wireguard-admin/PLANS.md

Execution Plan

Purpose and authority

This is the living execution plan for WireGuard Admin version 1. It records milestone scope, progress, review findings, and evidence so a new agent can resume from repository files without relying on chat history.

Read AGENTS.md, the specification, architectural decisions, implementation order, and the glossary before execution. The specification defines behavior; this plan schedules its delivery. Approved dependencies are in DEPENDENCIES.md; Alpine/VM testing rules are in TESTING.md. Do not change requirements to make a milestone pass.

Creating this plan does not start implementation or change the active model. All milestones below are initially pending, and no validation results are claimed.

Model roles

Role	Required model	Reasoning effort	Responsibility
Coordinator	GPT-6-Sol (gpt-6-sol)	medium	Refine tasks, dispatch workers, resolve interfaces, verify results, maintain this plan, accept milestones
Implementation worker	GPT-6-Luna (gpt-6-luna)	high	Implement a bounded task and its meaningful tests
Independent reviewer	GPT-6-Luna (gpt-6-luna)	high	Review the actual changes and evidence against acceptance criteria
Repair worker	GPT-6-Luna (gpt-6-luna)	high	Fix review findings and regressions, then report new evidence

These are the user's explicit model choices, not suggestions. Configure them through the execution harness, not by merely telling an agent to impersonate a model. In a harness using spawn_agent, use model="gpt-6-luna", reasoning_effort="high", and fork_turns="none" for workers; supply their context explicitly. Do not silently substitute another model. If the required model or effort is unavailable, report the limitation before starting affected execution. This Markdown file cannot switch the calling coordinator's model.

Sequential execution and ownership

• Number milestones with integers starting at 1. Keep IDs stable, never renumber accepted work or reuse IDs. Append new milestones using the next available integer; add bounded tasks within a milestone when finer scope is needed.
• Execute milestones in ascending order. Start the next milestone only after the current milestone is accepted. Do not bypass an unmet gate because a later task looks independent.
• The coordinator owns PLANS.md, task boundaries, interface agreements, and acceptance. Workers report proposed plan updates; they do not independently mark milestones accepted.
• Default to one implementation writer at a time. Independent tasks within the active milestone may run concurrently only with explicit disjoint file ownership and agreed interfaces. Do not let agents overwrite one another's edits or run competing Cargo manifest/lockfile changes.
• Use subagents for current-task work, not new user-owned chats. Reviewers should be separate agents from implementers and initially read-only. Further delegation must remain within the coordinator's assigned scope and model policy.
• Preserve unrelated user changes. Do not create commits, publish, deploy, or access production merely because a milestone is accepted.

Milestone lifecycle and review loop

Use states pending, in_progress, in_review, needs_changes, blocked, and accepted. A blocked milestone records the concrete missing prerequisite; it is not accepted and its successors remain pending.

1. Prepare. Inspect the actual repository. Expand the active milestone using the template below: concrete files/interfaces, small steps, observable outcomes, exact available commands, and expected results. Identify missing prerequisites before dispatch.
2. Implement. Give a worker a bounded task brief. It implements only the assigned scope, adds focused behavioral tests, and reports changed files, commands/results, assumptions, and unfinished work.
3. Verify and review. The coordinator examines the actual files/diff and checks evidence. A fresh reviewer evaluates correctness, regressions, specification/ADR compliance, security-relevant failure paths, and test coverage. Agent confidence or a prose summary is not acceptance evidence.
4. Repair. Record each actionable finding with an ID, location, impact, expected behavior, and reproduction or validation. Assign a worker to fix it and rerun affected tests. The reviewer rechecks fixes and newly affected behavior.
5. Repeat. Continue review and repair until findings are resolved and acceptance checks pass. Do not stop at an arbitrary iteration count or repeat an unchanged failing approach. Investigate repeated failures, reduce the task, or record a real external blocker. Settled requirements remain unchanged.
6. Accept. The coordinator runs milestone gates against the integrated files, records reviewer disposition and validation evidence, updates progress/outcomes, and marks the milestone accepted. Only then advance. Routine acceptance does not require another user approval; new dependencies outside the approved set and unresolved product decisions retain their existing approval rules.

If a revision invalidates earlier acceptance evidence, record which milestones are affected and reopen the earliest affected milestone before advancing. Keep the integrated state buildable at each accepted milestone.

Worker task brief

Every dispatch must include:

• Milestone ID, task ID, required model/effort, and role.
• User-visible objective, relevant specification sections/ADRs, and prerequisite state.
• Explicit read list, owned files, interfaces to preserve, and out-of-scope work.
• Approved dependencies needed by this task; no permission to add unapproved dependencies.
• Acceptance criteria and commands with expected outcomes; identify tests requiring Docker/VM access.
• Safety boundary: synthetic fixtures only, no production keys/services/configuration, no host-network shortcuts.
• Required report: changed files, checks actually run and their results, findings/risks, and remaining work. No secrets in reports.

For reviewers, provide the same objective and criteria plus the change baseline or exact changed-file list. Ask for independent inspection rather than confirmation of the implementer's conclusions.

Milestone record template

Use this structure when expanding each active milestone. Replace placeholders before dispatch; do not interpret them as completed work.

## Milestone <next integer> — <observable outcome>

Status: pending
Prerequisites: <accepted milestone IDs and environment requirements>

### Outcome and scope
<What becomes possible, boundaries, and links to governing requirements.>

### Context and implementation steps
<Actual paths, current state, interfaces, task ownership, and ordered steps.>

### Acceptance and validation
- [ ] <Observable behavior and test/demonstration proving it.>
- [ ] <Relevant failure behavior and how it is verified.>
Commands: <exact commands, working directory, prerequisites, expected results>

### Progress
- [ ] <Task ID and owner/agent ID; timestamp when updated>

### Review and repair
| Finding | Iteration | Location and impact | Owner | Resolution and evidence | State |
| --- | --- | --- | --- | --- | --- |

### Evidence and handoff
<Commands actually run, exit/results, artifact paths, reviewer disposition,
remaining limitations, next concrete action.>

### Decisions and discoveries
<New facts/trade-offs, reasons, and ADR references when warranted.>

### Outcome
<Coordinator acceptance decision and timestamp, or exact blocker.>

Use ISO 8601 timestamps with offsets for progress. Keep evidence concise and reproducible, following execution records; diagnostic attempts belong outside this plan. Use redacted excerpts or artifact paths rather than large logs. Distinguish planned commands from executed commands and unavailable checks from passing checks. Keep the plan self-contained by summarizing discoveries that affect the next task, not just linking to an agent conversation.

Validation gates

For Rust milestones, use the relevant focused tests and the formatting, Clippy, default tests, and release-build commands in AGENTS.md. Add exact commands when targets exist; do not invent passing outputs. Unit and fixture checks run without root. Use standard-library test adapters rather than an additional mock framework.

Container suites are opt-in and use pinned/cached Alpine images, fresh server/client containers, synthetic keys, isolated networking, and scoped NET_ADMIN. The real runtime adapter executes inside the server container. Missing prerequisites required by a suite are incomplete validation, not success. Milestone 8 validates IPv4 networking only by user direction; IPv6 capability and traffic remain unverified while the production dual-stack requirement remains in force. Alpine fixture application is not a production systemd test.

Actual systemd/D-Bus acceptance runs in a disposable VM. Never use production to fill gaps in test coverage. Final release acceptance requires relevant unit, Alpine WireGuard, and VM systemd results reported separately. Document blockers without silently weakening the gate.

Milestone register

Each row is a delivery milestone, not a completion claim. Expand its record before execution; retain its original ID and acceptance scope.

ID	Milestone	Prerequisites	State
1	Rust foundation, settings, and domain states	None	accepted
2	Server configuration editing with byte preservation	1	accepted
3	Client keys, encrypted vault, and existing-client import	2	accepted
4	Backups, safe Commit, and full restoration	3	accepted
5	Runtime observation and systemd restart adapter	4	accepted
6	Client configuration delivery and reissue lifecycle	5	accepted
7	Complete terminal management workflow	6	accepted
8	Alpine Testcontainers integration	7; suitable disposable Docker environment	accepted
9	Real systemd acceptance and release readiness	8; disposable systemd VM	retired
10	Visible styled keyboard quick reference in bottom panel	8; existing M7 TUI	accepted
11	Valid subnet routes shown as a capability limitation	10	accepted
12	Aligned, responsive client table	11	accepted
13	Compact terminal QR disclosure	12	accepted
14	Restart verification for valid legacy peers	13	accepted

Milestone 1 — Rust foundation, settings, and domain states

Status: accepted (2026-10-18T18:59:35Z; independent R2 re-review and coordinator gates passed). Prerequisites: no previous milestone; verified GPT-6-Sol/medium coordinator and GPT-6-Luna/high workers, the pinned native Rust environment, and registry access or cached approved dependencies. Docker, root, a running VPN, and musl linking are not required for this milestone.

Outcome and scope

Deliver a compilable single-package foundation that can read validated settings relative to the executable, represent client identities and draft/saved/applied states, and allocate IPv4/IPv6 addresses without touching a real server. Startup supports --help and --version without root, settings, or vault access. Management startup checks root before attempting privileged operations.

This is a foundation, not a working VPN manager. Until later milestones wire in the TUI, management startup must explain that the management interface is not implemented and exit nonzero without reading a real server config or changing anything. Do not display a successful management session for a placeholder.

Read SPEC.md sections Purpose, Data locations, Data sources, New client parameters, and Operations and states; all three ADRs; and docs/ENVIRONMENT.md, docs/PROJECT_LAYOUT.md, docs/DEPENDENCIES.md, and docs/DEVELOPMENT.md. No WireGuard document edits, key generation, vault/import, backups/Commit writes, systemd/runtime adapters, QR, TUI, or container infrastructure are implemented here.

Context and implementation steps

At preparation, the repository contained design/Codex documents and rust-toolchain.toml, but no Cargo.toml, Cargo.lock, or source tree. The toolchain pin is 1.97.1 and the created manifest uses edition 2024. Local system tools match; rustup is absent. Musl standard library/linker readiness remains deferred to milestone 8.

Execute the tasks below sequentially with one implementation writer. For each task dispatch, the coordinator supplies exact document sections and the interface contract established by the prior task. Workers do not edit PLANS.md or accept work.

Task	Owner	Files and deliverable
M1.1	implementer	Cargo.toml, Cargo.lock, src/main.rs, src/lib.rs, narrow startup/error modules as needed, README.md and .gitignore: package scaffolding, arguments, root boundary, safe incomplete-management behavior
M1.2	implementer	src/config.rs, config/wireguard-admin.example.toml, settings tests: typed settings, validation, and executable-relative paths
M1.3	implementer	src/domain.rs and child modules only if needed, domain tests: public-key identity, change states, address allocation and reservation rules
M1.4	reviewer, then repairer as needed	Independently inspect the integrated M1 changes and acceptance evidence; coordinator assigns bounded repair files and finding IDs
M1.5	coordinator	Run integrated gates, update outdated scaffolding statements, record evidence and acceptance in this plan

M1.1 creates package wireguard-admin, binary wireguard-admin, library wireguard_admin, edition 2024, and rust-version 1.97.1. Keep main thin, parse only the small agreed argument surface with std, and test the effective-UID boundary through an injectable/pure decision rather than requiring root tests. Unknown arguments fail clearly. Preserve existing documentation/configuration. Add narrow ignores for local deployment data without hiding config examples or synthetic fixtures. Do not create placeholder files for all future modules.

M1.2 uses TOML with explicit required fields for interface name, server config path, client source directory, server endpoint, IPv4 and IPv6 allocation ranges, DNS addresses, systemd unit, and nonzero restart timeout. Data root is optional and defaults to executable-directory/Backup with data and archives beneath it. Choose and document a fixed settings filename alongside the executable; do not add a new CLI settings override. Resolve relative configured paths consistently against that directory, never the process working directory. Separate parsing, validation, and resolution so tests do not read the host environment. Do not require referenced production files or systemd to exist to validate settings.

Validate address families, ranges, endpoint syntax, usable service/interface names, DNS values, and timeout. Do not resolve DNS over the network in a settings test. Endpoint validation must support a hostname or IP with a port and bracketed IPv6. Document the resulting settings schema in the example and README.

M1.3 represents a public key as a validated 32-byte identity with standard WireGuard Base64 parsing; duplicate aliases remain valid. Keep applied snapshots separate from saved and draft state. Model unavailable runtime state explicitly. Pass existing/server/reserved addresses as inputs; do not query real interfaces. Deletion from draft alone must not reserve an address as if saved; committed removal retains the address until an explicit successful-apply transition. Discarded drafts restore saved allocation availability. This milestone tests these transitions as pure model behavior, not an actual Commit implementation.

Allocate the first usable free address with bounded work proportional to the occupied set, not subnet size. Exclude supplied server/occupied/reserved addresses and IPv4 network/broadcast addresses where applicable. Handle /31, /32 and narrow IPv6 ranges explicitly, avoid arithmetic overflow, and return clear exhaustion errors. Manual addresses must match the configured family/range and be available. Do not silently add IPv6 to imported IPv4-only model records.

Approved direct dependencies for this milestone: serde (derive), toml, thiserror, ipnet, time when timestamps are needed, base64 for public-key representations, and rustix for the effective-UID query. Use tempfile as a dev-dependency for filesystem/subprocess fixtures if needed. Select compatible versions/features; no unapproved crate or premature crypto/TUI/container dependency. Generate the initial Cargo.lock once dependency choices are resolved; then use --locked.

Acceptance and validation

• M1-A1: package/library/binary compile under the pinned native toolchain; Cargo.lock is tracked and no unrelated dependency or file scaffolding is added.
• M1-A2: help/version work without root or settings, unknown arguments fail, and management startup rejects non-root before privileged access. Root-path behavior is covered by injection, without running the application as root.
• M1-A3: valid TOML yields typed settings; missing/invalid fields produce actionable errors without opening a real server config, vault, or service.
• M1-A4: executable-relative paths and defaults remain identical from two different working directories; test via pure path inputs or subprocesses, not parallel process-wide current-directory mutation.
• M1-A5: valid/invalid public keys, repeated aliases, explicit unknown runtime state, draft discard, and saved/applied divergence have behavioral coverage.
• M1-A6: IPv4/IPv6 first-free selection, manual selection, occupied/server exclusions, tiny ranges, exhaustion, and deferred release are verified. A large IPv6 range test demonstrates that allocation does not scan the entire subnet.
• M1-A7: all standard gates pass without root/Docker/production access; a fresh independent reviewer has no unresolved actionable findings.
• M1-A8: README describes the limited executable and setup honestly; commands, example settings, and source paths match actual implementation. Update the design-only statement in AGENTS.md when source scaffolding really exists.

Planned commands from the repository root after Cargo.toml and lockfile exist:

cargo metadata --locked --no-deps --format-version 1
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version

Expected: zero exits for these commands, successful help/version without settings, and all ordinary tests pass as an unprivileged user. Argument/root rejection and working-directory independence are exercised by tests. Record actual focused test commands when test names exist. Do not execute a bare management launch as root. No Alpine build, container tunnel, or VM/systemd check is claimed by M1 acceptance.

Progress

• Preparation: toolchain configuration and environment observations recorded; this is not application implementation or milestone acceptance.
• M1.1 — implementer (/root/implementer_m1_1), 2026-10-18T18:47:43Z; package and startup boundary integrated.
• M1.2 — implementer (/root/implementer_m1_2), 2026-10-18T18:50:19Z; typed settings, validation, paths, example, and tests integrated.
• M1.3 — implementer (/root/implementer_m1_3), 2026-10-18T18:54:21Z; domain model, allocation, and tests integrated.
• M1.4 — fresh reviewer (/root/reviewer_m1_r1) R1 and R2, repairer (/root/repairer_m1_r1) for domain finding; all findings closed 2026-10-18T18:59:35Z.
• M1.5 — coordinator integrated validation and acceptance completed 2026-10-18T18:59:35Z.

Review and repair

Finding	Iteration	Location and impact	Owner	Resolution and evidence	State
M1-R1-01	R1/R2	src/domain.rs constructor can claim verified without a matching applied snapshot; misleading state	repairer	constructor rejects inconsistent Verified; Commit/mismatch demote stale Verified; 13 focused, 22 total tests passed; R2 confirmed	closed
M1-R1-02	R1/R2	AGENTS.md still claims no Rust application exists	coordinator	opening statement updated to limited scaffold; R2 confirmed	closed
M1-R1-03	R1/R2	Cargo.lock existed outside Git index	coordinator	git add -N Cargo.lock; git ls-files --error-unmatch Cargo.lock succeeds; R2 confirmed; no commit/content staging	closed

Evidence and handoff

Preparation verified local rustc/Cargo 1.97.1, formatter and Clippy availability; rustup/musl readiness limitations are in docs/ENVIRONMENT.md. This execution verified the active coordinator turn as gpt-6-sol/medium from session turn context; project agent files and [agents] defaults specify gpt-6-luna/high. The repository had no Cargo manifest/source and a clean worktree at 2026-10-18T18:45:43Z. Current rustc/Cargo are 1.97.1, with rustfmt 1.9.0 and Clippy 0.1.97. No prior milestone exists. M1.1 added Cargo.toml, Cargo.lock, src/{main,lib,startup}.rs, and updated README/.gitignore. The coordinator inspected those files and the working tree. The worker reported passing locked metadata, fmt, Clippy, four startup tests, release build, release help/version, and diff check; integrated M1 gates remain pending. Cargo registry search failed, but approved rustix 1.1.5 resolved from local cache. M1.2 added src/config.rs, the example settings TOML, approved serde/toml/thiserror/ipnet dependencies, and README settings guidance. The coordinator inspected the files. The worker reported five focused settings tests and nine total tests passing, along with locked metadata, fmt, Clippy, release build, and diff check. Cargo resolution required an approved network-enabled retry after sandbox DNS failure. Independent review remains pending. M1.3 added src/domain.rs, its library declaration, and approved base64 dependency. The coordinator inspected the files. The worker reported 12 focused domain tests, 21 total tests, locked metadata, fmt, Clippy, and release build passing. The three implementer turns were independently verified from their session turn contexts as gpt-6-luna/high. Next: fresh review of the integrated milestone. R1 reviewer turn context was also verified as gpt-6-luna/high. R1 ran locked metadata, fmt, Clippy, 21 tests, release build, and help/version; all passed. It reported findings M1-R1-01 through M1-R1-03 above. No production, container, VM, or root management launch was used. Repairer turn context was verified as gpt-6-luna/high. Its domain repair passed 13 focused tests, 22 total tests, fmt, Clippy, and release build. The coordinator updated AGENTS.md and marked Cargo.lock intent-to-add in the Git index after a sandbox write denial and approved escalation. git ls-files now recognizes it; no Git commit was created. R2 re-review closed all three findings with no new actionable issues. Its turn context was verified as gpt-6-luna/high.

Coordinator integrated gates on 2026-10-18: cargo metadata --locked --no-deps --format-version 1, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked (22 passed), cargo build --locked --release, release --help, release --version, and git diff --check all exited 0. Unknown argument and a bare management launch as UID 1000 exited 2 with clear diagnostics, as expected. git ls-files --error-unmatch Cargo.lock exited 0; the file is intent-to-add in the Git index and its contents are not staged or committed. Unit/fixture evidence only; Alpine WireGuard and disposable systemd VM checks are later milestones and were not run. No production configuration, key, service, or VPN was accessed.

Decisions and discoveries

Use the already installed native compiler release as the reproducible baseline, not an unpinned stable channel. The toolchain file is consumed by rustup proxies; the current system-packaged binaries require explicit version checks. This is an environment constraint, not permission to install packages or alter global tools.

Outcome

Accepted 2026-10-18T18:59:35Z after independent review and integrated gates. The executable currently exposes help/version and safe startup errors; settings and domain operations are library logic. Management/TUI behavior remains for later milestones. Stop here; next milestone is 2 and has not started.

Milestone 2 — Server configuration editing with byte preservation

Status: accepted (2026-10-18T19:26:14Z; independent R3 review and integrated gates passed). Prerequisites: milestone 1 accepted; pinned native Rust environment and approved cached dependencies or registry access. No root, WireGuard, systemd, Docker, or production files are required.

Outcome and scope

Deliver a pure library API that parses an existing server configuration, inspects its client entries, and prepares additions, deletions, alias changes, and managed metadata updates entirely in memory. Rendering an unmodified parsed document must reproduce the original bytes exactly. Editing a client must preserve every byte outside the explicitly owned edit spans.

Governing requirements: SPEC.md Data sources, Operations and states, Importing existing clients, and configuration-preservation acceptance criteria; ADRs 0001 (no implicit apply) and 0003 (server authority); PROJECT_LAYOUT.md, DEVELOPMENT.md, DEPENDENCIES.md, and TESTING.md. Follow the existing model and module conventions instead of introducing a second client identity system.

Out of scope: reading production files, filesystem write/Commit orchestration, key generation, client-file scanning/import and cryptographic matching, vaults, backups, TUI, runtime/systemd actions, and network integration tests. Startup must retain the safe incomplete-management behavior from milestone 1.

Existing code and integration constraints

• src/lib.rs currently exposes config, domain, and startup only.
• domain::PublicKey parses canonical Base64 into 32 bytes and provides identity, equality, ordering, and formatting. Reuse it for lookup; never identify peers by alias or position alone. domain::validate_alias rejects empty/control text while allowing repeated aliases across clients.
• domain::Client contains identity, alias, and ClientAddresses with mandatory IPv4 plus optional IPv6. Snapshot rejects duplicate public keys. The document representation must not force every existing [Peer] into these narrow types.
• Existing peers may have multiple AllowedIPs, network prefixes, missing fields, duplicate keys, IPv6-only addresses, unknown parameters, or malformed metadata. Retain their original spans and return explicit inspection issues. Do not pick the first address, collapse routes, drop a peer, or invent missing values to force a successful conversion. Provide an explicit fallible projection for compatible records; keep unsupported records available for inspection.
• Settings already expose resolved server paths but this milestone consumes supplied document content only. ClientStates models pure draft/saved/applied transitions; parsing/rendering must not mutate it or claim anything is applied.
• Cargo already includes base64, ipnet, rustix, serde, thiserror, and toml. No generic INI parser or new unapproved dependency is needed. Approved time may be added for UTC timestamp validation; do not add crypto or TUI crates early.

Context and implementation steps

Run tasks sequentially with one writer. The coordinator supplies relevant requirements, acceptance IDs, owned files, and prior interface agreements to each worker. Use GPT-6-Luna/high implementer, a separate reviewer, and repairer under the GPT-6-Sol/medium coordinator. Workers do not edit milestone acceptance state.

Task	Owner	Files and deliverable
M2.1	implementer	src/wireguard.rs, src/wireguard/document.rs, src/lib.rs, focused tests: lossless document/span representation and peer inspection
M2.2	implementer	src/wireguard/metadata.rs, document integration, docs/CONFIG_FORMAT.md: versioned managed comment grammar and validated metadata
M2.3	implementer	wireguard module and narrow domain adapters: atomic in-memory add/delete/rename/metadata preparation keyed by PublicKey
M2.4	implementer	tests/config_preservation.rs, tests/fixtures/wireguard/, README/library usage documentation: integrated preservation and failure scenarios
M2.5	reviewer, repairer	Independent integrated review, bounded fixes and regression checks, re-review
M2.6	coordinator	Integrated gates, evidence/findings ledger, acceptance and next handoff in PLANS.md

M2.1 defines document ownership before editing. Preserve section order, whitespace, line endings (LF/CRLF, including mixed endings), blank lines, unknown directives, comments, and absence of a final newline. Use retained source bytes and spans, not reconstructed serialization or a map keyed by property name. Separate raw storage from parsed public views; errors and Debug must not expose the raw server text, Interface PrivateKey, or peer PresharedKey. Unknown/unparseable content is preserved, not silently normalized. Document supported input encoding; invalid text must either remain losslessly opaque or be rejected without lossy decoding.

Recognize WireGuard sections and key/value syntax deliberately. Repeated [Peer] sections are expected; repeated/conflicting identity fields or the same public key in multiple peers are ambiguous, not last-write-wins. Inspect them with issues and refuse edits whose target or boundaries cannot be established safely.

M2.2 specifies a uniquely recognizable managed block immediately before its peer, with begin/end markers, explicit format version, alias, and optional creation UTC timestamp. Before M2.3, document the exact grammar, escaping, ownership and attachment rules, supported versions, unknown-field policy, and examples in docs/CONFIG_FORMAT.md. Use unambiguous single-line encoding for aliases so #, =, quotes, Unicode, or marker-looking text cannot create directives/sections. Reject control/newline injection using domain validation. Reuse approved parsing facilities where useful; a TOML-encoded string within comments does not mean the server file itself is TOML. Never put secrets or a second public-key copy in the block. Existing peers with unknown creation date have no fabricated timestamp.

Metadata absence is a legacy state, not corruption. Use a shortened public-key fallback only in a public view; do not persist it as a chosen alias implicitly. Client filename fallback belongs to later import work. Malformed, duplicated, misattached, or unsupported-version blocks must yield explicit issues and block unsafe metadata edits; do not overwrite them as if absent or interpret arbitrary administrator comments as managed blocks.

M2.3 adds a new peer from validated public identity and supplied client addresses, not a newly generated key. New host routes use /32 and /128 as appropriate; existing AllowedIPs and connection parameters remain unchanged on alias edits. Allow IPv4-only existing clients, repeated aliases, and caller-supplied timestamps. Existing-peer metadata preparation is an explicit edit, not a side effect of parse. A rename changes only the owned alias representation (or inserts an explicit new managed block when safely absent), preserving any known creation date.

Deletion removes only the selected peer's owned section content and attached managed block. Define handling of administrator comments around and within the peer so deleting it never removes/reassigns another peer's managed metadata or unrelated comments. Sections such as [Interface], PostUp/PostDown, and arbitrary server directives must never be rewritten or executed. Unknown peer directives are retained on non-deletion edits; deletion deliberately removes the selected peer's configuration, not neighboring content.

Validate each edit completely before applying it. Missing/ambiguous target, invalid key/alias/address/metadata, or unsupported structures must leave the original document unchanged. Sequential edits recompute or otherwise maintain valid spans; no stale offsets after insertions/deletions. Rendering never writes files and must not invoke commit_draft, system tools, or runtime adapters.

M2.4 uses synthetic fixture data only. If secret-shaped input is required for preservation/redaction checks, generate dummy values in the test or clearly mark non-production placeholders; do not print full fixtures in assertion failures. Prefer comparisons of preserved slices and precise changed spans over brittle snapshots of the entire file. No real server sample is needed or permitted.

