sasa/wireguard-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete terminal management workflow

Browse Source
This commit is contained in:
sasa
2026-10-21 23:25:31 +03:00
parent f718f739b4
commit 2ccd67d64c
19 changed files with 7313 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PLANS.md
+403 -6
View File
@@ -114,9 +114,9 @@ Each row is a delivery milestone, not a completion claim. Expand its record befo
| 2 | Server configuration editing with byte preservation | 1 | accepted |
| 3 | Client keys, encrypted vault, and existing-client import | 2 | accepted |
| 4 | Backups, safe Commit, and full restoration | 3 | accepted |
| 5 | Runtime observation and systemd restart adapter | 4 | blocked |
| 6 | Client configuration delivery and reissue lifecycle | 5 | pending |
| 7 | Complete terminal management workflow | 6 | pending |
| 5 | Runtime observation and systemd restart adapter | 4 | accepted |
| 6 | Client configuration delivery and reissue lifecycle | 5 | accepted |
| 7 | Complete terminal management workflow | 6 | accepted |
| 8 | Alpine Testcontainers integration | 7; suitable disposable Docker environment | pending |
| 9 | Real systemd acceptance and release readiness | 8; disposable systemd VM | pending |
@@ -2221,9 +2221,405 @@ Stop after M6; do not start M7 without a separate request.
### Milestone 7 — Complete terminal management workflow
Connect tested application operations to Ratatui/Crossterm screens: list and statistics, forms, anomalies/import, draft/diff, Commit, restart, output/QR, and backup selection/restore. Keep expensive work off the render/input loop and maintain public-key-based selection.
Status: accepted (2026-10-21T23:23:41+03:00; independent R2 closed the finding and coordinator gates passed for synthetic UI/PTY scope).
Prerequisites: milestones 1–6 accepted; verified coordinator/worker model roles,
pinned native Rust environment and registry access or cached compatible approved
`ratatui`/`crossterm` dependencies. Default validation runs without root, host
WireGuard, host D-Bus or production files. Terminal lifecycle evidence requires
a disposable pseudo-terminal or an isolated interactive terminal with synthetic
adapters. Missing terminal evidence is an unmet M7 gate, not a passing test.
Acceptance: keyboard workflows and cancellation preserve the required states, statistics refresh without claiming online status, destructive actions identify targets, passwords are masked, and terminal cleanup/resize/non-TTY/error behavior is verified. No implicit apply or save on exit.
#### Outcome and scope
Replace the management-startup placeholder with a usable native Rust TUI around
M1–M6 application operations. The administrator can inspect clients/anomalies and
current statistics, initialize the vault/import existing files, prepare creation,
rename and deletion drafts, review and Commit, explicitly restart, deliver a file
and optional QR, create/list backups, preview/confirm restoration, and exit with
the specified draft warning. The UI keeps draft, saved and applied state distinct.
Read SPEC.md in full, CONTEXT.md, ADRs 0001–0003, IMPLEMENTATION.md,
PROJECT_LAYOUT.md, DEVELOPMENT.md (especially terminal behavior), DEPENDENCIES.md,
TESTING.md, ENVIRONMENT.md, CONFIG_FORMAT.md, VAULT_FORMAT.md, PERSISTENCE.md,
BACKUP_FORMAT.md, RUNTIME.md and DELIVERY.md before editing their respective
boundaries. Preserve their versioned formats and accepted M1–M6 contracts.
Out of scope: new VPN settings, IP/key editing operations, server bootstrap,
remote/multiple-interface management, action/service logs, traffic history,
automatic save/apply/rollback, concurrent-editor reconciliation, container/VM
harness implementation and production testing. Real kernel and systemd evidence
remain mandatory later at M8/M9; M7 acceptance covers UI and synthetic integration.
Do not redesign accepted library behavior in key handlers.
#### Context and implementation steps
Actual preparation state and integration constraints:
- `src/main.rs` and `src/startup.rs` still return `ManagementUnavailable` for
root management; help/version and lazy root checking already work. `src/lib.rs`
exports the application modules; no `src/tui.rs` or TUI dependencies exist yet.
