xray-rust 0.8.0

Stable source release of xray-rust 0.8.0. The mobile SDK is prepared and published separately in xray-rust-mobile.

Changes:

• Trojan, Shadowsocks 2022 and VMess AEAD client outbounds, shared imports, and additive C ABI 1.11 with Swift/Kotlin adapters.
• Hysteria2 Salamander, automatic port hopping, bounded stream limits, and mobile rebind support (#53).
• Opt-in TUN flow admission and Android UID policy helpers (#51), including ready-to-use Apple provider hooks.
• TLS ClientHello fragmentation and bounded FinalMask UDP noise (#52).
• Linux IPv4/IPv6 TCP/UDP TPROXY via dokodemo-door (#47).
• TLS Vision direct-mode compatibility, blackhole outbound support, cancellation fixes and bounded VMess relay optimizations.

The compatibility reference remains Xray-core v26.7.28. Scope and unsupported combinations are documented in the source tree; this release does not claim full upstream feature or performance parity.

Known limitations and acceptance scope:

• #56 remains open by explicit release-owner decision: the exact Android Rust candidate recorded 3 UDP timeouts in 13,440 stress attempts (HTTP 6,720/6,720). An independent Xray-core Android SOCKS control had 1 in 960. The ingress and scheduling differ; the missing-reply location and cause remain unresolved. These results do not establish Wi-Fi causation or a client fix.
• The initial iPhone Hysteria2 default FD provider case retained TCP/UDP receive timeouts. Further diagnosis and calibrated 5% performance-regression confirmation are owner-deferred; neither is claimed passed.
• SS2022 passed iPhone WAN transitions only with the documented native-server UDP PMTU workaround. The default-policy large logical IPv6 UDP baseline failed and remains recorded. This is conditional deployment evidence, not a universal network-path fix.
• Android Wi-Fi/cellular and lock/wake checks remain explicitly not tested for this release. Strict UID admission denies sockets whose owner is unavailable, including the observed bound-TCP case. SS2022 remote EOF and historical protocol/resource tradeoffs remain documented.
• Host protocol comparisons are bounded single-flow measurements against pinned Xray, not a prior-Rust calibrated 5% check. Raw CPU, memory, sample order, outliers and failed attempts accompany the evidence.

The attached evidence retains exact candidate identities, original failed controls, supported deployment conditions and scoped owner decisions. A structural evidence-gate pass must not be interpreted as every trial passing or proof of zero regressions.

Exact candidate device/host report · Validated evidence workflow.

Source-tag verification: all required runtime, interop and evidence jobs in the original exact-tag CI passed. Its cross-branch secret scan reported public report-digest false positives. Independent GitHub verification passed the unchanged tagged scanner policy over the complete tag ancestry and the corrected, regression-tested policy over all branches. The original failed scanner result is retained in the attached validation record. The source tag was not moved.