Acceptance and validation

• M2-A1: unmodified round trips are byte-identical for LF, CRLF, mixed endings, no final newline, whitespace/comments, unknown directives, and multiple peers.
• M2-A2: parse/inspection/edit/render operate only on caller-supplied data; no filesystem persistence, live config access, runtime mutation, or startup change.
• M2-A3: public identity reuses PublicKey; duplicate aliases are supported; malformed/missing/duplicate keys and unsupported address shapes remain visible as issues rather than being silently normalized into Snapshot/Client.
• M2-A4: new peer addition, selected-peer deletion, rename, and explicit legacy metadata insertion affect only intended spans; all server parameters and unrelated administrator comments remain byte-identical.
• M2-A5: the exact metadata format is documented with supported version, escaping/attachment rules and examples. Missing creation dates stay missing; rename preserves known dates, and no key copy or secret appears in metadata.
• M2-A6: malformed/unknown-version/misattached blocks and ambiguous peers are preserved and reported; unsafe edits fail without changing any original bytes.
• M2-A7: boundary cases cover first/last/adjacent peer removal, inter-peer comments, Unicode/quoted/marker-like aliases, control injection, and repeated edits with no stale spans. Rendering an edit result and parsing it again produces the intended public records without modifying untouched content.
• M2-A8: unsupported routes, multiple addresses and IPv6-only records round-trip unchanged; projection to the narrow M1 model fails explicitly when necessary.
• M2-A9: errors/Debug never disclose secret-bearing source lines or complete documents; input rejection does not corrupt the caller's document.
• M2-A10: existing M1 tests and startup help/version behavior remain intact; focused/full gates pass and independent review has no unresolved findings.

Planned commands from the repository root, after M2 targets exist:

cargo test --locked wireguard
cargo test --locked --test config_preservation
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

Use unit-test names containing wireguard for the focused filter, and verify that the filter actually runs tests. All commands above should exit zero; negative cases are assertions inside passing tests, not ignored failures. Run as an unprivileged user with synthetic input. Dependency resolution is needed only if approved time is introduced; update Cargo.lock before --locked gates. Document the exact commands/results and test counts when execution occurs. No container or VM result is required or claimed for this pure-library milestone.

Progress

• Description prepared from the current M1 code and approved documents.
• M2.1 — implementer (/root/implementer_m2_1) completed 2026-10-18T19:10:30Z; lossless parser/inspection integrated.
• M2.2 — implementer (/root/implementer_m2_2) completed 2026-10-18T19:14:23Z; v1 metadata grammar, attachment, and format document integrated.
• M2.3 — implementer (/root/implementer_m2_3) completed 2026-10-18T19:17:05Z; pure peer edits/projection integrated.
• M2.4 — implementer (/root/implementer_m2_4) completed 2026-10-18T19:20:05Z; fixture suite and README integrated with one retained failing assertion.
• M2.5 — fresh reviewer (/root/reviewer_m2_r1) completed R1/R2/R3; repairer (/root/repairer_m2_r1) resolved both findings; R3 found no remaining issue.
• M2.6 — coordinator integrated gates passed and acceptance recorded.

Review and repair

Finding	Iteration	Location and impact	Owner	Resolution and evidence	State
M2-R1-01 (M2-I-01)	implementation/R1	src/wireguard/edit.rs:214 rename rebuilt full metadata block and normalized mixed endings outside alias bytes	repairer	Replaced only the encoded alias value; mixed-ending regression and R2/R3 review passed	closed
M2-R2-01	R2	PeerInspection.issues omitted valid but unsupported address shapes, contrary to M2-A3	repairer	Added redacted unsupported-shape/missing-IPv4 issues and fixture assertions; R3 review passed	closed

R1 found the preservation defect. R2 confirmed that fix and found the inspection gap. R3 confirmed both repairs and found no remaining actionable issue. The byte-preservation assertion was retained; unsupported records remain visible.

Evidence and handoff

Planning inspected Cargo.toml, src/lib.rs, domain public-key/client/state types, settings interfaces, M1 acceptance evidence, and governing documents. M1 records 22 passing tests and independent R2 acceptance; this planning task did not rerun those checks and makes no new application-validation claim. No M2 source edits, workers, Cargo commands, production files, containers, or services were involved.

Execution verified the active coordinator turn as gpt-6-sol/medium from session turn context. M1 is accepted. At execution start the only existing worktree change was this prepared M2 record in PLANS.md; no M2 source files existed. Rustc/Cargo 1.97.1, rustfmt 1.9.0, and Clippy 0.1.97 are available. M2.1 contract: a caller-supplied byte buffer with retained source/spans, a public peer inspection view keyed by the existing PublicKey, secret-free issues/errors/Debug, and exact unchanged-byte rendering. Invalid UTF-8 may be rejected with a redacted error. Editing remains for later tasks. Next action: dispatch M2.1. No M2 validation result is claimed yet. M2.1 added src/wireguard.rs, src/wireguard/document.rs, and a library declaration. The coordinator inspected the actual files. The parser retains a UTF-8 source buffer and byte spans, rejects invalid UTF-8 without echoing it, reports peer identity/route issues without losing raw content, and renders unchanged bytes exactly. The worker reported seven focused wireguard tests, 28 full tests, fmt, Clippy, release build, and diff check passing. Its turn context was verified as gpt-6-luna/high. Metadata grammar and edits remain unimplemented; next action is M2.2. M2.2 added src/wireguard/metadata.rs, integrated metadata inspection in the document module, and documented v1 grammar in docs/CONFIG_FORMAT.md. The coordinator inspected those files. Valid blocks expose alias, optional UTC creation time, and owned span; malformed/unsupported/misattached blocks yield redacted issues. The worker reported 14 focused wireguard tests, 35 full tests, fmt, Clippy, release build, and diff check passing; no new dependency. Its turn context was verified as gpt-6-luna/high. Next action is M2.3. M2.3 added src/wireguard/edit.rs and API exports for add/delete/rename, explicit legacy metadata insertion, and fallible projection. The coordinator inspected the code. The worker reported 21 focused wireguard tests, 42 full tests, fmt, Clippy, release build, and diff check passing. Its turn context was verified as gpt-6-luna/high. Next: M2.4 fixture-level behavioral tests and README updates, then independent review. M2.4 added tests/config_preservation.rs, a synthetic server fixture, and README library API guidance. The coordinator inspected those files. Focused integration results: eight passed, one failed at the mixed-ending metadata rename assertion (M2-I-01). Full cargo test --locked likewise has 42 unit tests passing but fails on that integration assertion. Fmt, Clippy, release build, and diff check passed. Its turn context was verified as gpt-6-luna/high. No acceptance gate is claimed passing while this fails. Next: fresh independent review of all M2 changes and the recorded defect. R1 reviewer turn context was verified as gpt-6-luna/high. It reproduced M2-R1-01, ran 21 focused wireguard tests passing, and found fmt, Clippy, release build, and diff check passing. Integrated test/full test remain red. Next: repair M2-R1-01, then R2 re-review. The repairer was configured as gpt-6-luna/high. First repair restricted an existing valid metadata rename to its encoded alias value. R2 independently confirmed the mixed-ending regression passed and identified M2-R2-01: valid unsupported routes were not reported in PeerInspection.issues. The second repair added redacted address-shape issues and their behavioral assertions, while retaining raw routes, safe metadata edits, and fallible projection. It also replaced a parser expect on user input with a redacted typed error. R3 independently verified both repairs and reported no further actionable finding. R2/R3 reviewer turns used the same independently spawned gpt-6-luna/high reviewer; it remained read-only throughout.

Coordinator integrated gates on the final M2 source, run unprivileged with synthetic input on 2026-10-18: cargo test --locked wireguard passed 21 tests; cargo test --locked --test config_preservation passed 9 tests; cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo build --locked --release, and git diff --check exited zero; cargo test --locked passed 42 unit and 9 integration tests (0 doc tests); release --help and --version exited zero with the existing safe startup output. The focused filter was verified to execute 21 tests. No production files, host VPN/service, container, or systemd VM was accessed; real-system checks are not required for this pure-library milestone and are not claimed.

Decisions and discoveries

M1's ClientAddresses cannot represent every valid existing AllowedIPs layout. Keep a lossless document model plus explicit projection issues rather than broadening product scope or truncating existing settings. Metadata grammar and comment ownership must be settled and documented before edit implementation. No new ADR is required merely for moving parser code into the planned modules.

Outcome

Accepted after independent R3 review and all M2-A1–A10 checks. No M2 blockers remain. Stop here; milestone 3 is the next action only on a new request.

Milestone 3 — Client keys, encrypted vault, and existing-client import

Status: accepted (2026-10-19T20:08:32Z; independent R7 review and coordinator gates passed). Prerequisites: milestones 1 and 2 accepted; pinned native Rust environment and access to compatible approved cryptographic dependencies or a populated cache. No root, running WireGuard, systemd, Docker, VM, or production input is needed.

Outcome and scope

Deliver library operations for WireGuard client key generation, encrypted vault initialization, password-free encryption of new records, password-authorized secret retrieval, and safe reconciliation/import of existing client files. Reuse M1 identities/settings and M2 server inspection without rewriting originals.

Read SPEC.md Data sources, Encrypted vault, Importing existing clients, Connection delivery, and Backups and restoration; ADRs 0002 and 0003; CONFIG_FORMAT.md; DEPENDENCIES.md, DEVELOPMENT.md, and TESTING.md. Preserve the distinction between vault encryption, server secrets, and an unencrypted output file.

This milestone prepares versioned vault bytes and encrypted import results; filesystem persistence/Commit and its mandatory backups belong to milestone 4. Initial setup prepares encryption of valid existing files immediately in the same setup operation, but must not install a vault, rewrite the server, or bypass the later persistence gate. Use supplied buffers and an explicit read-only source adapter; no automatic scan at application startup. TUI/password prompts, delivery files/QR and first-delivery session orchestration belong to milestones 6 and 7. No runtime or service operations are introduced.

Existing code and integration constraints

• M1 provides domain::PublicKey, Client, ClientAddresses, Snapshot, ClientStates, and validated/resolved settings, including the source directory and data paths. Public keys, not filenames or repeated aliases, identify secrets.
• M2 exposes wireguard::ConfigDocument::parse, render, peers, sections, and source_slice, plus explicit add/delete/rename/legacy-metadata edits. PeerInspection provides identity candidates, AllowedIPs, metadata, and issues. Its raw source may contain secrets; never expose it through import reports.
• project_client requires valid attached metadata and a supported address shape. Do not make successful projection a prerequisite for preserving or reconciling existing records. Missing metadata, IPv6-only peers, extra routes, and ambiguous keys must remain inspectable rather than being silently dropped or normalized.
• Managed metadata is already v1: Base64url alias and optional strict UTC creation string in an attached comment block. Keep that grammar unchanged. The server alias wins; a filename/public-key fallback is display-only until an explicit metadata edit. Do not assign import time as an unknown creation date.
• Server parsing is not client parsing: a client file's [Interface] PrivateKey identifies the client, while its [Peer] PublicKey normally identifies the server. Never use that server key as the client's identity.
• Cargo currently contains base64, ipnet, rustix, serde, thiserror, and toml. Add only the approved crypto crates needed here: age, x25519-dalek, getrandom, secrecy, and zeroize; tempfile may be a dev-dependency for source-adapter tests. Verify current official APIs, maintained compatible versions, feature flags, and secret-type compatibility before choosing them. No custom cipher/KDF, OpenSSL subprocess, wg genkey, unapproved crate, or unrelated upgrade.

Context and implementation steps

Run these tasks sequentially with one writer. GPT-6-Sol/medium coordinates; GPT-6-Luna/high implements, reviews independently, and repairs. The coordinator supplies scope, owned files, relevant documents, accepted interfaces, checks, and required report contents. Workers do not accept milestones or edit PLANS.md.

Task	Owner	Files and deliverable
M3.1	implementer	src/vault.rs, optional src/vault/keys.rs, src/lib.rs, Cargo files: secret-safe WireGuard key types, generation and matching
M3.2	implementer	src/vault/ modules as needed, docs/VAULT_FORMAT.md: asymmetric vault setup, password-protected identity, versioned envelopes and load validation
M3.3	implementer	src/vault/import.rs or a narrow import module: caller-buffer client parsing, reconciliation reports and encrypted import preparation
M3.4	implementer	read-only configured-directory adapter, tests/vault_import.rs, synthetic temporary inputs and README guidance: initial setup/import workflow and failure coverage
M3.5	reviewer, repairer	Independent crypto/use-of-library, import and integrated regression review; bounded fixes and re-review
M3.6	coordinator	Integrated gates, findings/evidence and acceptance/handoff in PLANS.md

M3.1 wraps private keys/passwords in secret-aware containers with redacted or no Debug, no implicit Display/Serialize, and explicit exposure only at necessary cryptographic/encoding boundaries. Generate WireGuard-compatible private keys using OS randomness and derive their public key using x25519-dalek. Preserve canonical WireGuard Base64 on output; validate decoded length/encoding on input. Keep imported private-key bytes intact rather than replacing them with newly generated keys. Test generation/derivation and matching without leaking values in assertion failures. Handle random-source errors as recoverable errors.

M3.2 initializes a separate age recipient/identity pair, never reusing a WireGuard key. Store only the recipient and password-encrypted vault identity in the public serialized bundle; encrypt each client record to that recipient without requiring the password. Use the age library's established authenticated encryption and password protection; do not implement the cryptographic construction manually.

Document exact v1 vault/record formats, component filenames/layout intended for M4, version handling, public record identifiers, and size limits before encoding production data. Use serde/TOML or opaque age payloads as appropriate, without silently introducing a second serializer dependency. Ensure serialization cannot write plaintext secrets through a generic derive. Reject unknown versions and truncated/oversized structures with redacted typed errors.

Bind the decrypted payload to its expected client public key and vault context; derive its public key again and reject mislabelled/swapped records. On unlocking, verify the decrypted vault identity matches the declared recipient. Do not allow public envelope metadata alone to authorize a key's identity or reissue status. Do not invent cryptography to authenticate a plaintext index: document the limits of unauthenticated public metadata and perform the necessary checks after decrypt.

Each authorized retrieval accepts a fresh password, decrypts only for that operation, validates binding, and returns an explicit short-lived secret result. Do not cache an unlocked identity, retain the password between requests, or fall back to original plaintext files after wrong password, missing/corrupt records, or password loss. Keep cloning/exposure of secrets minimal; zeroize supported owned buffers on drop and document unavoidable library-managed copies without claiming all process memory can be erased. Password-policy/UI additions are not part of this milestone.

M3.3 parses supplied client content without generic lossy INI serialization. Require one unambiguous client private key and derive its PublicKey for matching. Validate client Address values while retaining enough information to report unsupported shapes and compare addresses rather than conflating client prefixes with server host routes. Preserve existing optional connection parameters needed later, including any valid preshared secret, inside the encrypted payload; do not introduce new MTU/keepalive/PSK settings or generation. Reject ambiguous or malformed secret fields rather than choosing the last occurrence. Do not run PostUp/hooks, resolve DNS, mutate routes, or execute text from imported files.

Reconcile against the authoritative M2 server inspection and provide explicit, secret-free results for server-only, file-only, matched, mismatched, invalid, and ambiguous/duplicate candidates. Missing/invalid managed metadata and narrow projection failures are represented separately from cryptographic key mismatch. Compare the client file's server peer key with the server identity when it can be determined safely; absent/ambiguous server identity is unresolved, not assumed valid. Do not infer identity from filenames or friendly aliases.

Matching key material may be encrypted even when address parameters conflict, but record/report that reissue is blocked pending explicit reconciliation. Do not truncate routes, overwrite server metadata, automatically add a file-only client to the VPN, or treat public filename fallback as authoritative. Duplicate files or existing vault entries must not cause silent overwrite or last-wins selection; preserve the prior record and return an explicit resolution issue. A repeat import without decryption must not claim plaintext equality it cannot verify. Define deterministic handling and tests rather than guessing equivalence.

M3.4 supplies a bounded read-only adapter for the configured source directory: regular files only, documented candidate selection, no recursive traversal or symlink following, bounded content sizes, and redacted per-file errors. A source file failure must not abort other valid imports; a directory-enumeration failure must be visible and must not be called a successful complete scan. Use safe file opening for privileged future callers; expanding rustix's approved feature set is permitted when required, but no new direct crate is implicitly approved.

Initial setup combines vault creation with attempted import of valid candidates. Return the encrypted prepared bundle and a report; invalid/conflicting candidates remain visible and originals are untouched. Explicit later import reuses the vault recipient without asking for a password or replacing the protected identity. Reissue authorization remains separate. Keep directory IO out of pure parsing and crypto tests; all adapter tests use synthetic temporary directories, never actual configured server/client paths. All writes in this milestone are test artifacts or explicit serialization buffers, not installed application state.

Acceptance and validation

• M3-A1: generated WireGuard keys derive valid PublicKey values; imported key correspondence and malformed Base64/length handling are tested without tools.
• M3-A2: vault setup uses an independent key pair and password-protected identity; serialized application vault data contains no plaintext private keys, passwords, or imported secret-bearing configurations.
• M3-A3: new record encryption and later explicit import need only the public recipient, not a password/unlocked identity; loading ciphertext needs no password.
• M3-A4: correct-password retrieval returns the selected secret; wrong/missing password, unknown versions, malformed/truncated ciphertext, recipient mismatch, and record relabelling fail without fallback or loss of the original bundle.
• M3-A5: independent retrieval operations require fresh authorization, with no reusable unlocked identity/password exposed through ordinary vault APIs. Errors, reports and Debug are redacted; secret serialization is explicit and protected.
• M3-A6: matching uses the public key derived from client Interface PrivateKey, not its server peer key or alias. Reports cover matched/server-only/file-only, conflicts, invalid files, duplicate/ambiguous keys and unsupported address shapes.
• M3-A7: address/server-binding discrepancies remain explicit and block the authorized reissue path until resolved; a valid secret may still be encrypted. Duplicate imports never silently replace existing secrets or trusted metadata.
• M3-A8: setup prepares encrypted imports from valid source files while skipping invalid candidates with explanations. Regular-file selection, limits, symlink rejection and enumeration failures are tested using temporary data only.
• M3-A9: source files and original server bytes are unchanged; no metadata is implicitly inserted, no creation dates invented, and M2 parsing/editing guarantees remain intact. Missing metadata does not prevent encrypted preservation of a key.
• M3-A10: serialized bundle round-trip preserves encrypted identity/records without decryption, ready for M4 backup/persistence; no filesystem installation, implicit Commit/runtime change, UI delivery or first-issue bypass is introduced.
• M3-A11: standard integrated gates and M1/M2 regressions pass; independent review closes actionable crypto, import, secret-lifetime and boundary findings.

Planned commands from the repository root after M3 tests and lockfile exist:

cargo test --locked vault
cargo test --locked --test vault_import
cargo test --locked --test config_preservation
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

Ensure the focused filter runs tests and record counts/results; all gates should exit zero. Resolve approved new dependencies/update the lockfile before locked checks. Keep password-encryption tests bounded while exercising real library crypto; do not weaken production KDF parameters simply to speed up tests. Use synthetic generated keys and no sensitive panic/assert output. No root, Docker, VM, actual WireGuard interface, or production config is required or claimed.

Progress

• Description prepared against accepted M1/M2 code and current documents.
• M3.1 — implementer (/root/implementer_m3_1) completed 2026-10-18T19:41:39Z; secret-safe WireGuard key generation, parse, derivation and matching.
• M3.2 — implementer (/root/implementer_m3_2) completed 2026-10-18T19:46:09Z; versioned age-encrypted bundle, fresh-password retrieval, format documentation.
• M3.3 — implementer (/root/implementer_m3_3) completed 2026-10-18T19:52:45Z; caller-buffer parse/reconciliation and authenticated import status.
• M3.4 — implementer (/root/implementer_m3_4) completed 2026-10-18T19:58:55Z; bounded read-only directory adapter, initial setup/import flow and synthetic tests.
• M3.5 — fresh reviewer (/root/reviewer_m3_r1) completed R1–R7; repairer (/root/repairer_m3_r1) resolved all findings; R7 found no actionable issue.
• M3.6 — coordinator integrated gates passed and acceptance recorded.

Review and repair

Finding	Iteration	Location and impact	Owner	Resolution and evidence	State
M3-R1-01	R1	src/vault.rs:134 Debug printed untrusted imported connection fields	repairer	Redacted imported payload Debug; sentinel regression and R2 passed	closed
M3-R1-02	R1	src/vault/source.rs:110 directory path was reopened after secure FD open, allowing enumeration/read inventory mismatch	repairer	Enumerates through pinned rustix::fs::Dir; path-replacement regression and R2 passed	closed
M3-R1-03	R1	src/vault/import.rs:409 unknown server identity was collapsed into a known key mismatch	repairer	Added Matches/Mismatch/Unresolved and blocked retrieval regression; R2 passed	closed
M3-R1-04	R1	src/vault/source.rs:206 duplicate existing vault entry was generic encryption failure	repairer	Added equality-unverified duplicate issue; repeat-import regression and R2 passed	closed
M3-R2-01	R2	docs/VAULT_FORMAT.md omitted intended component filename/layout for M4	repairer	Documented intended data_directory/vault.toml without persistence; R3 confirmed	closed
M3-R2-02	R2	Secret-bearing test assert_eq! output could disclose synthetic key/config bytes on failure	repairer	Replaced with redacted boolean assertions; R3 confirmed	closed
M3-R3-01	R3	src/vault.rs:306 unsupported encrypted payload version reported as RecordMismatch, not actionable UnsupportedVersion	repairer	Split version/label checks; valid encrypted unsupported-version regression and R4 passed	closed
M3-R4-01	R4	src/vault.rs:48 canonical Base64 comparison created a plaintext key String without zeroization	repairer	Wrapped in Zeroizing<String>; R5 confirmed	closed
M3-R5-01	R5	src/vault.rs:38 Base64 decode could drop partially decoded key bytes on malformed input before zeroizing wrapper	repairer	Decode into zeroizing buffer from allocation onward; R6 confirmed	closed
M3-R5-02	R5	src/vault.rs:287 identity UTF-8 conversion cloned decrypted identity into ordinary Vec, vulnerable on error	repairer	Borrow from zeroizing plaintext; R6 confirmed	closed
M3-R6-01	R6	src/vault/import.rs:112 allocated ordinary directive String before knowing whether value was secret/ignored	repairer	Borrowed dispatch; zeroizing PrivateKey/PSK allocations, duplicate/error paths and regressions passed; R7 confirmed	closed

The reviewer otherwise found crypto binding, fresh authorization and bounded scan behavior sound at fixture level. No finding may be closed by hiding a conflict, disabling tests, or relaxing encryption.

Evidence and handoff

Planning inspected Cargo.toml, exported M2 document/edit/metadata APIs, CONFIG_FORMAT.md, M1 model constraints, approved dependencies and ADR 0002. M2 records independent R3 acceptance, 42 unit plus 9 integration tests, and passing integrated gates. Those results are historical evidence; this planning task did not rerun application tests, select crypto versions, or add dependencies/source. No workers were dispatched and no source directory, private key, service, or network environment was accessed.

Next execution action: verify configured model roles and the current repository, review official APIs/compatibility for the approved cryptographic libraries, then dispatch M3.1 with the bounded task and acceptance criteria. Escalate unavailable packages as dependency/environment blockers rather than changing approved crypto.

