podssh v1.0.0-beta.3

podssh v1.0.0-beta.3

The third beta. It carries the repairs since v1.0.0-beta.2, the iroh road
and WARP's road in each binary, the DERP road, and podssh update, which
replaces the binary with a signed release. A beta is a prerelease. Its tag never moves: a defect found in it
goes into the next beta.

The files

File	For
podssh-x86_64-unknown-linux-musl	Linux on x86-64, static: no library and no loader needed
podssh-aarch64-unknown-linux-musl	Linux on aarch64, static
podssh-armv7-unknown-linux-musleabihf	Linux on 32-bit ARM with hard float (a Raspberry Pi with a 32-bit system), static
podssh-riscv64gc-unknown-linux-musl	Linux on 64-bit RISC-V, static
podssh-aarch64-apple-darwin	macOS on Apple silicon; it links the system's libraries only
podssh-x86_64-apple-darwin	macOS on Intel
podssh-x86_64-pc-windows-msvc.exe	Windows on x86-64, with a static C runtime
podssh-aarch64-pc-windows-msvc.exe	Windows on ARM64, with a static C runtime
SHA256SUMS	The SHA-256 of each binary
SHA256SUMS.sigstore.json	The signature of SHA256SUMS: Sigstore's keyless signing, by the release workflow at this tag
provenance.sigstore.json	The provenance of each binary (SLSA), signed the same way: the workflow, the tag and its commit
THIRD-PARTY-LICENSES.md	The licenses of the crates in the binaries, with their texts

Each binary ran on its own platform before it was published: --version,
the whole manual, keygen and keygen -y, the iroh road's parse of a
ticket, WARP's road asking for Cloudflare's Terms before it dials, and
GitHub's SSH banner through the live relay.

Check a download

T=v1.0.0-beta.3; B=podssh-x86_64-unknown-linux-musl   # or another file of the table
curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/$B"
curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/SHA256SUMS"
grep " $B\$" SHA256SUMS | sha256sum -c - && chmod +x "$B"
./"$B" --version   # podssh 1.0.0-beta.3 (the commit of the tag)
./"$B" doctor      # what this host allows, and whether the whole path works

On macOS, check with shasum -a 256 -c in place of sha256sum -c -. A
binary that curl fetched has no quarantine; after a browser's download,
run xattr -d com.apple.quarantine "$B" first. On Windows, compare
(Get-FileHash podssh-x86_64-pc-windows-msvc.exe).Hash with its line in
SHA256SUMS (the case of the letters differs).

The provenance of a binary names the release workflow and the tag (with the
GitHub CLI):

gh attestation verify "$B" --repo Azathothas/podssh \
  --signer-workflow Azathothas/podssh/.github/workflows/release.yml --source-ref "refs/tags/$T"

The signature of SHA256SUMS names the workflow at the tag (with cosign; 3.x
and 2.6 both check it):

curl -fsSLO "https://github.com/Azathothas/podssh/releases/download/$T/SHA256SUMS.sigstore.json"
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity "https://github.com/Azathothas/podssh/.github/workflows/release.yml@refs/tags/$T" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

The two proofs and podssh --version name the same commit.

The sizes

Each binary carries the iroh road (T-348), WARP's road (T-352) and the DERP
road (T-379) now, and podssh update (T-375).
The sizes of the release's dry run of 2026-11-01 (at 5e42bd4), beside
beta.2's:

Binary	beta.2	beta.3
Linux x86-64	9.6 MiB	15.2 MiB
Linux aarch64	7.5 MiB	11.7 MiB
Linux armv7	5.6 MiB	8.8 MiB
Linux riscv64	7.2 MiB	11.7 MiB
macOS, Apple silicon	6.2 MiB	9.2 MiB
macOS, Intel	8.1 MiB	12.2 MiB
Windows x86-64	7.9 MiB	11.9 MiB
Windows ARM64	6.9 MiB	10.5 MiB

What works

podssh ssh, each, run, job, session, containers, proxy, pipe,
cp, mv, scp, sftp and edit, doctor, keygen, agent, man,
status, ping, health, node, operator, relay, chat, play,
config, mcp and update. podssh man is the reference: each command,
flag, -o keyword, variable, file and exit code. The iroh road is in each
binary: podssh node --iroh, a destination iroh:TICKET, and
--iroh-ticket. So is WARP's road, warp://HOST[:PORT], and the DERP road,
podssh node --derp and a destination derp:TICKET. These binaries have no
Tailscale: podssh ts exits with 70 and says so.