- `Application` in `src/app.rs` owns document/domain/vault drafts and session-only
first-issue material. `SavedStore::read_saved` performs journal recovery;
`Application::open` accepts caller-provided `ClientStates` and marks runtime
unknown. Introduce a narrow, tested application loading/projection boundary
where needed so startup derives states from authoritative document bytes,
rather than rebuilding client rules in the binary or supplying an empty set.
- The narrow `Snapshot` cannot represent every inspected peer. List document
anomalies and unsupported/ambiguous entries explicitly without silently
dropping them. Disable actions requiring an unambiguous public key/supported
projection; do not choose a duplicate alias or truncate routes to enable them.
- Existing operations include `prepare_new_client`, `rename_client`,
`delete_client`, `discard_draft`, `commit`, initial vault/setup preparation,
backup list/create, restore preview/confirmation, restart preview/choice,
first-file delivery and password-per-action `reissue_client_file`. Reuse these
boundaries. Add only missing application-facing projections/adapters, with
focused tests; ordinary UI state never contains server bytes or private keys.
- `vault::source` provides bounded configured-directory scanning and setup;
`vault::import` provides reconciliation/key verification. Explicit selected-file
import needs a bounded adapter/application entry point if the existing API
cannot express it. Keep originals untouched, imported secrets encrypted in
draft, anomalies visible and conflicting reissue blocked. Do not invent an
automatic conflict repair or an unlock-by-clearing-a-flag UI.
- Runtime transport and restart adapters are synchronous bounded operations;
terminal code must schedule them off the input/render loop. A read-only refresh
may report technical correspondence, but must not mark applied, persist a
verification timestamp, release addresses or suppress M6 activation warnings.
- `Application::confirm_restore` replaces saved settings and session state.
Refresh every settings-dependent view/operation from the restored generation;
discard stale previews, output confirmations and queued statistics. Preserve
fixed installation paths/interface constraints and M6 invalidation semantics.
One implementation writer at a time; coordinator owns PLANS.md. Establish the
application/worker interface before terminal wiring. Add modules only as needed.
| Task | Owner | Files and deliverable |
| --- | --- | --- |
| M7.1 | implementer | `src/app.rs`, `src/startup.rs`, relevant config/persistence/vault adapters and tests: safe session loading, public display projections and missing selected-file import/application boundaries |
| M7.2 | implementer | `src/tui.rs`, `src/tui/state.rs`, `src/tui/events.rs` as needed: secret-free screen/navigation state, typed commands/results, serialized application worker and bounded statistics scheduling |
| M7.3 | implementer | `Cargo.toml`, `Cargo.lock`, `src/main.rs`, `src/lib.rs`, `src/startup.rs`, `src/tui/terminal.rs`, `src/tui/render.rs`: approved terminal dependencies, interactive startup, guarded lifecycle, responsive layout and client/statistics screens |
| M7.4 | implementer | TUI forms/dialogs and narrow application additions: vault setup/import, creation/manual addresses, aliases/deletion, draft review/Commit, explicit restart and cancellation flows |
| M7.5 | implementer | TUI delivery/backup screens: masked authorization, destination/overwrite/retry, file plus optional QR, manual backups, archive preview and confirmed restore |
| M7.6 | implementer | `tests/tui_workflow.rs`, focused TUI/terminal tests, `README.md`, affected supporting docs: synthetic end-to-end workflows, terminal evidence and accurate operating instructions |
| M7.7 | reviewer, then repairer | Independent integrated review of M7 scope and regressions; bounded finding repairs and fresh re-review evidence |
| M7.8 | coordinator | Integrated gates, evidence ledger, scoped acceptance and M8 handoff in PLANS.md |
M7.1 loads executable-relative settings only after management privilege checks,
uses the safe saved-store/recovery path and derives the initial client view from
the server document. Do not silently replace corrupt state/vault with empty data.
Initial vault creation asks for a masked password and confirmation, checks existing
files at the earliest opportunity, presents reconciliation results and stages
changes through Commit. Cancellation does not install a vault or rewrite source
files. Explicit import and managed metadata additions remain draft operations;
unknown creation dates remain unknown. Temporary fallback labels are filenames
or shortened public keys, never a new alias registry.
