wireguard-admin/docs/RELEASE_READINESS.md

Release readiness and qualification matrix

This is a scope-qualified M9.4 record, not a release approval. M1–M8 are accepted in PLANS.md; M9 real-system acceptance remains incomplete because no explicitly selected disposable systemd VM is available. No production host, VPN, service, key, or configuration was accessed. The operator procedure is in OPERATIONS.md.

Current host release candidate

The following native artifact was built from the current Rust sources with the pinned compiler and locked dependency set. Its --help and --version paths were executed on the development host. This assessment does not establish startup in a guest or supported compatibility with another distribution.

Property	Observed value
Source Git HEAD	f4a6540df9621c9c5e5d1430243f92e749356a59
Working-tree state at build	Pre-existing dirty documentation only: PLANS.md modified and docs/VM_ACCEPTANCE.md untracked; no source, manifest or lockfile changes
Relevant input fingerprint	SHA-256 02ace329ca2ed17aa0b47112a3fcaa090b7d9a7eaa334f293aea9792e35e668a over sorted src/, Cargo.toml, and Cargo.lock file hashes
Compiler and target	rustc 1.97.1, host x86_64-unknown-linux-gnu; Cargo 1.97.1
Build command	cargo build --locked --release — exit 0
Artifact	target/release/wireguard-admin, x86-64 ELF PIE, dynamically linked
Artifact SHA-256	d52d43cd02332352ffbd09c97e3b8095a710359128260c1286006e1c76c1b283
Runtime requirements observed	ELF interpreter /lib64/ld-linux-x86-64.so.2; libc.so.6 (GLIBC symbols through GLIBC_2.39) and libgcc_s.so.1; ldd resolved these on the development host
Artifact smoke	./target/release/wireguard-admin --help and --version — both exit 0; no settings, terminal, root management, service or interface exercised

Commands used to inspect the artifact were sha256sum target/release/wireguard-admin, file target/release/wireguard-admin, readelf -h, readelf -l, readelf -d, readelf --version-info, and ldd target/release/wireguard-admin. The linked GLIBC requirement is an observed lower symbol-version bound, not proof that a distribution satisfying it is otherwise compatible. No installer, package, signature, reproducible-build claim, or supported distribution baseline is provided. This native GNU artifact is not an Alpine/musl artifact.

The source-input fingerprint was calculated from the repository root with:

rg --files src Cargo.toml Cargo.lock | sort | xargs sha256sum | sha256sum

Specification-to-evidence matrix

“Accepted” refers to the repository's existing milestone result. It does not mean every production platform or dual-stack behavior has been qualified. For M1–M7, the concise milestone scope, review outcome and commands are in the corresponding accepted sections of PLANS.md. M8's detailed source, artifact, run and scope record is evidence/milestone-8.md.

Requirement area	Existing evidence	Qualification and limit
Settings validation, executable-relative paths, draft/saved/applied model	M1 accepted record in PLANS.md; M7 startup/workflow record there	Synthetic/unit and TUI workflow coverage; no guest startup or production configuration.
Server configuration authority, client identity by public key, byte preservation and metadata	M2 accepted record in PLANS.md; specification in SPEC.md	Fixture/behavioral evidence for preserving non-client bytes and comments; no real server file was used.
Secret-safe keys, encrypted vault, read-only imports and originals	M3 accepted record in PLANS.md; M8 import/reissue scenario in evidence/milestone-8.md	Synthetic import plus accepted Alpine lifecycle scenario; source originals were fixture files and retained. Vault password loss remains unrecoverable by design.
Backups, mandatory backup boundary, journaled Commit, recovery and previewed restore	M4 accepted record in PLANS.md; M8 restore and backup-failure runs in evidence/milestone-8.md	Saved-state operations and test-fixture behavior covered. Restore did not apply runtime changes; real-VM manual recovery remains unverified. Archives are not encrypted.
Read-only runtime observations, restart orchestration, deadline and failure reporting	M5 accepted record in PLANS.md; runtime section of docs/RUNTIME.md; M8 Rustix observations	Fake-adapter and real Alpine WireGuard reader/IPv4 observations exist. No actual systemd/D-Bus job or Application::restart against real systemd has been run.
Delivery, first issue, password-per-action reissue, QR and private output	M6 accepted record and M7 synthetic PTY/workflow records in PLANS.md; docs/DELIVERY.md	Synthetic behavior covers file publication/reissue and QR rendering/terminal handling. No user device scan or actual client device qualification is recorded.
Native TUI, root/startup boundary and exit/terminal cleanup	M7 accepted record in PLANS.md, including synthetic PTY and workflow checks	Not a real guest root/non-root startup smoke. The release binary was only exercised for help/version on the build host.
Alpine real WireGuard lifecycle and IPv4 traffic	M8.7 in evidence/milestone-8.md	Accepted M8 used the pinned Alpine 3.22.7 fixture and selected disposable Docker daemon; repeated fresh integrated IPv4 scenarios passed on the recorded source fingerprint. Fixture Apply is a test-only callback, not systemd evidence.
Dual-stack behavior	M1–M7 synthetic client/configuration tests; M8 scope declaration	Production IPv4+IPv6 creation/full-tunnel requirements remain in force. Real IPv6 capability and traffic were excluded from M8 and are unverified; an IPv4 result does not qualify IPv6.
Real systemd job, alias/fast completion, failure/timeout, verified apply, restore and release-worker startup	No M9 VM result exists; docs/VM_ACCEPTANCE.md is a reviewed safety/scenario contract	Unverified / M9 incomplete. No selected disposable guest or VM run. Do not infer this from fake service adapters, Alpine or the host --help check.
Native artifact identity and dynamic dependencies	This document's host release-candidate record	Host-only assessment. Guest compatibility and startup are unverified; no universal Linux support claim.

Qualification status and next action

• M1–M8 remain accepted at their recorded scope. Later M9 documentation does not change or broaden their evidence.
• M9.1 has a reviewed, non-runnable VM safety/scenario contract. M9.2–M9.3 real-system work and M9.5–M9.6 review/acceptance remain incomplete.
• The release candidate was built and its ELF dependencies inspected on the host, but has not been copied to or started in a guest. Actual guest architecture/distribution compatibility, root management startup, systemd/D-Bus behavior and service recovery are unverified.
• Real IPv6 capability and tunnel traffic are unverified. No M8 IPv4 or synthetic dual-stack test is a substitute for that qualification.
• No release, installation, production action, Git commit, or deployment is authorized by this report.

Next action: select and explicitly identify a disposable VM/guest satisfying VM_ACCEPTANCE.md, then complete its target guard and real-system scenarios before independent M9 review. Keep systemd/guest results separate from the existing Alpine and synthetic evidence. Any final release statement must retain the real IPv6 qualification gap unless that coverage is explicitly authorized and completed.