What to test again

New since v1.0.0-beta.2:

• podssh update: the newest release for this binary's own target. Its
  SHA256SUMS is checked against Sigstore's signature by this repository's
  release workflow at the tag, then the binary's own sum, before the binary
  is replaced in place. --check only looks; --version TAG takes a given
  release (T-375).
• The iroh road in each binary, and a notice when a relay refuses this
  binary's iroh, which names podssh update and --iroh-relay (T-348). The
  road keeps UDP only once a datagram came back, so a host that drops UDP
  goes through the relay at once (#70, T-359).
• warp://HOST[:PORT] with ssh, -J and proxy: a port of any host
  inside Cloudflare WARP's tunnel, MASQUE over HTTP/2 on port 443 through
  the proxy, with no relay. The first run registers one device, only once
  PODSSH_WARP_ACCEPT_TERMS=yes accepts Cloudflare's Terms, and keeps its
  record in the cache. A proxy that allows names alone refuses the
  endpoint's address, and podssh says so (#63, T-352).
• podssh node --quick-tunnel reaches the quick tunnel's edge inside WARP's
  tunnel when port 7844 is closed to the host, or first with --warp
  (T-374).
• The DERP road: podssh node --derp serves a node through Tailscale's
  public DERP servers (or those of --derp-server), and podssh ssh derp:TICKET reaches it. A node with an allowlist and no pair serves it
  unasked; PODSSH_DERP=no turns that off. node://NAME --derp-ticket
  adds it to the race of a node's roads, and podssh doctor has a section
  derp (T-379).
• When no relay host opens a session and no relay was named, podssh ssh
  and the commands that reach a server as it does try the direct road once,
  through the proxy, and say so; PODSSH_DIRECT=no turns that off (T-363).
• --forwarder TEMPLATES: other products' WebSocket forwarders in place of
  the relay, such as Mudlet's or ssheasy's, for ssh, proxy and the
  commands of ssh's road; PODSSH_FORWARDER and the settings file's
  Forwarder give them too, and podssh doctor --forwarder checks them
  (#59, T-369).
• -J USER@HOST:443 through a proxy that allows port 443 alone, with the
  hop's password from SSH_ASKPASS, and podssh doctor --hop, which says
  whether a hop answers with SSH there (#61, T-371).
• The iroh road keeps a signed record of its node's home relay at n0's
  pkarr server, so a client whose ticket names an old relay finds the node;
  PODSSH_IROH_PKARR=off turns it off (T-350).
• podssh pipe http-listen:PORT relay:%h:%p: an HTTP CONNECT proxy for a
  program that knows only HTTPS_PROXY, with --proxy-auth-file for an
  address off loopback (#75, T-367).
• podssh pipe with ws://, wss:// and ws-listen:: a WebSocket by its
  URL, and a WebSocket server in front of a port (#76, T-368).
• podssh ssh iap:// and eice://: the tunnels of Google Cloud's IAP and of
  AWS's EC2 Instance Connect Endpoint. Their tokens and credentials come
  from files, never from the command line (T-351). They were built against
  stand-ins; a live report is welcome.
• -R takes each form of OpenSSH's: socket paths on either side, and the
  remote SOCKS form (#73, T-365).
• -J cf://HOST: a Cloudflare tunnel as the first hop of a jump chain
  (T-347).
• podssh doctor:
  • whether the proxy takes an address as well as names (#74, T-366);
  • the listeners that this host allows, each listened on once (T-357,
    T-358);
  • this host's clock, when a certificate looks expired or not yet valid,
    in each command's TLS failure too (T-345);
  • the system's stores of roots on Windows and macOS, and what to do about
    an issuer that no root signs (T-340).
• DNS over HTTPS in RFC 8484's wire form, with Quad9 after Cloudflare and
  Google. The addresses that carried a session are tried when the resolvers
  fail (T-344).
• The quick tunnel over QUIC, where UDP reaches Cloudflare's edge (T-301).
• russh 0.65.0, with its security fixes (T-356); the keys of the AEAD
  ciphers are wiped when a cipher is dropped (T-377).