Execution verified the coordinator session as gpt-6-sol/medium; M1 and M2 are accepted. At start, the only worktree change was this prepared M3 plan. Rustc/Cargo 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97 match the pinned baseline. Official crate documentation was checked for age 0.12.1 (Rust 1.74 minimum, recipient and passphrase APIs, no default features), x25519-dalek, getrandom, and secrecy. age re-exports its compatible secrecy via age-core; use that re-export rather than adding a conflicting direct version. The local cache initially lacked age; a read-only cargo info age@0.12.1 failed under sandbox DNS restrictions, then succeeded with approved network escalation. No manifest or source was changed during this prerequisite check. Next: assign M3.1 to the configured implementer. M3.1 added vault::WireGuardPrivateKey using approved x25519-dalek 2.0.1, getrandom 0.3.4, and zeroize 1.9.0; no age/secrecy direct dependency was introduced prematurely. The coordinator inspected the new key API and manifest. The implementer ran cargo test --locked vault (3 tests), cargo test --locked (45 unit and 9 preservation integration tests), fmt, Clippy, release build and diff check successfully. Its turn context was verified gpt-6-luna/high. No production data or service was accessed. Next: M3.2 versioned age vault format and authorized retrieval on top of this key type. M3.2 added approved age 0.12.1, VaultBundle recipient encryption and passphrase-protected identity, bounded TOML loading, ciphertext/recipient/key binding checks, and docs/VAULT_FORMAT.md. The coordinator inspected source, format and manifest. The worker ran cargo test --locked vault (9 tests), cargo test --locked (51 unit and 9 preservation integration tests), fmt, Clippy, release build and diff check successfully; its turn context was verified gpt-6-luna/high. This is task progress, not integrated M3 acceptance. M3.3 must extend encrypted records to retain imported connection parameters and enforce duplicate/no-overwrite and conflict reissue semantics; independent review must scrutinize the current public reissue_blocked flag's authority and secret lifetime. Next: M3.3 caller-buffer import/reconciliation. M3.3 added src/vault/import.rs and extended the encrypted v1 record payload to retain imported connection parameters, including valid PSKs. It changed duplicate insertion to fail without overwrite and moved the conflict gate into the authenticated payload; the public flag is advisory. The coordinator inspected implementation and updated format documentation. The worker ran cargo test --locked vault (15 tests), cargo test --locked (57 unit and 9 preservation integration tests), fmt, Clippy, release build and diff check successfully; its turn context was verified gpt-6-luna/high. This remains pending independent review. Potential review focus: unresolved versus mismatched server identity classification, preservation and lifetime of source buffers, and absence of conflict-clearing bypass. Next: M3.4 bounded read-only directory adapter and setup/import workflow. M3.4 added src/vault/source.rs, tests/vault_import.rs, README guidance, approved tempfile 3.23.0 as a development dependency, and rustix fs/std features. It uses Linux openat2 no-symlink file opens, per-file/aggregate limits and incomplete-scan reporting. The coordinator inspected the adapter, fixture tests and manifest. The worker ran cargo test --locked vault (16 tests), cargo test --locked --test vault_import (5), cargo test --locked --test config_preservation (9), cargo test --locked (58 unit, 9 preservation and 5 vault-import tests), fmt, Clippy, release build and diff check successfully; its turn context was verified gpt-6-luna/high. No production path or service was accessed. Possible review focus: path-based directory enumeration after secure fd open, explicit duplicate-existing-record reporting, and whether server-key unknown is distinct from mismatch. Linux openat2 absence yields an incomplete scan, not success. Next: fresh integrated independent review M3.5 before acceptance. Fresh R1 reviewer turn used gpt-6-luna/high. It inspected integrated code and ran focused vault (16), vault-import (5), and M2 preservation (9) tests; the full suite passed 58 unit plus 14 integration tests, and fmt, Clippy, release build, help/version and diff check passed. It found M3-R1-01 through M3-R1-04 above. These passing tests do not close the review findings. Next: repair, re-review, then coordinator integrated gates. The repairer (/root/repairer_m3_r1, gpt-6-luna/high) reported all four R1 findings repaired with focused regressions. It ran cargo test --locked vault (18), vault-import (5), M2 preservation (9), full tests (60 unit plus 14 integration), fmt, Clippy, release build and diff check successfully. The coordinator inspected changed paths. Findings remain pending independent R2 re-review; no acceptance is claimed yet. R2 independently confirmed M3-R1-01 through M3-R1-04 and found no remaining defect in those paths. It found M3-R2-01 and M3-R2-02 above. Focused vault (18), vault-import (5), preservation (9), full tests (60 unit plus 14 integration), fmt, Clippy, release build, help/version and diff check passed; the passing gates do not resolve the documentation and test-output gaps. Next: narrow repair and R3 re-review. R3 independently closed M3-R2-01/02 and confirmed R1 repairs remain intact. It found M3-R3-01 and noted an M3-A7 evidence gap: the existing known server-key mismatch test also has unsupported address projection, so an isolated mismatch-blocks-reissue test is needed. Aggregate scan-byte and directory-entry limits are implemented but lack dedicated boundary tests; their coverage should be strengthened if practical. R3 reran focused vault (18), vault-import (5), preservation (9), full suite (60 unit plus 14 integration), fmt, Clippy, release build, help/version and diff check successfully. Passing checks do not close M3-R3-01. Next: repair and R4. The repairer (/root/repairer_m3_r1) split encrypted payload version and label checks, added a valid age-encrypted unsupported-version regression, an isolated known server-key-mismatch/reissue-block regression, and inexpensive aggregate-byte/directory-entry cap tests through private testable limits. It reported 22 focused vault tests, 5 vault-import tests, 9 M2 preservation tests, 64 unit plus 14 integration tests in the full suite, and passing fmt, Clippy, release build and diff check. The coordinator inspected the new code; R4 independent re-review is pending. No M3 acceptance is claimed yet. R4 independently confirmed M3-R3-01 and all earlier repairs. It reran focused vault (22), vault-import (5), M2 preservation (9), full tests (64 unit plus 14 integration), fmt, Clippy, release build, help/version and diff check, all passing. It found M3-R4-01 above; this must be repaired before M3 acceptance. No production access or real-system result is claimed. R5 independently confirmed M3-R4-01 but identified M3-R5-01/02 in adjacent secret-lifetime paths. Focused vault (22), vault-import (5), preservation (9), full tests (64 unit plus 14 integration), fmt, Clippy, release build, help/version and diff check all passed; these checks do not prove zeroization on failure. Earlier repairs remain intact. Next: targeted cleanup and R6 re-review; M3 is not accepted. R6 independently confirmed M3-R5-01/02: base64 decoding now occurs inside a zeroizing Vec even on failure, and age identity parsing borrows from zeroizing bytes. It found M3-R6-01 in the import parser. It reran focused vault (22), vault-import (5), M2 preservation (9), full suite (64 unit plus 14 integration), fmt, Clippy, release build, help/version and diff check, all passing. No production access or real-system result was claimed. Next: targeted parser cleanup and R7. The repairer changed src/vault/import.rs to borrow section, directive key and value until dispatch; ignored/misplaced values are not allocated. Recognized PrivateKey/PSK values enter zeroizing storage immediately, including duplicate/error paths. Redaction regressions were added. It reported focused vault (22), full tests (64 unit plus 14 integration), fmt, Clippy, release build and diff check passing; the coordinator inspected the changed parser. Independent R7 re-review was the next gate after this repair. R7 independent reviewer (configured gpt-6-luna/high) inspected the final parser, prior repairs, cryptographic/secret lifetimes, source-directory safety and M3-A1–A11. It found no remaining actionable issue and recommended acceptance. The coordinator reran the full planned command set on the final integrated source on 2026-10-19: cargo test --locked vault passed 22 tests; cargo test --locked --test vault_import passed 5; cargo test --locked --test config_preservation passed 9; cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo build --locked --release, and git diff --check exited zero; cargo test --locked passed 64 unit tests, 9 preservation integration tests and 5 vault-import integration tests (0 doc tests); release --help and --version both exited zero with existing safe startup output. The focused vault filter ran 22 actual tests. These are unprivileged synthetic/unit fixture results only. No production files, running VPN, host service, Alpine container or systemd VM was accessed; container/VM checks are not required for this M3 library milestone and are not claimed. No M3 blocker remains.

Decisions and discoveries

The client's Interface private key and the server's Peer public key have different roles. Existing M2 source/span APIs support authoritative reconciliation but must not be reused as an unsafe source-dump parser for secrets. M1 projection cannot represent all legacy peers; use richer import inspection without changing that model or metadata v1 merely to suppress anomalies.

Prepared vault encoding is the M3/M4 interface: M3 supplies versioned encrypted components; M4 owns atomic installation, backup-before-mutation, restore, and Commit deletion. M6 owns file/QR generation and first-delivery session policy. This boundary avoids persisting unbacked state during an import/crypto milestone.

Outcome

Accepted after independent R7 review, closure of all findings and passing M3-A1–A11 gates. Stop here; milestone 4 is the next action only on a new request. No vault installation, Git commit, deployment or production access occurred.

Milestone 4 — Backups, safe Commit, and full restoration

Status: accepted (2026-10-19T21:10:25Z; independent R5 closed all findings and final coordinator gates passed). Prerequisites: milestones 1–3 accepted; pinned native Rust environment and available approved dependencies. This milestone uses synthetic temporary filesystems and injected failures, not root, production files, or running services.

Outcome and scope

Deliver library/application operations that install prepared M3 vault data, save an M2-edited server document through Commit, preserve internal allocation state, create/list backups, and preview/confirm full restoration without a vault password. Writes must be honest about partial failure and recoverable from the mandatory pre-operation backup. Neither Commit nor restore applies VPN changes.

Read SPEC.md Data locations, Data sources, Operations and states, Encrypted vault, and Backups and restoration; all three ADRs; VAULT_FORMAT.md, CONFIG_FORMAT.md, DEVELOPMENT.md, DEPENDENCIES.md, ENVIRONMENT.md, and TESTING.md. Distinguish the application's Commit action from Git commits, which are not authorized here.

Out of scope: TUI, output files/QR, password prompts, reissue reconciliation, real WireGuard/systemd observation or restart, automatic failed-restart rollback, concurrent editor detection/locking, compression, retention cleanup, migration to different server paths, and production access. The startup management placeholder remains safe until later milestones; expose testable APIs rather than a new CLI.

Existing code and integration constraints

• config::ResolvedSettings provides executable-relative server/client/data paths and data/archive directories; settings live at wireguard-admin.toml beside the executable. Use explicit resolved paths in adapters, never process cwd.
• M2 ConfigDocument and edits preserve original bytes and report unsupported peers. Commit persists the prepared document without reserializing server settings, silently projecting away anomalies, or rewriting unchanged comments.
• M3 VaultBundle::to_toml/from_toml encode/load encrypted v1 bundles without password entry. VAULT_FORMAT.md fixes the intended path as data/vault.toml. Preserve recipient, encrypted identity, records, and authenticated blocked flags; backups/restore do not decrypt or rebuild them from plaintext imports.
• PreparedImportSetup contains bundle/report; read-only scans never installed application state. M4 owns initial installation through the same persistence and pre-Commit backup boundary as later prepared imports.
• Vault records are private and there is currently no public removal operation. Add a narrow public-key removal API as needed; do not serialize/reparse internals to bypass encapsulation or expose plaintext. Do not automatically purge file-only imported records merely because they are absent from the server configuration.
• M1 ClientStates::commit_draft updates the in-memory saved snapshot and address reservations only. Invoke/reflect that transition after successful disk commit, never before it. Current reservation state is private and has no persistence codec; add explicit validated state encode/load support, not generic secret or whole-document serialization. Preserve unsupported M2 peers outside narrow Client.
• Historical verified/applied snapshots are not fresh runtime observations. On reopening/restoring, preserve needed reservation/history data but mark current runtime unknown until M5 verifies it. Restore never frees a pending deleted IP.
• Cargo already includes M1–M3 libraries and tempfile for tests. Approved tar and time may be introduced with minimal features, and tempfile/rustix used for secure writes. Moving tempfile to normal dependencies is allowed if needed. No new hash/UUID/compression/database/framework dependency is implicitly approved.

Context and implementation steps

Use sequential tasks and one writer. GPT-6-Sol/medium coordinates; GPT-6-Luna/high implements, reviews independently, and repairs. Supply explicit ownership, scope, accepted interfaces, validation, and task report requirements on each dispatch.

Task	Owner	Files and deliverable
M4.1	implementer	src/backup.rs and child modules as needed, docs/BACKUP_FORMAT.md: versioned allowlisted archive, limits, inventory, validated preview
M4.2	implementer	narrow persistence module, src/config.rs/src/domain.rs adapters as needed, docs/PERSISTENCE.md: safe path handling, validated state, staged writes and recovery contract
M4.3	implementer	src/app.rs, src/vault.rs narrow deletion API, library exports: prepared change sets, initial setup/Commit and mandatory backup ordering
M4.4	implementer	application/backup/persistence modules: manual and pre-restart backup APIs, previewed confirmed full restore, restart-history boundary
M4.5	implementer	tests/commit_restore.rs, test-only failure adapters and README: round trips, fault injection, archive attacks, permission and reservation scenarios
M4.6	reviewer, repairer	Independent integrated review, bounded repairs, re-review of failure paths and regressions
M4.7	coordinator	Integrated gates, evidence/findings ledger and acceptance/handoff in PLANS.md

M4.1 defines a versioned uncompressed tar archive with a bounded TOML manifest. Use logical fixed member names for settings, server configuration, internal state, and encrypted vault; never restore directly to tar-supplied paths. Record UTC creation time, operation reason (manual/pre-Commit/pre-restore/pre-restart), member inventory/lengths, and historical verification status without inventing working state. Define collision-safe archive naming without overwriting an existing file. A new archive is visible in the list only when fully written and finalized.

Capture the currently installed saved bytes, not the proposed draft or decrypted records. Settings and server config may contain secrets: archives require 0600. Exclude source client files, drafts, previous archives, staging/journal artifacts, and delivered plaintext output. Initial setup can lack vault/internal state: represent genuine absence explicitly, not as corruption or an empty fake vault. Restoring that backup must restore absence for those owned components. Missing required settings/server config or read errors are not optional absence.

Bound archive/member size and entry count before reading/extracting everything. Reject unsupported manifest versions, missing/duplicate/unexpected members, absolute or traversal paths, links, device/special entries, inconsistent sizes, truncation, and unsafe extension/header interpretations. Parse allowed files in staging before mutation using existing settings/document/vault validators. Do not reject a losslessly supported anomalous peer simply because project_client fails. The tar checksum is not authentication; do not advertise tamper-proof backups or silently add a signing/hash dependency. Bounds/structural validation remain required.

M4.2 documents file layout and a versioned internal-state schema for reservations, historical apply evidence, and operation recovery if needed. Keep aliases and client configuration authoritative in the server file. Reject unknown or malformed state rather than silently losing reservations. A file loaded from disk must not self-assert current RuntimeObservation::Verified without runtime verification.

Separate orchestration from a narrow filesystem adapter for deterministic errors. Use safe no-follow/anchored path operations, regular-file checks and private staging. Detect target aliasing/overlap (for example vault and server resolving to the same file) before mutations. Do not traverse a symlink or use archive metadata to chmod/chown arbitrary targets. Create files/directories with 0600/0700 from creation; preserve protected directory access and handle existing permissions explicitly. Do not recursively delete the data directory to implement restore.

Use same-filesystem temporary files, complete writes, flush/sync, atomic rename, and directory sync where applicable. A rename is not a transaction across server, settings, and data directories. Document ordering, durable recovery markers or an explicit equivalent, and recovery from interruption between replacements before implementing it. Never claim multi-file atomicity just because each rename is atomic. Backup-before-mutation and write recovery are not optimistic locking.

On replacement failure, either leave the old set intact or return an explicit incomplete/recovery-required result with the preserved pre-operation backup. Do not publish success, advance saved memory, or accept another mutation over unresolved partial state. Recovery must be deterministic and tested after reopening from partial files. It may finish/restore a local write transaction as documented; it must never apply runtime changes or become automatic failed-restart rollback. Report cleanup failures honestly and keep recoverable evidence if cleanup is unsafe.

M4.3 builds a prepared change set containing edited server bytes, staged encrypted vault, and validated internal state. Preview/validate it before installation. Complete the pre-Commit backup before the first protected destination replacement. Failure to create/finalize the backup stops Commit and preserves installed bytes and saved in-memory state. Then stage/install the set and only after success advance saved snapshots and expose successful Commit. A failed Commit retains retryable draft intent without treating possibly partial disk state as consistent.

Deletion removes the explicitly selected client record and vault secret in the same committed operation; unknown/missing vault records need clear behavior, since server-only clients are legitimate. Unrelated imported/file-only records remain. Earlier archives remain unchanged. Prepared imports/setup never overwrite an existing vault identity silently and never clear authenticated reissue blocking. Discarding an uncommitted preparation must not change installed files. Persistent settings updates are not a new product feature; Commit handles agreed client and internal changes while settings are included in backups/restoration.

M4.4 exposes listing and manual backup plus a reusable pre-restart backup operation for M5, without restarting anything here. Sorting/time labels do not imply a backup is working. Accept historical verification only from an explicit verified-apply boundary intended for M5; represent no verified state honestly. Any identity/token used to associate a saved generation with verification must not be a fresh runtime claim or a new crypto dependency. Never mark pre-restart bytes known-working based on the backup reason alone.

Restore has a read-only preview followed by explicit confirmation of that prepared archive. Validate the chosen content and determine affected files before writes; then complete the precautionary backup, stage all replacement/deletion actions, and install. Restore settings, whole server file, internal state, and opaque vault as a complete saved set, not a client merge. Whole-file restoration of the archived server is intentional; ordinary Commit still obeys M2 client-only editing rules.

Use current trusted destination mapping and enforce the installation's invariant paths. Archived settings cannot redirect writes outside that mapping or switch data roots during restore; report incompatible paths instead of adding migration logic. Keep the selected validated archive stable between preview and confirmation so confirmation cannot apply different bytes. Do not silently discard the active draft until confirmed; cancellation/validation/backup failure preserves it. Successful restore discards it and reloads the restored saved state, retaining conservative pending reservations across the still-unchanged runtime boundary. Historical restored state cannot assert the current interface matches it. Caller never needs or supplies a password for archive listing, backup, preview or restore.

M4.5 injects failures at backup creation/write/finalization, staging writes, sync, each destination replacement, recovery and cleanup. Verify exact file sets and memory transitions rather than only error messages. Avoid permission tests that pass accidentally as root; run unprivileged and inject deterministic failures. Use temporary private directories and generated encrypted bundles. Do not log server fixture contents or decrypted data in failing assertions.

Acceptance and validation

• M4-A1: documented versioned archive/state layouts round-trip settings, server bytes, encrypted vault and internal state without any password/decryption; initial missing vault/state is represented and restored explicitly.
• M4-A2: complete backups precede Commit/restore and the future restart boundary; backup/read/finalization failure prevents protected replacements and successful memory transitions. Manual backup/listing works without mutations to saved data.
• M4-A3: successful Commit writes the prepared client changes, vault and state; untouched server spans remain identical; saved memory advances only on success, runtime stays unchanged/unknown, and draft discard does not write files.
• M4-A4: explicit client deletion removes only its current vault record while server-only and file-only anomalies remain supported; old archives are unchanged.
• M4-A5: confirmed restore fully replaces owned saved components, including removal of components absent in the archive, without merging or reading plaintext client sources. Preview/cancel does not mutate or silently discard the draft.
• M4-A6: original client source files, unrelated files and all archives outside the selected/pre-operation artifacts are protected from traversal, symlink/link escapes, target aliasing and unsafe tar entries; test bounded parsing and rejection.
• M4-A7: 0600 secret-bearing files/archives and 0700 private directories apply from creation, including staging; errors and Debug redact secret-bearing bytes.
• M4-A8: injected failures/interruption between multi-file replacements produce no false success or premature saved-memory change; reopening detects incomplete work and follows the documented deterministic recovery path before new mutations.
• M4-A9: saved/deleted address reservations survive reopen and restore across unapplied changes; neither action releases them or trusts historical verification as current runtime. Missing/malformed state cannot silently permit address reuse.
• M4-A10: listing records UTC reason and explicit historical apply status; pre-Commit/pre-restart archives and newest archives are not automatically working.
• M4-A11: incompatible archived destination settings are rejected; restored server/config/vault stay at trusted invariant paths, and no whole-directory wipe or recursive archive inclusion occurs.
• M4-A12: M1–M3 regressions and integrated gates pass; independent review closes actionable persistence, archive, backup-order and failure-recovery findings.

Planned commands from the repository root after M4 targets and lockfile exist:

cargo test --locked backup
cargo test --locked persistence
cargo test --locked --test commit_restore
cargo test --locked --test vault_import
cargo test --locked --test config_preservation
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

Filters must execute actual focused tests. All commands should exit zero; negative cases are assertions within passing tests. Resolve approved added crates and update Cargo.lock before locked checks. Record actual counts, commands and failure-injection coverage. Tests are unprivileged filesystem/library checks only; no container/VM or live restart acceptance is required or claimed in this milestone.

Progress

• Description prepared from accepted M1–M3 interfaces and current documents.
• M4.1 — /root/implementer_m4_1 added src/backup.rs, docs/BACKUP_FORMAT.md, approved tar/time dependencies, and six focused archive tests (2026-10-19T20:23:23Z). Coordinator inspected the actual code; final integrated review and gates subsequently passed.
• M4.2 — /root/implementer_m4_2 added src/persistence.rs, docs/PERSISTENCE.md, and validated reservation restoration in src/domain.rs (2026-10-19T20:30:34Z). Integrated review subsequently passed.
• M4.3 — /root/implementer_m4_3 added src/app.rs, a narrow vault record-removal API, and one trusted archive-directory accessor (2026-10-19T20:35:58Z). Commit backup/install ordering and draft tests passed integrated review.
• M4.4 — /root/implementer_m4_4 added list/manual/pre-restart backup boundaries and byte-bound restore preview/confirmation, with path-invariant validation and focused tests (2026-10-19T20:42:20Z); integrated review passed.
• M4.5 — /root/implementer_m4_5 added nine cross-module tests and fixed restore reservations plus interface-name invariant (2026-10-19T20:49:14Z). Documentation was synchronized; independent review passed.
• M4.6 — fresh /root/reviewer_m4_r1 reviewed the integrated result; separate /root/repairer_m4_r1 repaired R1 and R4 findings; R2/R3/R5 re-review closed all with no new actionable findings (2026-10-19T21:10:25Z).
• M4.7 — coordinator ran all planned integrated gates and accepted M4 (2026-10-19T21:10:25Z).

Review and repair

Finding	Iteration	Location and impact	Owner	Resolution and evidence	State
M4-R1-01	R1/R2	src/persistence.rs saved reads accepted existing secret-bearing files with broad permissions.	/root/repairer_m4_r1	R2 confirmed fail-closed server/vault mode checks and regression tests.	closed
M4-R1-02	R1/R2/R3	Archive and installation failure paths lacked deterministic evidence.	/root/repairer_m4_r1	R3 confirmed partial restore interruption after server replacement, unchanged session saved/draft/applied state, failed rollback and fresh reopen recovery, and intact pre-restore archive; focused test passed.	closed
M4-R4-01	R4/R5	src/app.rs lost verified saved-generation history on reopen and mislabeled pre-Commit backups.	/root/repairer_m4_r1	R5 confirmed durable history after mandatory backup, truthful archive labeling, reopen history with runtime Unknown, and failure/clear tests.	closed

R1 independently inspected the integrated code; cargo test --locked --test commit_restore passed 9 tests and git diff --check was clean. Reviewer did not claim Alpine, VM, live WireGuard, or host-service evidence. R2/R3/R5 completed the required re-reviews and closed all findings.

Evidence and handoff

Planning inspected Cargo.toml, M3 vault serialization and source/import APIs, VAULT_FORMAT.md, M1 state methods, M3 recorded acceptance and governing documents. M3 records independent R7 review, 64 unit tests plus 9 preservation and 5 vault import integration tests, and passing coordinator gates. These are historical results; this planning task did not rerun tests or modify application code, dependencies, files in configured runtime directories, or installed vault state.

M4.1 worker reported cargo test --locked --offline (70 unit, 9 preservation, 5 vault-import), cargo test --locked --offline backup (6), Clippy, format, and git diff --check passing. These are worker results, not final integrated acceptance. The archive API accepts explicit saved bytes and validates a bounded fixed-member UStar format without extraction; app-level semantic validation and trusted path handling remain for M4.2–M4.4. M4.2 worker reported 10 persistence tests, full suite (80 unit + 9 preservation + 5 vault-import), Clippy, release build, format and diff checks passing. It supplies SavedStore with validated read/install/recover, a private journal, and explicit recovery-required results; per-syscall fault injection remains for M4.5. These are worker results only. M4.3 worker reported formatting, Clippy, full tests (89 unit + 14 integration), release build, and diff checks passing. Its Application stages public-key edits, pre-Commit backups exact installed bytes, and advances saved memory only after install. Broad-route legacy deletion fails closed because the persisted reservation format holds single addresses; exact-host legacy routes are retained. This is worker evidence, not integrated acceptance. M4.4 worker reported 95 unit + 14 integration tests, formatting, Clippy, offline release build and diff checks passing. Coordinator inspection identified additional reservation/path failure cases for M4.5 tests and independent review. M4.5 worker reported 95 unit + 23 integration tests, focused backup (11), persistence (10), and commit_restore (9), plus format, Clippy, release build, help/version, and diff checks passing. Its tests reproduced and fixed restore dropping current saved-client reservations and accepting an archived interface-name switch. Syscall-level write/fsync fault injection is not yet exhaustive; this remains an explicit review concern. These are worker results, not final acceptance. Next action: fresh independent M4 reviewer, then repair/re-review as needed. R1 returned M4-R1-01 and M4-R1-02 as actionable. Next action: a separate repairer fixes those findings, then the reviewer rechecks. Repairer reported both fixed, with 102 unit + 23 integration tests and formatting, Clippy, release build and diff checks passing (2026-10-19T20:57:23Z). The coordinator has not yet accepted those claims; next action is independent R2 re-review. R2 (2026-10-19T20:58:52Z) closed M4-R1-01 and partially closed M4-R1-02. Focused persistence (15), backup (12 unit + 2 integration), commit_restore (9), and injected Commit test (1) passed. Reviewer requires a restore partial-install failure/recovery test at the application boundary. Next action: targeted repair and R3 re-review; milestone remains in progress. Targeted repair added a private restore-install test seam and regression. R3 (2026-10-19T21:01:08Z) closed M4-R1-02, found no new actionable defects, and passed the focused test plus git diff --check. Next action: coordinator integrated gates and A1–A12 decision. Coordinator gates passed on the R3 revision, but a targeted historical-status audit found M4-R4-01 (2026-10-19T21:03:13Z). Those gate results will be rerun after repair. The milestone remains in review; next action is targeted repair and independent re-review.

Final integrated evidence after R5 repair (coordinator, 2026-10-19T21:10:25Z): cargo test --locked backup passed 14 unit + 2 integration matches; cargo test --locked persistence passed 15; cargo test --locked --test commit_restore passed 9; cargo test --locked --test vault_import passed 5; cargo test --locked --test config_preservation passed 9. cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked (108 library unit + 9 Commit/restore + 9 preservation + 5 vault import, 0 doctests), cargo build --locked --release, release --help and --version, and git diff --check all exited zero. All three findings are closed by independent R2/R3/R5; R5 found no new actionable issue. Evidence is unprivileged synthetic/unit-fixture only. No Alpine, disposable systemd VM, live VPN, host service, production file or production key was accessed or claimed. The terminal workflow and real runtime/systemd checks belong to later milestones. M4 has no remaining blocker.

Decisions and discoveries

Vault v1 already fixes data/vault.toml and authenticated conflict behavior. Preserve that format and opaque ciphertext. New state/backup formats belong in their own documents rather than altering vault or managed-comment v1 without need.

The persistence layer spans directories and cannot assume a single atomic rename. Interruption recovery and conservative address reservations are required write integrity, not concurrent editing support or automatic failed-restart rollback. Confirmed archive restoration replaces server settings as part of explicit recovery; normal client Commit continues to preserve administrator-owned bytes. The v1 internal-state historical timestamp follows the application's single-administrator save boundary; it is not a digest check against manual out-of-band file changes. Reopen treats history as historical, not current runtime verification. Restoration carries forward pending address reservations for safety while replacing archived client/settings/vault saved content.

Outcome

Accepted after independent R5 review, closure of M4-R1-01/M4-R1-02/M4-R4-01, and all M4-A1–A12 gates. Stop after M4. Begin M5 only on a separate request; no Git commit, deployment or production access occurred.

Milestone 5 — Runtime observation and systemd restart adapter

Status: accepted (2026-10-20T22:59:39+03:00; scoped fixture acceptance and independent integrated re-review complete). Prerequisites: milestones 1–4 accepted; pinned native Rust environment and compatible approved rustix and zbus dependencies. Ordinary M5 acceptance uses injected adapters and temporary saved stores without root or host-service/network access. Real WireGuard and systemd acceptance stays assigned to milestones 8 and 9 respectively, not silently waived.

Outcome and scope

Deliver a read-only Linux WireGuard runtime adapter, a systemd D-Bus restart adapter, and application orchestration for an explicitly confirmed restart: complete backup, restart the configured unit, await its job, verify the configured interface/peers, persist verification through M4, then publish applied state and release reserved addresses. Supply safe public runtime/statistics views for the future TUI without deriving client identity or online status from aliases.

