revealed by real Cargo before approving a release.
• Runtime regression gate: real H1/H2/h2c/H3 QUIC, WebSocket, TLS and certificates, SQLite upgrade/backup/restore with preexisting data, sessions/Basic Auth/API security, SSE and panel on Safari behind reverse proxy, cache HOT/COLD and BAN/PURGE, and zstd/br/gzip negotiation. Compare load/RSS and avoid overwriting production data.

Historical verification records (0.31.1 and earlier)

0.31.1 — mobile/reverse-proxy dashboard startup (2026-10-10)

• Cause found in source: dashboard HTML fetched 17 deferred JS resources, while the first bundle launched an async session/config bootstrap without waiting for all later scripts to finish. A fast API response could invoke the renderer before window.rustProxyIntegrations.bindings was registered. An interrupted script transfer could cause the same exception. The reported Safari error is consistent with this race, but the specific production network failure was not captured.
• Implemented: one ordered embedded JS payload at /assets/app.js?v=0.31.1; CSS URL also versioned; DOMContentLoaded/module gating and explicit startup recovery; up to two bounded retries of initial configuration (400/800 ms). Old private asset URLs remain available. No API, authentication, saved preferences, database or proxy data path changes.
• PASS: ./dev.sh test completes all source checks, SQLite migration/backup and upgrade smoke tests, security and language checks, Node UI tests (including new startup-order and retry test), and documentation checks before Cargo. python3 tools/checks/source_module_contracts.py checks each JS module and the assembled 608 KB bundle with node --check. cd docker-agent && go test ./... passed. Shell syntax passed.
• Not verified: ./dev.sh test terminates 127 at Cargo; ./dev.sh check also 127 (cargo/rustc absent). Browser smoke against a local simulated API was attempted, but Chromium navigation was blocked by sandbox policy (ERR_BLOCKED_BY_ADMINISTRATOR); no successful browser smoke run is claimed. Playwright WebKit browser binaries are not installed here. No real iPhone Safari or production reverse-proxy test was possible.
• Release-host checks: ./dev.sh check && ./dev.sh test && ./dev.sh release, followed by Safari/Chrome iPhone tests behind the reverse: 20+ full reloads from Overview/Cache/Settings, initial config API failures, SSE reconnect, browser console errors, and response encoding/version consistency for HTML, /assets/app.js?v=0.31.1 and CSS. Review the detailed plan in IMPLEMENTATION_0.31.1.md.

0.31.0 Axum handler Send correction (2026-10-10)

• Reported failure: error[E0277] at src/proxy/types.rs:53, .fallback(forward), on Axum 0.8.9. forward calls asynchronous public BAN/PURGE handling. That helper accepted &Request<Body> across .await, which requires a Sync body to produce the Send future that Handler expects.
• Source correction: move Request<Body> into cache_http_invalidation, validate it synchronously, copy the method for audit logging and explicitly drop the body before the first .await. No cache selectors, IP permissions, status codes, API routes or session flows were changed. Strengthen tools/checks/admin_surface_audit_0310.py to reject a reintroduced borrowed request in the async handler.
• Executed: ./dev.sh test — all pre-Rust checks PASS (source/security/SQLite, UI Node, docs, language packs); command terminates 127 when Cargo is required. ./dev.sh check — 127, Cargo absent. cd docker-agent && go test ./... — PASS. bash -n dev.sh, Python source compile and manifest version probe — PASS (0.31.0).
• Not executed: Rust cargo check --locked --all-targets, cargo test --locked --all-targets, cargo build --locked --release, rustfmt or live HTTP regression. No cargo/rustc or download access is available in this environment. This source correction is not claimed as a compiler-verified release.