M7.2 keeps one owner of mutable application/session state. Use standard-library
threads/channels where sufficient; serialize mutations and reject duplicate
submission while busy. Specify bounded/coalesced event queues, refresh interval,
read timeout, stale-result generation checks and worker shutdown. Do not allow
old results to overwrite a newer Commit/restore/restart view or recreate delivery
authorization. Progress/error/cancel navigation remains responsive while work is
pending. Cancellation of a dialog is distinct from aborting submitted work: do
not report an operation cancelled while it may still save files or restart.
Exit during submitted work must wait for an honest outcome with progress; no
unbounded join or silent detachment of protected mutations. An already submitted
systemd job can outlive its timeout; show the existing report's uncertainty.
M7.3 checks terminal suitability before raw/alternate-screen entry and before
saved-store recovery or setup mutations. Help/version still require neither root,
settings, terminal nor vault. Non-TTY/unsupported startup yields plain stderr and
a nonzero result without escape sequences. A scoped terminal guard restores raw
mode, alternate screen and cursor after normal exit, partial initialization,
render/input errors and handled interruption, including best-effort panic cleanup.
Avoid secret-bearing panic diagnostics and competing writes to the active screen.
List alias/fallback label, shortened key, IPv4/IPv6, draft/saved differences,
unapplied/unknown runtime status and anomalies using text as well as color. Keep
selection by full public key across refresh/sort and show that key in client
confirmations. Malformed records may use document location for inspection, never
as an alternate ambiguous mutation identity. Show last-handshake time and current
interface RX/TX counters; distinguish never, zero and unavailable/stale readings.
Missing runtime is nonfatal. Support keyboard-only use, visible focus, help,
scrolling, empty/error states and resizing to a terminal too small for content.
Escape all untrusted text, including imported filenames, aliases and errors.
M7.4 offers dual-stack default/manual allocation and reports validation/exhaustion
without losing prior draft. Renames may repeat. Deletion warns that saved removal
can leave runtime access active and addresses reserved. A semantic draft preview
shows client changes without raw configuration diffs (which could expose secrets).
Commit has no runtime calls. With a draft, restart offers exactly “Discard draft
and restart” or “Cancel”; cancellation preserves draft and first-issue eligibility.
Confirmed restart uses the application's preview and full backup/job/verification
sequence. Exit warns that draft will be discarded, offers cancellation and never
implicitly commits. Failed backup, Commit, restart or recovery displays the actual
stage/result and leaves state consistent with the existing application contract.
M7.5 permits first delivery only after Commit in the same creation session;
reissue requests a fresh password for the selected client every time. Passwords
and QR matrices have short-lived dedicated owners, outside ordinary view/debug/
snapshot state. Cancel/close clears them; do not retain an unlocked vault. The
selected destination and explicit overwrite confirmation use M6 capabilities,
not alias-derived paths. Show retry, publication uncertainty, manual-cleanup and
file-success/QR-failure outcomes accurately. Changing the directory can retry a
failed eligible first file. QR is additional to successful mandatory file output;
render its quiet zone and modules without clipping, show a resize/file fallback
when it cannot fit, and clear the disclosure screen on close. Show the M6
activation warning without inferring activation from historical verification.
Backup rows show archive identity, UTC creation time, reason and historical
verified status without labelling the newest archive as working. Restoration
previews clients/settings changes safely, identifies the exact archive, warns of
full saved-state replacement and draft loss, and requires confirmation. Cancel
has no replacement/precautionary-backup side effects. Confirmed restore needs no
password, makes its precautionary backup and never restarts; refresh the session
view and report saved/unapplied state. No archive cleanup or merge is added.
#### Acceptance and validation
- [x] M7-A1: production management startup reaches the TUI using executable-relative
settings and safe recovery; injected non-root/non-TTY/invalid startup checks
prove early failure. Help/version remain independent of privileged data.
- [x] M7-A2: keyboard list/details/forms, focus/help, scrolling, small/empty/error
screens and resize are usable. Duplicate aliases and refresh cannot retarget
actions. All authoritative peers/anomalies remain visible, including unsupported
entries; untrusted terminal controls are escaped.
- [x] M7-A3: synthetic setup/import covers server-only, file-only, matching,
mismatched and invalid files, preserves original bytes, encrypts valid secrets,
blocks conflicting reissue and stages metadata without fabricating dates.
