Split-Process Fast-Path Data Plane and UDP Tunneling

This major release introduces a structural evolution in Latch's architecture: the official separation of the Control Plane and Data Plane using a hybrid Go/Rust split-process model, alongside full post-quantum UDP encapsulation support.

Key Changes & Resolved Issues

• Split-Process Architecture (Go + Rust): Offloaded heavy data-path routing from the Go runtime to a dedicated native Rust daemon (latch-dataplane). Go now safely handles orchestration, configuration, mTLS, and PQC key generation (Management Plane), while Rust manages high-speed stream forwarding.
• UDP Encapsulation and Tunneling (Issue #5): Implemented an end-to-end post-quantum UDP transit pipeline. Legacy UDP packets are captured, wrapped in secure binary frames, encrypted via ChaCha20-Poly1305 using the hybrid master key, and decapsulated smoothly on the target node.
• Windows Socket Lifecycle & Race Fixes: Resolved critical WSAEADDRINUSE resource collisions and port-handover race conditions on Windows. Re-engineered the control plane socket delegation flow to ensure zero-downtime port binding during active integration tests.
• Deterministic Test Pipeline: Fixed intermittent I/O timeout bugs inside TestEndToEndProxy. The cross-platform automation suite (test.ps1 / test.sh) now reliably runs end-to-end hybrid proxy flows under full race-detector and fuzzing conditions.

Cross-Platform Automation Check

To locally verify the complete pipeline, execute independent fuzzing vectors, and cross-compile both control-plane and data-plane optimized binaries into ./dist/:

On Windows (PowerShell):
.\test.ps1

On Linux/macOS (Bash):
chmod +x test.sh
./test.sh

Session Resumption Framework and Multi-Platform Pipeline Automation

This major update introduces a high-performance Session Resumption (Fast Reconnect) mechanism to bypass heavy post-quantum handshakes on reconnections. We have also standardized automated workflows across Windows, Linux, and macOS.

Key Changes & Resolved Issues

• Post-Quantum Session Resumption (Issue #4): Implemented a stateful session-resumption layer. Using a secure server-side SessionStore and AES-GCM Ticket encryption, returning clients can now reuse negotiated master keys. This completely bypasses heavy ML-KEM-768 math, drastically reducing latency on reconnects.
• Lock-Based Client Caching: Integrated active session caching on the client side with strict mutex-based synchronization to prevent race conditions during concurrent connection spawns.
• Standardized Bash Automation (test.sh): Added a Linux and macOS native verification script to parity the Windows PowerShell workflow. It executes formatting, module tidying, go vet, fuzzing, race detection, and cross-compilation.
• Apple Silicon & macOS Support: Upgraded the compilation pipeline to cross-compile optimized production binaries for macOS Intel (darwin/amd64) and macOS Apple Silicon (darwin/arm64), outputting all artifacts to the managed ./dist/ directory.

Performance & Resilience Validation

The new session resumption pipeline was verified under race-detector conditions. Tests confirm smooth fallback behavior: once the Session TTL expires, both client and server gracefully fall back to a full hybrid PQC handshake without dropping active connections.

Verification

To run the new multi-platform test suite, format check, and compile all binaries (Windows, Linux, macOS) locally:

On Linux/macOS:
chmod +x test.sh
./test.sh

On Windows:
.\test.ps1

Migration to mTLS and Asymmetric Cryptographic Authentication

What's New in v1.1.0

In this major update, we have completely overhauled the project's transport security architecture. We shifted away from symmetric pre-shared secret verification (-secret) to full mutual node authentication via TLS (mTLS). This guarantees strict infrastructure isolation and ensures that clients are fully authorized before any resource-intensive post-quantum cryptographic (PQC) handshakes are initiated.

Key Changes & Resolved Issues

• Migration to Transport mTLS: The initialization signatures for network.NewServer and network.NewClient have been fully refactored to work with comprehensive *tls.Config cryptographic contexts. The legacy string-based validation mechanism has been completely removed.
• Asynchronous Handshake (Deadlock Elimination): The tlsConn.Handshake() call on the server side has been moved into the concurrent context of the handleConnection goroutine. This unblocked the main Accept loop thread, successfully eliminating deadlocks during simultaneous connections and preventing premature connection teardowns (wsarecv: An existing connection was forcibly closed by the remote host).
• PKI Context Isolation in Tests: The testing suite in integration_test.go now features a genuine local Public Key Infrastructure (local CA) setup. It enforces strict separation of serial numbers and individual certificates for both the client and server, removing low-level network loopback buffer collisions (tls: error decoding message).
• Cross-Compilation Automation: The test.ps1 automation script has been updated. The build pipeline now automatically builds, cross-compiles, and isolates optimized production binaries for both Windows (amd64) and Linux (amd64) inside a dedicated ./dist directory.

