Tenebra v0.6.0

Tenebra 0.6.0

Verification scope for this release

Tenebra 0.6.0 is published with the project owner's approval of a reduced release acceptance scope. The complete Windows protection matrix has not passed. The implementation's intended coverage described below is not evidence that every failure condition has been tested.

The exact Windows installer was exercised through installation, upgrade from 0.5.11, repair, uninstall with profile preservation and reinstall. Both interface modes and ordinary-user flows were checked at 100% and 150% scaling. Controlled IPv4 tunnel and system-proxy traffic, proxy restoration, repeated engine crashes and a bounded service-stop scenario were exercised.

End-to-end IPv6/QUIC leakage checks, BFE restart, reboot before core recovery, all existing-flow and DIRECT-exception cases, routing/interface changes, suspend/resume and the full update/uninstall failure matrix remain follow-up work. The tested service-stop capture is a limited observation, not a universal no-leak guarantee. The original report of unavailable servers on another Windows PC and real-world DPI bypass effectiveness remain unverified. macOS/Linux package build checks do not establish equivalent native runtime coverage.

The attached acceptance.json records this limited release decision and explicitly sets fullNativeMatrixPassed to false. The candidate files, updater signatures and source provenance are unchanged.

Область проверки

Версия выпущена по решению владельца проекта с перечисленными ограничениями. Проверены установка и обновление Windows, оба режима интерфейса, реальные IPv4-подключения, восстановление прокси и отдельные аварии движка и службы. Полная матрица защиты, IPv6/QUIC, перезагрузка и остальные перечисленные выше случаи ещё не приняты. Работа обхода DPI в каждой сети и исходный случай «все серверы недоступны» не подтверждены.

---

This desktop release revises both interface modes and Windows service,
installation and connection handling.

• Simple mode brings subscription setup, server selection and connection
  feedback into one flow. Full mode has a revised connection panel, searchable
  servers and consistent settings, profiles, import and diagnostic screens.
• Connection errors distinguish local service, engine and proxy failures from
  server failures. A failed TCP probe no longer prevents selecting a server or
  claims that its VPN protocol cannot connect.
• Windows service communication verifies the installed service identity,
  supports the ordinary signed-in user and elevated administrators, and bounds
  requests when the service stops responding.
• System proxy handling tracks the owning Windows user and keeps the settings
  required for restoration. Disconnect and cleanup errors remain visible.
• The Windows installer loads the service-management assembly before waiting
  for the service to stop, fixing the false stop-state failure in a fresh
  PowerShell process.
• Routing and reconnect changes preserve split settings, reject unusable
  multihop chains and limit repeated engine failures.
• Keyboard focus, compact layouts, themes and Russian/English text have been
  revised across both modes.

Windows protection

When enabled and applied by a connection, persistent Windows protection keeps
blocking if the VPN engine or Tenebra service exits. Explicit Disconnect,
disabling protection with confirmed cleanup, or a successful uninstall releases
Tenebra's policy. Configured DIRECT exceptions use the running engine.

Protection covers ordinary Windows application IPv4/IPv6 traffic after Windows
Filtering Platform loads its policy. It does not cover the interval before BFE
starts, deliberately disabled BFE, or forwarded VM/container traffic. The saved
preference, last confirmed protection state and errors are shown separately.

Packages and verification

Desktop packages cover Windows, macOS, Linux and Arch Linux. Windows installs
the privileged service. macOS requires the documented manual daemon setup and
is not notarized. Linux package and AppImage setup requirements are documented
in the README. Updater signatures use the project's minisign key; they are not
Windows Authenticode certificates. Android and iOS are outside this release.

Publication requires recorded Windows installation, service, ordinary-user UI,
tunnel and protection acceptance of these exact signed artifacts. The attached
candidate.json records source and file hashes; acceptance.json identifies
the reviewed native evidence. CI build reports alone do not establish native
runtime testing on every platform.

The original report that all servers appeared unavailable on one Windows PC
has not been causally reproduced. Successful controlled-endpoint tests do not
establish that every subscription or network environment has been fixed.