# Release readiness and qualification matrix

This is a scope-qualified M9.4 record, not a release approval. M1–M8 are
accepted in [`PLANS.md`](../PLANS.md); M9 real-system acceptance remains
incomplete because no explicitly selected disposable systemd VM is available.
No production host, VPN, service, key, or configuration was accessed. The
operator procedure is in [`OPERATIONS.md`](OPERATIONS.md).

## Current host release candidate

The following native artifact was built from the current Rust sources with the
pinned compiler and locked dependency set. Its `--help` and `--version` paths
were executed on the development host. This assessment does not establish
startup in a guest or supported compatibility with another distribution.

| Property | Observed value |
| --- | --- |
| Source Git HEAD | `f4a6540df9621c9c5e5d1430243f92e749356a59` |
| Working-tree state at build | Pre-existing dirty documentation only: `PLANS.md` modified and `docs/VM_ACCEPTANCE.md` untracked; no source, manifest or lockfile changes |
| Relevant input fingerprint | SHA-256 `02ace329ca2ed17aa0b47112a3fcaa090b7d9a7eaa334f293aea9792e35e668a` over sorted `src/`, `Cargo.toml`, and `Cargo.lock` file hashes |
| Compiler and target | rustc 1.97.1, host `x86_64-unknown-linux-gnu`; Cargo 1.97.1 |
| Build command | `cargo build --locked --release` — exit 0 |
| Artifact | `target/release/wireguard-admin`, x86-64 ELF PIE, dynamically linked |
| Artifact SHA-256 | `d52d43cd02332352ffbd09c97e3b8095a710359128260c1286006e1c76c1b283` |
| Runtime requirements observed | ELF interpreter `/lib64/ld-linux-x86-64.so.2`; `libc.so.6` (GLIBC symbols through `GLIBC_2.39`) and `libgcc_s.so.1`; `ldd` resolved these on the development host |
| Artifact smoke | `./target/release/wireguard-admin --help` and `--version` — both exit 0; no settings, terminal, root management, service or interface exercised |

Commands used to inspect the artifact were `sha256sum target/release/wireguard-admin`,
`file target/release/wireguard-admin`, `readelf -h`, `readelf -l`, `readelf -d`,
`readelf --version-info`, and `ldd target/release/wireguard-admin`. The linked
GLIBC requirement is an observed lower symbol-version bound, not proof that a
distribution satisfying it is otherwise compatible. No installer, package,
signature, reproducible-build claim, or supported distribution baseline is
provided. This native GNU artifact is not an Alpine/musl artifact.

The source-input fingerprint was calculated from the repository root with:

```sh
rg --files src Cargo.toml Cargo.lock | sort | xargs sha256sum | sha256sum
```

## Specification-to-evidence matrix

“Accepted” refers to the repository's existing milestone result. It does not
mean every production platform or dual-stack behavior has been qualified. For
M1–M7, the concise milestone scope, review outcome and commands are in the
corresponding accepted sections of [`PLANS.md`](../PLANS.md). M8's detailed
source, artifact, run and scope record is
[`evidence/milestone-8.md`](evidence/milestone-8.md).

| Requirement area | Existing evidence | Qualification and limit |
| --- | --- | --- |
| Settings validation, executable-relative paths, draft/saved/applied model | M1 accepted record in `PLANS.md`; M7 startup/workflow record there | Synthetic/unit and TUI workflow coverage; no guest startup or production configuration. |
| Server configuration authority, client identity by public key, byte preservation and metadata | M2 accepted record in `PLANS.md`; specification in `SPEC.md` | Fixture/behavioral evidence for preserving non-client bytes and comments; no real server file was used. |
| Secret-safe keys, encrypted vault, read-only imports and originals | M3 accepted record in `PLANS.md`; M8 import/reissue scenario in `evidence/milestone-8.md` | Synthetic import plus accepted Alpine lifecycle scenario; source originals were fixture files and retained. Vault password loss remains unrecoverable by design. |
| Backups, mandatory backup boundary, journaled Commit, recovery and previewed restore | M4 accepted record in `PLANS.md`; M8 restore and backup-failure runs in `evidence/milestone-8.md` | Saved-state operations and test-fixture behavior covered. Restore did not apply runtime changes; real-VM manual recovery remains unverified. Archives are not encrypted. |
| Read-only runtime observations, restart orchestration, deadline and failure reporting | M5 accepted record in `PLANS.md`; runtime section of `docs/RUNTIME.md`; M8 Rustix observations | Fake-adapter and real Alpine WireGuard reader/IPv4 observations exist. No actual systemd/D-Bus job or `Application::restart` against real systemd has been run. |
| Delivery, first issue, password-per-action reissue, QR and private output | M6 accepted record and M7 synthetic PTY/workflow records in `PLANS.md`; `docs/DELIVERY.md` | Synthetic behavior covers file publication/reissue and QR rendering/terminal handling. No user device scan or actual client device qualification is recorded. |
| Native TUI, root/startup boundary and exit/terminal cleanup | M7 accepted record in `PLANS.md`, including synthetic PTY and workflow checks | Not a real guest root/non-root startup smoke. The release binary was only exercised for help/version on the build host. |
| Alpine real WireGuard lifecycle and IPv4 traffic | M8.7 in `evidence/milestone-8.md` | Accepted M8 used the pinned Alpine 3.22.7 fixture and selected disposable Docker daemon; repeated fresh integrated IPv4 scenarios passed on the recorded source fingerprint. Fixture Apply is a test-only callback, not systemd evidence. |
| Dual-stack behavior | M1–M7 synthetic client/configuration tests; M8 scope declaration | Production IPv4+IPv6 creation/full-tunnel requirements remain in force. Real IPv6 capability and traffic were excluded from M8 and are unverified; an IPv4 result does not qualify IPv6. |
| Real systemd job, alias/fast completion, failure/timeout, verified apply, restore and release-worker startup | No M9 VM result exists; `docs/VM_ACCEPTANCE.md` is a reviewed safety/scenario contract | **Unverified / M9 incomplete.** No selected disposable guest or VM run. Do not infer this from fake service adapters, Alpine or the host `--help` check. |
| Native artifact identity and dynamic dependencies | This document's host release-candidate record | Host-only assessment. Guest compatibility and startup are unverified; no universal Linux support claim. |

## Qualification status and next action

- M1–M8 remain accepted at their recorded scope. Later M9 documentation does
  not change or broaden their evidence.
- M9.1 has a reviewed, non-runnable VM safety/scenario contract. M9.2–M9.3
  real-system work and M9.5–M9.6 review/acceptance remain incomplete.
- The release candidate was built and its ELF dependencies inspected on the
  host, but has not been copied to or started in a guest. Actual guest
  architecture/distribution compatibility, root management startup,
  systemd/D-Bus behavior and service recovery are unverified.
- Real IPv6 capability and tunnel traffic are unverified. No M8 IPv4 or
  synthetic dual-stack test is a substitute for that qualification.
- No release, installation, production action, Git commit, or deployment is
  authorized by this report.

Next action: select and explicitly identify a disposable VM/guest satisfying
[`VM_ACCEPTANCE.md`](VM_ACCEPTANCE.md), then complete its target guard and
real-system scenarios before independent M9 review. Keep systemd/guest results
separate from the existing Alpine and synthetic evidence. Any final release
statement must retain the real IPv6 qualification gap unless that coverage is
explicitly authorized and completed.