Read SPEC.md Operations and states, Client screen and statistics, and Backups and restoration; ADRs 0001 and 0003; PERSISTENCE.md, BACKUP_FORMAT.md, DEVELOPMENT.md, DEPENDENCIES.md, TESTING.md, and the current application/domain code. Commit and restore must retain their strict no-runtime-mutation behavior.

Out of scope: TUI/screens, automatic refresh scheduling in a render loop, delivery or QR, automatic failed-restart rollback/retry, reload/syncconf as an alternative apply path, additional service managers/interfaces, production tests, and creation of the Alpine/VM harnesses. Keep management startup safely incomplete; do not introduce a new restart CLI or run real adapters in default tests.

Existing code and integration constraints

• Application owns the saved store/bytes, byte-preserving document, ClientStates, vault draft and historical verification. Resolve runtime settings from the current saved generation, including settings restored from a backup, not a stale constructor copy or archive-supplied arbitrary bus/service destination.
• Application::create_pre_restart_backup archives installed bytes and sets a pending boundary flag. mark_verified_after_runtime_check is crate-private: it checks that boundary and saved generation, validates an observed Snapshot, installs verification state through SavedStore's journal, then advances memory. Wire these existing boundaries into the real sequence; do not bypass them with a direct state-file write or public "mark verified" setter.
• PersistedState v1 holds reservations and a historical UTC timestamp. Reopen is always Unknown. Commit/restore clear stale verification; M5 records the timestamp only after matching runtime and successful journaled write. BACKUP_FORMAT.md ties archive historical status to that saved generation, not merely the date.
• The existing pre_restart_backup_pending boolean is not proof of a successful restart. Scope/invalidate authorization per attempt, failure, cancellation and saved-generation change; an old successful backup must never authorize later unrelated verification. Refine the internal contract if needed, preserving M4 guarantees and tests. No new concurrency/version-control scheme is required.
• Snapshot includes aliases and a narrow ClientAddresses model; kernel peers do not contain aliases or managed comment timestamps. Do not compare raw kernel structures directly against Snapshot equality or invent runtime metadata.
• M2 ConfigDocument::peers() retains full AllowedIPs and redacted issues; some valid peers cannot project into M1 Client. Include every authoritative peer in technical verification, or fail closed as unverifiable. Never ignore unsupported records to obtain a matching reduced subset. Missing/invalid managed alias alone must not be mistaken for evidence of a different runtime peer.
• Cargo already contains time, rustix, tempfile and persistence/crypto dependencies. The approved wireguard-uapi 3.0.1 public read path cannot guarantee complete, bounded dumps (M5-R1-04). Use existing approved rustix with narrow net/event features for a checked read-only Generic Netlink GET adapter; add approved zbus only when needed. Inspect current official APIs/features and Rust compatibility. Do not assume older zbus blocking examples apply to the selected version. No unapproved direct Tokio/executor/mock crate or utility subprocess fallback is authorized.

Context and implementation steps

Run tasks sequentially with one writer under the established model policy: GPT-6-Sol/medium coordinator; GPT-6-Luna/high implementer, independent reviewer and repairer. Dispatch owned files, exact interfaces, acceptance IDs, checks and required evidence. Workers do not mark milestones accepted or edit PLANS.md.

Task	Owner	Files and deliverable
M5.1	implementer	src/runtime.rs, narrow domain/application views and docs/RUNTIME.md: public observation model, saved technical projection and pure comparison contract
M5.2	implementer	runtime adapter modules, Cargo files/library exports: approved-rustix read-only WireGuard Generic Netlink codec/transport with isolated conversion/error tests; split pure decoder then bounded socket transport
M5.3	implementer	src/service.rs, child modules if necessary: zbus systemd restart/job observation with deadline and a mockable transport boundary
M5.4	implementer	src/app.rs, narrow M4 state/persistence integration: confirmed restart orchestration, per-attempt authorization, durable verification and honest failure results
M5.5	implementer	tests/runtime_restart.rs, test-only adapters, README/RUNTIME/PERSISTENCE documentation: integrated success, order and failure scenarios
M5.6	reviewer, repairer	Independent integrated review, bounded fixes and re-review, including M4 persistence regressions
M5.7	coordinator	Integrated gates, evidence/findings and milestone acceptance/handoff in PLANS.md

M5.1 defines public observations keyed by PublicKey, with explicit interface presence/unavailability, peer AllowedIPs, last handshake, received/transmitted byte counters, and observation time. Preserve zero/never-handshaken separately from unavailable data. Counters are current interface values, may reset after a restart, and are not historical usage or proof of online/offline status. Traffic is reported from the server interface's perspective. Alias display joins by public key using saved metadata, never list index or filename.

Define technical equivalence independently of counters, handshake, peer ordering, route ordering, aliases, dynamically learned endpoints and timestamps. Verify the expected configured interface exists and the complete saved peer public-key set and normalized AllowedIPs match, including absence of deleted/extra peers and an empty valid peer set. Report missing/extra/mismatched/unverifiable records with public identities and categories. Duplicate/ambiguous saved identities or partial runtime dumps cannot pass. Do not claim comparison of fields the adapter cannot observe. Retain full route sets for legacy peers; enrich M1 projection narrowly only if required and do not drop valid data to fit Snapshot.

Document the boundary between technical match and M4's narrow observed Snapshot: use saved aliases only after technical peer/route equivalence is established, not as alleged kernel observations. If the complete document cannot be safely verified/represented for durable marking, keep the operation unverifiable and reservations retained rather than passing a fabricated subset to M4.

M5.2 uses the configured interface via Linux WireGuard/netlink APIs only; no set, add/remove, module loading, host route manipulation or external wg invocation. Handle multipart responses and peer/AllowedIPs fragments according to the kernel protocol; require matching request sequence, an error-free terminal NLMSG_DONE, no interrupted dump and a complete response before claiming absence or equality. Bound reads/waits and aggregate limits. Convert no-device, permission, malformed data, transport failure and timeout to distinct actionable, redacted outcomes.

WireGuard library structures may include server private or preshared keys even when only public statistics are needed. Never derive/log their full Debug, retain them in public observations, or serialize them as status data. Minimize lifetime and clear supported owned buffers; document unavoidable library copies honestly. Default tests exercise supplied decoded inputs/test transport, never a host socket.

M5.3 connects to the system bus and fixed systemd Manager API for the validated configured unit, requests an actual restart, and follows the returned job to its terminal result. Subscribe/install observation before submission so immediate completion cannot be missed; correlate by the actual job and unit, ignore unrelated signals, and handle disconnection/name-owner changes or subscription failure. Successful request submission, job disappearance, or a unit already being active is not completed restart evidence. Accept only the documented successful terminal result, then let runtime verification decide whether VPN configuration matches. Account for wg-quick oneshot units that are active/exited; do not demand a daemon PID or long-running process that WireGuard itself does not require.

Use a monotonic configured deadline across D-Bus connection/subscription/request, job waiting and post-job verification rather than resetting it on each retry. Backup completion precedes service mutation but may have a separate filesystem failure boundary. A timeout bounds the application's wait, not proof that systemd stopped its job. Report "may still complete" when appropriate; do not retry a restart or issue broad cancellation/rollback automatically. Ordinary test code uses a supplied job event/transport adapter; no real system bus is contacted.

M5.4 adds explicit preparation/confirmation for restart and draft discard suitable for a future TUI. Preview/cancel does not save/discard a draft or call systemd. On confirmed discard-and-restart, reject unresolved persistence recovery, validate saved input and configured unit, complete the pre-restart backup, discard only as authorized and restart only the saved configuration. Never implicitly Commit. A backup failure leaves protected state and draft unchanged and submits no job.

Check compatibility with service-managed config rewriting, notably wg-quick SaveConfig behavior: do not edit administrator-owned settings to work around it or claim saved-generation verification when shutdown has overwritten intended peer changes. Detect an unsafe/unverifiable apply precondition and explain it; use a safe test fixture/service setup, not an automatic production setting change.

Demote stale current verification when a restart is submitted; a failed request, job, read or comparison cannot leave a misleading previously Verified state. Keep reservations and recovery information conservative. Read back the complete runtime after successful job completion within the deadline; do not require a client to connect or handshake, since correct peers can be idle. Periodic read-only observations may report correspondence, but must not release deleted addresses or persist successful restart history by bypassing the explicit sequence.

Only a matching full observation from the successful attempt can reach M4's journaled verification boundary. If the saved-generation check or state write fails after VPN restart, report "runtime changed, verification not durably recorded" rather than full success. Retain reservations/in-memory safety and honor RecoveryRequired before later mutations. Do not rollback the VPN, repeat restart automatically, mark the old history as current, or remove the backup.

M5.5 uses fake monotonic time and deterministic adapter event sequences, temporary saved stores and synthetic configuration. Assert call order: backup completed before restart request; successful job before runtime verification; matched observation before journaled state publication; persistence success before memory and reservation release. Failures must be visible by stage, including whether a restart was submitted/may still be active, backup location, and any required manual recovery. Avoid sensitive D-Bus/library error text in reports.

Acceptance and validation

• M5-A1: public read-only observation distinguishes missing/unavailable/unknown, no handshake and valid zero counters; public-key joins and counter resets do not invent online state, aliases, traffic history, or successful apply.
• M5-A2: configured-interface runtime adapter consumes complete bounded peer data, including fragmented route lists, and exposes only public information; no runtime mutations, secret Debug output or default host access occur.
• M5-A3: pure verification covers dual-stack and IPv4-only peers, reordered sets, empty peers, missing/extra/deleted peers, route mismatches, malformed or partial observations, and unsupported saved shapes without subset success.
• M5-A4: service adapter targets only the configured systemd unit, tracks the returned job without a fast-completion race, and handles unrelated events, failed/canceled jobs, disconnects, permission errors and monotonic timeout.
• M5-A5: explicit cancellation preserves the draft; confirmed draft discard never commits. Failed mandatory backup submits no restart and preserves draft, saved bytes, reservations and previous historical evidence.
• M5-A6: successful restart alone is insufficient: interface/peer verification must pass before M4 marking; idle clients need no handshake to be applied.
• M5-A7: each failure invalidates that attempt's authorization; a stale backup flag, old successful job, read-only refresh or old verified Snapshot cannot mark a later generation applied or release a reserved address.
• M5-A8: verified state and timestamp become visible only after M4 journaled state persistence succeeds. Injected post-restart write/recovery failure retains safe reservations and reports changed runtime without false overall success.
• M5-A9: reopening still treats verification timestamps as historical; Commit and restore retain their no-runtime-mutation behavior and invalidate stale apply evidence. Archived settings changes select the restored unit/timeout correctly.
• M5-A10: timeouts do not imply a job was canceled; no automatic restart retry, live setting rewrite, reload/syncconf fallback or VPN rollback is introduced.
• M5-A11: full M1–M4 regressions and integrated M5 fake-adapter tests pass with no root, Docker, real system bus/interface, production paths or secret reads.
• M5-A12: independent review closes actionable runtime/service/race/persistence findings; documentation clearly defers real WireGuard checks to M8 and actual systemd/D-Bus acceptance to M9 rather than claiming them from mocks.

Planned commands from the repository root once M5 targets/lockfile exist:

cargo test --locked runtime
cargo test --locked service
cargo test --locked --test runtime_restart
cargo test --locked --test commit_restore
cargo test --locked --test config_preservation
cargo test --locked --test vault_import
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

Ensure filters execute actual tests and report counts and exit status. Resolve approved dependencies and update Cargo.lock before locked gates. Default tests must remain deterministic, unprivileged and independent of a daemon/bus/network. No bare management launch, actual restart, or host WireGuard probing is permitted.

Progress

• Description prepared against accepted M1–M4 interfaces and current documents.
• 2026-10-20T20:44:56+03:00 preparation: confirmed M1–M4 accepted in this plan, inspected the worktree and role configuration; stopped before dispatch because the active coordinator model/effort is not exposed for verification.
• 2026-10-20T21:39:34+03:00 execution resumed: verified the active session's latest turn context as gpt-6-sol/medium in its local session record, and confirmed the four configured roles use gpt-6-luna/high; reread required project documents and inspected the actual repository. The earlier model-verification blocker is resolved.
• M5.1 — implementer delivered pure public observation and full saved-peer comparison in src/runtime.rs, docs/RUNTIME.md and library export. Independent R1 review found wrong-interface acceptance and two test gaps; repairer fixed all three; fresh R2 re-review found no remaining actionable M5.1 finding. Final cargo test --locked runtime passed (14 matching tests, including 10 runtime-module tests; 104 library tests filtered). This is partial M5 work, not milestone acceptance.
• M5.2 — after confirming wireguard-uapi 3.0.1's incomplete/unbounded public read API, a read-only explorer identified existing approved rustix net/event as a bounded transport route. Implementers delivered a checked pure decoder (src/runtime/netlink.rs) and nonblocking read-only socket transport (src/runtime/transport.rs) with synthetic/fake-I/O tests. Independent R2 and R3 reviews found three on-wire/error defects; repairer fixed all, and independent re-review closed them. Latest focused cargo test --locked runtime passed 29 matching tests; fmt, Clippy and diff checks passed. No host socket or real WireGuard behavior was tested; M8 remains responsible for isolated real adapter validation.
• M5.3 — approved zbus 5.19.0 async-io adapter and pure job tracker implemented in src/service.rs and src/service/dbus.rs, with a shared monotonic deadline and signals installed before restart. Independent R1 review found alias/primary-unit mismatch; repairer resolved GetUnit + Unit.Id before restart and R2 re-review closed the finding. cargo test --locked service:: passed 18 fake/pure tests; fmt, Clippy and diff checks passed. No system bus or real service was contacted; M9 VM acceptance remains pending.
• M5.4 — Application now exposes saved-bound restart preview, explicit cancel/restart/discard choices and redacted stage-aware reports; backup precedes discard/submission, full technical match and one-use attempt authorization precede M4 journaled marking. SaveConfig/recovery/stale-generation checks and fake adapter tests added. Independent R1 found false “may still complete” on known terminal job failure; repairer corrected it and fresh R2 review closed the finding. Latest cargo test --locked app passed 33 matching tests; fmt, Clippy and diff checks passed. No host bus/interface was accessed.
• M5.5 — added tests/runtime_restart.rs public preview/cancel/restored-settings integration tests (2 passed), private fake-adapter/clock deadline coverage in src/app.rs (34 app-filtered tests passed), and README/RUNTIME/PERSISTENCE documentation distinguishing synthetic M5 evidence from later real M8/M9 validation. cargo test --locked passed 161 library units plus 25 integration tests; fmt, Clippy and diff checks passed. Full independent integrated review remains M5.6.
• M5.6 — fresh independent integrated review found six actionable API, reporting, documentation and deadline findings; repairer addressed them in two bounded rounds, and independent re-review closed all six. The reviewer found no remaining actionable scoped M5 issue. Real kernel/systemd behavior remains M8/M9 work.
• M5.7 — coordinator inspected the integrated worktree, ran every planned command on the final revision, recorded results below, and accepted M5-A1–A12 for the specified synthetic/fake-adapter scope.

Review and repair

R1 independent reviewer findings and R2 disposition:

• M5-R1-01 (P1, src/runtime.rs interface observation/comparison): a peer/route match from the wrong interface could pass. Repairer added observed interface identity and a configured-name argument to comparison; wrong-name regression now fails closed. R2 independently confirmed closure.
• M5-R1-02 (P2, src/runtime.rs test coverage): no direct invariance test for handshake changes and counter resets. Repairer added one; R2 confirmed closure.
• M5-R1-03 (P2, src/runtime.rs test coverage): missing malformed-route and structural-document subset-match regressions. Repairer added both; R2 confirmed closure.
• M5-R1-04 (blocking dependency/API limitation, M5.2): independent reviewer confirmed wireguard-uapi 3.0.1 src/linux/socket/wg_socket.rs:87-108 loops on iter.next() without a deadline and uses while let Some(Ok(response)), allowing a receive error after a fragment to terminate the loop and return a partial Device as success. The public API provides no completeness proof or read timeout. Secret-bearing decoded fields can be kept private by careful consumption, but that does not fix boundedness or completeness. An abandoned timeout thread also cannot cancel the read. Resolution: read-only explorer verified rustix 1.1.5 provides public safe AF_NETLINK/NETLINK_GENERIC socket and polling APIs when its approved direct dependency enables net/event. It does not provide a WireGuard codec, so M5.2 must implement a small checked decoder with explicit complete-dump and aggregate-limit fixture tests, followed by a bounded socket transport. This is an implementation choice within the approved dependency list, not a new direct dependency or specification change. No unsafe fallback or partial-success adapter is accepted; this finding remains open until tested.
• M5-R2-01 (P1, src/runtime/transport.rs request IFNAME encoding): the initial builder put the NUL outside nla_len; repairer included it in the payload and added exact-byte assertions. Independent R3 re-review confirmed closure.
• M5-R2-02 (P2, src/runtime/transport.rs family errors): type validation made NLMSG_ERROR handling unreachable; repairer added checked errno mapping for no-device, permission and transport failures and injected tests. Independent R3 re-review confirmed closure.
• M5-R3-01 (P1, src/runtime/transport.rs IFNAME attribute number): initial request used type 3 (private key) instead of kernel-defined IFNAME type 2; repairer corrected it and added a literal numeric assertion independent of the implementation constant. R3 reviewer follow-up confirmed closure.
• M5.3-R1 (P2, src/service.rs/src/service/dbus.rs alias correlation): the tracker initially compared JobRemoved.unit to the configured literal, which can be an alias while systemd reports the primary unit name. Repairer added bounded read-only GetUnit/Unit.Id resolution before RestartUnit; the request still targets the configured name and the terminal event must match both primary ID and returned job path. Synthetic alias/failure/order tests passed; fresh R2 reviewer confirmed closure.
• M5.4-R1-01 (P2, src/app.rs service failure report): submitted terminal JobRemoved failures were incorrectly reported as possibly still completing. Repairer distinguished terminal failure from ambiguous request/wait timeout or disconnect while preserving submission/manual-recovery fields. Synthetic cases for failed, dependency, timeout, canceled, skipped and unknown results passed; fresh R2 reviewer confirmed closure.

M5-R1-04 is now resolved at the implementation-choice level with a bounded rustix decoder/transport and synthetic tests; actual kernel behavior is deferred to M8 and has not been claimed here.

Integrated review finding IDs below are prefixed M5-I to distinguish them from earlier task-local reviewer IDs:

• M5-I-R1-01 (P1): a public raw systemd adapter could be called without the mandatory application backup. Repairer made it crate-private and added a compile-fail public-API doctest; independent R2 confirmed closure.
• M5-I-R1-02 (P1): a public domain verification setter bypassed the application sequence. Repairer restricted it to the crate; R2 confirmed closure.
• M5-I-R1-03 (P2): runtime failures collapsed to one uninformative category. Repairer added six redacted runtime-failure categories; R2 confirmed closure.
• M5-I-R1-04 (P2): TESTING.md incorrectly described the wireguard-uapi read adapter. Repairer documented the actual approved-rustix path; R2 confirmed.
• M5-I-R2-05 (P2): expiry of the shared application deadline could be reported as a generic runtime-read failure or mismatch. Repairer added a distinct deadline result and deterministic before/after-read fake-clock tests; the independent reviewer re-reviewed and closed it.
• M5-I-R2-06 (P2): RUNTIME.md called the now crate-private service adapter a public API. Repairer corrected the boundary description; independent re-review closed it.

The fresh integrated reviewer reported no further actionable issue against M5-A1–A12 after the second repair round. Review and tests use synthetic state; they do not establish real kernel or systemd/D-Bus behavior.

Evidence and handoff

Planning inspected current Cargo dependencies, Application backup/verification boundaries, persistence/state schemas, backup metadata rules and M4 evidence. M4 records independent R5 acceptance and coordinator results: 108 library unit, 9 Commit/restore, 9 preservation and 5 import tests, plus completion gates. Those are historical recorded results; this planning task did not rerun Cargo checks, add dependencies/source, dispatch agents or contact a system bus/VPN.

2026-10-20 preparation confirmed .codex/config.toml requests gpt-6-sol/ medium, all four .codex/agents/*.toml request gpt-6-luna/high, and the available spawn-agent catalog lists those models and efforts. The active primary session exposes only the GPT-6 family, not its exact model or effort; project defaults can be overridden by a live session. Thus the mandatory coordinator verification is incomplete. The worktree already had a user change to this M5 description; it was preserved. rustc/Cargo reported 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97. git diff --check passed before this status edit. No M5 code, tests, dependencies, worker dispatch or acceptance checks ran during that earlier preparation.

The active session was subsequently verified by matching CODEX_SESSION_ID to its local rollout record and reading the latest turn_context model and effort: gpt-6-sol / medium (2026-10-20T18:36:50.175Z). The four role files explicitly configure gpt-6-luna / high; M5 workers will be spawned with those effective model/effort overrides and their configured roles. This resolves the prior configuration blocker without substituting models.

2026-10-20T21:50:55+03:00 coordinator validation of the partial integrated revision (all exit 0): cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked (118 library unit, 9 Commit/restore, 9 config-preservation and 5 vault-import tests passed; main/doc tests 0), cargo build --locked --release, cargo test --locked runtime (14 matching tests, of which 10 are in the runtime module), each of the three named M4 integration targets (9/9/5 passed), release --help and --version, and git diff --check. No service or runtime_restart test target exists yet, so those planned checks were unavailable and not counted as passing. wireguard-uapi and zbus are not in the retained manifests/lockfile. No root, Docker, host interface, system bus, production data, Alpine or VM test was used. Passing partial gates does not establish M5-A2 or M5-A4–A12.

2026-10-20T22:03:03+03:00 continuation: active coordinator session rollout again showed gpt-6-sol / medium; role files still specify gpt-6-luna / high. Worktree remained the prior partial M5 result. Read-only explorer examined cached wireguard-uapi/rustix sources and kernel protocol docs; no socket or production state was accessed. The chosen rustix route needs checked Generic Netlink family resolution, exact sequence/DONE/error handling, fragment coalescing, monotonic deadline and strict limits before M5-A2 can pass.

Final M5.7 validation on the integrated revision (all exit 0): cargo test --locked runtime (32 matching tests), cargo test --locked service (19 matching tests), cargo test --locked --test runtime_restart (2), cargo test --locked --test commit_restore (9), cargo test --locked --test config_preservation (9), cargo test --locked --test vault_import (5), cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked (163 library unit tests, 25 integration tests and one compile-fail doctest passed; binary tests 0), cargo build --locked --release, release --help and --version, and git diff --check. The release binary reports that the management interface is not implemented, as expected. Tests were unprivileged synthetic/fake-adapter checks; no Docker, Alpine, systemd VM, host bus/interface, production path, private key or real restart was accessed. M8 and M9 still require their own real-system acceptance and cannot inherit a passing result from these checks.

Next action: stop after accepted M5. M6 may begin only on a separate request; M8 Alpine and M9 disposable-VM validation remain future milestones.

M5.3 prerequisite decision: use approved zbus 5.19.0 with async-io and default features disabled. A standard-library wake/park executor with one monotonic deadline can bound connection setup, match-rule registration, method calls and signal waits without an unapproved direct runtime dependency. Subscribe and install observation before RestartUnit; buffer/handle a fast completion that arrives before the method reply. Confirm real signal and alias behavior in the disposable systemd VM at M9; fake events here are not VM evidence.

Decisions and discoveries

M4 verification persistence already supplies the intended durable boundary, but its pending-backup flag is only one prerequisite. M5 must establish restart/job and runtime evidence before invoking it and invalidate per-attempt authority. Aliases are server metadata, not kernel data; verification must separate technical correspondence from display/domain projection. A successful service job and a successful durable application record are distinct stages with distinct failures.

Primary API references for implementation (check the chosen version at dispatch): systemd D-Bus, wireguard-uapi, and zbus. These references do not pin new versions.

Outcome

M5.1–M5.7 are complete. Accepted for the milestone's explicitly scoped synthetic/fake-adapter checks after independent integrated review, two repair rounds, re-review and all planned coordinator gates. No real WireGuard or systemd/D-Bus result is claimed; M8/M9 remain future acceptance stages. No Git commit, deployment or production access occurred. Stop after M5; do not start M6 without a separate request.

Milestone 6 — Client configuration delivery and reissue lifecycle

Status: accepted (2026-10-21T21:50:26+03:00; independent integrated re-review closed findings and all scoped M6.7 gates passed). Prerequisites: milestones 1–5 accepted; pinned native Rust environment and compatible approved dependencies. Validation uses generated keys, synthetic saved stores and temporary output directories without root, a terminal, Docker, production inputs or any actual runtime/service call.

Outcome and scope

Deliver testable application/library operations to create a new client with a session-held private key, Commit its encrypted record and server entry, save its plaintext WireGuard configuration after Commit, and optionally produce a QR code for the same delivery. Subsequent issuance requires a fresh password per selected client. Output errors permit changing the destination and retrying initial issuance during the current creation session without password entry.

Read SPEC.md New client parameters, Encrypted vault, Connection delivery, Importing existing clients and Operations and states; ADRs 0001–0003; VAULT_FORMAT.md, CONFIG_FORMAT.md, PERSISTENCE.md, RUNTIME.md, DEVELOPMENT.md, DEPENDENCIES.md, TESTING.md and the current Application/VaultBundle code.

Out of scope: TUI/password entry widgets, rendering live terminal screens, plaintext source-file fallback, automatic key rotation/reconciliation, adding connection settings, runtime mutation, automatic restart, actual phone/client import, Alpine harness and VM tests. Keep startup safely incomplete. Generation and saving an output file do not apply configuration to WireGuard.

Existing code and integration constraints

• Application::add_client currently accepts a prepared public Client and edits server/domain drafts. It does not generate or own a private key or authorize first delivery. Add a coordinated creation operation rather than treating any existing/imported public key as eligible for password-free output.
• WireGuardPrivateKey::generate, public_key, and explicit Base64 exposure exist. VaultBundle::encrypt_record encrypts a new key using the recipient, while retrieve_client_record returns short-lived retained connection fields only after password-based decryption and authenticated conflict checks.
• New-key records currently have no retained client parameters. Build their configuration from authoritative saved peer addresses and current saved application settings, not empty record defaults. Imported records can contain DNS/MTU/endpoint/routes/keepalive/PSK; preserve supported existing parameters rather than silently converting every imported client to a new default template.
• RetrievedClientRecord exposes its key and optional preshared key explicitly and redacts Debug; do not turn it into a globally cached unlocked vault or add a password-free retrieval API to work around first-delivery state.
• Application::commit saves staged document/vault/state only after backup and journaled installation succeeds. delete_client, discard_draft, restore, saved settings and restart choices can affect delivery eligibility. Integrate with these transitions without regressing M4/M5 or bypassing recovery-required handling. Application::document() is a draft; output must use committed bytes.
• M5 observes public technical runtime fields and does not supply a trusted server private key for generation. Derive the server public key from the authoritative saved [Interface] PrivateKey through existing X25519 code, in a narrow secret boundary, or use an already validated authoritative derivation if available. Missing/ambiguous/invalid server identity blocks output rather than guessing or reading another file/interface. Never print or serialize the server private key.
• Cargo already contains the key/crypto, file-safety and time dependencies. Approved qrcode may be added with minimal features (no image/SVG output needed). No decoder, image, CLI, TUI, random, hash or new helper crate is implicitly approved. Check official APIs/version compatibility before adding the crate.