0.31.0 BAN/PURGE compilation fix, security review and UI help (2026-10-10)

• Addressed reported Rust E0716 (format! temporary borrowed as &'static str) by returning a fixed 422 response and logging the specific rejection.
• Restricted public HTTP maintenance to one external scheme and matched Host/vhost, rejected duplicate controls and invalid bodies, and added a shared two-slot limit plus spawn_blocking for heavy HTTP/admin cache invalidation work; audit removal before BAN-rule deletion.
• Added localized EN/PL curl help popover beside the Cache allowlist; added protocol/host/scheme/headers Rust regression sources, admin anonymous/CSRF test sources and an offline source audit script. The detailed findings, attack-surface table and operator acceptance checklist are in SECURITY_AUDIT_0.31.0.md.
• Executed this follow-up: ./dev.sh test passed every pre-Rust static/SQLite/security/JS/docs/translation check, then exited 127 on unavailable Cargo. ./dev.sh check also exited 127. go test ./... under docker-agent/, syntax checking all 27 browser JS files, OpenAPI JSON parse, shell syntax and separate source audits passed. A separate Chromium screenshot attempt timed out and does not count as verified UI rendering.
• Rust compiler and runtime tests NOT RUN HERE: cargo, rustc and rustfmt are absent; the only safe conclusion about E0716 is that its offending lifetime pattern was removed in source. Live BAN/PURGE over H1/H2/H3, TLS, reverse trust, performance and regression gates remain open.

0.31.0 negotiated panel content compression and HTTP BAN/PURGE follow-up (2026-10-10)

• administration.panel_compression defaults to {zstd:true,br:true,gzip:true} and uses the existing Administration form/config revisions. Authenticated panel HTML and embedded /assets/ CSS/JS/language bundles are precompressed only once per resource; per-request browser Accept-Encoding/q selects zstd, br, gzip or identity. The public login HTML remains identity (static login assets can negotiate compression). Vary, Content-Encoding, Content-Length are set per response. Compression for public proxied responses is unchanged. An upstream reverse proxy can override Accept-Encoding and therefore the negotiated result.
• Empty-by-default cache.http_invalidation_allowed_cidrs restricts public-vhost PURGE /path?query exact removal and BAN /prefix lazy invalidation to allowed client IPv4/IPv6 ranges; /0 rejected. Existing vhost/host ACL, rate limit and trusted forwarding logic remain in force. BAN / requires explicit confirmation; operation is audited, uses spawn_blocking around the existing cache engine and is never sent upstream. CIDR changes do not rotate cached objects.
• System information Refresh button is next to the API badge, without another row. EN/PL locales, OpenAPI and settings/cache/API docs were updated; SQLite schema remains 9 and Cold format remains 3.
• PASS: ./dev.sh test completed all pre-Rust checks (SQLite migrations, release smoke, security, translations, Node UI, source contracts) then exited 127 because cargo/rustc are missing. ./dev.sh check likewise exits 127. Standalone go test ./... in docker-agent/, JavaScript syntax checks, OpenAPI JSON parse and Node form roundtrip passed. Chromium headless verified that API badge and System information Refresh button remain on the same row at viewport widths 320, 390, 1024 px.
• Source-byte measurements (not wire captures): authenticated HTML after version substitution 320,756 B; Zstd level 3 around 50,526 B, Brotli level 5 around 43,654 B, gzip level 6 around 47,343 B using local utilities. The actual wire choice follows browser q values, not necessarily the smallest encoded representation. FCP/LCP and mobile real-browser startup were not measured on a running RustProxy.
• Rust NOT RUN: no Cargo/Rustc; Rust codec decoding, actual vhost BAN/PURGE authorization/HTTP/1-H2-H3, live proxy integration and exact wire metrics require a Rust-capable host. Production acceptance remains open.

0.31.0 mobile startup / HTML payload follow-up (2026-10-10)

• Removed html.app-loading body { visibility: hidden }. An initial CSS-driven overlay shows a loading spinner before the application code runs, a delayed (12 s) retry link when scripts or requests stall, and an explicit localized EN/PL failure state. No inline scripts or styles were introduced; authenticated CSP and the public login document are preserved. Reduced-motion preferences disable the spinner animation.
• Dashboard shell and live SSE start once the authenticated session and language bundle are resolved, without blocking on preferences, configuration, certificate inventory or initial /api/status. Unavailable configuration shows a visible toast and does not blank the page. This improves perceived startup but is not a measured FCP improvement.
• Moved the Overview Refresh now button into the title row, with no additional top-level row; the button remains hidden outside Overview.
• Private HTML is gzip-compressed and cached once in memory (no per-request recompression); Accept-Encoding: gzip yields Content-Encoding: gzip, Vary: Accept-Encoding and compressed Content-Length. Without gzip or with gzip;q=0, the existing identity HTML remains. Public login is not compressed/altered by this handler; API, SSE and proxy paths are not changed.
• Measured from source bytes: HTML source 318,905 B, authenticated response after substituting two version placeholders 318,875 B (previous packaged authenticated response 317,723 B); Python gzip level 6 of the response 46,821 B (about 85.3% less HTML transfer). These are source-based estimates, not HTTP wire captures from running RustProxy, so browser-delivered Content-Length remains to be confirmed with a compiled server.
• PASS: deterministic Node startup/placement test, Chromium 320/390/1024 px rendering and title/button alignment, existing static checks and Node coordinator regressions. NOT RUN: Rust compilation or Rust tests (cargo/rustc unavailable), live HTTP gzip/identity/auth, real mobile hardware reproduction and field measurements (FCP/LCP/white-screen rate). Acceptance remains open.