- [x] M7-A4: create/rename/delete, semantic preview, cancel/discard and Commit
preserve draft/saved/applied boundaries. Allocation includes manual/invalid/
exhausted cases. Backup failure stops protected mutation; Commit/restore invoke
no service/runtime mutation even through the UI dispatch path.
- [x] M7-A5: restart with draft exposes the specified two choices; Cancel preserves
draft. Fake service/runtime outcomes prove successful verification releases
reservations, while job failure, timeout, missing/mismatching peers or failed
verification persistence do not. No implicit retry or rollback occurs.
- [x] M7-A6: first-file success/retry/change-directory, overwrite refusal/approval,
uncertain publication, QR failure after file success, reissue/password errors,
session exit and restore invalidation follow M6. No original-file password
bypass, secret snapshot or QR-only disclosure path is introduced.
- [x] M7-A7: backup list/manual backup, exact-target preview/cancel/restore,
precautionary-backup failure and restored operational settings are covered.
Restoration fully replaces saved state without password or implicit restart.
- [x] M7-A8: delayed/failing fake workers demonstrate responsive input, duplicate
prevention, bounded/coalesced refresh and stale-result rejection. Statistics
never imply online status or advance applied state; exit/shutdown is bounded
and reports submitted-operation uncertainty accurately.
- [x] M7-A9: synthetic terminal lifecycle checks demonstrate cleanup on normal
exit, partial setup failure, render/input error, handled interruption and panic
where feasible. Record exact PTY/manual procedure and outcomes; default tests
never acquire production adapters or require root. Explicit QR display retains
a complete quiet zone, is not clipped and clears on dismissal.
- [x] M7-A10: independent reviewer has no unresolved actionable findings; all
integrated Rust gates pass and documentation describes actual workflows and
remaining M8/M9 limits. No real-system result is claimed from UI fixtures.
Planned commands (repository root; pinned environment verified first):
`rustc -Vv`, `cargo -V`, `rustfmt --version`, `cargo clippy --version`;
`cargo test --locked --test tui_workflow` after M7.6 creates that target;
`cargo test --locked --test client_delivery`,
`cargo test --locked --test runtime_restart`,
`cargo test --locked --test commit_restore`,
`cargo test --locked --test vault_import`,
`cargo test --locked --test config_preservation`;
`cargo fmt --all -- --check`,
`cargo clippy --locked --all-targets -- -D warnings`,
`cargo test --locked`, `cargo build --locked --release`,
`./target/release/wireguard-admin --help`,
`./target/release/wireguard-admin --version`, and `git diff --check`.
Expected: successful checks, default tests without host access, accurate help and
no secret output. Select compatible minimal TUI dependency versions from official
crate documentation at execution time; retain Cargo.lock, avoid unrelated updates.
Record focused terminal test names and the exact isolated smoke procedure once
implemented; never launch root management against the development host for proof.
Phone/decoder QR interoperability must be recorded separately if demonstrated;
no scan success is presumed from matrix/render tests or required via production.
#### Progress
- [x] M7.1 — implementer `/root/m7_1`: safe session bootstrap, secret-free all-peer projection and bounded selected-file import integrated; review remains at M7.7.
- [x] M7.2 — implementer `/root/m7_1`: secret-free state/events and serialized application worker integrated; final independent review remains at M7.7.
- [x] M7.3 — implementer `/root/m7_1`: terminal adapter, startup and list/statistics rendering integrated; synthetic PTY and independent review subsequently passed.
- [x] M7.4 — implementer `/root/m7_1`: setup/import, create/rename/delete, draft/Commit and explicit restart forms integrated.
- [x] M7.5 — implementer `/root/m7_1`: delivery, backups and previewed restore workflows integrated.
- [x] M7.6 — implementer `/root/m7_1`: synthetic workflow/terminal evidence and documentation integrated.
- [x] M7.7 — independent R1 review, targeted repair by `/root/m7_repair_r1`, and R2 re-review closed M7-R1-01; no actionable findings remain.
- [x] M7.8 — coordinator reran all planned integrated gates, recorded scoped evidence and accepted M7-A1–A10.
