spry-turn 0.2.1 — standalone performance qualification

Standalone Rust STUN/TURN, MIT / TheCryptoDonkey / ForgeSworn. This prerelease adds measured TCP/TLS readiness tuning and broader qualification. Shipping runtime dependencies and public configuration are unchanged.

• Full native M4 matrix: UDP delivery 16–22% above the tested coturn configuration and TLS 27–35% above; TCP ranges from 1.2% behind to 8.5% ahead. Linux VM results are mixed, including UDP regressions. These are disclosed loopback workloads, not maximum WAN capacity.
• 216 complete M4/Linux matrix runs and 96,423,584 checked forwarded packets. Raw data, resource counters, unsuccessful burst trials and separate batching/process/PGO experiments are retained.
• 32 socket/fixture tests on macOS and Linux, real TCP backpressure recovery, 180-second churn with 30,137 allocations, and 15.2 million ASan/libFuzzer inputs without crashes.
• Actual KithMoot web source 24038110 passed UDP/TCP/TLS generated decoded media against the exact macOS release binary. Owner credentials are entered through device Settings; zero credential-service requests.
• WASM integrity/arena execution passed one million reuse operations without linear-memory growth.

Downloads: macOS ARM64 and GNU/Linux ARM64 TLS-enabled standalone executables, plus WASM/ESM/TypeScript codec bindings. Verify SHA256SUMS; BUILD.json and release-manifest.json identify source and each payload. Linux was tested with Debian glibc 2.36 and needs glibc/libgcc. The WASM codec cannot host a raw-socket server in a browser.

Getting started · Measurements and limits · KithMoot acceptance · Support and donations · LLM index

Cross-network operation, physical GrapheneOS calls, trusted public certificate renewal and Archy installation remain separate gates. Full coturn parity is not claimed. This release deploys no relay or credential service; the existing private coturn instance is unchanged. Package registries, container images and Pages remain outside this release.

spry-turn 0.2.0 / bounded UDP relay ports

Prerelease adding operator-selected UDP peer-relay port ranges. MIT licensed; no hosted service or package-registry publication.

Public MIT source and these existing archives were authorised on 23 October 2026. The release was originally created privately; tags and archive bytes are unchanged. Historical private-access wording inside frozen guides describes their original access conditions.

• --relay-ports FIRST:LAST selects an inclusive range. Occupied host ports are skipped; exhaustion returns authenticated TURN 508 without allocating outside the range. Released ports can be reused.
• Browser and socket regressions verify bounded ports with bidirectional traffic over UDP/TCP/TLS. Omitting the option retains OS-assigned ephemeral ports.
• Public Config::relay_port_range field: embedding Rust hosts using struct literals must add the field, or initialise with Config::local(secret).
• Updated operator firewall/NAT/certificate guidance, API/compatibility docs, changelog, source hashes and generated LLM context. Donation destinations are unchanged.

Assets include a macOS ARM64 executable with TLS, a WASM codec with browser ESM/TypeScript glue, licence notices, release-manifest.json and SHA256SUMS. Verify downloads with shasum -a 256 -c SHA256SUMS. The macOS executable is not a Linux or phone binary; browser WASM remains a codec rather than a raw-socket TURN host.

Release binaries have remapped build paths. Public operation, independent security review, trusted-certificate lifecycle, Archy installation and physical-phone acceptance remain unqualified. The historical M4 comparison predates this runtime change.

Documentation · Operator guide · Support and donations · LLM index

Linux/macOS source CI passed; its source tree matches this release: https://github.com/forgesworn/spry-turn/actions/runs/40021806198

Downloaded archives passed 22 independent socket cases, bounded-port Chromium data/audio/video over UDP/TCP/TLS, actual WASM execution, checksums and secret scanning. Exact source/build/download receipts are attached in release-manifest.json.

spry-turn 0.1.0 / initial prerelease

Initial prerelease of spry-turn: a lightweight standalone Rust STUN/TURN server, embeddable native relay and WASM packet codec. MIT licensed, maintained by TheCryptoDonkey under ForgeSworn. This release does not deploy a service or publish a package registry entry.

Public MIT source and these existing archives were authorised on 23 October 2026. The release was originally created privately; tags and archive bytes are unchanged. Historical private-access wording inside frozen guides describes their original access conditions.

• UDP/TCP clients, optional TLS, UDP peer allocations, coturn-compatible expiring shared-secret credentials and bounded resources.
• Standalone, browser/native integration, Rust/WASM API, operations and coturn compatibility guides, with explicit missing features and qualification gates.
• Established ForgeSworn donation destinations, repository funding configuration and generated llms.txt/llms-full.txt, checked for freshness and local links in CI.
• Native ARM64 M4 Max UDP loopback evidence and raw results. The measured improvement applies to the recorded coturn configuration/workload; it does not establish Linux/WAN/TLS performance or total system memory.

Downloads:

• spry-turn-v0.1.0-aarch64-apple-darwin.tar.gz: macOS ARM64 executable with TLS enabled, MIT/RFC/dependency notices and usage guidance. This is not a Linux or phone binary.
• spry-turn-v0.1.0-wasm32-unknown-unknown.tar.gz: WASM packet codec, browser ESM glue and TypeScript declarations, with notices. Ordinary browser WASM cannot host a raw-socket TURN server.
• release-manifest.json: exact source commit, build features and content hashes.
• SHA256SUMS: verify downloaded files with shasum -a 256 -c SHA256SUMS before extraction.

Build-machine paths were remapped and the resulting artefacts scanned before upload. Socket, browser, WASM execution, lint/unit/minimal-feature, documentation and secret checks passed locally; Linux/macOS release-tag CI passed, as did downloaded native/WASM archive verification using the exact tagged test suites.

Release CI: https://github.com/forgesworn/spry-turn/actions/runs/40019310127

This is an initial implementation with no independent audit or production qualification. Fixed relay-port ranges, static users, TCP relay allocations, DTLS, dual allocations, Archy packaging and Sapflow integration are not implemented. The publisher operates no TURN server, credential issuer or directory.

Documentation · Benchmarks · Support and donations · LLM index