0.31.0 dashboard refresh implementation and source verification (2026-10-10)

• Source delivery based on the supplied RustProxy-0.30.1.zip (no .git; remote master not verifiable). Implemented one per-browser scheduler, per-account/validated preferences, per-client SSE interval and fallback isolation, active-view Traffic/Cache, separated /api/system-info, compatible full /api/status, version/docs and English/Polish UI.
• PASS: source/version/module/security checks, SQLite schema-9/upgrade smoke, translations/docs, all bundled Node UI tests including deterministic refresh scheduler, Go agent unit tests, all admin JS syntax. Browser simulation checks 20 view transitions, no duplicated timers/in-flight requests, 0/manual, hidden tab, SSE failure/recovery, independent errors and logout.
• NOT RUN: Rust compilation, Rust tests and release build because cargo/rustc/rustfmt are missing (./dev.sh test/check/fmt/release exit 127 at toolchain gate). Real RustProxy API/SSE/traffic/regression tests and SSE bandwidth/CPU measurement remain unverified. The stress suite's Python HTTP test peer is not a RustProxy runtime test.
• See full 0.31.0 implementation and verification report. No database schema changes, git commit or tag.

0.30.1 sysinfo compiler-feature fix (2026-10-10)

• The operator's Rust compiler reported four E0433 errors because the pinned sysinfo = 0.38.4 dependency enabled only network, but the new OS/kernel status methods require the system feature. Enabled both network and system without changing dependency versions or status API behavior.
• Removed the reported unused Tokio AsyncReadExt import from src/acme/runtime_env.rs.
• Added a guard for both sysinfo features to system_info_no_subprocess_contracts.py, wired that source check into ./dev.sh test, and synchronized the older manifest assertions in check_source.py and release_smoke.py. Cargo compilation on the operator's machine is still required to verify the full Rust build.
• Offline checks passed after the correction: system-info feature/source contracts, Rust and browser module contracts, version/source/release-smoke (SQLite/schema 9 and upgrade), memory, web server, security/dependency, simulated system-info UI, docs/translations, and Bash syntax. These static checks do not establish Rust compile success.

0.30.1 no-subprocess system information refinement (2026-10-10)

• Reused sysinfo::System::{long_os_version, name, os_version, kernel_version} for OS and kernel metadata on supported Linux/BSD/macOS/Windows targets; results remain cached. The status endpoint no longer reads Linux /etc/os-release or /proc/sys/kernel/osrelease directly.
• Removed the extra Python, pip and Certbot version subprocesses. At ACME startup, bounded local reads of the selected interpreter's pyvenv.cfg and the selected installation's pip-*.dist-info/METADATA and certbot-*.dist-info/METADATA provide versions when possible; missing/ambiguous values remain null. System Python full patch versions cannot be guaranteed without an executable probe, so they may be unavailable. ACME operational dependency checks and actual issuance still require subprocesses; those are not system-information collection.
• Added Windows .exe lookup for system Python/Certbot, metadata source unit regressions (not executed without Cargo) and compiler-independent source-contract regression system_info_no_subprocess_contracts.py. No new Rust dependencies, schema or API property changes.
• Compiler-independent checks passed: system_info_no_subprocess_contracts.py, rust_module_contracts.py, source_module_contracts.py, version_contracts.py, check_source.py, release_smoke.py (SQLite/schema 9 and upgrade), memory_contracts.py, web_server_contracts.py, security_contracts.py, security_dependency_contracts.py, docs_check.py, langs_check.py, all shipped Node UI regressions (including no-metadata fallback) and high_traffic_memory_model.py (simulated PURGE + 2,000 requests against a Python peer, not RustProxy). Rust/Cargo are absent, so cargo check, Rust unit tests and live multi-OS acceptance were not performed; production acceptance remains open.

