sasa/wireguard-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix subnets validation

Browse Source
This commit is contained in:
sasa
2026-10-26 22:59:11 +02:00
parent e141c03c2c
commit ecc5c83d78
11 changed files with 605 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/evidence/milestone-10.md
+49
View File
@@ -0,0 +1,49 @@
# Milestone 10 acceptance evidence
Run: 2026-10-26T21:07:24Z, local development workspace. This report covers the
styled TUI keyboard footer only. Milestone 9 remains retired and unaccepted.
## Source and environment
- HEAD: `e141c03c2c401b09ad0fa78557cb9403640ea80a`; working tree was dirty
with `PLANS.md`, `README.md`, `src/delivery/qr.rs`, and `src/tui/render.rs`.
The following SHA-256 values identify the relevant integrated inputs at the
gates: `render.rs` `40e2abc891cc562a628eb661dcdcd3e052818c4332c25f3ae555e184d9adb65d`;
`forms.rs` `8ecbd614c1ecc7f1ab4cbae9223f9820c5d8315c62a54cffbc6d5c2e640f6c31`;
`qr.rs` `b8d30e6b24370fd1e3d666586481af74b12f279043cb1e0a7a1e61923588c4b8`;
`README.md` `fa4ef797565895dbd78f920e92263df718720bdb84dba48da88e611020638741`;
`Cargo.lock` `b8549df27f971dc550218cfc28e788f6630a1e13e7df538aded38e969ab713b6`.
- `rustc 1.97.1 (8bab26f4f 2026-07-14)` and `cargo 1.97.1
(c980f4866 2026-06-30)`. The release build used the locked local target;
no container, VM, production service or VPN was accessed.
## Checks and scope
| Exact command | Result |
| --- | --- |
| `cargo test --locked tui::` | Exit 0; 38 TUI unit tests passed. |
| `cargo test --locked --test tui_workflow` | Exit 0; 6 integration tests passed, including isolated PTY smoke. |
| `cargo fmt --all -- --check` | Exit 0. |
| `cargo clippy --locked --all-targets -- -D warnings` | Exit 0 after M10.3-R1 repair. |
| `cargo test --locked` | Exit 0; 271 library units passed, 2 opt-in container drivers ignored; all integration suites and 2 compile-fail doctests passed. The Testcontainers target reported 25 passed and 1 ignored; no opt-in Alpine run occurred. |
| `cargo build --locked --release` | Exit 0. |
| `git diff --check` | Exit 0. |
The TestBackend checks cover 120×30, 80×24, 40×8, 34×8 and below-minimum
rendering. They assert visible footer interior, styled key labels, applicable
80×24 list actions, compact navigation/Help and overflow, context-specific
forms/progress, and QR Esc guidance without fixture payload disclosure. These
are synthetic buffer checks; no physical terminal QR scan or systemd behavior
is claimed.
## Review and decision
Independent M10.1 review found R1/R2 context/form hint issues; repair and
re-review closed both on the integrated implementation. A separate fresh
integrated M10.3 review found R1 (Clippy failure) and R2 (README context
overstatement). The repairer fixed both; the same independent reviewer
re-reviewed the repaired state and reported no remaining actionable finding.
The reviewer supported M10-A1–A5 within synthetic/PTY scope; the coordinator's
full gates above satisfy M10-A6. Compact QR may show a too-large condition at
34×8 while retaining Esc clearing guidance. M10 acceptance is scoped to TUI
presentation and does not upgrade M9 systemd/IPv6 evidence.
docs/evidence/milestone-11.md
+62
View File
@@ -0,0 +1,62 @@
# Milestone 11 acceptance evidence
Run: 2026-10-26T21:20:07Z, local development workspace. This report covers
presentation of valid but unsupported peer `AllowedIPs` shapes. It does not
establish runtime WireGuard, Alpine or systemd behavior.
## Source and environment
- HEAD `18f28eef02d6a9f94a1d34ad94e25079ebf125a2`; the working tree was
dirty with `PLANS.md`, `src/app.rs`, `src/tui/render.rs`,
`src/tui/terminal.rs`, and `tests/config_preservation.rs`. An external
workspace actor created HEAD during implementation; this team created no
commit. The integrated inputs at the gates have SHA-256 values:
`app.rs` `75935d694d85cad11511ffbcff093cc7ebded08f02eb26589cb552fdbe1c7720`;
`document.rs` `af4fed6c25fe4b801112d19fe4867ed809c6a05e68492c3a53cc4829ac3b766b`;
`render.rs` `2f673febaba9e6f0ada1c274f33c0db02fe78fd2bca50310b1215d5a22dd8c9f`;
`terminal.rs` `ed9a99932dddbaf508667c5f17886704bda749264c53cc60c7e29b889a56e074`;
`config_preservation.rs` `0cdac39ac6ac370aaa85ea13610cb00f778a7efc559a39896212d96c6147f0b0`;
`Cargo.lock` `b8549df27f971dc550218cfc28e788f6630a1e13e7df538aded38e969ab713b6`.
- `rustc 1.97.1 (8bab26f4f 2026-07-14)`; `cargo 1.97.1
(c980f4866 2026-06-30)`. Synthetic fixtures and Ratatui TestBackend only;
no production, Docker, VM or live VPN action.
## Checks and scope
| Exact command | Result |
| --- | --- |
| `cargo test --locked valid_subnet_routes_are_classified_without_changing_source_or_mutation_safety` | Exit 0; focused config preservation test passed. |
| `cargo test --locked tui::render::tests::client_rows_show_draft_state_and_escape_anomalous_unsupported_peers` | Exit 0; focused list/details test passed. |
| `cargo test --locked --lib issues_screen_hides_valid_address_shape_limits_but_keeps_genuine_errors` | Exit 0; focused issue-screen test passed after repair. |
| `cargo test --locked --test config_preservation` | Exit 0; 10 tests passed. |
| `cargo fmt --all -- --check` | Exit 0. |
| `cargo clippy --locked --all-targets -- -D warnings` | Exit 0. |
| `cargo test --locked` | Exit 0; 272 library tests passed, 2 opt-in drivers ignored; integration and 2 compile-fail doctests passed. Testcontainers target reported 25 passed and 1 ignored without starting Alpine. |
| `cargo build --locked --release` | Exit 0. |
| `git diff --check` | Exit 0. |
The parser preserves the valid example's original source and all three routes.
The application leaves its raw peer issues and unsupported projection intact;
the TUI presents parsed-valid address-shape limitations separately from
malformed input. The list and issue screen omit capability-only diagnostics;
details show the exact subnet explanation. Tests also cover a normal supported
client, extra host routes, IPv6-only shape, mixed malformed route, and existing
broad-route deletion safety. Alias-only rename of an unprojectable peer retains
its existing behavior and preserves routes. The TUI still blocks normal client
mutations for unprojectable peers.
## Review and decision
Fresh independent review initially raised M11-R1, treating a second distinct
`/32` host route as a configuration error. After checking the WireGuard
[`wg(8)` AllowedIPs format](https://man7.org/linux/man-pages/man8/wg.8.html),
the reviewer withdrew R1: a valid additional host route is another model
capability limitation. The coordinator raised M11-R2 because non-subnet valid
address shapes were still displayed as anomalies. A repairer classified the
two parsed-valid shape variants consistently for presentation, kept all raw
issues for safety, and added regressions. Independent re-review reported no
remaining actionable finding. A1–A4 passed within source/fixture scope; the
integrated gates above satisfy A5.
No real WireGuard or systemd behavior was exercised. Milestone 9 remains
retired and unaccepted; real systemd/D-Bus and IPv6 capability are unverified.