What a beta does not have yet

• The check of a release from end to end with no human (T-251); it runs
  before v1.0.0.
• Signatures of the platforms: the Mac binaries are not signed with an
  Apple Developer ID, and the Windows binaries carry no Authenticode
  signature, so SmartScreen may warn. The proofs above stand in for them.

Report a defect

Open an issue at https://github.com/Azathothas/podssh/issues with the
output of podssh --version and podssh doctor --json. Read that output
before you post it: it names this host's proxy and addresses, and never a
token or a password.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Documents

• docs/relay-operator.md, audited on 2026-10-31 for the relay's agent: a brief that stands alone (what podssh is, the contract as the boundary, how an item is handed back), 18 items with their measureme… (804fff4)

Other

• T-300, partial: a quick tunnel that podssh makes itself, over HTTP/2 with no cloudflared, and its client. The node, podssh node NAME TARGET --quick-tunnel (crates/podssh-relay/src/quick/, feature quic… (2258dd6)
• T-331, partial: the layer's CLOSE before the exit of job, run, pipe, health, containers and --upgrade on a podssh node's cf:// name. Each runs on a runtime of one thread, where a spawned task runs onl… (24dda6b)
• T-307: the notice of a silent far end on the forward road through the relay. Nothing below SSH answers a key there, so with SSH's bytes up, while no question waits, the relay stream sends a WebSocket … (262e2fa)
• T-327: podssh config import mremoteng, mRemoteNG's confCons.xml or an export of it, with roxmltree 0.21 (default-features off, T-292's Decision): each Node of Type Connection a session in its folders,… (32f5995)
• T-330, partial, the first step: aes-gcm 0.11.1 and x25519-dalek 3.0.0 of Dependabot's Azathothas/podssh#47 and #46, and chacha20poly1305 0.11.0 with them, as crypto/aead.rs calls both through the trai… (71f2397)
• T-330, partial, the second step: vt100 0.18.1 (Dependabot's Azathothas/podssh#45, which it moved from 0.16.2), on vte 0.15. The size is a NonZero both ways there: the oracle's model and podssh se… (4b46a72)
• T-330, the third step and the close: sha1 0.11.0 (Dependabot's Azathothas/podssh#44) in podssh-ssh and podssh-cli, with hmac 0.13.0 in podssh-ssh, where the two meet in the hashed names of known_hosts… (4999d83)
• T-332: the notice of a silent far end with --direct. There the bytes are SSH's, end to end, so the question is SSH's own: with a key from the terminal, while no question waits, the session sends keepa… (e44f019)
• The format of three files as the gate's lint checks it (cargo fmt -- --check over the gate's packages): crates/podssh-cli/src/node_quick.rs and crates/podssh-cli/tests/node.rs of T-300, crates/podssh-… (909d8c8)
• T-330's first step undone for aes-gcm and chacha20poly1305, before the push: the gate's step msrv, run here on Rust 1.85.1, refuses them at resolution, as aes-gcm 0.11 and chacha20poly1305 0.11 bring … (7cebfbe)
• The proofs of a published release, checked as its notes tell a user to check them, on a fresh runner: .github/workflows/release-proofs.yml, by hand with a tag (the Prove of T-210 and T-211; the first … (05c681b)
• T-332, a repair after the close, found in review: a keepalive that still waited for its reply kept the next key from asking, so a link that died after the far end's bytes answered one question, and be… (2d15b72)
• Two tests that failed at random on Windows (the gate's job windows at 2d15b72, run 41138739390; both passed at 05c681b), each from a port that was free when chosen and taken before its server bound it… (6206f6e)