0.30.1 system information and legend change (2026-10-10)

• Corrected H1/H2/H3 Overview legend markers to use exactly the protocol series theme variables (HTTP and WebSocket cards).
• Removed certificate runtime details from About, moved existing authenticated runtime metadata to Settings -> System information, added OS/version/kernel/architecture and existing process telemetry. Initial implementation used bounded ACME version subprocess probes for the selected binaries; the later refinement above replaces them with non-executing metadata reads, and leaves missing versions unavailable.
• Updated locale packs (English/Polish), authenticated OpenAPI status schema and release identity. SQLite schema 9, Cold Cache format 3 and persisted configuration have not changed.
• Passed offline: rust_module_contracts.py, source_module_contracts.py, version_contracts.py, check_source.py, release_smoke.py (including SQLite/schema 9 and source upgrade), memory_contracts.py, high_traffic_memory_model.py (simulated PURGE plus 2,000 requests against a Python peer, not RustProxy), web_server_contracts.py, security_contracts.py, security_dependency_contracts.py, all seven shipped Node UI regressions (including system_info_0301_ui_test.mjs), docs_check.py and langs_check.py. The full ./dev.sh test pipeline exceeded this environment's execution limit after passing through the Web Server contracts; remaining checks were run individually. ./dev.sh check exited 127 because Rust/Cargo are absent. No Rust compilation, Rust unit tests or real managed/system Certbot runtime checks were performed. Production acceptance remains open.

0.30.0 same-version sustained-memory audit (2026-10-10)

• Reviewed cache metadata, HOT/COLD admission and cleanup, file/remote JSON sinks, live log history, analytics, local directory listings, HTTP/2/HTTP/3, TCP/UDP sessions, DNS/health tasks, PHP-FPM streaming, transforms, rate-limit buckets, and periodic tasks. See memory verification for audited invariants and the real-runtime acceptance procedure.
• Confirmed a long-run retention issue: the selective PURGE path incremented Store.key_generations for affected base keys and never reclaimed those identities until an all-cache purge. Its existing global generation barrier already invalidates all older fills/tickets, so obsolete per-key metadata can be reset per selective PURGE. Also release large HashMap capacity after mass invalidations. Added a 512-distinct-PURGE Rust regression (not executed without Cargo).
• Removed unnecessary repeated analytics-label allocations using borrowed map lookups and allocation on insertion only. Filtered local directory listings in place rather than building a second metadata vector and moved generated HTML into the response instead of cloning it. Reused the existing redacted JSONL serialization when sending the same access event to Loki (while preserving the Loki-only path).
• Offline test: 300,000 simulated distinct PURGE identities over six intervals. Legacy bookkeeping model retained 50k → 300k keys, whereas the corrected epoch model retained 1 key after each operation. The load driver sent 10,000 real HTTP requests using 24 persistent clients and 1,000 distinct paths to a Python test peer, with expected status/body counts. These tests validate model behavior and driver operation only: they do not measure RustProxy RSS, heap, or leak freedom.
• ./dev.sh test: all Rust-independent source, security, SQL/upgrade, Node/browser UI, documentation/translation and memory-replay checks passed (including its 2,000-request peer smoke); exit 127 only at the missing Cargo toolchain guard. ./dev.sh check also exits 127 for missing Cargo. go test ./... in docker-agent passed.
• Rust/Cargo unavailable in this environment. Actual cargo check, Rust unit tests, RustProxy GET/PURGE under load, production-like JSON sinks, HTTP/2/3 and TCP/UDP traffic, and long-duration RSS/heap plateau measurements remain pending. No API, SQLite schema, Cold Cache format or version changes.

0.30.0 source verification (2026-10-10)

• Moved per-backend health-check overrides into the Health tab: a monitored-only backend selector reveals one persistent editor at a time, without changing the JSON configuration schema. Newly enabled custom policies start from the current shared policy; previously customized backends keep their configured values. Disabling monitor hides the editor but retains the override. Preserving draft switching, validation routing, rename and removal is covered by the simulated DOM regression.
• Memory audit: access-file JSONL and Logstash now share one serialization for each event. Existing bounded file/error sink queues, live history, open files, traffic analytics and cache/transform budgets were checked in source. Removed two avoidable directory-inventory memory spikes: per-vhost log scanning now retains at most 256 candidates while enumerating and gzip-rotation scanning at most 64. Added a source contract and a Rust unit regression for 10,000 candidate filenames and deterministic newest-first ties.
• The Node/UI, source, security, upgrade, SQL migration, translation and documentation checks in ./dev.sh test are run in this environment; the Rust suite and full ./dev.sh check cannot complete because cargo and rustc are unavailable (exit 127). go test ./... in docker-agent is run separately. The Rust unit regression is included but not executed. No real request-load test or long-running RSS/heap profile was performed, so the review cannot prove complete absence of runtime leaks.
• No SQLite schema migration or Cold Cache format change; root Cargo package/lock and OpenAPI version set to 0.30.0. Use a Rust toolchain for ./dev.sh check and ./dev.sh test, and measure RSS during sustained file/JSON logging, before deploying.

