# Milestone 8 reproducible evidence

This report records disposable Alpine fixture results. It does not claim
production or systemd/D-Bus behavior. Current acceptance state is in
[PLANS.md](../../PLANS.md); superseded attempts are in the
[history](../history/milestone-8-before-workflow-cleanup.md) and focused
[diagnostics](../diagnostics/milestone-8.md).

## M8.5 import/reissue and preceding scenarios

- Recorded: 2026-10-24T23:14:00+03:00. Run occurred earlier on 2026-10-24;
  an exact start timestamp was not captured.
- Source identity: Git HEAD
  `2ccd67d64cd9ef4210ac3dc369473b3849319649` with dirty tracked and
  untracked M8 files. The reproducible input fingerprint is SHA256
  `e7aeaf13444ac6350db66cd6c34fb3a46f4ee0723eb18b8ebe0b0054e1672fd0`.
  It was identical before the pinned driver build and after the real run. The
  fingerprint was generated by:

  ```sh
  rg --files src tests/support tests/containers tests/testcontainers_wireguard.rs Cargo.toml Cargo.lock | sort | xargs sha256sum | sha256sum
  ```

- Builder: `rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02`,
  target `x86_64-unknown-linux-musl`; Rust 1.97.1. The locked, offline driver
  build passed:

  ```sh
  docker run --rm --platform linux/amd64 --mount type=bind,src=/home/sasa/share/rust/wireguard-admin,dst=/src,readonly --mount type=bind,src=/tmp,dst=/out -e CARGO_TARGET_DIR=/out/wga-m8-build-target -e CARGO_HOME=/out/wga-m8-cargo-home -w /src rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02 cargo test --locked --offline --lib --no-run --target x86_64-unknown-linux-musl
  ```

- Driver: `/tmp/wga-m8-build-target/x86_64-unknown-linux-musl/debug/deps/wireguard_admin-dcc9c812241bb031`,
  SHA256 `e250d8eb60db0ad262b404624fa7f9d984f807d8688c055e9f8629178c00b151`.
- Runtime image: `wireguard-admin-alpine:3.22.7`, image ID
  `sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5`,
  Linux/amd64. Selected disposable local Docker daemon:
  `unix:///var/run/docker.sock`, ID
  `1baad80e-d79d-49ab-b19a-fb00fd3662d7`, Docker Server 29.1.3,
  host Linux `6.18.18-gentoo` x86_64.
- Exact selected-daemon command:

  ```sh
  DOCKER_HOST=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ENDPOINT=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ID=1baad80e-d79d-49ab-b19a-fb00fd3662d7 WIREGUARD_ADMIN_TESTCONTAINERS=1 WIREGUARD_ADMIN_TEST_DRIVER=/tmp/wga-m8-build-target/x86_64-unknown-linux-musl/debug/deps/wireguard_admin-dcc9c812241bb031 cargo test --locked --test testcontainers_wireguard selected_daemon_wireguard_and_application_smoke -- --ignored --exact --test-threads=1
  ```

- Result: exit 0, 1 passed, 0 failed, 0 ignored, 25 filtered out, 82.06s.
  The integrated scenario exercised existing and new IPv4 peers, Commit and
  delivered-file traffic, saved deletion and explicit fixture Apply, two
  previewed password-free restores with saved/runtime separation, and import
  of matched/conflicting/invalid private sources followed by password-gated
  reissue and traffic from the reissued bytes. It used the real Rustix reader
  for peer/routes/handshake/counter assertions. Exact-name Docker container
  and network listings were empty after the run.
- Independent disposition: M8.5-IMP-01 closed on re-review after checking all
  three source-file byte comparisons and the regression for a changed invalid
  candidate. Earlier traffic, deletion and restore slice findings were closed
  independently as recorded in the plan.
- Limit: this is one Alpine fixture result for the fingerprint above. Later
  source edits invalidate it as final integrated evidence. User-directed IPv6
  capability/traffic tests were skipped. No real systemd job was exercised.