• v1.0.0-beta.2 is published, a prerelease at f7f97a5 (the tag's run 41147977814, 2026-10-31 00:02 to 00:11 UTC), from a run by hand with publish on a branch at that commit, as main held newer ones; T-2… (f60523b)
• T-300 and T-331, the seven defects that a review of the code named, each read again at its lines, each repaired with a test that its plant fails; the allowlist held throughout. A visitor's stream that… (200ff2d)
• The operator's rulings of 2026-10-31, and T-300 and T-331 closed by their live run. Q48: podssh is a client first, whose clients cannot build it and some cannot download it, so no legacy constraint th… (107f7d6)
• T-333, by the operator's ruling of Q48: the library crates and podssh-todo declare Rust 1.89, the minimum of their dependencies, and podssh-ws takes aes-gcm 0.11 and chacha20poly1305 0.11 again (aead … (afd7424)
• The operator's rulings after the study of stand-ins (2026-10-31). Q42: the relay's own loop is T-062's target: a forward session to tcp.ssh.relay.ajam.dev:443 carrying a pair of the reverse road whose… (8abf160)
• T-062 (partial): the live test of a slow forward client through the relay's own loop. A pair's node takes from a local source; the operator's leg reaches the relay through a CONNECT proxy of the test … (f93e4a2)
• T-062: the relay's checks of a slow receiver do not operate. Through the relay's own loop, from a cloud container and from GitHub Actions (relay-live.yml, run 41157016178): the control carried 8 MiB a… (b1f75c9)
• The record: GitHub issue #17 is closed, with T-024, T-025 and T-062 done; T-336 waits for the relay's operator. (08275ee)
• T-335: the iroh cells of the throughput run measure the relay, and say so. The iroh client watches the paths of each connection and notes when a direct path carries its data; podssh ssh iroh:TICKET, a… (3ae89f9)
• T-301 (partial): the keys of QUIC in podssh-ws's own provider, for the quick tunnel over QUIC. Both TLS 1.3 suites now carry quic keys (crypto/quic.rs): AES-GCM packets with the nonce of RFC 9001 sect… (152a1e4)
• The record: 17 entries from the audit of hardcoded assumptions and the study of carriers without the operator's relay (2026-10-31), drafted by an agent and merged here. T-337 (P1): the publish job run… (627d208)
• The record: the counts of the 17 entries merged in 627d208 (350 entries: 27 open, 1 partial, 35 blocked, 287 done), which cargo todo counts wrote after the merge was staged. (72b1ae5)
• T-301 (partial): the quick tunnel over QUIC, where no proxy is set and UDP reaches the edge, as cloudflared makes one; HTTP/2 stays the road through a proxy and the fallback. podssh-relay's quick modu… (98e05c2)
• T-301: the quick tunnel over QUIC, done. Live in GitHub Actions (quick-tunnel-live.yml, run 41162536619 at 98e05c2): the node registered at Cloudflare's dfw16 over QUIC, from noq with no C and podssh-… (095b689)
• T-354: a session whose ends close at once while it moves says no loss. Reproduced here on one CPU, with debug lines in the close paths: the far end accepted a resume on a move's new link, found the se… (1a3e7b6)
• T-337 (partial): each action of each workflow is named by its commit, and the job that attests, signs and publishes runs no tool of a third party. The commits, read again on 2026-10-31 at each reposit… (33d8253)
• T-337: done. The release workflow by hand with nasm=prebuilt at 33d8253 (run 41166843026, 04:01 to 04:15 UTC): each job passed with the actions pinned by commit; the job notes, which may only read the… (8263b2f)
• T-338 (partial): a fact of the relay's document is read at its line, then in its section, and a watch reads the relay and its domain each day. Each fact and operand of relay-facts.toml names its secti… (1d16bb4)