Same-version 0.29.7 PHP profile UI, Rust warning and error interception review (2026-10-09)

• Move the shared PHP-FPM Syntax and safety help button to the bottom of the profile-management dialog, below Add profile, with a visible horizontal separator. Keep the service-local help button where it was. The simulated Web Service UI test asserts this placement and that the help modal still opens.
• Remove the unused mut in the web_server::serve binding (src/proxy/forward/web_source.rs).
• Correct application-error interception semantics in both Reverse Proxy and Web Server/PHP-FPM: responses supplied by a backend/service (including cache hits) are explicitly marked and are not overwritten by global/vhost error pages when pages.intercept_statuses is disabled. RustProxy-generated routing/upstream failures remain eligible for the configured local error page. Interception is performed before cache admission; selected statuses receive no-store even after response-header rules and always retain the application's HTTP status, ignoring a standalone error page's status override. An internal named-location fallback remains terminal and has precedence.
• Rust regression tests cover the opt-in behavior, the marker's effect in the response observer, precedence and preservation of status with a differently configured page status. Source/UI contracts verify both forwarding paths and correct ordering around HTTP/2 WebSocket body adaptation; these are not substitutes for live protocol tests.
• ./dev.sh test: all Rust-independent source, JS, SQL/upgrade, security, documentation and translation checks passed; then exited 127 due to unavailable cargo/rustc. Rust compilation, unit tests and runtime HTTP/FastCGI/WebSocket acceptance have not been performed here. No configuration schema change or version bump.

0.29.7 same-version compile error corrections (2026-10-09)

• Correct the three operator-reported E0308 mismatches. Reverse Proxy origin interception now receives an axum::body::Body response only after adapting the upstream Response<hyper::body::Incoming>, preserving the original Incoming body expected by the HTTP/2 WebSocket tunnel wrapper. The operation remains before transformation and cache admission.
• Reapply configured response-header rules to an intercepted page, then restore Cache-Control: no-store so the admin page cannot accidentally enter shared cache through a custom header policy. Internal named error fallbacks retain precedence.
• Build owned Arc<Member> candidates for the active health-check supervisor and clone the Arc into each JoinSet::spawn task, rather than attempting to spawn a future carrying &Arc<Member>.
• Static/UI/source/SQL/upgrade/security/documentation checks passed via ./dev.sh test up to the Rust guard (exit 127). ./dev.sh check exited 127 before compilation due to missing Rust/Cargo. These are source-level corrections, not a verified Rust build. Operator should run ./dev.sh check and ./dev.sh test on a Cargo-equipped host before deployment.

0.29.7 in-version PHP UX and origin error interception (2026-10-09)

• Both Web Service local PHP fields and shared PHP-FPM profiles now expose per-field examples, units, bounded syntax, PATH_INFO/Authorization/PHP enablement info tooltips and a common detailed help dialog; all localized through language packs. Configuration semantics remain unchanged.
• New optional vhosts[].pages.intercept_statuses: supported unique HTTP error codes are validated; selected application-origin responses are replaced by vhost/global/built-in RustProxy pages before admission to cache, preserve the HTTP status by default, and carry Cache-Control: no-store. The existing internal error fallback runs first. Empty/default list leaves existing origin error responses intact.
• Added Rust source-level regression tests for default preservation, replacement, headers, precedence and malformed codes plus JS form behavior checks. ./dev.sh test ran all pre-Cargo contracts (including Web Service PHP profile editing, origin-interception roundtrip, offline migration and security checks) successfully but exited 127 at the missing cargo guard. ./dev.sh check also exited 127 for that reason. Rust compilation, Rust unit execution, and live Web Server/FastCGI/backend routing remain unverified.