Performance Validation Results

Despite the introduction of an asymmetric mTLS transport layer, the core proxy engine maintains its peak efficiency due to optimized memory pooling. High-load execution metrics on an Intel(R) Core(TM) i5-14600KF CPU show an increased frame processing rate while maintaining a strict zero-pressure profile on the Go garbage collector:

BenchmarkProxyPipe-20 1039668 1069 ns/op 0 B/op 0 allocs/op

Using the Updated Build

The -secret flag has been deprecated. Deploying the tunnel now requires passing pre-configured TLS certificate parameters (either programmatically or via an updated configuration layer):

• Run Server: ./pqc-proxy -mode server -listen :9090 -target 127.0.0.1:8000
• Run Client: ./pqc-proxy -mode client -listen :3000 -target 127.0.0.1:9090

To locally verify the entire pipeline, run integration tests, and execute the cross-compilation suite:
.\test.ps1

Structured Logging Infrastructure and Performance Validation

This patch release focuses on production observability and rigorous performance auditing. We have completely overhauled the logging layer and validated the core proxy engine under high-load benchmarking conditions.

Key Changes

• Structured Production Logging: Fully migrated the logging infrastructure from standard text output to Go's native log/slog library. Log messages now include structured metadata attributes (e.g., remote_addr, local_addr) and fully support configurable severity levels (Debug, Info, Warn, Error).
• High-Load Performance Benchmarks: Introduced micro-benchmarking (BenchmarkProxyPipe) inside the network test suite to measure throughput and track regression under continuous simulated data transfer.
• Verified Zero-Allocation Pipeline: Profiled the application under load using go test -bench. Results confirm 0 B/op and 0 allocs/op on the critical data transmission path, verifying that sync.Pool buffer allocation and the new slog implementation introduce zero memory pressure or GC overhead.
• Test Suite Stabilization: Fixed intermittent race conditions and refined port lifecycle management in the end-to-end integration tests to ensure deterministic local and CI execution.

Performance Evaluation Metrics

Executed on Intel(R) Core(TM) i5-14600KF (Go architecture: amd64, OS: windows):

BenchmarkProxyPipe-20      975308      1129 ns/op        0 B/op        0 allocs/op

To audit memory allocations and execute the micro-benchmarks locally, run:

go test -run=^$ -bench=BenchmarkProxyPipe -benchmem ./internal/network/tests/...

Secure Authentication and Workflow Automation

This minor release introduces critical security enhancements and improves developer experience by automating verification processes.

Key Changes

• HMAC-based Authentication: Added a two-stage handshake verification. The server now validates incoming connections using a pre-shared secret via HMAC-SHA256 before initiating resource-heavy PQC operations.
• Automation Suite: Introduced test.ps1 to streamline local development. The script performs static analysis (go vet), runs race-detector-enabled tests, and builds the binaries.
• Resilience: Improved error handling for socket binding, ensuring cleaner process lifecycles and better reporting on address/port conflicts.
• Documentation Update: Updated README.md to reflect the new authentication parameters and deployment workflow.

---

Quick Start

To use the new authentication feature, provide a -secret flag to both the server and the client:

Server

./pqc-proxy -mode server -listen :8081 -target 127.0.0.1:9091 -secret "YourSecret"

Client

./pqc-proxy -mode client -listen :3000 -target 127.0.0.1:8081 -secret "YourSecret"

---

Verification

You can now run the comprehensive test suite to ensure everything is functioning correctly before building:

.\test.ps1

Initial Production-Ready Release

This is the first stable release of pqc-proxy, a hybrid post-quantum TCP tunnel designed to secure legacy application traffic against future quantum cryptanalysis.

Key Features

• Hybrid Key Exchange: Combines X25519 (ECDH) and ML-KEM-768 (Kyber) for robust, quantum-safe security.
• AEAD Encryption: Full stream protection using ChaCha20-Poly1305.
• Zero-Allocation Pipeline: Optimized data relaying using sync.Pool to minimize memory overhead.
• Chaos Testing: Integrated framework for network stability and resilience testing.
• Observability: Built-in Prometheus metrics exporter for real-time monitoring.

Getting Started

1. Download the binary matching your OS.
2. Run as a Server:
   ./pqc-proxy -mode server -listen :9090 -target 127.0.0.1:8000
3. Run as a Client:
   ./pqc-proxy -mode client -listen :3000 -target 127.0.0.1:9090

Changelog

• Implement hybrid PQC handshake engine.
• Integrate Chaos injection for network reliability testing.
• Setup CI/CD pipeline via GitHub Actions.
• Add comprehensive documentation and unit test suites.