#### Review and repair
| Finding | Iteration | Location and impact | Owner | Resolution and evidence | State |
| --- | --- | --- | --- | --- | --- |
| M7-R1-01 (P2) | R1/R2 | `src/tui/render.rs` client list omitted per-row draft/saved change and anomaly text required by SPEC/M7-A2. | `/root/m7_repair_r1` | Added row-leading state/anomaly markers, draft-removal rows, 34-column TestBackend and control-escaping assertions; independent R2 confirmed closure. | closed |
R1 separately noted coverage limits for M7-A5 confirmed restart through the UI
executor and M7-A9 terminal failure/interruption cases. The reported M7-A4
delete/discard coverage gap is disputed by `tests/tui_workflow.rs` worker-path
assertions for `DeleteClient` and `DiscardDraft`; ask R2 to verify those lines.
Repairer reported M7-R1-01 fixed and added synthetic PTY handled Ctrl-C cleanup
evidence. Follow-up added five isolated PTY child cases: failure after raw-mode
setup, failure after alternate-screen entry, render I/O error, input I/O error
and active-mode panic. Assertions check raw mode off, matching restoration
sequences and a generic panic diagnostic without payload. Focused lifecycle
PTY test, focused TUI tests (25), workflow tests (6), fmt, Clippy and diff checks
passed in the repairer run; `docs/TESTING.md` records procedure and limits.
Independent R2 review and coordinator rerun remain pending. M7-A5 UI executor
fake-outcome coverage remains a separate acceptance question.
#### Evidence and handoff
2026-10-21 execution preparation: confirmed M1–M6 accepted in their milestone
records and register; preserved the pre-existing M7 expansion in this worktree.
Matched `CODEX_SESSION_ID` to this session's local rollout record and verified
its latest `turn_context` is `gpt-6-sol`/`medium`; all configured worker roles are
`gpt-6-luna`/`high`, and M7.1 was dispatched through the harness with those exact
overrides. Native rustc/Cargo 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97 matched
the pin. Inspected the actual source/startup/application/store/import interfaces.
No M7 acceptance gate is claimed yet.
M7.1 implementation changed `src/app.rs`, `src/startup.rs` and
`src/vault/source.rs`; no dependency or versioned format changed. The worker
reported `cargo test --locked` (209 library unit plus integration/doc suites),
Clippy, fmt and diff checks passing. Coordinator inspected the changed-file list
and public interfaces, ran `git diff --check` (pass), and independently ran
`cargo test --locked --lib selected_file` (4 passed). M7.1 supplies
`open_from_saved_store`, `display_projection`, `open_management_session` and
`import_selected_file`. Independent integrated review is still pending.
M7.2 implementation added `src/tui.rs`, `src/tui/state.rs`,
`src/tui/events.rs` and a library export. The worker reported focused
`cargo test --locked tui::` (9 passed), fmt, Clippy and diff checks passing.
Coordinator inspection found a blocking `send` in the first shutdown fallback;
the implementer replaced it with an atomic stop request and nonblocking signal,
and added a full-queue/delayed-read regression test. This repair was checked
before progressing. The operation protocol currently covers draft mutation,
Commit, backups and selected import; later tasks extend it for restart, restore
and delivery. The shutdown handle must remain live while it reports `Pending`.
M7.3 implementation added the guarded Crossterm/Ratatui terminal path,
keyboard list/details/help and bounded read-only runtime sampling. Approved
direct dependencies `ratatui` 0.30.2 and `crossterm` 0.29.0 were added; their
resolution required advancing the already approved `time` pin from 0.3.44 to
0.3.47. The worker reported `cargo test --locked tui::` (15 passed), fmt,
Clippy and diff checks passing, plus successful help/version smoke checks.
Coordinator reran focused TUI tests (13 passed before the final lifecycle
repair) and inspected startup, dependency and terminal changes. Inspection
found terminal I/O error paths could drop an active worker and a panic hook was
left installed; the implementer repaired both and added synthetic tests for
delayed operation reporting and hook restoration. Actual PTY lifecycle evidence
and independent integrated review remain required.
M7.4 implementation added `src/tui/forms.rs` and extended terminal,
render/state/events, with a narrow draft-only peer selection fix in `src/app.rs`.