• The record: T-355, Dependabot's updates of 2026-10-30 and 2026-10-31 (Azathothas/podssh#57, #64 to #68), and the curves' 0.14: p256 and p384 0.14 together in podssh-ws's provider would take crypto-big… (c5bc791)
• T-339 (partial): a watch of cloudflared's releases against the quick tunnel's pin, the edge by its SRV record, and the release named in a refusal. crates/podssh-relay/src/quick/cloudflared-pin.txt hol… (4ee1053)
• T-338: done. The watch by hand at 1d16bb4, each a dry run: plain, green, the live relay at the pin with no problem and no note, and ajam.dev 445 days ahead by Google Registry's RDAP, nothing to open (… (0b1ed7c)
• T-339: closed on its two live runs at 4ee1053. upstream.yml, run 41169460255, read cloudflared's newest release, 2026.10.7, and each of the four files of the table held bytes that it knows; its plant,… (1316e53)
• T-340 (partial): an issuer that no root of podssh signs ends with what to do. podssh_ws::tls::handshake_hint finds rustls's CertificateError::UnknownIssuer in a failed handshake, by its type in the io… (59b67e6)
• T-340 (partial): the stores of Windows and macOS join the default trust, after podssh-ca.pem. podssh_ws::stores reads, on Windows, ROOT of the current user and of the machine through crypt32 (windows-… (eee611a)
• The test of a write that the peer never reads first fills the loopback's buffers in real time. The macOS job at 1d16bb4 (run 41168072049) failed direct_write_limit_ends_a_write_that_the_peer_never_rea… (2d70f1c)
• The record: T-356, russh 0.65.0 (2026-10-25), which T-341's first reading of the vendored crates' upstreams found: six security fixes, three of them in the client that podssh runs (any number of EXT_I… (4954431)
• T-341: the vendored crates have watches of their own. cargo-deny passes over a path package: an advisory planted for russh 0.64.1, patched from 0.64.2, in a scratch advisory-db at the directory that c… (80e26fc)
• T-356 (partial): russh 0.65.0 from crates.io, with its six security fixes, and no vendored copy. Three of the fixes are in the client that podssh runs: any number of EXT_INFO messages (GHSA-4p9f-7p9m-… (3504c1a)
• T-340: the Windows proof passed in CI, and the macOS step no longer waits on a dialog. At eee611a (build run 41171716387, the job windows): with the root out of the store, a server that it signs was r… (8554930)
• T-342 (partial): the relay's limits from its /relays.json widen what a session takes in and narrow what it spends. The pool's cache keeps the limits of the same document (pool::Limits, parse_limits; a… (27b8d8f)
• The operator's rulings of 2026-10-31 on Q49 to Q52, and two entries. Q49: a binary may use relays outside ssh.relay.ajam.dev when they are compatible, a token going only to the deployment that minted … (deacafd)
• T-342: done. The relay's limits are facts now, checked live. crates/podssh-probe/facts/relay-limits.toml holds the five limits of /relays.json?host=github.com&port=22 (connect 10000 ms, idle 180000 ms… (1ed4c72)
• T-347 (partial): -J cf://HOST, a Cloudflare tunnel as the first hop of a jump chain. jump::hops reads cf://[user@]HOST as the first hop of the command's own chain, keeps HOST as the chain's tunnel, an… (86e4b91)
• T-355 (part): Dependabot's group of minor and patch updates (Azathothas/podssh#64): unicode-width 0.2.2 to 0.2.3, proptest 1.11.0 to 1.12.0, h2 0.4.19 to 0.4.20 and rcgen 0.14.7 to 0.14.10, the lock a… (19e30fb)
• Repair CI: the job secrets, red from 27b8d8f on. T-356 removed the 13 lines of russh's test keys from TruffleHog's allowlist with the vendored copy, and the scan reads each commit of the history, whic… (7b402d0)