0.29.7 backend/cache/FPM policy review (2026-10-09)

• Backend monitoring now has an explicit per-member switch and optional policy; tests cover backwards-compatible defaults, serialization, inherited Host and validation. Membership in the balanced pool remains a separate setting.
• cache.expose_only_hits defaults to false globally and may be overridden at a vhost. Tests cover HIT/MISS/BYPASS suppression, origin diagnostic removal, independently configured Via and cache identity stability. Actual wire behavior requires Cargo/runtime tests.
• PHP limitation: user-supplied WordPress and Roundcube services both target unix:/run/php/php_rustproxy.sock. Only Roundcube passes a restrictive FastCGI PHP_ADMIN_VALUE: open_basedir; PHP-FPM may retain this value across worker reuse, causing WordPress to fail. The 302 to setup-config.php is a consequence of missing access to wp-config.php. Added conflict warning, inline guidance and pool-isolation instructions; code changes cannot alter an already-shared PHP-FPM worker's isolation. The operator must provision and select a dedicated Roundcube FPM pool and restart/recycle affected old workers.
• Source changes keep SQLite schema 9/Cold Cache format 3. Compiler-independent tests and verification are reported below; Rust compilation/live HTTP/2/H3/PHP integration is not asserted in this environment.

0.29.7 verification summary

• ./dev.sh test: all Rust-independent contracts, SQLite migration/backup/source-upgrade checks, JS vhost/Web Server regressions, source security/dependency audits, docs and translation checks passed. It exits with code 127 at the Rust/Cargo availability guard, because rustc and cargo are not installed. This is not a successful Rust test-suite run.
• node tools/checks/backend_cache_0297_ui_test.mjs: passed; simulates the actual backend form toggles and verifies independent monitoring/pool-eligibility state, per-member health override and cache controls.
• Rust-only regression tests were added but could not execute: effective active/passive member policies and validation, HTTP Host defaults, HIT-only cache headers, per-vhost policy resolution, and cache compatibility identity.
• Operator acceptance remains open: Rust compilation, real PHP-FPM worker isolation on separate sockets, alternating WordPress/Roundcube requests, live 404 fallback, and actual wire-level cache HIT/MISS/BYPASS checks on HTTP/1.1, H2 and H3.

0.29.6 FastCGI EOF and error-log routing (2026-10-09)

• Operator reproduced: uncompressed /static.php/... returned HTTP 200 and 29,309 bytes with cache BYPASS; gzip returned HTTP 200 then TLS unexpected EOF and zero bytes. Repeated panics in futures-util 0.3.34 stream/unfold.rs:108 correlate with these failures. This is operator evidence, not a reproduced in-house integration test.
• Cause identified in source: native Web Server FastCGI response bodies used an unfused stream::unfold over a Tokio MPSC receiver. The compression wrapper may poll the stream after it returns None; the unfused Unfold then panics. The Reverse Proxy source uses an HTTP client body rather than this FastCGI stream.
• Change: wrap the FastCGI response stream in .fuse(). Add repeated-post-EOF polling test and mocked FastCGI-to-gzip completion/decode test. No changes to PHP-FPM parameters, vhost configuration or migrations.
• Logging change: the existing error-file controller receives WARN and ERROR (including PHP-FPM stderr); the console tracing layer suppresses these only when the file is enabled, with fallback to stderr on file/queue failure. A Rust panic hook emits structured ERROR diagnostics instead of bypassing the sink via the default stderr hook.
• Add asynchronous file routing and live enabled/disabled toggle tests. Actual Rust compilation, FastCGI compressor tests, panic runtime acceptance and live Roundcube regression require a Cargo-equipped environment and remain unverified here.
• Release: Cargo package/lock root/OpenAPI and release checks moved to 0.29.6; retained SQLite schema 9 and Cold Cache format 3.
• Static checks passed: version_contracts.py, docs_check.py, langs_check.py, rust_module_contracts.py, web_server_contracts.py, check_source.py, release_smoke.py, web_service_ui_test.mjs, and Node syntax/OpenAPI JSON parsing. The ./dev.sh test run passed its source, browser UI, security, memory and upgrade checks before reaching the missing Rust toolchain; ./dev.sh check exited 127 for the same reason.

