7.0 KiB
Milestone 27 evidence — integrated refactoring handoff
Recorded 2026-10-30T23:18:12+02:00. Baseline HEAD: 7123197ec4a3fad74b71f5c7b598f1d6fd74d3a1, initially clean. Final working tree is uncommitted and changes CONTEXT.md, PLANS.md, docs/PROJECT_LAYOUT.md, docs/architecture/domain-refactoring.md, src/app.rs, src/app/backups.rs, src/app/first_file.rs, src/app/restart.rs, src/runtime/netlink.rs, and src/service.rs. No Cargo manifest, lockfile, dependency, feature, persisted codec, archive, vault, settings-default, WireGuard editor, or fixture file changed in M27. Rust/Cargo 1.97.1, rustfmt 1.9.0, Clippy 0.1.97, native host target. All tests below used synthetic fixtures/PTY only; no production configuration, keys, VPN, host service, Docker daemon, or VM was accessed.
Final inputs
| Input | SHA-256 |
|---|---|
CONTEXT.md |
7dcfa4d86f70fb850f3416d6659275ee28237b5075c5beed82d2a33ad44150a4 |
docs/PROJECT_LAYOUT.md |
f973207e71f20c6c912105c16546a51150acf63551a7f196ecd38d2101e9a44b |
docs/architecture/domain-refactoring.md |
45ad18a43b224f318b0a7e55548d47f7ccea8e2e719e3378ef35f419e3ec8391 |
src/app.rs |
e235ff788c1b5f1ac0ac9951a9c4bb578205dfc65903d3ae80ed9f3142fb38da |
src/app/backups.rs |
b3b01289b20e262c24cfce79c507fe4d3761102df4863a11b3a90b2398b0692f |
src/app/first_file.rs |
d41fa3e2d2150c401ceee9caaeb7268b741a970105e5266123334cd78d977073 |
src/app/restart.rs |
5d26cb877fd8a8211549e15868ccd450729ce3ecb54ea954efd15b379f5a2ce0 |
src/runtime/netlink.rs |
396f4726880c7cf54764d6ff0c67aa1ab2d6c66cd36af7b1be4ca0e04862bab3 |
src/service.rs |
e7c7a4367e2a0dc8a87113e3083d8998e7aebb56f6d4c32d5c763b9f239fa8eb |
target/release/wireguard-admin |
cb6e995d64a7cb7537c5fb17e86d609ca62fff150f519a970febd0800b0d4177 |
Source-input fingerprint from rg --files src tests/support tests/containers tests/testcontainers_wireguard.rs Cargo.toml Cargo.lock | sort | xargs sha256sum | sha256sum: 1b746e31e2e8c96f511c34b51e417b486d65fa0cc17983fa15e12882dd9c6a02. This includes the final test-only backup visibility repair and identifies the host-tested source independently of the dirty plan/evidence files.
Architecture and preservation audit
M19's baseline source was recorded against 23d6180f2478f636c185d67b8bb3788d21656ce3. The coordinator inspected git diff --stat from that commit through M26 HEAD and the changed production/format-sensitive file list; that diff spans the M20–26 application/domain/TUI moves and changes only persistence test references, not its codec. Cargo.toml, Cargo.lock, settings defaults, backup/vault/byte-preserving editor implementation, and synthetic fixture files did not change in that baseline-to-M26 diff. The independent reviewer inspected the integrated refactor against the M19 map, current source and shared preservation matrix, including authority, public identity, unsupported/ambiguous peers, original imports, retained plaintext discipline, short-lived delivery secrets, saved/runtime separation, restart uncertainty, address release, TUI eligibility/generation and public visibility. No unresolved behavior, authorization, or secret-handling regression was found. Historical M19 restore-reservation gap was closed by M23 and is now mapped to actual tests and owner.
The architecture document now gives the three requested end-to-end reading paths with entry point, rule owner, side-effect boundary and failure tests, and resolves each M19 owner/transition to actual M20–26 modules/tests. The glossary remains domain-only and the layout lists present files. ClientStates::draft_mut and Application::vault_draft_mut were already removed. Application::open, add_client, and display_projection have active unit/integration or test-only container callers and remain with explicit caller/retention rationale; production startup/create uses the intended methods. A fixture-only pre-restart backup facade and its helper were restricted to private #[cfg(test)] code. Stale comments describing implemented confirmation, D-Bus and netlink flows as future work were corrected. No test assertion was weakened.
Existing preserved-format and behavior coverage includes the focused config_preservation, commit_restore, client_delivery, runtime_restart, vault_import, and tui_workflow suites below, plus persistence, archive, vault, domain, service and application tests in the full suite. Old fixture inputs still load with unchanged meaning under these host checks; this is synthetic compatibility evidence, not a new real-system run.
Integrated checks
All commands ran in the repository root after the final source repair. Exit 0 unless specified.
| Command | Actual result |
|---|---|
cargo test --locked --test config_preservation |
10 passed, 0 failed |
cargo test --locked --test commit_restore |
9 passed, 0 failed |
cargo test --locked --test client_delivery |
5 passed, 0 failed |
cargo test --locked --test runtime_restart |
3 passed, 0 failed |
cargo test --locked --test vault_import |
5 passed, 0 failed |
cargo test --locked --test tui_workflow |
9 passed, 0 failed |
cargo fmt --all -- --check |
Exit 0 |
cargo clippy --locked --all-targets -- -D warnings |
Exit 0 |
cargo test --locked |
Exit 0; library 352 passed, 2 ignored; integration and 2 doc tests passed; opt-in Alpine tests stayed ignored |
cargo build --locked --release |
Exit 0; artifact hash above |
git diff --check |
Exit 0 |
The first final-gate attempt after making the fixture facade test-only found Clippy dead code in its child helper. The repair made the child helper test-only too; the entire table above was rerun on that final source. The initial failed attempt is diagnostic history, not a passing gate.
Independent review and limits
Fresh reviewer /root/m27_review was separate from implementer /root/m27_implement; repairer /root/m27_repair made bounded fixes. R1 (missing display_projection caller audit), R2 (stale plan resume point), R3 (future-work source comments), and R4 (fixture-only public backup API) were repaired and re-reviewed. R4's first repair exposed the Clippy dead-code helper; the second repair and final gates closed it. The reviewer independently verified the final source, fingerprint and binary hashes, reran formatting, Clippy, full tests, release build and diff check, and confirmed M27-A4 plan/evidence consistency after the register correction. No scoped review finding remains.
M8's last Alpine result used fingerprint b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2; today's final source fingerprint differs. The M8 run is historical and does not validate this source. No explicitly selected current disposable daemon/driver was provided for M27, so Alpine revalidation is incomplete and no Alpine pass is claimed. The retired M9 disposable-VM/systemd checks remain unverified; Alpine would not prove actual systemd/D-Bus behavior. Real IPv6 capability/traffic and release readiness are also unverified. M27 acceptance is limited to host/synthetic scope.