Context and implementation steps

Run bounded tasks sequentially, one writer at a time. GPT-6-Sol/medium coordinates; GPT-6-Luna/high implements, independently reviews and repairs. Dispatch file ownership, prerequisite interfaces, acceptance IDs and actual required checks. Only the coordinator updates milestone acceptance and evidence in PLANS.md.

Task	Owner	Files and deliverable
M6.1	implementer	src/delivery.rs and child modules as needed, library exports, docs/DELIVERY.md: secret-safe payload model and deterministic configuration generation
M6.2	implementer	src/app.rs, narrow delivery/domain integration: coordinated new-client creation and session-scoped first-issue state
M6.3	implementer	delivery/files module, existing safe filesystem helpers: file preparation, explicit overwrite confirmation, secure output and retry results
M6.4	implementer	delivery/QR module, Cargo files, app integration: optional matrix/text output bound to the same authorized payload/file action
M6.5	implementer	tests/client_delivery.rs, focused unit tests and README/DELIVERY guidance: full first-issue/reissue and failure lifecycle
M6.6	reviewer, repairer	Independent integrated review, bounded findings repair and re-review
M6.7	coordinator	Integrated validation, evidence ledger and scoped acceptance/handoff in PLANS.md

M6.1 renders a deterministic standard WireGuard client file: [Interface] with client private key, saved addresses and DNS; [Peer] with server public key, endpoint and routes. New clients have IPv4/IPv6 and routes 0.0.0.0/0, ::/0, using the configured template and authoritative saved host addresses. Define the client Address prefix policy explicitly, keeping host identity separate from server-side AllowedIPs; do not infer client addresses from the public endpoint. No new MTU, keepalive or PSK defaults are introduced.

For imported reissue, retain validated existing optional fields and IPv4-only shape where applicable. Never execute or copy hooks/unknown arbitrary directives from source configs. Validate decrypted fields again at rendering boundaries so newlines/control text cannot inject sections/directives. Compare retained identity and addresses/server binding with fresh saved authoritative values; a stale or mismatched record fails closed instead of silently regenerating a different connection. Respect authenticated reissue_blocked, missing server/file-only cases, and M2 unsupported projection without truncating routes to get a valid output. Document precedence between saved server state, application defaults for new clients, and retained imported fields; do not invent a conflict-resolution UI.

Keep plaintext payloads in explicitly exposed, short-lived zeroizing owners, redacted Debug/errors and no generic Serialize/Display. Raw source/client output is never an ordinary status object. Bound payload size. Passwords, encoded private keys and rendered files must not appear in logs, panic output, snapshots or test failure diagnostics. Document unavoidable encoding/QR-library copies honestly.

M6.2 coordinates address selection, key generation, server/client draft insertion, vault encryption and temporary first-issue tracking as one preparation. Use M1 allocation/reservations and optional manual selection; reuse M2 edits and M3 key matching. Failure at any preparation step leaves prior draft and eligibility unchanged. Existing vault setup may require its initial password separately; creating additional clients in an existing vault does not request that password.

Define an internal lifecycle such as pending-draft, committed-awaiting-first-file, and issued/invalidated, keyed by PublicKey and actual creation/committed record context rather than alias, UI row, or historical public-key presence. Store no first-issue private key, password, or eligibility in settings, internal state, backup, vault plaintext fields or recovery journal. Session state is not recreated by reopen/restore/import. A failed/incomplete Commit cannot promote eligibility. Unrelated valid commits/renames must not accidentally authorize another key or consume an unused first issue; compare the relevant saved client/record context.

Discard/delete/restore/reopen/session end and any relevant key/record replacement invalidate stale pending material. Define transition timing so cancellation and failed backup/pre-install validation preserve unchanged work, while a successful replacement or unresolved partial persistence cannot retain unsafe output authority. A confirmed restart applying an unchanged saved client must not require a password merely because runtime state changes. Do not conflate access activation with the first-output permission. Successful saved deletion revokes output authorization immediately, even if the old runtime peer remains active until restart.

M6.3 prepares destination selection without writing, then requires explicit confirmation if a file exists. Never derive a path directly from an alias that may repeat or contain separators; use a safe suggested filename and explicit selected destination. Reject symlink/special-file destinations and unsafe ancestor traversal; do not overwrite internal application files, server config, vault, settings, journal or backups as a client output. Output goes only to the chosen location; no directory-wide chmod/deletion or source-file cleanup.

Use secure temporary/staged writes, mode 0600 from creation, complete flush/sync, atomic publication and parent sync as appropriate. New-file publication must not silently replace a file; overwrite requires a confirmed bounded action for that destination. Document behavior if failure follows publication (for example parent sync failure): the file may already exist and must be reported honestly, with explicit confirmation on retry, not claimed absent or automatically removed.

Output failure before confirmed success preserves retry eligibility for the same initial client in the current session, allowing a different directory. A normal plaintext file must be saved for every delivery action; QR-only success is not allowed. Success consumes initial eligibility and drops the cached private key. Later file/QR issuance for that client requires a fresh password. Password reissue is per action/client, not session-wide vault unlocking; wrong password, conflict or missing key has no source-file bypass. Retries may keep only bounded operation-local material, never a reusable unlocked identity across unrelated actions.

M6.4 generates an optional QR from the exact bytes saved in that delivery action, using qrcode's matrix/public rendering API without PNG/image features or external qrencode. Support a future terminal renderer through a matrix/controlled text representation with quiet zone and documented dimensions. Keep secret-bearing matrix/text out of Debug, snapshots and ordinary progress messages. Do not expose an unguarded second QR path that reconstructs private material from cached state.

One authorized action may include both file and QR; showing that same prepared QR does not require a second password. If QR encoding exceeds capacity or fails, the file can still be successfully delivered: report file success and QR failure separately, consume first-issue eligibility, and do not report a total failure that misleadingly permits another first file. A later new QR/delivery action then requires password authorization. A future TUI displays/clears the operation-local QR; terminal lifecycle implementation remains M7.

M6.5 covers complete library flows with private temporary stores and generated synthetic keys. Use fault-injected file writes and unit-tested authorization transitions, not privileged filesystem behavior. Assert file content through redacted comparisons/parsed public values and explicit key correspondence without printing secrets. Reuse M3 parsing for compatible generated files to demonstrate identity/server/routes semantics. File/QR equality should be guaranteed by a single payload source and tested at the encoding boundary; do not claim external QR decoding/real-device compatibility unless actually checked or add a decoder crate without approval.

Acceptance and validation

• M6-A1: new clients yield valid full-tunnel dual-stack configurations using committed addresses/settings and a correctly derived server key; missing or ambiguous authoritative identity fails without guessing or exposing secrets.
• M6-A2: imported reissue preserves supported existing optional parameters and IPv4-only shape; stale identity/address/server bindings, authenticated conflict flags and unsupported data block unsafe delivery without truncation.
• M6-A3: coordinated creation stages a matching public client and encrypted key; failed preparation leaves prior drafts intact. No output is authorized before successful Commit or from an imported/existing key without a password.
• M6-A4: failed/incomplete Commit does not promote first issue; a successful Commit permits first output for the newly created client in that session. Draft discard/delete/restore/reopen and record replacement cannot restore or transfer stale eligibility; duplicate aliases remain independent by public key.
• M6-A5: failed file save supports same-session retry/new directory without password for initial issuance; success consumes eligibility. Reissue requires fresh per-client authorization with no cached identity/plaintext-file fallback.
• M6-A6: mandatory plaintext file creation uses 0600 from first write, safe paths, bounded payloads, explicit overwrite confirmation and honest partial- publication failure reporting; protected application/source files stay untouched.
• M6-A7: optional QR uses the exact same payload as the saved file; QR failure does not erase file success or grant another first issue. No independent QR-only bypass or retained cross-action secret cache exists.
• M6-A8: outputs warn when saved changes are not verified applied. Unavailable runtime is not silently treated as active; delivery never invokes service or WireGuard operations, releases reservations or changes apply history.
• M6-A9: rendering/input injection, wrong password, missing vault/record, duplicate/conflicting metadata, occupied/manual address failures, overwrite decline, symlink/special paths, and write/flush/publication/sync failures are tested.
• M6-A10: secret-bearing types, errors/Debug and tests do not disclose keys, passwords, configuration payloads or QR matrices; ephemeral material is never persisted in backup/journal/state and supported owned buffers clear on drop.
• M6-A11: M1–M5 regressions and integrated gates pass unprivileged with no real network, system bus, runtime, production paths or terminal required. Independent review closes actionable auth-lifecycle/rendering/output-safety findings.

Planned commands from the repository root after M6 targets and lockfile exist:

cargo test --locked delivery
cargo test --locked --test client_delivery
cargo test --locked --test runtime_restart
cargo test --locked --test commit_restore
cargo test --locked --test vault_import
cargo test --locked --test config_preservation
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

Ensure focused filters run actual tests. Resolve approved qrcode and update Cargo.lock before locked checks; do not add Ratatui/Crossterm prematurely. Record commands, counts and exit results. All commands should exit zero; negative cases are passing assertions. No phone QR scan, real tunnel, terminal screenshot, Alpine or systemd result is required or claimed for this library/file-output milestone.

Progress

• Description prepared against accepted M1–M5 code and current documents.
• 2026-10-20T23:12:02+03:00 execution preparation: verified active coordinator gpt-6-sol/medium in this session's latest turn context and project worker roles gpt-6-luna/high; confirmed M1–M5 accepted, read required specification, ADRs and supporting documents, and inspected the clean source baseline. The pre-existing expanded M6 plan edit in this worktree is preserved.
• M6.1 — implementer delivered bounded, zeroizing payload rendering in src/delivery.rs, library export and docs/DELIVERY.md, with new-client and authenticated-import paths. Independent R1 found an unchecked caller-supplied server identity; repairer moved derivation to the saved [Interface] PrivateKey boundary and added malformed/missing/ambiguous cases. Independent re-review closed M6.1-R1. Final focused cargo test --locked delivery::tests passed 7 tests; fmt, Clippy and diff checks passed. Fixture evidence only; no file/QR or host behavior claimed.
• M6.2 — implementer added transactional dual-stack creation and encrypted vault staging, plus session-only first-file state in src/app.rs and a narrow encrypted-record context accessor in src/vault.rs. Independent R1 identified duplicate live authorizations; repairer made issuance single-flight with explicit retry states, and re-review closed it. The same reviewer identified stale standalone plaintext after app mutation; second repair moved output behind an app-owned deliver_first_issue closure holding the mutable session borrow, and re-review closed it. Final cargo test --locked app::tests:: passed 41 synthetic tests; fmt, Clippy and diff checks passed. M6.3 still must connect actual file results to these states.
• M6.3 — implementer added secure file-output adapter in src/delivery/files.rs, app first-issue bridge, narrow SavedStore protected-path accessor and documentation. Initial focused cargo test --locked delivery passed 16 and cargo test --locked app passed 47; fmt, Clippy and diff checks passed. Fresh independent review found two actionable findings (M6.3-R1/R2 below). Three targeted repair rounds and independent re-review closed both under the documented single-administrator threat model; final focused cargo test --locked delivery passed 20 and file-module tests passed 12; fmt, Clippy and diff checks passed. No production filesystem behavior is claimed.
• M6.4 — implementer added approved qrcode 0.14.1 with default features disabled, bounded/zeroizing operation-local matrix representation, file-first optional QR integration and focused tests. Initial cargo test --locked delivery passed 22 and cargo test --locked app passed 51; fmt, Clippy and diff checks passed. Independent R1 found a public QR-only encoder path; repairer made it crate-private with a compile-fail doctest, and independent re-review closed the finding. Final focused delivery (22) and doctests (2) passed. No phone scan or terminal rendering is claimed.
• M6.5 — implementer added fresh password-per-action reissue from installed vault bytes, validated authenticated key-only/imported provenance, a live-generation activation warning, five public synthetic lifecycle tests in tests/client_delivery.rs, and README/DELIVERY guidance. Initial focused integration (5), delivery (22), app (51) and partial-provenance regression (1) passed with fmt, Clippy and diff checks. Fresh independent review found first-issue outputs omitted the activation warning. Repairer added it to file-only, file+QR and definite-publication/bookkeeping-uncertain results; re-review found uncertain file publication still omitted it, so a second repair added warning to failed outcomes and injected file-only/QR uncertainty tests. Independent re-review closed the finding. At M6.5 closure, cargo test --locked app:: passed 50 and --test client_delivery passed 5; fmt, Clippy and diff checks passed. Integrated gates ran later in M6.7.
• M6.6 — a fresh independent integrated reviewer inspected M6-A1–A11 and found three actionable issues: secret-bearing assertion diagnostics, optional imported server-key binding in the public renderer, and unreported temporary-file cleanup failure. Repairer fixed all three; independent re-review closed them with no new actionable issue. The reviewer found M6-A1–A10 supported by scoped synthetic evidence and left M6-A11 pending coordinator integrated gates.
• M6.7 — coordinator ran every planned command against the integrated revision, verified all exit zero and nonempty focused test filters, checked changed files and reviewer evidence, and accepted M6-A1–A11 for the explicitly scoped fixture/file-output milestone. No real WireGuard, systemd, terminal or phone scan is claimed.

Review and repair

M6.1-R1 (P2, src/delivery.rs): the initial renderers accepted a caller-supplied server public key without proving it came from the saved server configuration; the initial valid-looking test even used a different key. Repairer made both renderers derive it from exactly one valid saved [Interface] PrivateKey, reject missing/duplicate/malformed sources with a redacted error, and compare imported retained identity to that key. Synthetic regression tests passed (7 focused); the independent reviewer re-reviewed and closed the finding.

M6.2-R1 (P2, src/app.rs): two outstanding first-issue capabilities could both expose plaintext before either was consumed. Repairer made authorization single-flight/token-bound and added explicit pre-publication versus uncertain- publication retry handling. The independent reviewer closed this part after focused tests.

M6.2-R2 (P2, src/app.rs): invalidating a standalone token after deletion or replacement did not revoke a caller-held plaintext payload. Repairer removed that accessor and introduced an app-owned publication closure that validates saved peer/record context immediately before the file writer runs while holding &mut Application; stale deletion/replacement tests show the closure is not invoked. Independent re-review closed the finding. The real file adapter is still M6.3 work, not evidence from these synthetic closures.

M6.3-R1 (P2, src/delivery/files.rs): a confirmed overwrite rechecked the destination inode before renameat, but another entry could replace it between the check and publication and then be overwritten without confirmation. The independent reviewer supplied a deterministic Checkpoint::Publish substitution reproducer. Repairer changed confirmed replacement to atomic RENAME_EXCHANGE, checks the displaced inode and rolls back without deleting unexpected entries; rollback identity and parent sync failures report uncertainty. A later re-review found the normal-success temp-name unlink still vulnerable to a different local writer. Final repair requires a selected parent owned by root/current effective user without group/world write, checks existing ancestors, and uses an exclusive 0600 temporary name with 128 bits of OS randomness. Independent re-review closed R1 under the single-administrator threat model. Same-privilege concurrent name changes remain explicitly outside scope; temporary 0600 output retained after a rollback is documented for manual cleanup rather than risking deletion of an unconfirmed entry.

M6.3-R2 (P2, src/app.rs): after a definite file publication, a fallible post-publication saved-state read/mark could return an undifferentiated app error, concealing that a plaintext file was already created. The independent reviewer requested an explicit published-but-bookkeeping-uncertain result and fault test. Repairer added PublishedButBookkeepingUncertain with definite file-success evidence and invalidated the session-held first-issue key on bookkeeping failure. The independent reviewer closed R2 after a synthetic post-publication saved-store failure test. No password-free retry is authorized by that result.

M6.4-R1 (P2, src/delivery/qr.rs): a public QR encoder allowed a library caller to render a payload and generate a QR without the mandatory file action. Repairer restricted the encoder and module to crate visibility, kept public output/error value types for the guarded app result, and added a compile-fail doctest. Independent re-review closed the finding after file-first and QR-failure tests. QR scanning and terminal rendering remain unverified/future.

M6.5-R1 (P2, src/app.rs): initial file-only and file-plus-QR delivery did not report whether the saved client had been verified active. Repairer bound an activation warning to the exact installed generation and the live verified saved/applied snapshot, never the historical timestamp. Re-review found the possibly-published parent-sync failure still lost the warning; second repair carried it in the failed outcome and tested uncertain publication for both variants with QR skipped. Independent re-review closed R1. All evidence is synthetic/fault-injected, not live VPN or device compatibility.

M6.6-R1 (P2, src/app.rs tests): assert_eq! on saved and rendered client configuration bytes could print a private key if a test failed. Repairer changed those to boolean assertions and audited related tests. Independent integrated re-review closed this secret-diagnostic finding.

M6.6-R2 (P2, src/delivery.rs/src/vault.rs): the public imported renderer accepted a missing saved-server binding from a mutable retrieved record. Repairer made retained fields private/read-only, required imported provenance and an exact present saved-server binding, and added missing/stale binding tests. Independent integrated re-review closed it.

M6.6-R3 (P2, src/delivery/files.rs/src/app.rs): ignored temp-file cleanup errors could leave a plaintext 0600 staging file while reporting an ordinary pre-publication failure. Repairer added a distinct ManualCleanupRequired result, retry gating until explicit cleanup acknowledgement, documentation and an injected cleanup-failure test confirming no selected-file publication. Independent integrated re-review closed it. The user may still need to inspect and remove a retained staging file; the application does not silently erase an uncertain entry.

All actionable M6 task-local and integrated review findings are closed after repair and independent re-review. The integrated reviewer found M6-A1–A10 supported by synthetic/fault-injected evidence; M6-A11 then passed the coordinator's final integrated gates. No password check was weakened and no preservation test was disabled.

Evidence and handoff

Initial planning inspected current Application creation/Commit/discard/restart interfaces, VaultBundle key-only encryption and password-authorized retained fields, current Cargo dependencies, M5 acceptance record and runtime documentation, plus product specification/secret-storage ADR. M5 records scoped fixture acceptance and passing integrated gates with independent re-review; real kernel/systemd checks remain M8/M9. That planning-only turn did not rerun application tests, add crates/source, generate private keys/output/QR, dispatch agents or contact host runtime/services.

Final M6.7 validation on the integrated revision (all exit 0): cargo test --locked delivery (23 matching tests), cargo test --locked --test client_delivery (5), cargo test --locked --test runtime_restart (2), cargo test --locked --test commit_restore (9), cargo test --locked --test vault_import (5), cargo test --locked --test config_preservation (9), cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked (205 library unit, 30 integration and two doctests passed; binary tests 0), cargo build --locked --release, release --help and --version, and git diff --check. Release --help correctly states the management interface is not implemented. Checks used synthetic keys, temporary stores/output directories and fake adapters without root, Docker, host WireGuard/system bus, production paths or a terminal. The approved qrcode 0.14.1 was added with default features disabled; no other direct dependency was introduced. No phone QR scan, live tunnel, Alpine test or disposable systemd VM result is claimed. Those validations remain future M7–M9 work, not passing M6 evidence.

Next action: stop after accepted M6. M7 may begin only on a separate request; do not create a Git commit or deploy.

Decisions and discoveries

New vault records contain a key but no template parameters, while imported records retain supported connection fields. Delivery needs an explicit provenance and precedence rule rather than assuming both are interchangeable. Creation must retain ephemeral private material separately from password-only vault retrieval; otherwise first delivery without a password is impossible. That ephemeral material cannot be persisted or reconstructed after session loss.

M5 applies saved state and M6 exports saved state; neither should call the other implicitly. File and QR are two representations of one authorized delivery action, with file success as the first-issue completion boundary. M7 supplies the terminal interaction around these library contracts.

Outcome

M6.1–M6.7 are complete. Accepted for the milestone's explicitly scoped synthetic/file-output checks after independent integrated review, repair, re-review and all planned coordinator gates. The TUI, phone compatibility, real WireGuard and actual systemd/D-Bus behavior are not claimed; M7–M9 own their later acceptance. No Git commit, deployment or production access occurred. Stop after M6; do not start M7 without a separate request.

Milestone 7 — Complete terminal management workflow

Status: accepted (2026-10-21T23:23:41+03:00; independent R2 closed the finding and coordinator gates passed for synthetic UI/PTY scope). Prerequisites: milestones 1–6 accepted; verified coordinator/worker model roles, pinned native Rust environment and registry access or cached compatible approved ratatui/crossterm dependencies. Default validation runs without root, host WireGuard, host D-Bus or production files. Terminal lifecycle evidence requires a disposable pseudo-terminal or an isolated interactive terminal with synthetic adapters. Missing terminal evidence is an unmet M7 gate, not a passing test.

Outcome and scope

Replace the management-startup placeholder with a usable native Rust TUI around M1–M6 application operations. The administrator can inspect clients/anomalies and current statistics, initialize the vault/import existing files, prepare creation, rename and deletion drafts, review and Commit, explicitly restart, deliver a file and optional QR, create/list backups, preview/confirm restoration, and exit with the specified draft warning. The UI keeps draft, saved and applied state distinct.

Read SPEC.md in full, CONTEXT.md, ADRs 0001–0003, IMPLEMENTATION.md, PROJECT_LAYOUT.md, DEVELOPMENT.md (especially terminal behavior), DEPENDENCIES.md, TESTING.md, ENVIRONMENT.md, CONFIG_FORMAT.md, VAULT_FORMAT.md, PERSISTENCE.md, BACKUP_FORMAT.md, RUNTIME.md and DELIVERY.md before editing their respective boundaries. Preserve their versioned formats and accepted M1–M6 contracts.

Out of scope: new VPN settings, IP/key editing operations, server bootstrap, remote/multiple-interface management, action/service logs, traffic history, automatic save/apply/rollback, concurrent-editor reconciliation, container/VM harness implementation and production testing. Real kernel and systemd evidence remain mandatory later at M8/M9; M7 acceptance covers UI and synthetic integration. Do not redesign accepted library behavior in key handlers.

Context and implementation steps

Actual preparation state and integration constraints:

• src/main.rs and src/startup.rs still return ManagementUnavailable for root management; help/version and lazy root checking already work. src/lib.rs exports the application modules; no src/tui.rs or TUI dependencies exist yet.
• Application in src/app.rs owns document/domain/vault drafts and session-only first-issue material. SavedStore::read_saved performs journal recovery; Application::open accepts caller-provided ClientStates and marks runtime unknown. Introduce a narrow, tested application loading/projection boundary where needed so startup derives states from authoritative document bytes, rather than rebuilding client rules in the binary or supplying an empty set.
• The narrow Snapshot cannot represent every inspected peer. List document anomalies and unsupported/ambiguous entries explicitly without silently dropping them. Disable actions requiring an unambiguous public key/supported projection; do not choose a duplicate alias or truncate routes to enable them.
• Existing operations include prepare_new_client, rename_client, delete_client, discard_draft, commit, initial vault/setup preparation, backup list/create, restore preview/confirmation, restart preview/choice, first-file delivery and password-per-action reissue_client_file. Reuse these boundaries. Add only missing application-facing projections/adapters, with focused tests; ordinary UI state never contains server bytes or private keys.
• vault::source provides bounded configured-directory scanning and setup; vault::import provides reconciliation/key verification. Explicit selected-file import needs a bounded adapter/application entry point if the existing API cannot express it. Keep originals untouched, imported secrets encrypted in draft, anomalies visible and conflicting reissue blocked. Do not invent an automatic conflict repair or an unlock-by-clearing-a-flag UI.
• Runtime transport and restart adapters are synchronous bounded operations; terminal code must schedule them off the input/render loop. A read-only refresh may report technical correspondence, but must not mark applied, persist a verification timestamp, release addresses or suppress M6 activation warnings.
• Application::confirm_restore replaces saved settings and session state. Refresh every settings-dependent view/operation from the restored generation; discard stale previews, output confirmations and queued statistics. Preserve fixed installation paths/interface constraints and M6 invalidation semantics.

One implementation writer at a time; coordinator owns PLANS.md. Establish the application/worker interface before terminal wiring. Add modules only as needed.

Task	Owner	Files and deliverable
M7.1	implementer	src/app.rs, src/startup.rs, relevant config/persistence/vault adapters and tests: safe session loading, public display projections and missing selected-file import/application boundaries
M7.2	implementer	src/tui.rs, src/tui/state.rs, src/tui/events.rs as needed: secret-free screen/navigation state, typed commands/results, serialized application worker and bounded statistics scheduling
M7.3	implementer	Cargo.toml, Cargo.lock, src/main.rs, src/lib.rs, src/startup.rs, src/tui/terminal.rs, src/tui/render.rs: approved terminal dependencies, interactive startup, guarded lifecycle, responsive layout and client/statistics screens
M7.4	implementer	TUI forms/dialogs and narrow application additions: vault setup/import, creation/manual addresses, aliases/deletion, draft review/Commit, explicit restart and cancellation flows
M7.5	implementer	TUI delivery/backup screens: masked authorization, destination/overwrite/retry, file plus optional QR, manual backups, archive preview and confirmed restore
M7.6	implementer	tests/tui_workflow.rs, focused TUI/terminal tests, README.md, affected supporting docs: synthetic end-to-end workflows, terminal evidence and accurate operating instructions
M7.7	reviewer, then repairer	Independent integrated review of M7 scope and regressions; bounded finding repairs and fresh re-review evidence
M7.8	coordinator	Integrated gates, evidence ledger, scoped acceptance and M8 handoff in PLANS.md

M7.1 loads executable-relative settings only after management privilege checks, uses the safe saved-store/recovery path and derives the initial client view from the server document. Do not silently replace corrupt state/vault with empty data. Initial vault creation asks for a masked password and confirmation, checks existing files at the earliest opportunity, presents reconciliation results and stages changes through Commit. Cancellation does not install a vault or rewrite source files. Explicit import and managed metadata additions remain draft operations; unknown creation dates remain unknown. Temporary fallback labels are filenames or shortened public keys, never a new alias registry.