0.29.5 Roundcube PHP PATH_INFO dispatch (2026-10-09)

• Cause confirmed by source: serve_inner originally ran try_files before recognizing /static.php/skins/... as a PHP script plus PATH_INFO. For an existing static.php, the last try_files candidate /index.php intercepted the asset request and could return HTML instead of the asset.
• Fixed dispatch order following rewrites and path ACLs; execute existing PHP PATH_INFO targets before try_files. Access restrictions also apply to the resolved PHP script path; the other fallback path remains protected.
• Added roundcube_static_php_path_info_runs_before_front_controller_try_files and without_php_path_info_try_files_keeps_legacy_front_controller_fallback using a local test FastCGI server and decoded FastCGI params. These are source tests until run with Cargo, not validated against live PHP-FPM or Roundcube.
• Operator action: ensure PHP-FPM PATH_INFO splitting enabled on the chosen Web Service / shared profile; keep try_files for the main service. No extra special-case URL rewrite is needed for Roundcube static.php URLs.
• Static checks passed: version_contracts.py, web_server_contracts.py, rust_module_contracts.py, docs_check.py, langs_check.py, web_service_ui_test.mjs, and release_smoke.py. ./dev.sh test exceeded the available execution limit while running broader static check_source.py. cargo/rustc are unavailable; the new Rust FastCGI tests were not executed and neither was a live Roundcube integration.

0.29.4 PHP-FPM profile toolbar shortcut (2026-10-09)

The Web Server list toolbar now contains a PHP-FPM profiles button immediately before New Web Service. Both this shortcut and the PHP tab's existing profile button open the same shared profile-management dialog; no API or configuration schema changes were required. English/Polish button translations and a UI regression covering placement, both entry paths and closing the dialog were added.

node --check on the changed Web Server script and its profile helper, node tools/checks/web_service_ui_test.mjs, and the focused version, language, Web Server architecture and documentation checks passed. ./dev.sh test was attempted but exceeded the execution time limit during the Rust-independent verification phase, so it did not complete in this run. Rust compilation and runtime tests remain unverified without Cargo.

0.29.4 version bump (2026-10-09)

The PHP-FPM profiles, Web Server cache/transforms and HTTP_HOST fixes have been assigned to a new 0.29.4 release. The source version, root Cargo.lock package entry, OpenAPI metadata, release checks and documentation match 0.29.4. The 0.29.3 internal-fallback changes remain included. This is a source release; no compiled artifacts are included.

Release verification: python3 tools/checks/version_contracts.py, python3 tools/checks/check_source.py, python3 tools/checks/docs_check.py, python3 tools/checks/release_smoke.py and the Node Web Service profile UI regression checks passed. ./dev.sh test completed its Rust-independent source, migration/upgrade, security, browser and documentation checks, then exited 127 because Rust/Cargo is not installed. Compilation, Rust unit tests and live HTTP/FastCGI/cache/transform verification remain unperformed.

0.29.4 feature verification (2026-10-09)

The operator-requested follow-up adds reusable PHP-FPM profiles, fixes the Web Server cache/transform bypass and supplies HTTP_HOST for authority-only HTTP/2 and HTTP/3 FastCGI requests. Changes include Config serialization, revisioned administration section and OpenAPI, Web Server browser modal, route cache/transform pipeline and FastCGI parameter encoding. New Rust unit tests cover profile resolution, detach, validation and HTTP_HOST; the Node UI test exercises opening/editing a profile and attaching it to a service.

Rust compilation, proxy/PHP-FPM integration tests and performance acceptance remain unverified without Rust/Cargo. Static contracts and browser tests are run separately and do not substitute for production acceptance.

Changes

0.29.3 fallback correction (operator report): the replay-body guard treated HTTP/2 and HTTP/3 GET/HEAD bodies with unknown size hints as non-replayable, even when the stream was empty. The fallback guard now performs the existing bounded empty-body probe for GET/HEAD; a true empty stream is replayable, while nonempty/unknown-length request bodies are forwarded only once. The internal target lookup now warns when the named location cannot be resolved. Added Rust async regression tests for empty H2/H3 GET/HEAD, unknown-length GET payload preservation, and unbounded POST non-consumption. The observer also preserves the final internal fallback response (including its 404 HTML) instead of applying a second global/vhost error page; a Rust test exercises this precedence. These Rust tests have not been executed in this environment because Cargo is unavailable.

Same-version 0.29.2 correction: Web Server main routes no longer inherit transient_unavailable from the vhost backend configuration. When the Web Server source has no enabled Reverse Proxy Custom Locations, backend definitions are not compiled. An enabled reverse-proxy Custom Location still compiles and uses the backend pool. Removed fallback-only Prometheus metrics, retained PHP/Web Server metrics.