• T-355 (part): toml 1.1 and base64 0.23 (Azathothas/podssh#66, #65), and T-377. toml 1.1.6 for the facts files of podssh-probe, the line that iroh already takes; the lock drops toml 0.9.12, toml_dateti… (1a9aefe)
• Triage of GitHub #59 to #63 and #69 to #76: 17 entries and two questions. #69: T-357 (doctor's words of listeners, P1) and T-358 (a listen after doctor's bind, blocked on Q53); #70: T-359 (the iroh ro… (8207d29)
• The operator's rulings of 2026-10-31 on Q53 and Q56. Q53: podssh doctor listens once on each socket that it binds, with a backlog of 1, on 127.0.0.1 port 0 and a Unix socket of mode 0600, accepts noth… (3218fc6)
• T-377: done. The keys of podssh's AEAD ciphers are wiped when a cipher is dropped. chacha20poly1305 0.11, which T-333 took, wipes its key only with its feature zeroize, where 0.10 always did, and AES-… (1c378ab)
• T-355 (part): the curves' 0.14 (Azathothas/podssh#68, with p256), and crypto-bigint 0.5.5 leaves the tree. p256 0.14.0 and p384 0.14.0 together in podssh-ws's TLS provider; the lock drops the curves' … (48a8744)
• T-357 and T-358: done. podssh doctor listens once on each socket that it binds, and names the listeners that a refusal stops (Azathothas/podssh#69; the operator's ruling on Q53). The lines listen AF_I… (12fc719)
• TODO/issues.md: Azathothas/podssh#69 closed by T-357 and T-358 (12fc719). (0f1f748)
• Repair CI: the job macos, red at 7b402d0 and 1a9aefe; T-340 and T-356: done. On macos-15 no root can be put in either domain of trust settings: add-trusted-cert asks for the right com.apple.trust-sett… (800e464)
• T-347 (partial): the live run found -J cf://NAME refusing --client-key, and it is repaired. quick-tunnel-live.yml (run 41176392964): podssh ssh cf://NAME direct and through the proxy each carried 8 Mi… (cb30f1e)
• T-355 (part): the box's Alpine 3.20 to 3.24 (Azathothas/podssh#57). Both images that scripts/test_in_box.sh makes from images/box/Dockerfile build on 3.24.3: the box with openssh-client (now openssh-c… (4594d62)
• T-355: done. The Tailscale fork's chacha20poly1305 0.10 to 0.11 (Azathothas/podssh#67), as patch 0025, with its feature zeroize, which 0.11 needs to wipe a key; ts_control_noise, which pinned 0.10 apa… (5f7189d)
• T-347: done. -J cf://HOST passed live (quick-tunnel-live.yml, run 41180727325 at cb30f1e): the node's sshd behind a real quick tunnel as the jump host, then the same sshd at 127.0.0.1:4022 through its… (b9e007c)
• T-345: done. Each command names this host's clock when a certificate has expired or is not valid yet, not doctor alone. podssh_ws::tls::handshake_hint gives the clock's words with its reading for rust… (93e8031)
• T-355: the fork's own lock off russh 0.60.1 (patch 0026) (2a5b211)
• Repair CI: the job macos, red at b9e007c; Dependabot's #77 (925c94b)
• T-359 (part 1): the iroh road takes UDP after a datagram came back, not after a bind (GitHub #70) (5e8ee9f)
• Repair CI: the gate's step release, red at 925c94b (faults.certs, faults.standins, faults.clock) (91c62c8)
• T-359 (part 2): doctor's UDP out, whether a node's quick tunnel takes QUIC; T-301's ends over QUIC (b5b3398)
• Repair CI: faults.clock and the interop ids at 91c62c8 (e268459)
• T-359: done. The iroh road keeps UDP only after a datagram came back (GitHub #70) (6f6eda2)
• T-365: done. -R takes each form of OpenSSH: socket paths on either side, and SOCKS (GitHub #73) (5fdfdc3)
• T-360: done. The map of issues is held to GitHub's numbers (GitHub #71) (34ce8ab)
• T-361: done. A done Prove names only targets that exist (GitHub #71) (4f86346)
• T-375: podssh update: the release for its own target, its signature checked, in place of the binary (5877a00)
• T-348: the iroh road in the release binaries, and a notice when a relay refuses its iroh (c5ffadb)