The worker reported `cargo test --locked tui::` (18 passed), fmt, Clippy and
diff checks passing. Coordinator reran the focused TUI tests (18 passed) and
inspected the secret owner, forms and command dispatch. Current focused tests
cover masked setup input, manual-address validation, full-key rename
confirmation and draft-restart choice; M7.6 must add broader synthetic behavior
tests for Commit/restart failure and cancellation paths before acceptance.
M7.5 implementation extended worker-owned prepared destinations and validated
restore previews, password-per-action reissue, file-plus-optional-QR disclosure,
backup browsing and exact-archive restoration. The worker reported
`cargo test --locked tui::` (22 passed), fmt, Clippy and diff checks passing;
coordinator reran focused TUI tests (22 passed) and inspected continuation and
result handling. Synthetic tests currently cover generation-bound prepared
actions, password masking, retry confirmation and QR fit. Actual end-to-end
publication/restore failure behavior and terminal disclosure lifecycle remain
M7.6 evidence needs; no real-system behavior is claimed.
M7.6 added `tests/tui_workflow.rs` (6 tests), synthetic terminal injection and
restart-result rendering test, and updated README/TESTING/PROJECT_LAYOUT.
The worker reported `cargo test --locked --test tui_workflow` (6 passed),
focused restart rendering (pass), fmt, Clippy, full `cargo test --locked`
(233 unit, 36 integration, 2 doctests), release build and diff check passing.
The PTY smoke ran under `/usr/bin/script` with a synthetic application and fake
unavailable statistics; it exercised 80×24 → 40×8 → 80×24 resize, q exit and
alternate-screen/cursor restoration. No host WireGuard/systemd or production
path was accessed. The UI test constructs restart outcomes for display and
cancel; actual fake service/runtime outcomes remain application-library
evidence. QR file-success/encoder-failure is likewise covered at the M6 app
boundary, while M7 proves QR ownership, dismissal and complete fit. No phone
or external decoder interoperability is claimed. Coordinator gate rerun and
independent review are pending.
M7.7 R1 was dispatched to a fresh read-only reviewer, separate from the
implementer, with all M7-A1–A10 criteria and actual changed/untracked paths.
The coordinator updated AGENTS.md's stale introductory implementation-status
sentence without changing behavior rules. Review findings are pending.
R1 reviewer `/root/m7_integrated_review_r1` inspected actual source, untracked
TUI files and docs; `cargo test --locked --test tui_workflow` passed 6/6 and
`git diff --check` passed. It identified M7-R1-01 above. It did not claim
real WireGuard/systemd evidence. Repair and re-review are next.
R2 independent re-review inspected the renderer repair and synthetic terminal
refactor, ran the focused row test, five-case lifecycle PTY test,
`cargo test --locked --test tui_workflow` (6/6) and `git diff --check` (all pass),
and closed M7-R1-01 with no new actionable finding. R2 withdrew its earlier A4
gap after verifying worker `DeleteClient`/`DiscardDraft` assertions. It found
the existing application fake service/runtime restart tests plus TUI preview,
choice/cancel and result-display tests sufficient for M7-A5's synthetic scope;
these do not prove the real systemd adapter.
Coordinator final integrated validation on the reviewed revision (all exit 0):
`rustc -Vv` and `cargo -V` reported 1.97.1; `rustfmt --version` reported
1.9.0-stable; `cargo clippy --version` reported 0.1.97.
`cargo test --locked --test tui_workflow` passed 6/6, including the synthetic
PTY smoke; `cargo test --locked --test client_delivery` 5/5,
`runtime_restart` 2/2, `commit_restore` 9/9, `vault_import` 5/5 and
`config_preservation` 9/9. `cargo fmt --all -- --check`,
`cargo clippy --locked --all-targets -- -D warnings`, `cargo test --locked`,
`cargo build --locked --release`, release `--help`, release `--version` and
`git diff --check` all passed. The coordinator independently reran the focused
five-case lifecycle PTY test (1/1), and checked 29 local Markdown links in the
changed guidance/plan files with none missing. Help and version printed only
their expected public text. Actual changed and untracked source, test, manifest,
lockfile and documentation paths were inspected; no unapproved direct crate,
production path, live service or Git commit was introduced.