M7.2 keeps one owner of mutable application/session state. Use standard-library threads/channels where sufficient; serialize mutations and reject duplicate submission while busy. Specify bounded/coalesced event queues, refresh interval, read timeout, stale-result generation checks and worker shutdown. Do not allow old results to overwrite a newer Commit/restore/restart view or recreate delivery authorization. Progress/error/cancel navigation remains responsive while work is pending. Cancellation of a dialog is distinct from aborting submitted work: do not report an operation cancelled while it may still save files or restart. Exit during submitted work must wait for an honest outcome with progress; no unbounded join or silent detachment of protected mutations. An already submitted systemd job can outlive its timeout; show the existing report's uncertainty.

M7.3 checks terminal suitability before raw/alternate-screen entry and before saved-store recovery or setup mutations. Help/version still require neither root, settings, terminal nor vault. Non-TTY/unsupported startup yields plain stderr and a nonzero result without escape sequences. A scoped terminal guard restores raw mode, alternate screen and cursor after normal exit, partial initialization, render/input errors and handled interruption, including best-effort panic cleanup. Avoid secret-bearing panic diagnostics and competing writes to the active screen.

List alias/fallback label, shortened key, IPv4/IPv6, draft/saved differences, unapplied/unknown runtime status and anomalies using text as well as color. Keep selection by full public key across refresh/sort and show that key in client confirmations. Malformed records may use document location for inspection, never as an alternate ambiguous mutation identity. Show last-handshake time and current interface RX/TX counters; distinguish never, zero and unavailable/stale readings. Missing runtime is nonfatal. Support keyboard-only use, visible focus, help, scrolling, empty/error states and resizing to a terminal too small for content. Escape all untrusted text, including imported filenames, aliases and errors.

M7.4 offers dual-stack default/manual allocation and reports validation/exhaustion without losing prior draft. Renames may repeat. Deletion warns that saved removal can leave runtime access active and addresses reserved. A semantic draft preview shows client changes without raw configuration diffs (which could expose secrets). Commit has no runtime calls. With a draft, restart offers exactly “Discard draft and restart” or “Cancel”; cancellation preserves draft and first-issue eligibility. Confirmed restart uses the application's preview and full backup/job/verification sequence. Exit warns that draft will be discarded, offers cancellation and never implicitly commits. Failed backup, Commit, restart or recovery displays the actual stage/result and leaves state consistent with the existing application contract.

M7.5 permits first delivery only after Commit in the same creation session; reissue requests a fresh password for the selected client every time. Passwords and QR matrices have short-lived dedicated owners, outside ordinary view/debug/ snapshot state. Cancel/close clears them; do not retain an unlocked vault. The selected destination and explicit overwrite confirmation use M6 capabilities, not alias-derived paths. Show retry, publication uncertainty, manual-cleanup and file-success/QR-failure outcomes accurately. Changing the directory can retry a failed eligible first file. QR is additional to successful mandatory file output; render its quiet zone and modules without clipping, show a resize/file fallback when it cannot fit, and clear the disclosure screen on close. Show the M6 activation warning without inferring activation from historical verification.

Backup rows show archive identity, UTC creation time, reason and historical verified status without labelling the newest archive as working. Restoration previews clients/settings changes safely, identifies the exact archive, warns of full saved-state replacement and draft loss, and requires confirmation. Cancel has no replacement/precautionary-backup side effects. Confirmed restore needs no password, makes its precautionary backup and never restarts; refresh the session view and report saved/unapplied state. No archive cleanup or merge is added.

Acceptance and validation

• M7-A1: production management startup reaches the TUI using executable-relative settings and safe recovery; injected non-root/non-TTY/invalid startup checks prove early failure. Help/version remain independent of privileged data.
• M7-A2: keyboard list/details/forms, focus/help, scrolling, small/empty/error screens and resize are usable. Duplicate aliases and refresh cannot retarget actions. All authoritative peers/anomalies remain visible, including unsupported entries; untrusted terminal controls are escaped.
• M7-A3: synthetic setup/import covers server-only, file-only, matching, mismatched and invalid files, preserves original bytes, encrypts valid secrets, blocks conflicting reissue and stages metadata without fabricating dates.
• M7-A4: create/rename/delete, semantic preview, cancel/discard and Commit preserve draft/saved/applied boundaries. Allocation includes manual/invalid/ exhausted cases. Backup failure stops protected mutation; Commit/restore invoke no service/runtime mutation even through the UI dispatch path.
• M7-A5: restart with draft exposes the specified two choices; Cancel preserves draft. Fake service/runtime outcomes prove successful verification releases reservations, while job failure, timeout, missing/mismatching peers or failed verification persistence do not. No implicit retry or rollback occurs.
• M7-A6: first-file success/retry/change-directory, overwrite refusal/approval, uncertain publication, QR failure after file success, reissue/password errors, session exit and restore invalidation follow M6. No original-file password bypass, secret snapshot or QR-only disclosure path is introduced.
• M7-A7: backup list/manual backup, exact-target preview/cancel/restore, precautionary-backup failure and restored operational settings are covered. Restoration fully replaces saved state without password or implicit restart.
• M7-A8: delayed/failing fake workers demonstrate responsive input, duplicate prevention, bounded/coalesced refresh and stale-result rejection. Statistics never imply online status or advance applied state; exit/shutdown is bounded and reports submitted-operation uncertainty accurately.
• M7-A9: synthetic terminal lifecycle checks demonstrate cleanup on normal exit, partial setup failure, render/input error, handled interruption and panic where feasible. Record exact PTY/manual procedure and outcomes; default tests never acquire production adapters or require root. Explicit QR display retains a complete quiet zone, is not clipped and clears on dismissal.
• M7-A10: independent reviewer has no unresolved actionable findings; all integrated Rust gates pass and documentation describes actual workflows and remaining M8/M9 limits. No real-system result is claimed from UI fixtures.

Planned commands (repository root; pinned environment verified first): rustc -Vv, cargo -V, rustfmt --version, cargo clippy --version; cargo test --locked --test tui_workflow after M7.6 creates that target; cargo test --locked --test client_delivery, cargo test --locked --test runtime_restart, cargo test --locked --test commit_restore, cargo test --locked --test vault_import, cargo test --locked --test config_preservation; cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, ./target/release/wireguard-admin --help, ./target/release/wireguard-admin --version, and git diff --check. Expected: successful checks, default tests without host access, accurate help and no secret output. Select compatible minimal TUI dependency versions from official crate documentation at execution time; retain Cargo.lock, avoid unrelated updates. Record focused terminal test names and the exact isolated smoke procedure once implemented; never launch root management against the development host for proof. Phone/decoder QR interoperability must be recorded separately if demonstrated; no scan success is presumed from matrix/render tests or required via production.

Progress

• M7.1 — implementer /root/m7_1: safe session bootstrap, secret-free all-peer projection and bounded selected-file import integrated; review remains at M7.7.
• M7.2 — implementer /root/m7_1: secret-free state/events and serialized application worker integrated; final independent review remains at M7.7.
• M7.3 — implementer /root/m7_1: terminal adapter, startup and list/statistics rendering integrated; synthetic PTY and independent review subsequently passed.
• M7.4 — implementer /root/m7_1: setup/import, create/rename/delete, draft/Commit and explicit restart forms integrated.
• M7.5 — implementer /root/m7_1: delivery, backups and previewed restore workflows integrated.
• M7.6 — implementer /root/m7_1: synthetic workflow/terminal evidence and documentation integrated.
• M7.7 — independent R1 review, targeted repair by /root/m7_repair_r1, and R2 re-review closed M7-R1-01; no actionable findings remain.
• M7.8 — coordinator reran all planned integrated gates, recorded scoped evidence and accepted M7-A1–A10.

Review and repair

Finding	Iteration	Location and impact	Owner	Resolution and evidence	State
M7-R1-01 (P2)	R1/R2	src/tui/render.rs client list omitted per-row draft/saved change and anomaly text required by SPEC/M7-A2.	/root/m7_repair_r1	Added row-leading state/anomaly markers, draft-removal rows, 34-column TestBackend and control-escaping assertions; independent R2 confirmed closure.	closed

R1 separately noted coverage limits for M7-A5 confirmed restart through the UI executor and M7-A9 terminal failure/interruption cases. The reported M7-A4 delete/discard coverage gap is disputed by tests/tui_workflow.rs worker-path assertions for DeleteClient and DiscardDraft; ask R2 to verify those lines.

Repairer reported M7-R1-01 fixed and added synthetic PTY handled Ctrl-C cleanup evidence. Follow-up added five isolated PTY child cases: failure after raw-mode setup, failure after alternate-screen entry, render I/O error, input I/O error and active-mode panic. Assertions check raw mode off, matching restoration sequences and a generic panic diagnostic without payload. Focused lifecycle PTY test, focused TUI tests (25), workflow tests (6), fmt, Clippy and diff checks passed in the repairer run; docs/TESTING.md records procedure and limits. Independent R2 review and coordinator rerun remain pending. M7-A5 UI executor fake-outcome coverage remains a separate acceptance question.

Evidence and handoff

2026-10-21 execution preparation: confirmed M1–M6 accepted in their milestone records and register; preserved the pre-existing M7 expansion in this worktree. Matched CODEX_SESSION_ID to this session's local rollout record and verified its latest turn_context is gpt-6-sol/medium; all configured worker roles are gpt-6-luna/high, and M7.1 was dispatched through the harness with those exact overrides. Native rustc/Cargo 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97 matched the pin. Inspected the actual source/startup/application/store/import interfaces. No M7 acceptance gate is claimed yet.

M7.1 implementation changed src/app.rs, src/startup.rs and src/vault/source.rs; no dependency or versioned format changed. The worker reported cargo test --locked (209 library unit plus integration/doc suites), Clippy, fmt and diff checks passing. Coordinator inspected the changed-file list and public interfaces, ran git diff --check (pass), and independently ran cargo test --locked --lib selected_file (4 passed). M7.1 supplies open_from_saved_store, display_projection, open_management_session and import_selected_file. Independent integrated review is still pending.

M7.2 implementation added src/tui.rs, src/tui/state.rs, src/tui/events.rs and a library export. The worker reported focused cargo test --locked tui:: (9 passed), fmt, Clippy and diff checks passing. Coordinator inspection found a blocking send in the first shutdown fallback; the implementer replaced it with an atomic stop request and nonblocking signal, and added a full-queue/delayed-read regression test. This repair was checked before progressing. The operation protocol currently covers draft mutation, Commit, backups and selected import; later tasks extend it for restart, restore and delivery. The shutdown handle must remain live while it reports Pending.

M7.3 implementation added the guarded Crossterm/Ratatui terminal path, keyboard list/details/help and bounded read-only runtime sampling. Approved direct dependencies ratatui 0.30.2 and crossterm 0.29.0 were added; their resolution required advancing the already approved time pin from 0.3.44 to 0.3.47. The worker reported cargo test --locked tui:: (15 passed), fmt, Clippy and diff checks passing, plus successful help/version smoke checks. Coordinator reran focused TUI tests (13 passed before the final lifecycle repair) and inspected startup, dependency and terminal changes. Inspection found terminal I/O error paths could drop an active worker and a panic hook was left installed; the implementer repaired both and added synthetic tests for delayed operation reporting and hook restoration. Actual PTY lifecycle evidence and independent integrated review remain required.

M7.4 implementation added src/tui/forms.rs and extended terminal, render/state/events, with a narrow draft-only peer selection fix in src/app.rs. The worker reported cargo test --locked tui:: (18 passed), fmt, Clippy and diff checks passing. Coordinator reran the focused TUI tests (18 passed) and inspected the secret owner, forms and command dispatch. Current focused tests cover masked setup input, manual-address validation, full-key rename confirmation and draft-restart choice; M7.6 must add broader synthetic behavior tests for Commit/restart failure and cancellation paths before acceptance.

M7.5 implementation extended worker-owned prepared destinations and validated restore previews, password-per-action reissue, file-plus-optional-QR disclosure, backup browsing and exact-archive restoration. The worker reported cargo test --locked tui:: (22 passed), fmt, Clippy and diff checks passing; coordinator reran focused TUI tests (22 passed) and inspected continuation and result handling. Synthetic tests currently cover generation-bound prepared actions, password masking, retry confirmation and QR fit. Actual end-to-end publication/restore failure behavior and terminal disclosure lifecycle remain M7.6 evidence needs; no real-system behavior is claimed.

M7.6 added tests/tui_workflow.rs (6 tests), synthetic terminal injection and restart-result rendering test, and updated README/TESTING/PROJECT_LAYOUT. The worker reported cargo test --locked --test tui_workflow (6 passed), focused restart rendering (pass), fmt, Clippy, full cargo test --locked (233 unit, 36 integration, 2 doctests), release build and diff check passing. The PTY smoke ran under /usr/bin/script with a synthetic application and fake unavailable statistics; it exercised 80×24 → 40×8 → 80×24 resize, q exit and alternate-screen/cursor restoration. No host WireGuard/systemd or production path was accessed. The UI test constructs restart outcomes for display and cancel; actual fake service/runtime outcomes remain application-library evidence. QR file-success/encoder-failure is likewise covered at the M6 app boundary, while M7 proves QR ownership, dismissal and complete fit. No phone or external decoder interoperability is claimed. Coordinator gate rerun and independent review are pending.

M7.7 R1 was dispatched to a fresh read-only reviewer, separate from the implementer, with all M7-A1–A10 criteria and actual changed/untracked paths. The coordinator updated AGENTS.md's stale introductory implementation-status sentence without changing behavior rules. Review findings are pending.

R1 reviewer /root/m7_integrated_review_r1 inspected actual source, untracked TUI files and docs; cargo test --locked --test tui_workflow passed 6/6 and git diff --check passed. It identified M7-R1-01 above. It did not claim real WireGuard/systemd evidence. Repair and re-review are next.

R2 independent re-review inspected the renderer repair and synthetic terminal refactor, ran the focused row test, five-case lifecycle PTY test, cargo test --locked --test tui_workflow (6/6) and git diff --check (all pass), and closed M7-R1-01 with no new actionable finding. R2 withdrew its earlier A4 gap after verifying worker DeleteClient/DiscardDraft assertions. It found the existing application fake service/runtime restart tests plus TUI preview, choice/cancel and result-display tests sufficient for M7-A5's synthetic scope; these do not prove the real systemd adapter.

Coordinator final integrated validation on the reviewed revision (all exit 0): rustc -Vv and cargo -V reported 1.97.1; rustfmt --version reported 1.9.0-stable; cargo clippy --version reported 0.1.97. cargo test --locked --test tui_workflow passed 6/6, including the synthetic PTY smoke; cargo test --locked --test client_delivery 5/5, runtime_restart 2/2, commit_restore 9/9, vault_import 5/5 and config_preservation 9/9. cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, release --help, release --version and git diff --check all passed. The coordinator independently reran the focused five-case lifecycle PTY test (1/1), and checked 29 local Markdown links in the changed guidance/plan files with none missing. Help and version printed only their expected public text. Actual changed and untracked source, test, manifest, lockfile and documentation paths were inspected; no unapproved direct crate, production path, live service or Git commit was introduced.

Acceptance mapping: A1 uses injected root/TTY/settings/recovery tests and the compiled production startup path; A2 uses all-peer projection, rendering, selection and 34-column anomaly/state tests; A3 uses synthetic source reconciliation and M3 vault checks; A4 and A7 use worker workflow plus Commit/restore fixture tests; A5 uses TUI choice/cancel/result tests and M5 fake service/runtime cases; A6 uses worker delivery/reissue tests and M6 file/QR failure cases; A8 uses delayed worker/queue/generation tests; A9 uses isolated PTY normal/interrupt/resize/failure/panic cases and QR fit/dismissal; A10 uses closed R2 review and the coordinator gates above. All are scoped to synthetic fixtures, fake adapters and isolated PTY behavior. No Alpine real WireGuard, disposable-VM real systemd/D-Bus, external QR decoder or phone scan was performed; those results are not inferred from M7 acceptance.

Planning only: inspected the approved specification, ADRs, supporting contracts, accepted M1–M6 records and current startup/application/store/import/delivery/runtime interfaces. No M7 code, dependency change, terminal session, Rust gate, Alpine or VM test was executed as part of this expansion. Planning validation passed: git diff --check; a local Markdown-link check found no missing PLANS.md targets; record-structure checks confirmed all eight template sections, tasks M7.1–M7.8, criteria M7-A1–M7-A10 and pending status. The milestone register now matches the accepted M5/M6 records. Rust rebuilds are not required for this documentation-only change.

Historical planning handoff above preceded M7 execution. The next milestone is M8 Alpine Testcontainers integration, which requires a separate execution request and its disposable environment prerequisites. Do not create Git commits, deploy or test on production from this acceptance.

Decisions and discoveries

M7 completes terminal orchestration around accepted library contracts rather than adding a second persistence/runtime/delivery implementation. Session loading, selected-file import and safe public projections are explicit integration tasks, not assumed existing APIs. Runtime statistics/technical matches and historical verification remain distinct from a verified explicit restart. Terminal cleanup and responsiveness need their own evidence beyond pure render tests. No new product decision or specification change is introduced by this expansion.

Outcome

Accepted for the defined synthetic UI/PTY scope after independent R2 review and all planned coordinator gates. M8/M9 retain real WireGuard/systemd release gates.

Milestone 8 — Alpine Testcontainers integration

Status: accepted (2026-10-25T20:43:00+03:00; M8.1–M8.7 complete, independent review closed, scoped IPv4 Alpine gates passed). Prerequisites: milestones 1–7 accepted; pinned Rust toolchain; an explicitly selected disposable Docker-compatible Linux environment with kernel WireGuard, scoped NET_ADMIN and IPv4 support; an Alpine-compatible test executable. Missing prerequisites are blockers/incomplete evidence, never passing tests.

Outcome and scope

Add an opt-in Rust Testcontainers suite using small Alpine server/client images. Exercise the actual application, encrypted vault/persistence/delivery APIs, and M5's real rustix Generic Netlink reader inside the server container against real kernel WireGuard interfaces. Establish real tunnels, generate IPv4 traffic, and prove that saved changes remain separate from runtime application. The user explicitly excluded IPv6 capability and traffic tests on 2026-10-22. Production dual-stack behavior in SPEC.md is unchanged; real IPv6 behavior is therefore unverified by this milestone.

Read SPEC.md Operations and states, Connection delivery, Backups and restoration, Client screen and statistics, and acceptance criteria; ADRs 0001–0003; TESTING.md, ENVIRONMENT.md, RUNTIME.md, DELIVERY.md, VAULT_FORMAT.md, PERSISTENCE.md, BACKUP_FORMAT.md, DEPENDENCIES.md and current application/worker code.

This is real-WireGuard integration, not real-systemd acceptance. Alpine fixtures have no systemd; a test-only apply operation may configure the interface explicitly. Actual zbus service job behavior, production restart and VM acceptance remain M9. M7's synthetic TUI/PTY evidence remains separate; M8 does not require live terminal screens, phone QR decoding, public Internet access, external DNS, production configuration, new product commands, or a production apply mode.

Existing code and integration constraints

• M1–M7 are accepted. The normal executable now starts the management TUI; do not invoke it with host/production settings as a shortcut for a test driver.
• Application has open-from-store, setup/import, creation, Commit, delivery/reissue, deletion, backup/list/restore and confirmed restart flows. Use these real APIs, not a parallel shell-only client manager that would leave application behavior untested. Public-key identity and source preservation remain authoritative.
• Real observation is runtime::transport::observe_interface, currently crate- private, with the validated decoder and bounded rustix transport. Do not use only wg show output or a fake observation as evidence that this reader works.
• Application::restart always invokes the actual zbus path, while injected restart functions are private. Plan an in-crate test seam so a test-only fixture service operation can apply peers and the real observation/persistence path can verify them. Preserve backup ordering and per-attempt authority from M5.
• Prefer cfg(test) in-container test scenarios/driver code, compiled for musl and selected explicitly, to reach private adapters without exposing an unauthenticated public apply API. If another arrangement is needed, document its compile-time isolation before implementation. No environment variable may switch production restart to a fake service or bypass password/backup/root checks.
• The TUI ApplicationWorker already has synthetic workflow tests. An optional in-container worker scenario may test its real statistics reader, but network acceptance must not depend on automating every terminal key sequence again.
• No Testcontainers crate, container image recipe or integration driver is present. Add approved testcontainers as a dev-dependency with compatible pinned version and minimal features. Prefer its supported synchronous facade if it avoids a direct executor dependency. Other direct helpers, Docker client crates or Tokio still require prior agreement; transitive dependencies are not new direct approvals. Use Cargo.lock and inspect official APIs for the selected version.
• Native tools use system Rust 1.97.1; musl readiness was previously unverified. Recheck rather than assuming rust-toolchain.toml installed targets or a linker.

Context and implementation steps

Use GPT-6-Sol/medium coordination and GPT-6-Luna/high implementation, fresh review and repairs. Execute bounded tasks sequentially with one writer and explicit file ownership. The coordinator alone updates milestone acceptance and evidence.

Task	Owner	Files and deliverable
M8.1	implementer	docs/TESTING.md/ENVIRONMENT additions and test support: exact opt-in architecture, prerequisites, image/build and driver contracts
M8.2	implementer	tests/containers/alpine/Dockerfile, fixture-only setup scripts, musl build recipe: small reproducible cached image and executable compatibility checks
M8.3	implementer	tests/testcontainers_wireguard.rs, tests/support/ modules and Cargo files: host orchestration, private network/container ownership, prerequisite checks, bounded execution and cleanup
M8.4	implementer	in-crate cfg(test) scenarios/private adapters, test driver coordination: real netlink reads, fixture apply and application state verification inside server
M8.5	implementer	container scenarios and TESTING/README documentation: required lifecycle, restore, delivery/import/failure assertions and executed evidence
M8.6	reviewer, repairer	Independent isolation, real-adapter coverage and negative-test review; bounded fixes and real-suite re-review
M8.7	coordinator	Default and explicit container gates, redacted results, prerequisites/limitations, acceptance and M9 handoff

M8.1 defines two execution locations: host harness uses Testcontainers to manage containers; server-side code uses the real application and kernel reader in that container's namespaces. Document how driver sessions persist across staged create, Commit, first delivery and apply phases, and how the client is configured from the actual delivered file. Do not lose the creation session between Commit and first issue or reconstruct password-free authority on reopen.

Choose a named ignored integration target/scenarios or another explicit opt-in mechanism that default cargo test never starts. The host suite must also opt into all in-container scenario processes. Ensure --ignored does not select unrelated privileged tests. Fail an explicitly requested suite nonzero on missing required prerequisites; never return early with a successful test result labelled skipped.

M8.2 pins an Alpine base release/digest and records the resolved image identity and package versions. Install only wireguard-tools, iproute2 and minimal fixture requirements. Use BusyBox capabilities when sufficient; justify any extra package in the test recipe. Runtime images contain no Cargo registry/compiler or systemd. Build/cache image layers and compatible driver artifacts before repeated tests; use fresh mutable containers/volumes for each scenario, not reusable dirty servers. Keep build context small with explicit copies/ignore rules, no .git, host Backup, credentials or private configuration. Never bake generated keys into image layers.

Build server/client driver code for x86_64-unknown-linux-musl or in a pinned Alpine builder matching the toolchain. Inspect dynamic requirements and actually execute a harmless readiness command inside Alpine. Do not rely on a glibc host binary, target name or successful host compilation as runtime compatibility proof. Only build required test targets; avoid pulling compiler/debug layers into the small runtime fixture. No global package installation or toolchain update is implicitly authorized by a missing cross-build prerequisite.

M8.3 checks Docker API access and explicit disposable-environment selection. Do not use a configured remote daemon without establishing that it is the selected non-production test environment. Probe WireGuard interface creation inside a disposable probe container, never by creating host interfaces or loading modules. Container tools alone do not supply the host kernel module. Refuse to repair prerequisites via SYS_MODULE, privileged mode or host sysctl changes automatically.

Create a dedicated uniquely named IPv4 network with a test subnet that does not overlap the tunnel ranges. Run server/client as container root with scoped NET_ADMIN in their own network/PID namespaces; no host networking, namespace joins to host, host D-Bus, host /etc/wireguard, Docker socket mount, or production binds. No host UDP publication is needed for container-to-container endpoints. Use container-internal reachable endpoint/port values, not localhost mapped ports. All settings/server/vault/output paths are private fixture directories created with the application's required permissions.

Use Testcontainers copy/exec APIs or an explicitly safe bounded transport for fixture data. Secret-bearing configs/passwords never enter command arguments, image metadata, public environment variables or raw stdout/stderr logs. Any necessary copied plaintext exists only in private temporary/container storage. Generate keys per scenario. Reports carry public keys, phase/status and redacted categories, not full configurations, QR matrices or wg show all dump output.

Bound image/start/driver/readiness/traffic/teardown operations. Poll explicit conditions with monotonic deadlines, not fixed sleeps. Use unique ownership and RAII/explicit cleanup for containers, networks and volumes on failures as well as success; cleanup must not mask the original failure or delete unrelated resources. Do not default to retain-failed-containers with secrets. Report leftover owned resources if daemon failure prevents cleanup.

M8.4 keeps fixture ip/wg calls solely in setup or test-only apply code. It may use wg-quick strip or equivalent explicit fixture setup, but must not execute arbitrary imported hooks. Handle optional DNS/MTU fields in delivered configs via a documented fixture setup, without mutating the delivered payload just to pass. Avoid an unneeded resolvconf dependency by configuring networking explicitly when appropriate. No subprocess apply path is added to production.

Configure endpoint reachability outside the tunnel before full-tunnel policy so an encrypted UDP endpoint is not recursively routed into its own VPN. Set full IPv4 routes within the client's isolated namespace only. Exercise traffic to server tunnel addresses; an external Internet gateway/DNS is not required and successful tunnel reachability does not claim public Internet egress works. Ensure test success cannot come from the Docker underlay: target tunnel-only addresses, use an explicit interface/route assertion, and verify public counters through the actual rustix reader. Test-only service apply reports must be labelled fixture results, never actual systemd job evidence.

If fixture restart orchestration verifies and releases application reservations, use the existing private adapter seam with a real backup, fixture apply, actual netlink read/comparison and journaled verification. Do not simply call mark_applied or clear reservations to satisfy assertions. A direct fixture apply outside that orchestration proves only kernel state change; it cannot by itself prove the production successful-restart state transition.