## M8.5 mandatory-backup failure

- Source-input fingerprint: SHA256
  `b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2`, stable
  before the pinned driver build and after the real run. Driver SHA256:
  `ad45dc3f6b0987b075ac522e171c82c6651124c3d01c65c14df90595fe552815`.
- Builder: `rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02`.
  Runtime image: `wireguard-admin-alpine:3.22.7`, ID
  `sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5`.
  Selected disposable daemon: `unix:///var/run/docker.sock`, ID
  `1baad80e-d79d-49ab-b19a-fb00fd3662d7`.
- Exact selected-daemon command:

  ```sh
  DOCKER_HOST=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ENDPOINT=unix:///var/run/docker.sock WIREGUARD_ADMIN_TEST_DAEMON_ID=1baad80e-d79d-49ab-b19a-fb00fd3662d7 WIREGUARD_ADMIN_TESTCONTAINERS=1 WIREGUARD_ADMIN_TEST_DRIVER=/tmp/wga-m8-build-target/x86_64-unknown-linux-musl/debug/deps/wireguard_admin-dcc9c812241bb031 cargo test --locked --test testcontainers_wireguard selected_daemon_wireguard_and_application_smoke -- --ignored --exact --test-threads=1
  ```

- Result: exit 0, 1 passed, 0 failed in 81.45s. The scenario required a typed
  backup error and verified unchanged saved/runtime state, no fixture apply,
  retained address reservation, and the expected reader missing-interface and
  deadline errors. Exact-name checks found no remaining test containers or
  networks.
- Limit: this was a completed M8.5 slice result before the final gates and
  repeated full scenario runs recorded below. IPv6 capability/traffic was
  excluded by user direction; no real systemd job was exercised.

## M8.7 integrated gates and repeated Alpine scenario

- Recorded: 2026-10-25T20:40:51+03:00. Git HEAD remained
  `2ccd67d64cd9ef4210ac3dc369473b3849319649` with dirty milestone files.
  The source-input fingerprint command above returned
  `b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2`
  before the rebuilt driver and after all three successful real runs.
- The pinned Alpine runtime image rebuilt entirely from cached layers (ID
  `sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5`,
  linux/amd64). Networkless, read-only, capability-dropped readiness exited 0;
  `apk info -v` listed the 33 constrained packages. The pinned Rust 1.97.1
  Alpine builder produced the x86_64 musl test driver in 1m38s using the host's
  cached public Cargo registry mounted read-only after the earlier `/tmp` cache
  disappeared. The static PIE driver's SHA256 was
  `ad45dc3f6b0987b075ac522e171c82c6651124c3d01c65c14df90595fe552815`.
  The exact rebuild command was:

  ```sh
  docker run --rm --platform linux/amd64 --mount type=bind,src=/home/sasa/share/rust/wireguard-admin,dst=/src,readonly --mount type=bind,src=/tmp,dst=/out --mount type=bind,src=/home/sasa/.cargo/registry,dst=/out/wga-m8-cargo-home/registry,readonly -e CARGO_TARGET_DIR=/out/wga-m8-build-target -e CARGO_HOME=/out/wga-m8-cargo-home -w /src rust:1.97.1-alpine3.22@sha256:b348cb409ac0a73de15065997a360063cf87465574a15e3e4469862cb8996f02 cargo test --locked --offline --lib --no-run --target x86_64-unknown-linux-musl
  ```

- Integrated host gates on this source revision: `cargo fmt --all -- --check`,
  `cargo clippy --locked --all-targets -- -D warnings`, `cargo test --locked`,
  `cargo build --locked --release`, release `--help` and `--version`, and
  `git diff --check` all exited 0. Default tests included 258 passing library
  tests with two explicitly ignored driver tests, five delivery, nine
  Commit/restore, nine configuration, two runtime, 25 host harness with one
  ignored container scenario, six TUI, five vault import, and two doctests.
  Default tests did not execute the real-container scenario.
- The selected-daemon command in the preceding section ran twice against this
  fingerprint with fresh mutable resources: exit 0, 1/1 passed each time,
  80.77s and 80.77s. The documented unfiltered
  `cargo test --locked --test testcontainers_wireguard -- --ignored --test-threads=1`
  form then ran with the same `DOCKER_HOST` and `WIREGUARD_ADMIN_TEST_*` values:
  exit 0, 1/1 passed in 81.87s; 25 nonignored host tests were filtered out.
  Each run exercised the full M8.5 scenario, including real IPv4 traffic and
  Rustix observations, saved/runtime separation, deletion and verified
  reservation release, both restores, import/reissue, and mandatory-backup
  failures. Exact-name container and network listings were empty after each.
- Independent integrated review found no code defect. Its R1 stale testing and
  evidence statements, R2 general IPv6 gate, and R3 stale milestone summary
  were corrected and each closed on independent re-review. M8 acceptance state
  is recorded in PLANS.md.
- Scope: fixture Apply is test-only and does not prove a systemd/D-Bus job.
  IPv6 capability and traffic were deliberately not tested by user direction;
  production dual-stack behavior is still specified and unverified here. No
  production configuration, key, or service was accessed.