• Repair CI at 5877a00: the release's fixture on Windows, timeout on macOS (1a46970)
• T-343: Zig from the community mirrors, armv7's rustc checked, check-jsonschema pinned (7e7650b)
• T-375: done. podssh update ran from end to end in Actions on Linux, macOS and Windows (5c2107c)
• T-346: blocked on the relay's operator: the form and the keys of a signed list of relays (93f11b3)
• T-362: done. A claim of "not yet" names its entry or its date (GitHub #71) (94695d9)
• T-378: done. The quick tunnel's loop over HTTP/2 ends as the connection's when the edge closes it (401bf30)
• T-366: done. doctor asks the proxy for an address as well as for names (GitHub #74) (6258bbc)
• T-348, T-343: done. The release's dry run at 7e7650b built the eight binaries with the iroh road (927eb24)
• T-344, partial: DNS over HTTPS in RFC 8484's wire form, Quad9, and the addresses that carried a session (the draft of 2026-10-31 merged) (298761e)
• T-344: Quad9 is asked over HTTP/2, which it serves alone (22d9de6)
• T-344: done. Each of the six DoH resolvers answers live, Quad9's over HTTP/2 (8a2dea5)
• T-349: done. A DERP link through tailcat's relays, under the resumable layer (the draft of 2026-10-31 merged) (0920c54)
• The manual names PODSSH_DERP_SERVER, which T-349's DERP road reads (4e2010e)
• T-351: done. iap:// and eice://, the roads of a cloud's own tunnel, against stand-ins (the draft of 2026-10-31 merged) (68314c6)
• T-367: done. http-listen:, podssh pipe as an HTTP CONNECT proxy (GitHub #75; the draft of 2026-10-31 merged) (e10f79c)
• T-368: done. ws://, wss:// and ws-listen: as addresses of podssh pipe (GitHub #76; the draft of 2026-10-31 merged) (25da2f0)
• The cloud tests remove their scratch directories (gate steps ssh, ts, iroh at 68314c6) (a3f948d)
• The notes of v1.0.0-beta.3, made ready (T-309) (fc05d8e)
• T-371, partial: podssh doctor --hop, a first hop of -J as --direct reaches it (GitHub #61) (60fff70)
• T-371: -J through a proxy of port 443 alone, with the hop's password from SSH_ASKPASS (df4adb5)
• T-371: done. A -J hop on port 443 through the proxy, measured, and doctor --hop (GitHub #61) (b666713)
• T-350: done. A pkarr record finds a node whose home relay changed; the operator's Q57 to Q59 (the draft of 2026-10-31 merged) (752c406)
• T-352, partial: WARP's MASQUE road over HTTP/2, warp://, in the feature crate podssh-warp (the draft of 2026-10-31 merged) (cadf9d5)
• warp-live.yml: evidence of each step, after its first run gave none (T-352) (c7e86d1)
• warp-live.yml: the far end must hold GitHub's published host key (T-352) (4e2d139)
• warp-live.yml: OpenSSH records the key it was shown (T-352) (4576497)
• T-374, partial: the quick tunnel's edge inside WARP's tunnel (the draft of 2026-10-31 merged) (17b9153)
• T-352: done. WARP's road, live from GitHub's network, and in each release binary (Q59) (5c51647)
• Repair the gate at cadf9d5: WARP's pinned verifier in the scan, and its stand-in on Windows (T-352) (e4164ce)
• Tests read again on EINTR: pipe_http failed in the gate's step ssh at 5c51647 (a7a268b)
• T-374: done. The quick tunnel's node registered inside WARP's tunnel, live (500d702)
• T-379: done. The DERP road in the command line, in the race of a node's roads, and as Q50's fallback (the draft of 2026-10-31 merged) (5e42bd4)
• The third beta made ready, v1.0.0-beta.3 (the steps of T-309) (ae050e6)
• T-363: done. The direct road once each relay host failed, when no relay was named (the draft of 2026-10-31 merged) (6b831de)
• T-369: done. --forwarder, a road through other products' WebSocket forwarders (the draft of 2026-10-31 merged) (35fd1f1)
• The notes of v1.0.0-beta.3: the sizes of the dry run, the direct road and --forwarder (T-309) (54d89a0)