Validated operator-controlled PHP_ADMIN_VALUE FastCGI configuration per Web Service, with distinct PHP_VALUE/ADMIN directive sets, explicit panel controls and OpenAPI schema. Prometheus PHP Web Service request/status counters, response header latency and available concurrency permit gauge, plus Web Server service-scoped response statuses and header latency.

Acceptance limitations

The build environment has no Rust compiler (cargo/rustc). Rust compilation, unit tests, FastCGI integration with a live PHP-FPM pool and runtime load tests have not been performed here. Rust-independent checks are recorded separately. This source package is not certified for production deployment.

Checks performed

• 0.29.3 release identity: Cargo.toml, the root rust-proxy entry in Cargo.lock, administration OpenAPI version, README, CHANGELOG, ROADMAP, AGENTS and verification-report heading were updated to 0.29.3; the fallback source changes from the tested 0.29.2 correction are retained.

• 0.29.3 offline validation: python3 tools/checks/version_contracts.py, python3 tools/checks/check_source.py, python3 tools/checks/release_smoke.py passed; bash ./dev.sh test passed all listed non-Rust checks and stopped at missing Cargo with exit 127. This does not constitute compilation or successful runtime testing of RustProxy 0.29.3.

• Fallback correction: bash ./dev.sh test passed Rust-independent module, source, upgrade/SQLite, security, browser UI and documentation checks. It exited 127 at the missing Rust/Cargo toolchain. bash ./dev.sh check also exited 127 because Rust/Cargo is unavailable. The added Rust regression tests and the live HTTP/2/HTTP/3 proxy behavior remain unverified pending a compiler-enabled runtime and an operator test against origin-1/origin-2.

• Same-version correction: python3 tools/checks/check_source.py and python3 tools/checks/release_smoke.py passed. bash ./dev.sh test passed the Rust-independent checks and stopped at missing Rust/Cargo (exit 127). No live 503 regression test or Rust compilation could be performed.

• ./dev.sh test: all Rust-independent release, upgrade, security, JS, UI, documentation and source checks passed; exited 127 at the missing cargo toolchain guard.

• node --check src/admin/web/web-server.js: passed.

• python -m json.tool src/admin/openapi.json: passed.

• ./dev.sh check: exited 127 because Rust/Cargo is unavailable.

Debian deployment maintenance (same 0.29.2)

Installer/update now installs /etc/logrotate.d/rustproxy using the recorded service user/group. Updates repair /etc/profile.d/rustproxy-path.sh rather than warning. logrotate uses copytruncate because RustProxy holds open log descriptors; some log records may be lost during truncate. Rust build and live Debian/systemd acceptance remain unverified in this environment.

Version identity (0.29.7 source release)

Cargo.toml package version is the canonical release identity (now 0.29.7). Rust uses CARGO_PKG_VERSION at build time; build.rs substitutes the admin HTML placeholder. Packaging, upgrade and dev scripts read the manifest with scripts/version.py. Run python3 tools/checks/version_contracts.py to check that executable paths do not hardcode a version. Historical documentation and external dashboards may retain manually managed versions. Rust compilation/runtime verification is still pending.

Shared PHP-FPM profiles and Web Server cache/transform/Host patch (0.29.4)

• Added a revisioned php_fpm_profiles collection with per-Web-Service php_profile_id, preserving the local PHP configuration when a shared profile is attached/detached. Added profile editor modal, schema, Polish/English messages and browser regression test.
• Web Server vhost/location responses now pass the configured RustProxy cache, vhost response rules and transforms. Cache skips ineligible/private/Set-Cookie responses and handles cache hits, conditional requests and range requests. Filesystem/PHP requests are refreshed synchronously rather than using the reverse-proxy background revalidator.
• FastCGI always supplies HTTP_HOST when HTTP/2 or HTTP/3 omitted the ordinary Host header; existing explicit Host with port is retained. Added Rust regression tests for both paths.
• bash ./dev.sh test: all Rust-independent release, source, security, browser UI, documentation, migration and dependency checks passed; stopped at absent Rust/Cargo (exit 127). bash ./dev.sh check also stopped at absent Cargo (exit 127). Rust compilation, new Rust tests and live PHP-FPM/HTTP2/HTTP3 cache/transform verification remain unverified in this environment.