M8.5 implements these required scenarios, splitting tests where isolation helps:

1. Baseline and reader interoperability. Bring up a server plus an existing client with synthetic configuration, establish real IPv4 tunnel traffic, and observe the configured interface's complete peer set, routes, nonzero fresh handshake and increasing counters through the actual Rust reader. Capture before/after counters, not exact packet-byte totals. Empty/not-yet-handshaken observations must not be misreported as a reader failure or online heuristic.
2. Create, Commit, deliver, then apply. Use Application to prepare a new client, Commit and save the actual first-delivery file (QR optional). Assert saved server/vault change, mandatory pre-Commit archive, unchanged runtime peers and explicit activation warning. Configure a fresh client from delivered bytes; prove it cannot reach tunnel-only targets before apply. Apply through the test-only boundary, then require real handshake and IPv4 traffic.
3. Saved deletion versus live access. Delete and Commit an active client; assert current vault record removal, existing backup retention, and unchanged runtime peer/access before apply. Reopen saved state to verify the IP remains reserved. After fixture restart plus real verification/persistence, assert peer removal, failed fresh tunnel traffic and address release. Use a finite negative-check window and establish a working baseline so unrelated setup failure cannot masquerade as successful revocation.
4. Backup/restore separation. Save a known client set, mutate/Commit, preview and restore the archive without providing a vault password. Assert restored settings/server/vault/state and precautionary backup, plus unchanged kernel state until explicit fixture apply. Then verify the restored peer set and renewed tunnel traffic. Restoration alone never releases pending addresses.
5. Import, reissue and file safety. Import a valid generated existing client plus invalid/conflicting candidates from private source files. Assert original bytes unchanged, anomalies visible and conflicts blocked. Reopen and reissue a matched client through password-authorized output; verify wrong password fails and a valid delivered file can configure a real tunnel. Preserve first- issue/password boundaries and do not add plaintext source fallback.
6. Failure prevents application. Produce a deterministic backup failure in the container (not chmod-only when root can bypass it) and assert Commit/fixture restart does not install/apply prepared changes or release addresses. Cover default reader deadline/missing-interface behavior inside its namespace without changing host state. Keep already exhaustive malformed/archive/failure-unit cases in ordinary tests rather than duplicating them in every costly container.

For all negative reachability assertions, stop/restart client traffic as needed and use new requests; stale timestamps/counters or buffered packets cannot prove continued/revoked access. Use a fixture endpoint/traffic generator with its own bounded error classification. Record that IPv6 traffic is intentionally untested.

Acceptance and validation

• M8-A1: documented opt-in commands run an actual Testcontainers suite with pinned/cached Alpine runtime images and compatible in-container driver; default tests/help/version do not start Docker, require root or query host interfaces.
• M8-A2: explicit prerequisite checks reject unavailable daemon/kernel/capability or incompatible artifacts as incomplete/failure; no production or automatic privileged/module/sysctl workaround is used.
• M8-A3: isolated real peers establish IPv4 traffic, and the actual rustix reader reports complete public peer/routes, fresh handshake and traffic increments without relying solely on wg text or fake decoded observations.
• M8-A4: new client creation/Commit/file delivery use real Application and vault APIs; the delivered configuration works only after explicit fixture application, and Commit itself never changes runtime state.
• M8-A5: saved deletion removes only current secret, keeps archives and retains reservation/live peer until explicit apply; actual observation and journaled verification precede reservation release. Fresh traffic is revoked afterward.
• M8-A6: password-free restore replaces the saved set but does not apply it; fixture apply restores real tunnel behavior. Source files remain unchanged and imported conflict/wrong-password outputs remain blocked.
• M8-A7: deterministic mandatory-backup failure prevents protected write/apply; negative traffic and missing-interface results cannot pass due to unrelated broken setup or a silent empty/partial observation.
• M8-A8: fixture adapter cannot be selected in production or bypass root/password/ backup controls; no public alternate restart API or runtime environment bypass is introduced. Alpine results explicitly exclude actual zbus/systemd coverage.
• M8-A9: secret-free diagnostics, private copied files, limits/deadlines and cleanup work on both success and failure; only test-owned resources are removed.
• M8-A10: integrated default and real-container gates pass; a clean repeated run reuses image layers while starting fresh mutable scenarios and produces the same behavioral outcomes. Independent review closes actionable isolation/coverage issues.

Executed integrated host and selected-daemon commands, from repository root; the exact Docker environment, image/driver commands, counts and durations are in the M8.7 evidence:

cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
cargo test --locked --test testcontainers_wireguard -- --ignored --test-threads=1
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

The exact pinned image-build and in-container driver-build commands, prerequisites, and output artifact path are in TESTING.md. Both were executed; the test-only musl driver compiled and ran in Alpine. Build setup and cached dependency access are distinct from the locked host test execution. No unapproved direct dependency was added.

Image identities, kernel/runtime/toolchain versions, target architecture, scenario names, outcomes, durations and counts are recorded in the evidence report. All required scenarios executed and passed; the ignored-test output explicitly reports 1/1 passing rather than treating a skipped test as success. Real systemd validation remains M9.

Progress

Current snapshot: 2026-10-25. This replaces the chronological execution notes; the historical record preserves previous attempts and their reported evidence.

Task	State	Result / next action
M8.1	complete	Reviewed host/container contract.
M8.2	complete	Pinned Alpine recipe, package closure and readiness verified.
M8.3	complete	Reviewed IPv4 prerequisite probe passed on the selected daemon.
M8.4	complete	Reviewed in-container Application driver and real Rustix smoke passed.
M8.5 traffic	complete	Copied first-delivery file drives real IPv4 traffic; exact IPv4 routes, handshakes and counter deltas verified; independent findings closed.
M8.5 deletion	complete	Saved deletion preserves access until explicit fixture Apply; subsequent deleted-client traffic fails and retained-client traffic succeeds; independent finding closed.
M8.5 restore	complete	Two password-free restores, unchanged runtime before Apply, renewed IPv4 traffic and pending-address release after verified Apply passed on the selected daemon. Independent code review found no implementation defect; the plan-status finding closed on re-review.
M8.5 import/reissue	complete	M8.5-IMP-01 closed on independent re-review; focused tests and fingerprinted pinned musl build passed. Selected-daemon suite passed 1/1 in 82.06s with cleanup, including reissued-file IPv4 traffic.
M8.5 backup failure	complete	M8.5-BF-R1 closed on independent re-review. Typed backup errors, unchanged saved/runtime state, no fixture apply, retained reservation and reader errors passed on a known-source selected-daemon run (1/1, 81.45s).
M8.6	complete	R1 documentation, R2 IPv6 plan-gate and R3 stale milestone summary findings each closed on independent re-review. No code defect was found.
M8.7	complete	Cached image/readiness/packages, pinned musl rebuild, host gates, two fresh selected-daemon full runs and the documented unfiltered opt-in command passed on stable source inputs. Final independent review closed all findings; coordinator accepted M8-A1–A10 for the scoped IPv4 Alpine work.

Review and repair

Finding / work item	State	Disposition / next evidence
M8.1-R1; M8.2-R1/R2	closed	Independent re-review closed documentation/image findings.
M8.3-R1–R7	closed	Timeout/transport/error/name fixes reviewed; revised IPv4 probe passed.
M8.4-R1–R4	closed	Driver protocol, path confinement, host transport and cleanup findings independently closed; real smoke passed.
M8.5-R1/R2	closed	Delivered bytes consumed in client namespace; exact IPv4 route assertions; independent re-review closed both.
M8.5-R3	closed	Negative ping requires completed transmitted/zero-received evidence; Docker execution errors cannot pass; independent re-review closed it.
M8.5 restore phase failure	closed	Fixture expected only the removed client's IPv4 reservation; Application correctly retained both saved addresses. Exact-set expectation now derives all removed-client addresses; focused regression and selected-daemon pass. Diagnostic record.
M8.5-RESTORE-DOC-1	closed	Independent reviewer found stale restore status/handoff; coordinator updated the snapshot, and independent re-review closed it. No code defect found.
M8.5-IMP-01	closed	P2: the Alpine driver had omitted invalid-file byte preservation. Repair checks all three sources before claiming unchanged originals; focused regression and fingerprinted selected-daemon rerun passed, and independent re-review closed it.
M8.5 failure phase	closed	Fixture misread delete_client's bool as peer deletion; it actually reports vault-record removal and the legacy baseline has no record. Repair checks draft peer absence; focused regression and known-source selected-daemon run passed; independent review found no further issue with this check.
M8.5-BF-R1	closed	P2: Commit-failure assertion formerly accepted any error. Repair requires Err(AppError::Backup(_)); focused regression and known-source selected-daemon run passed, and independent re-review closed it.
M8.6-R1	closed	P2: TESTING.md and evidence report had stale M8.5 pending claims. Repairer recorded completed first-delivery transfer and fingerprinted backup-failure evidence; independent re-review closed it.
M8.6-R2	closed	P2: General plan gate required IPv6 prerequisites despite M8's explicit IPv4-only scope. Coordinator scoped prerequisite language to the suite and retained production dual-stack requirement as unverified; independent re-review closed it.
M8.6-R3	closed	P2: Milestone status summary still reported active M8.5 restore repair. Coordinator updated it to M8.1–M8.5 complete with M8.6/M8.7 open; independent re-review closed it.
M8.7-R1	closed	P2: Reviewer saw a prior plan snapshot while final evidence was being entered. Task/handoff rows and outcome now record passing repeated runs and R3 closure; independent re-review closed it.
M8.7-R2	closed	P3: Validation passage still described implemented and executed commands as planned, and snapshot date was stale. Coordinator corrected the passage and date; independent re-review closed it.

Detailed closed-finding rationale and superseded attempts are in the historical record. New diagnostic attempts belong in docs/diagnostics/, not this table.

Evidence and handoff

Previously reported evidence, carried forward without rerunning during this 2026-10-24 documentation cleanup:

Scope	Result and limit
IPv4 prerequisite	Coordinator probe passed 1/1 (1.46s); isolated resources cleaned.
M8.4 Application smoke	Coordinator musl rebuild and selected-daemon smoke passed 1/1 (4.05s); named resources absent afterward.
M8.5 delivered-file traffic	Repaired real run passed 1/1 (14.23s); host support tests passed 21 with privileged test ignored; independent re-review closed R1/R2.
M8.5 deletion	Repaired coordinator real run passed 1/1 (42.96s); host support tests passed 23 with privileged test ignored; cleanup verified; independent re-review closed R3.
M8.5 restore	Worker reported fmt, focused/full locked tests, all-target Clippy, release build and diff check passing before the final reservation-helper edit; focused helper regression and pinned musl rebuild passed afterward. Coordinator exact selected-daemon run passed 1/1 (72.66s), with named resources absent. Independent review found no code issue; later integrated gates are recorded in the M8.7 row.
M8.5 import/reissue	Worker reported fmt, Clippy and focused import tests after its final assertion edit; full locked tests and release build passed before it. After M8.5-IMP-01 repair, focused regressions and Clippy passed. Coordinator pinned musl build and selected-daemon run passed 1/1 (82.06s), with stable source fingerprint and named resources absent. Reproducible evidence.
M8.5 backup failure	Worker reported fmt, Clippy, full locked tests/release before the final typed-error repair; focused regression, fmt and Clippy passed afterward. Coordinator pinned musl build and selected-daemon run passed 1/1 (81.45s), source-input SHA256 b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2 stable before build/after run, driver SHA256 ad45dc3f6b0987b075ac522e171c82c6651124c3d01c65c14df90595fe552815, named resources absent. Independent re-review closed BF-R1.
M8.7 integrated gates	On the same source fingerprint, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, release help/version, and git diff --check exited 0. Cached Alpine image ID sha256:f41cd6b848d8280d4d86bcaceea962e1b3e5a73e9496c6f9d7929470d0e874d5 passed readiness; 33 constrained packages recorded. Pinned musl rebuild produced the same driver SHA256. Exact selected-daemon scenario passed 1/1 twice (80.77s each); documented unfiltered --ignored command passed 1/1 (81.87s). Named containers/networks absent after each. Reproducible evidence; prerequisite failures in diagnostics. Final independent review closed M8.7-R1/R2 and found M8-A1–A10 supported.

Exact earlier commands, environment/build identities and intermediate results remain in the historical record. For new evidence use the report format in execution records, including the tested revision or working-tree identity. Earlier runs lack a complete source fingerprint; do not infer that they validate subsequent edits. Final gates must run on the integrated revision. Do not rerun unrelated gates merely to maintain this document.

Next action: Milestone 8 is accepted. Stop here; Milestone 9 remains pending and requires a disposable systemd VM before its real D-Bus acceptance work.

Decisions and discoveries

• The user excluded IPv6 capability and traffic testing on 2026-10-22; production dual-stack requirements are unchanged. Real IPv6 remains unverified.
• Use the real bounded Rustix reader and test-only fixture Apply. Alpine cannot validate the private zbus/systemd adapter; real systemd acceptance remains M9.
• Build the musl test driver in the pinned Alpine builder; the host lacks the musl prerequisites. Cached image/build layers may be reused; secret-bearing fixture state must be fresh. Build identities are preserved in the history.
• Full fixture wg setconf resets learned peer state. Traffic assertions reconnect retained clients and require fresh observations; peer presence alone is not continuity evidence.

Outcome

M8 accepted for its user-scoped IPv4 Alpine Testcontainers work after independent review closed all actionable findings and the host and repeated real-container gates passed on one source fingerprint. M8-A1–A10 are satisfied within that scope. IPv6 capability and traffic were excluded by user direction; real systemd/D-Bus behavior remains unverified and belongs to M9. Milestone 9 was later retired by user direction; this historical M8 acceptance does not establish real systemd/D-Bus behavior.

Milestone 9 — Real systemd acceptance and release readiness

Status: retired (2026-10-26T20:52:01Z; user judged the milestone goal unnecessary over-engineering and removed it from the development sequence). No M9 acceptance result exists; real systemd/D-Bus behavior remains unverified. Prerequisites: milestones 1–8 accepted; explicitly selected disposable Linux VM with its own kernel, systemd as PID 1, system D-Bus, WireGuard and synthetic data; compatible pinned-toolchain artifacts and a bounded management/console channel. Missing VM access or required capabilities is a blocker, not passing acceptance.

Outcome and scope

Verify the real production Application::restart -> private zbus systemd job adapter -> real Rustix WireGuard observation -> journaled verification sequence. Complete operating/recovery instructions, an acceptance evidence map, and a reproducible release candidate. Acceptance authorizes no production experiment, installation, publication, deployment, Git commit or tag.

Read SPEC.md, IMPLEMENTATION.md, CONTEXT.md, ADRs 0001–0003, RUNTIME.md, PERSISTENCE.md, BACKUP_FORMAT.md, DELIVERY.md, ENVIRONMENT.md, TESTING.md, DEPENDENCIES.md and EXECUTION_RECORDS.md. Read only the relevant final M8 evidence and focused diagnostics when needed; do not reconstruct every historical attempt.

M8 was accepted for user-authorized IPv4-only Alpine coverage. Preserve that acceptance and do not silently reintroduce excluded IPv6 tests as a prerequisite for the VM. Production dual-stack requirements remain unchanged, so the final acceptance matrix/release notes must explicitly retain the unverified real IPv6 limitation. Do not claim complete dual-stack production validation from IPv4 VM/container or synthetic tests. Any additional IPv6 validation or requirement change needs an explicit scope decision; it is not a reason to block independent systemd/IPv4 work or conceal the remaining release qualification.

Out of scope: replacing Alpine coverage, new product features, another service manager, global toolchain/package installation, production access, automatic VPN rollback, new unapproved direct dependencies, and a general-purpose VM framework. Choose the smallest reproducible VM procedure using an available approved runtime; if none exists, record the prerequisite instead of installing one silently.

Current implementation and critical boundaries

• M7 provides actual startup, root checks, executable-relative settings, TUI and serialized ApplicationWorker. Help/version remain unprivileged. Use real root management only inside the selected VM, never on the development/production host.
• M8's src/container_driver.rs is cfg(test) and uses an explicitly fake fixture service apply plus real observation/persistence. It does not exercise zbus. Do not reuse that callback as M9 service evidence. Reuse safe fixture generation and redacted protocol patterns only where their semantics actually match.
• Application has preview/confirmation, pre-restart backup, attempt/generation checks, bounded service/runtime operations and durable state marking. Public Application::restart is the required VM entry point. Test-only VM code may inspect private results but must not substitute its service/read/install adapters.
• The pinned zbus 5.19.0 adapter subscribes before submission, resolves the loaded unit's primary ID, follows the returned job and accepts only done. Verify this against actual systemd, including fast completion and an alias resolving to a primary unit. Do not demand a daemon PID from an active/exited oneshot service.
• A service job completing does not prove peer correspondence; matching peers do not prove verification was persisted. Check both stages and address release. Historical markers remain historical after reopening. Retain M4 journal recovery and M5 timeout/partial-runtime-change reporting; no rollback/retry is automatic.
• A release executable is distinct from a cfg(test) harness. Capture each artifact's source identity/target and prove the actual executable starts in the VM as well as exercising library operations through a test driver.

Tasks and ownership

Execute sequentially with one writer, GPT-6-Sol/medium coordination and GPT-6-Luna/high implementer, independent reviewer and repairer. Provide bounded file ownership and acceptance IDs; the coordinator maintains this current snapshot.

Task	Owner	Deliverable and boundary	State
M9.1	implementer	docs/VM_ACCEPTANCE.md and tests/vm/ contract: explicit disposable target selection, pinned base/provisioning, driver, prerequisites and cleanup; no production endpoints	paused by user: guarded first start ran; Debian installer progress was observed, then the exact disposable VM was powered off on stop request; guest completion/provisioning/reset/cleanup unverified
M9.2	implementer	Minimal VM fixture/opt-in driver and build recipe: real systemd/WireGuard service, private synthetic settings/data, compatible test and release artifacts	pending M9.1 guest/guard
M9.3	implementer	Execute actual successful/failed/timeout/verification VM scenarios below; repair narrowly if real integration exposes defects	pending M9.2 fixture
M9.4	implementer	README/operations/recovery and release documentation, requirements-to-evidence matrix, release-candidate identity/runtime dependency assessment	complete for host/documentation scope: independently reviewed operator/recovery docs, qualified matrix and native GNU artifact assessment; guest startup remains blocked
M9.5	reviewer, repairer	Fresh independent review of VM targeting, actual production adapter use, failures/recovery, evidence and remaining release limitations; repair/re-review	partial document reviews closed; fresh VM implementation review pending after M9.1–M9.3
M9.6	coordinator	Integrated default/affected Alpine/VM gates, concise final evidence and qualified acceptance decision; no publishing or deployment	prior host gates passed; integrated VM gates and acceptance pending

M9.4 review finding: M9.4-R1 (P2, closed) — docs/RUNTIME.md described accepted M7 TUI/startup and M8 real IPv4 Rustix validation as future work. Targeted repair corrected those claims while retaining the systemd/D-Bus and real IPv6 limits; independent re-review closed it. Guest/systemd validation remains unavailable.

M9.1-R1–R8 (P2, closed on independent re-review) covered bounded guest marker capture, strict inventory, accurate host access status, occupied-path preflight, the observed NAT baseline, exact SATA controller inventory, target-folder symlink escape, and actual VBox machine-readable recording/storage syntax. Repairs and regressions passed the integrated synthetic VM suite (26/26). The create run registered only the pinned target UUID b14c850b-a21e-4a56-acca-785590f0c4ac; the UUID-pinned resume configured its VDI, ISO, host marker and manifest. The actual read-only guard then passed on the powered-off target. Neither create nor resume may be rerun on this occupied state. Diagnostic attempts are in milestone-9 diagnostics. M9.1-R9/R10 (P2, closed on independent re-review) corrected unattended command options and accepted VirtualBox's empty SATA port rows while rejecting extra media. The integrated synthetic VM suite passed 33/33 before actual preparation.

VM setup and execution contract

Use a disposable server VM and a controlled synthetic client in a separate VM or isolated namespace inside the lab. Test traffic must reach tunnel-only addresses, not succeed via the management network. Do not attach physical production networks, forward production credentials, mount host D-Bus/system paths, or expose host service control. Keep management reachable independently of the VPN being restarted.

Document VM image/release, kernel, architecture, systemd, D-Bus and WireGuard-tools versions, fixture units/drop-ins and exact provision/build/run/reset commands. Cache immutable image/build inputs; reset mutable state between scenarios. Require explicit target selection and lab marker validation before privileged test actions. A remote target being reachable or running Linux is not sufficient authorization. Refuse missing identity markers, ambiguous endpoints and accidental host execution. Use bounded waits/transport, owned-resource cleanup and redacted reports. Secrets never travel in argv, public logs, committed images/snapshots or evidence files.

Provision wg-quick/service prerequisites in the VM only, with a loaded/enabled fixture service, permissions compatible with SavedStore, and stable invariant paths. Set up fixtures without unsafe SaveConfig rewriting; test preflight refusal of such a configuration rather than modifying administrator settings automatically. Existing fixture hooks, if needed, are fixed reviewed lab code, never imported text. Network/kernel prerequisite changes and snapshots affect the disposable guest only.

Do not use a naked ignored test that can restart the current host's service when someone runs --ignored. Put target guards at the earliest privileged boundary. Use an explicitly selected VM launcher/driver and document exact commands after its files exist. All normal cargo tests remain unprivileged and bus/network-free. No production environment switch or fake-systemd mode is added to the binary.

Required scenarios

1. Real successful apply. Establish the existing client's IPv4 tunnel. Through Application create/Commit/deliver a new client and show saved/runtime divergence. Preview/cancel preserves draft and sends no service request; confirmed restart with the real adapter has a completed pre-restart backup, matching terminal job, actual interface/peer comparison and durable state write. New traffic succeeds, verification history is recorded, and reopening treats it as history, not a new live verification. Repeat a fast real job/loaded alias case without losing its completion signal. Do not use log inference in place of application outcomes.
2. Deletion and reservations. Commit deletion of a working client: access and reservation remain until the real successful restart/verification path. After it, the peer is absent, fresh tunnel-only traffic fails, durable reservation is released and old backups remain. Establish positive traffic first and bound negative checks so unrelated fixture failure cannot pass the scenario.
3. Failures and deadline. Use fixed guest-only fixture unit/drop-ins to cause a terminal job failure and a submitted job exceeding the configured deadline. Check bounded return, honest submitted/may-still-complete classification, no automatic retry/rollback, no false Verified state or IP release. Wait/reset the guest explicitly after a late completion; timeout is not cancellation. Also cover an unresolved configured unit before submission and backup failure that prevents any restart. Use focused synthetic tests for exhaustive bus races, not destructive daemon manipulation merely to duplicate unit coverage.
4. Successful job, failed verification. A dedicated fixture service completes but leaves the interface missing or a mismatched peer set. The real adapter must report the appropriate verification failure and retain reservations; no client handshake is required to prove correct idle peers. A separate controlled saved- state write failure after actual restart must report changed runtime without falsely recording durable verification. RecoveryRequired must prevent unsafe subsequent mutations; use established M4 fault seams only for persistence, never replace the actual service/runtime calls to claim this scenario passed.
5. Manual restore/recovery. After a deliberately bad saved/apply state, select a known-good archive through preview/confirm without supplying a vault password. Check precautionary backup, restored settings/config/vault and unchanged runtime until an explicit real restart; then verify the restored peer set and traffic. Follow the documented manual procedure, not a hidden automatic rollback. Keep transport access independent and validate file permissions/reopen behavior.
6. Actual executable smoke. In the guest's console/PTY, start the release binary from a dedicated root-only directory outside PATH, with settings alongside it. Check list/current statistics and one controlled Commit/restart workflow through the real worker path; exit/cancel restores terminal state. Help/version work as non-root without settings; non-root management is rejected. Reuse M7's detailed synthetic terminal tests rather than repeating every keyboard/form edge case.

Release preparation and evidence

Document installation prerequisites and binary placement, 0600/0700 permissions, setup/import with untouched originals, initial vault password and unrecoverable password loss, first/reissue file/QR behavior, Commit versus restart, timeout and partial-write outcomes, and manual recovery. Explain backup plaintext server-secret exposure and that backups beside the binary are not protection against disk loss. Do not add automatic retention, encryption, or remote backup features.

Produce a native release candidate under the pinned compiler and locked dependency set. Record source/dirty identity, artifact identity/target and actual dynamic-library requirements. Test the artifact in the chosen guest; distinguish its supported baseline from the tested development host. Existing musl artifacts may be reused only with captured compatible inputs. Do not claim reproducibility from merely running cargo build twice or claim support for untested architectures/distributions.

Create a specification-to-evidence matrix (including preservation, secrets, saved/ applied separation, backups, delivery and terminal behavior) using existing valid M1–M8 evidence plus M9 results. Reuse M8's current evidence where relevant inputs are unchanged; rebuild/rerun affected Alpine behavior when M9 changes invalidate it. Never carry forward a pass from an unidentified or older dirty artifact. List actual IPv4, synthetic dual-stack, unverified real IPv6, QR/device and systemd scopes honestly rather than labelling the entire product universally verified.

Acceptance and validation

• M9-A1: documented guarded VM procedure/compatible artifacts execute in the explicitly selected disposable guest; default tests cannot target host services.
• M9-A2: real zbus submission/job completion and Rustix verification succeed through Application::restart, including fast completion/primary-unit alias; actual release-worker startup is exercised separately from the test harness.
• M9-A3: completed pre-restart backup precedes service mutation; Commit/restore never apply changes; canceled draft/restart actions have no unintended effects.
• M9-A4: real successful deletion/apply releases durable reservations only after full verification; fresh traffic and reopened state support the result.
• M9-A5: unit/job/deadline/backup/missing-interface/mismatch and post-restart persistence failures have accurate staged outcomes, retained reservations, deterministic manual recovery and no automatic restart retry/VPN rollback.
• M9-A6: previewed password-free restore plus explicit real restart recovers the selected known-good state/traffic; the VM procedure matches operator instructions.
• M9-A7: root/non-root executable-relative startup, limited real terminal flow, artifact compatibility and private output/backup permissions are verified in VM.
• M9-A8: evidence matrix, release artifact identity, runtime dependencies, operator/recovery docs and unresolved coverage qualifications are accurate. M8's IPv6 exclusion is preserved; no unsupported full dual-stack claim is made.
• M9-A9: current default gates and affected Alpine/VM scenarios pass on the identified integrated revision; independent review closes actionable findings. Unavailable required VM checks prevent acceptance, rather than becoming a mock pass.