Acceptance mapping: A1 uses injected root/TTY/settings/recovery tests and the
compiled production startup path; A2 uses all-peer projection, rendering,
selection and 34-column anomaly/state tests; A3 uses synthetic source
reconciliation and M3 vault checks; A4 and A7 use worker workflow plus
Commit/restore fixture tests; A5 uses TUI choice/cancel/result tests and M5
fake service/runtime cases; A6 uses worker delivery/reissue tests and M6
file/QR failure cases; A8 uses delayed worker/queue/generation tests; A9 uses
isolated PTY normal/interrupt/resize/failure/panic cases and QR fit/dismissal;
A10 uses closed R2 review and the coordinator gates above. All are scoped to
synthetic fixtures, fake adapters and isolated PTY behavior. No Alpine real
WireGuard, disposable-VM real systemd/D-Bus, external QR decoder or phone scan
was performed; those results are not inferred from M7 acceptance.
Planning only: inspected the approved specification, ADRs, supporting contracts,
accepted M1–M6 records and current startup/application/store/import/delivery/runtime
interfaces. No M7 code, dependency change, terminal session, Rust gate, Alpine or
VM test was executed as part of this expansion. Planning validation passed: `git diff --check`; a local Markdown-link check
found no missing PLANS.md targets; record-structure checks confirmed all eight
template sections, tasks M7.1–M7.8, criteria M7-A1–M7-A10 and pending status.
The milestone register now matches the accepted M5/M6 records. Rust rebuilds
are not required for this documentation-only change.
Historical planning handoff above preceded M7 execution. The next milestone is
M8 Alpine Testcontainers integration, which requires a separate execution
request and its disposable environment prerequisites. Do not create Git
commits, deploy or test on production from this acceptance.
#### Decisions and discoveries
M7 completes terminal orchestration around accepted library contracts rather
than adding a second persistence/runtime/delivery implementation. Session loading,
selected-file import and safe public projections are explicit integration tasks,
not assumed existing APIs. Runtime statistics/technical matches and historical
verification remain distinct from a verified explicit restart. Terminal cleanup
and responsiveness need their own evidence beyond pure render tests. No new
product decision or specification change is introduced by this expansion.
#### Outcome
Accepted for the defined synthetic UI/PTY scope after independent R2 review and
all planned coordinator gates. M8/M9 retain real WireGuard/systemd release gates.
### Milestone 8 — Alpine Testcontainers integration
@@ -2239,7 +2635,7 @@ Acceptance: real D-Bus job handling, separate restart verification, address rele
## Current progress and resume point
- Milestones 1–6 are accepted; milestones 7–9 remain pending.
- Milestones 1–7 are accepted; milestones 8–9 remain pending.
- The approved dependency list is in [DEPENDENCIES.md](docs/DEPENDENCIES.md); container testing methodology is in [TESTING.md](docs/TESTING.md).
- Milestone 1 is expanded and the Rust environment is pinned.
- Milestone 2 delivered a lossless in-memory WireGuard configuration editor, versioned metadata, and behavioral preservation tests.
@@ -2248,6 +2644,7 @@ Acceptance: real D-Bus job handling, separate restart verification, address rele
- Milestone 5 delivered public runtime observations and technical comparison, an approved-rustix bounded read-only netlink adapter, a zbus systemd job adapter, restart orchestration, and synthetic integration tests. Independent integrated review and repairs closed all actionable scoped findings; all planned gates passed. Real kernel/systemd validation remains deferred to M8/M9.
- Milestone 6 delivered session-bound creation/first-file authorization, saved-state rendering and password-per-action reissue, secure plaintext file output, optional same-payload QR, and synthetic lifecycle tests. Independent integrated review and repair closed all actionable findings; all planned gates passed. TUI and real-system validation remain M7–M9.
- M1–M6 integrated gates and independent reviews passed. No Alpine or VM results are claimed.
- Milestone 7 delivered the native terminal workflow, safe startup/session projection, bounded single-owner worker, setup/import/draft/Commit/restart/delivery/backup/restore forms, synthetic PTY and workflow tests, and documentation. Independent R2 closed its list-status finding; all planned coordinator gates passed. Real WireGuard and systemd remain M8/M9.
## Plan maintenance