Validation and execution records

From repository root, run these existing commands at the integrated gate, not on every diagnostic retry:

cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --release
./target/release/wireguard-admin --help
./target/release/wireguard-admin --version
git diff --check

Before VM execution, document exact newly implemented build/provision/run/cleanup commands in docs/VM_ACCEPTANCE.md and the existing selected-daemon Alpine command in TESTING.md. No VM target/command is claimed available yet. Record actual results, counts, selected VM/base identity, source/artifact identity, cleanup and review mapping in docs/evidence/milestone-9.md when runs occur. Keep only latest applicable evidence/status in this plan. Investigations belong in docs/diagnostics/milestone-9.md when needed; after two failed repairs reassess/minimize before another expensive full run per EXECUTION_RECORDS.md. Do not create placeholder reports claiming tests.

Review, evidence and handoff

M9.1 initial non-runnable contract passed read-only review. After the user authorized local VirtualBox, approved outside-sandbox inventory confirmed VBoxManage 7.2.8 works and /dev/vboxdrv is visible there; only Win7/Win11 are registered and neither is a test target. The official Debian 13.7 amd64 netinst ISO in the private lab root has SHA256 a7ef94ac2fb9a7fec454552abd629b7cc9d5155c886165a45649f5ce6167e355, matching the downloaded official SHA256SUMS. The new target UUID b14c850b-a21e-4a56-acca-785590f0c4ac is configured and powered off with the private manifest/marker, exact VDI and pinned ISO; actual read-only guard check exited 0. The integrated synthetic VM suite passed 26/26 after independent review/repair; no existing Windows VM was modified. An exact-target VirtualBox unattended install dry run with private synthetic password files, Guest Additions ISO, and redacted output exited 0. The reviewed preparation command then exited 0; read-only showvminfo found the expected VDI and a private generated auxiliary .viso at SATA ports 0/1. It did not boot the guest. M9.4 operator instructions, qualified evidence matrix, and updated README, environment and runtime guidance passed independent review after M9.4-R1 repair. The native GNU artifact SHA256 is d52d43cd02332352ffbd09c97e3b8095a710359128260c1286006e1c76c1b283; host --help and --version exited 0. On the integrated unchanged Rust source, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, and git diff --check exited 0. M8's source-input fingerprint remains b28dc6e4cb92aa6edf384d966ba5952a8d6d0efe4c22d6a804b67fb2c0297da2; no Rust/Alpine input changed, so M8 evidence was not rerun. No VM scenario, production access or key read occurred. Guest compatibility and actual zbus/ systemd behavior remain unverified. The prior blocker audit was valid before VirtualBox was made accessible outside the sandbox; its no-VM conclusion is superseded by this authorized prerequisite path. M9.4 has no open finding.

M8 is accepted for real IPv4 Alpine application/transport coverage; its test-only service callback is not systemd evidence. Carry forward that distinction. Initial M9 evidence is unavailable until actual guest execution; record missing historical inputs as unavailable rather than reconstructing them.

Next action: none for M9. The user retired it and authorized development to continue with M10. Do not restart the VM or resume M9 work without a new explicit request. No M9-A1–A9 check is complete.

Outcome

Retired at the user's request. The separate disposable Debian VM b14c850b-a21e-4a56-acca-785590f0c4ac was powered off; a read-only running-VM inventory was empty afterward. M9.1 remains incomplete, M9.2–M9.3 have not run, and M9-A1–A9 remain unchecked. Prior host gates and M9.4 documentation passed; no release acceptance or deployment is claimed. Real IPv6 remains separately unverified by the previously accepted test scope.

Milestone 10 — Visible styled keyboard quick reference in bottom panel

Status: accepted (2026-10-26T21:07:24Z). The user retired M9 and explicitly directed development to continue. M1–M8 are accepted; M9 is no longer a prerequisite. M10's scoped TUI checks and independent review passed.

Outcome and scope

Display discoverable keyboard controls inside the bordered panel at the very bottom of the terminal. Users should be able to find routine operations without opening Help. Render each hint as a distinct key label followed by its action, with bold/color emphasis on keys and readable action text. Keep UI text in English, following repository conventions. These are keyboard hints; adding mouse interaction is outside this milestone.

The present src/tui/render.rs::draw reserves only two rows for a fully bordered footer. Its top and bottom borders leave no interior row, hiding the existing plain shortcut text. Repair layout as well as styling; merely recoloring that paragraph cannot meet the requirement.

Context and implementation steps

Task	Owner	Scope and expected result	State
M10.1	implementer	Inspect src/tui/render.rs, state.rs, forms.rs and terminal.rs; derive hints from actual supported keys and screen/form state. Implement the bottom panel with sufficient interior height, styled key/action groups and width-aware packing.	complete for task scope: R1/R2 repaired and independently re-reviewed; render 9/9 and forms 7/7 focused tests passed on integrated HEAD
M10.2	implementer	Cover resize, narrow/minimum terminals, list/details, forms, progress and QR disclosure with synthetic render/navigation checks. Update README shortcut guidance if needed.	complete: render 13/13, TUI workflow 6/6 including PTY smoke; integrated review closed
M10.3	reviewer / repairer	Independent review of actual layout, hints versus handlers, readability, clipping and state correctness; repair and re-review actionable findings.	complete: R1 Clippy and R2 README precision repaired and independently re-reviewed with no remaining finding
M10.4	coordinator	Run integrated gates, record source/artifact identity and actual results, maintain this plan and make the scoped acceptance decision.	complete: integrated gates passed; source fingerprints and results in M10 evidence

List/details quick reference must include navigation (Up/Down, Enter, Esc as applicable), ? Help and q Exit, plus the implemented management keys: n New, r Rename, d Delete, p Preview, c Commit, x Discard, R Restart, o First file, O Reissue, b Backups, B Backup, s Setup and i Import. Distinguish uppercase from lowercase visibly. Context-dependent actions must be omitted or explicitly marked unavailable when their real prerequisites are not met. Form hints must reflect their actual Enter/Tab/Esc behavior; busy screens must not advertise blocked submissions. QR disclosure must retain a visible hint for clearing it with Esc.

Use the existing Ratatui styles and dependencies. Select contrasting styles for navigation, ordinary actions and destructive actions, while keeping key/action text sufficient without color. Adapt panel height to packed rows and terminal height, preserve usable main content, and retain the existing too-small-terminal fallback. At narrow widths prioritize navigation and Help, showing an explicit Help/overflow hint for omitted commands rather than silently clipping them. Keep Help as the complete reference and preserve all existing operation semantics.

Acceptance and validation

• M10-A1: the lowest bordered panel has visible interior text; at 80x24 all applicable list actions are displayed in readable packed rows.
• M10-A2: key labels are visually distinct with bold/color styling; action text is readable, and meaning remains understandable without color.
• M10-A3: hints match actual key handlers, uppercase/lowercase and active screen/form prerequisites; no hint implies a disabled operation can run.
• M10-A4: resizing through 120x30, 80x24, 40x8 and the supported minimum 34x8 causes no panic, overlapping borders or invisible footer text; compact layouts retain navigation/Help and indicate omitted commands. Below-minimum sizes retain a readable resize message.
• M10-A5: list/detail navigation, forms, progress and QR remain usable; footer rendering exposes no secrets and performs no application mutations.
• M10-A6: focused synthetic rendering checks and all required Rust gates pass; independent review closes actionable findings with recorded evidence.

Planned validation: cargo test --locked tui::, cargo test --locked --test tui_workflow, then cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release and git diff --check. Use synthetic fixtures and Ratatui test buffers; inspect styles as well as rendered text and geometry. No production or VM operations are needed for this presentation change. Actual integrated results and source identity are in M10 evidence.

Review, evidence and handoff

M10.1 initial implementation added visible styled footer rows and passed cargo test --locked tui::render (7/7), cargo fmt --all -- --check, and git diff --check. Independent review found M10.1-R1 (P2, closed): compact rows advertised list navigation/Help during forms, QR, and pending work; and M10.1-R2 (P2, closed): generic form Enter was false for draft review and Tab was missing from tabbed forms. Targeted repair added secret-free form key capabilities and context-specific compact rows; independent re-review closed both findings on current integrated HEAD e141c03. Render tests passed 9/9, forms tests 7/7, format and diff checks passed. M10.2 coverage remains; no milestone acceptance is claimed yet.

M10.2 added synthetic TestBackend coverage for 120×30, 80×24, 40×8, 34×8, below-minimum fallback, all applicable saved-client list hints, QR Esc/footer rendering, and key/action styles. README now describes contextual shortcuts. cargo test --locked tui::render passed 13/13 and cargo test --locked --test tui_workflow passed 6/6 including PTY smoke; cargo fmt --all -- --check and git diff --check passed. Integrated review subsequently closed its findings. No VM or production operations were run.

Fresh integrated review found M10.3-R1 (P2, closed): Clippy failed on a collapsible if; repair preserved the action prerequisite and the gate passed. It also found M10.3-R2 (P3, closed): README overstated narrow-screen Help availability; repair qualified the claim to list/details. Independent re-review closed both with no remaining actionable finding. A 34×8 QR assertion confirms Esc guidance and no fixture payload exposure; compact QR may be too large to display, but can be cleared. M10 evidence records the integrated results and limitations.

The user removed M9 as a prerequisite without accepting its unchecked M9-A1–A9 criteria. The project configuration specifies GPT-6-Sol/medium for the coordinator and GPT-6-Luna/high for all four custom roles. No new dependencies were added.

Outcome

Milestone 10 accepted for scoped TUI presentation on the integrated source identified in M10 evidence. M9 stays retired and unaccepted. The user's subsequent AllowedIPs classification request is handled in M11 below.

Milestone 11 — Valid subnet routes shown as a capability limitation

Status: accepted (2026-10-26T21:20:07Z). Prerequisite M10 accepted; M9 was retired by user direction and remains unaccepted. This is the subsequent user-requested behavior change. No VM work is in scope.

Outcome and scope

Keep a peer with valid extra subnet routes in the client list as inspection only, without treating those routes alone as a configuration anomaly or counting them on the issues screen. Details explain neutrally: “This peer contains subnet routes. Managing this configuration is not supported yet.” Malformed addresses, invalid keys, duplicate identities, document issues and other genuine errors remain visible. Preserve all source bytes and routes; do not expand the mutable client model, address allocation or restart verification, or remove safety checks.

Context and implementation steps

Read the parser, projection and TUI before editing. ConfigDocument::parse already distinguishes parse errors from valid IpNet values outside the client model. Application::display_projection retains all peer issues and marks projection failures inspection-only. The TUI currently treats every peer issue as an anomaly in list/details/! at the start of M11. Classify valid unsupported address shape separately at the presentation boundary, while retaining raw issues for edit/restart safety. A subnet-specific capability notice must be derived from parsed routes, not from parsing display strings. M2's historical “inspection issues” wording described visibility; this user-directed change refines their UI severity without rewriting M2's acceptance evidence.

Task	Owner	Scope and expected result	State
M11.1	implementer	Add explicit error-versus-capability classification and focused parser/projection/TUI regressions for valid subnet routes, normal client and genuine errors; preserve mutation guards.	complete: parser/projection/TUI regressions and safety preservation inspected; integrated review closed
M11.2	reviewer / repairer	Independently review behavior, safety boundaries and tests; repair and re-review actionable findings.	complete: R1 withdrawn after source-based re-evaluation; R2 repaired and independently re-reviewed with no remaining finding
M11.3	coordinator	Run focused and full Rust gates, record source/evidence and make acceptance decision.	complete: integrated gates passed; source fingerprints/results in M11 evidence

Acceptance and validation

• M11-A1: a peer with 10.9.0.10/32, 192.168.88.0/24, 192.168.8.0/24 is visible as inspection only, with original bytes/routes intact and the exact neutral details explanation.
• M11-A2: those valid subnet routes alone cause no ! anomaly, error count or UnsupportedAllowedIpShape text in the list or issues screen.
• M11-A3: a normal supported peer remains mutable and unchanged; malformed addresses, invalid keys, duplicate identities and document issues remain visible as errors/ambiguities alongside any valid capability limitation.
• M11-A4: unsupported peers remain protected from TUI/application unsafe mutations; allocation and restart verification behavior are unchanged.
• M11-A5: focused regressions, independent review and all applicable Rust completion gates pass on the integrated result.

Planned checks: focused document, application, TUI and config-preservation tests; cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, and git diff --check. Use synthetic fixtures only. No Alpine, VM or production checks are needed for this classification/presentation change.

Outcome

Accepted for the requested classification/presentation behavior. M11-R1 (withdrawn): review initially called a second distinct /32 route a configuration error; reviewer re-evaluated against the WireGuard wg(8) format and confirmed it is another valid shape beyond the client model, with no actionable finding. M11-R2 (coordinator, closed): without any subnet, valid additional host routes or IPv6-only shapes still appeared as anomalies. The repair classifies parsed-valid shape variants as capability limitations for display, retains raw issues for safety, and adds a generic detail notice for non-subnet cases. Independent re-review found no actionable issue. M11 evidence records the source, focused checks and all Rust gates. An external workspace actor advanced HEAD to 18f28ee while M11.1 was underway; the review covered committed and uncommitted M11 inputs. This team created no commit. No Alpine, VM or production behavior is claimed. Stop after this milestone.

Milestone 12 — Aligned, responsive client table

Status: accepted (2026-10-26T21:39:45Z). M11 is accepted; M9 remains retired and unaccepted. The user requested this scoped presentation change.

Outcome and scope

Render client records with Ratatui's native Table and explicit column constraints. Show State, Name, Public key, Mode, and Allowed IPs headers when width permits. Keep columns aligned across short/long and Unicode aliases, supported and inspection-only peers, and all draft states. Truncate predictably by terminal cell width. At narrow widths prioritize State and Name, then omit or shrink secondary columns while preserving Enter access to full peer details. Retain diagnostics, document-level issue rows, draft-removal information, selected-row highlight, keyboard navigation, and the M10 bottom shortcut panel. This milestone changes rendering only; parser, projection, validation, persistence, allocation, restart and VPN behavior are unchanged.

Context and steps

src/tui/render.rs::render_list currently builds variable-length ListItem strings, so columns drift with alias/state length. UiState and src/tui/terminal.rs select real peers by peer_index; draft-removal and document-issue rows are appended after peer rows and are not peer selections. Keep that row order and mapping when replacing the widget with Table. detail_lines already retains full peer public key, alias, routes and issues. The list must continue escaping untrusted display text. Use the existing approved ratatui dependency and its terminal-width APIs; do not add a direct Unicode-width crate or literal tab delimiters.

Task	Owner	Scope and expected result	State
M12.1	implementer	Replace list rendering with responsive Ratatui Table, preserve peer selection mapping, state/diagnostic information and footer; add focused mixed-width/Unicode/long-route/empty/narrow tests.	complete: render 20/20, terminal 8/8, TUI workflow 6/6 on final integrated source
M12.2	reviewer / repairer	Fresh independent review of layout, truncation, details access, draft/document rows and navigation; repair and re-review actionable findings.	complete: R1–R4 repaired and independently re-reviewed closed; no remaining actionable finding
M12.3	coordinator	Verify integrated files, run focused and Rust completion gates, record evidence and accept only if criteria pass.	complete: all Rust completion gates passed; source fingerprints/results in M12 evidence

Acceptance and validation

• M12-A1: native Table has the five requested headers at ordinary width; row columns align across mixed alias lengths, states, duplicate aliases, supported and inspection-only peers, with no literal tabs.
• M12-A2: Unicode aliases and long values truncate at display-cell boundaries without corrupting adjacent columns; full peer alias, public key, routes and diagnostic explanations remain in details.
• M12-A3: 120×30, 80×24, 40×8, 34×8 and below-minimum layouts retain visible State/Name at supported sizes, adapt or omit secondary columns, preserve the M10 footer and readable resize fallback.
• M12-A4: Up/Down highlight and Enter-to-details stay tied to the selected peer (including unsupported/malformed peers), without enabling mutation; empty lists, draft additions/removals and document issues remain readable and do not disturb selection alignment.
• M12-A5: focused synthetic render/navigation tests and applicable Rust completion gates pass; independent review closes actionable findings.

Planned checks: cargo test --locked tui::render, cargo test --locked tui::terminal, cargo test --locked --test tui_workflow, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, and git diff --check. Synthetic Ratatui/PTY evidence only; no Alpine, VM, production, or live VPN checks are required for this presentation change.

Outcome

Accepted for scoped TUI presentation. M12-R1 (P2, closed): compact bordered table hid all peers; repair uses a borderless compact table with a visible selected row and footer. M12-R2 (P2, closed): empty/document-only views falsely highlighted row zero; selection is now None. M12-R3 (P2, closed): five columns omitted the two-cell marker budget; repair and buffer assertions cover the right edge. Independent re-review closed R1–R3. M12-R4 (P2, closed): at widths 72–78 the five-column threshold activated before the Allowed IPs header fit. Repair uses the full-header minimum width and buffer tests at 72/78/79/80; independent re-review closed R4 with no remaining finding. Final focused tests, format, Clippy, locked full suite, release build and diff check passed on the source in M12 evidence. Synthetic UI/PTY evidence does not establish physical terminal, Alpine or systemd behavior. Stop after this milestone; do not resume VM work, commit or deploy.

Milestone 13 — Compact terminal QR disclosure

Status: accepted (2026-10-27T21:13:30+02:00). M12 is accepted; M9 remains retired and unaccepted. This is the user's scoped terminal disclosure repair.

Outcome and scope

Render authorized QR modules with two vertical modules per terminal cell, explicit dark/light colors, and the complete four-module quiet zone. Fit must account for the actual bordered disclosure layout and wrapped delivery notice; retain file-backed fallback and Esc cleanup when it cannot fit. Existing file delivery, password authorization, and draft/saved/applied behavior remain intact.

Tasks and acceptance

Task	Owner	State	Evidence required
M13.1	implementer	complete for implementation scope	Compact rendering/layout and focused deterministic tests in src/tui/render.rs and test-only QR fixture in src/delivery/qr.rs
M13.2	independent reviewer; repairer	complete	R1–R5 repaired and independently re-reviewed; no actionable scoped finding remains
M13.3	coordinator	complete	Integrated files checked; pinned Rust gates passed; source and artifact recorded in M13 evidence

• M13-A1: all four two-module cell combinations, odd-height light padding, explicit colors and full quiet zone render correctly.
• M13-A2: a deterministic nonsecret 73-module matrix uses 73 columns and 37 QR rows, with exact fit/fallback dimensions from bordered layout and wrapped notice.
• M13-A3: fallback points to saved file; resizing redraws the same authorized QR; Esc clears it; no matrix or configuration enters logs, Debug or snapshots.
• M13-A4: independent review closes findings and focused plus required Rust completion gates pass. Automated render evidence is distinct from manual scanning.

Planned checks: cargo test --locked tui::render::tests::, focused QR tests, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, and git diff --check. Synthetic tests require no Docker or VM; real systemd is outside this scope. Evidence will be recorded in docs/evidence/milestone-13.md.

Outcome and handoff

M13-R1–R5 (P2, closed): fallback visibility at 34×12/20×8, Draft/Saved/Applied status, all quiet-zone edges, exact available-area reporting and uncertain delivery wording were repaired and independently re-reviewed. M13 evidence records focused and integrated results. No production or host service was used.

Accepted for the automated TUI rendering scope. A 73-module matrix needs 73×37 QR cells; the tested bordered layout with a one-row notice fits at 75×44. Longer notices increase the required terminal height. Physical terminal and phone/decoder scanning remain unverified; M9 systemd acceptance remains retired.

Milestone 14 — Restart verification for valid legacy peers

Status: accepted (2026-10-27T21:55:11+02:00). M13 is accepted; M9 remains retired and unaccepted. This is a scoped fix for restart preview and durable verification.

Outcome and scope

Use the complete saved technical peer set for restart eligibility and runtime verification, independently of optional managed alias metadata and the narrower management Client shape. Do not fabricate aliases/dates, rewrite saved peers, omit peers, or record a partial management snapshot as applied. Preserve the pre-restart backup, explicit choice, configured service/timeout, draft handling, and address-release boundary. Unsafe saved documents must stop before service mutation with secret-free identity/section and condition diagnostics.

Tasks and acceptance

Task	Owner	State	Evidence required
M14.1	implementer	complete for implementation scope	Restart projection and fixture regressions in src/app.rs, src/domain.rs, tests/runtime_restart.rs
M14.2	independent reviewer; repairer	complete	Independent behavior review found no issue; M14-R1 Clippy repair independently re-reviewed and closed
M14.3	coordinator	complete	Integrated files, pinned Rust gates and source/artifact identity recorded in M14 evidence

• M14-A1: saved managed client plus valid metadata-free legacy peer previews and restarts after full synthetic runtime match, without config rewrites.
• M14-A2: supported IPv4-only and technically valid route shapes outside the management model can be verified as a complete saved peer set.
• M14-A3: malformed/ambiguous peers and structural problems block before backup/service mutation with actionable public identity or section location.
• M14-A4: missing/extra/mismatched or incomplete runtime peers cannot be recorded as applied or release deleted addresses; successful full verification persists historical status and safe reservations across reopen.
• M14-A5: independent review closes findings; focused and required Rust completion gates pass. Fixture results remain separate from VM systemd evidence.

Planned checks: focused cargo test --locked app::tests:: and runtime restart tests, cargo fmt --all -- --check, cargo clippy --locked --all-targets -- -D warnings, cargo test --locked, cargo build --locked --release, git diff --check. Synthetic tests use fake service/runtime adapters; no Docker or VM is required. Detailed evidence will be recorded in docs/evidence/milestone-14.md.

Outcome and handoff

Accepted for the synthetic application/runtime-adapter scope. Complete SavedPeerProjection verification covers valid legacy and broader-route peers; no partial Client snapshot is recorded as applied. M14-R1 (P3, closed): Clippy's collapsible diagnostic guard was repaired, independently re-reviewed, and all integrated gates passed. M14 evidence records source identity and tests. No disposable-VM systemd acceptance or production access is claimed; M9 remains retired and unaccepted.

Current progress and resume point

• Milestone 14 is accepted (2026-10-27) for fixture restart orchestration: complete saved-peer projection, legacy/IPv4-only/broader-route eligibility, safe blockers and durable verified history passed independent review and pinned Rust gates. M14 evidence records source/artifact identity. No disposable-VM systemd acceptance or production result is claimed.

• Milestone 13 is accepted (2026-10-27): compact, explicitly colored QR disclosure, complete quiet zone and dimensioned fallback passed synthetic rendering tests, independent R5 closure and pinned Rust gates. M13 evidence records the reviewed source and release artifact. No manual scan, Alpine rerun, VM or production validation is claimed.

• Bounded TUI maintenance TUI-TS-001 (2026-10-27): new-client form creation timestamps now have whole-second UTC precision before strict metadata rendering. A fixed fractional-second instant and a synthetic blank-IP form-to-draft workflow passed; saved bytes stayed unchanged. Independent review found no actionable issue, and pinned-toolchain Rust completion gates passed. Timestamp repair evidence identifies the source and release artifact. This repairs M7 behavior without claiming new Alpine or VM validation; earlier artifact identities remain historical after this Rust change.

• Bounded TUI maintenance (2026-10-26): repaired list arrows opening client details. Up/Down now only move the highlight; Enter opens details and Esc returns. Initial navigation follows the renderer's first-row highlight. Independent review closed NAV-001 with no remaining scoped findings; validation is recorded in navigation repair evidence. This does not advance M9 or supply VM/Alpine acceptance evidence; prior artifact identities remain historical after this Rust change.

• Milestones 1–8 are accepted; milestone 9 is retired by user direction and unaccepted. Its real systemd/D-Bus checks remain unverified and are not a prerequisite to M10.

• Milestone 10 is accepted: the styled keyboard quick reference passed independent review, focused synthetic/PTY checks and Rust completion gates.

• Milestone 11 is accepted for valid but unsupported AllowedIPs route presentation; focused and full Rust gates and independent re-review passed. Real systemd/D-Bus and IPv6 behavior remain unverified.

• Milestone 12 is accepted: native responsive client table, independent R4 closure and all scoped Rust gates passed; source and synthetic UI/PTY evidence are linked above.

• The approved dependency list is in DEPENDENCIES.md; container testing methodology is in TESTING.md.

• Milestone 1 is expanded and the Rust environment is pinned.

• Milestone 2 delivered a lossless in-memory WireGuard configuration editor, versioned metadata, and behavioral preservation tests.

• Milestone 3 delivered secret-safe key handling, a versioned encrypted vault, caller-buffer reconciliation, and a bounded read-only source-directory import adapter.

• Milestone 4 delivered versioned private backups, journaled saved-file Commit and recovery, previewed full restore, durable address reservations and historical verification bookkeeping, with independent R5 closure and coordinator gates.

• Milestone 5 delivered public runtime observations and technical comparison, an approved-rustix bounded read-only netlink adapter, a zbus systemd job adapter, restart orchestration, and synthetic integration tests. Independent integrated review and repairs closed all actionable scoped findings; all planned gates passed. Real kernel/systemd validation remains deferred to M8/M9.

• Milestone 6 delivered session-bound creation/first-file authorization, saved-state rendering and password-per-action reissue, secure plaintext file output, optional same-payload QR, and synthetic lifecycle tests. Independent integrated review and repair closed all actionable findings; all planned gates passed. TUI and real-system validation remain M7–M9.

• M1–M6 integrated gates and independent reviews passed. No Alpine or VM results are claimed.

• Milestone 7 delivered the native terminal workflow, safe startup/session projection, bounded single-owner worker, setup/import/draft/Commit/restart/delivery/backup/restore forms, synthetic PTY and workflow tests, and documentation. Independent R2 closed its list-status finding; all planned coordinator gates passed. Real WireGuard and systemd remain M8/M9.

• Milestone 8 delivered reviewed opt-in Alpine Testcontainers coverage for real IPv4 WireGuard peers, application lifecycle, saved/runtime separation, restoration, import/reissue, backup failures and the real Rustix reader. Host gates and three fresh real-container runs passed on one stable source fingerprint; M8-A1–A10 accepted. Real IPv6 behavior is unverified by user-authorized scope.

• Milestone 9 is retired and unaccepted: the reviewed disposable VM preparation and guarded first start did not establish Debian/systemd acceptance. The exact VM was powered off after the user stopped work. M9.2–M9.3 were not started; M9-A1–A9 are unchecked.

• Next action: await user direction after M14. Do not restart the VM, access production, commit, or deploy.

Plan maintenance

Follow Execution records and diagnostic workflow. Update the current snapshot in place after a task result, review disposition, blocker/scope change, acceptance, or handoff. Do not append command-by-command attempts or worker transcripts. Keep register, milestone outcome and resume point consistent. Preserve final evidence and scope-change reasons; archive superseded history with a link before removing it. Change the specification only with actual user authorization.

Planning reference: OpenAI — Using PLANS.md for multi-hour problem solving. The specific model roles, milestone numbering, and review policy above are project decisions requested by the user.