rust-reality v2.0.0

What's Changed

• tooling: make the repository gate validate both workspaces by @jacek4yang in #214
• tooling: restore the binary build identity measurement depends on by @jacek4yang in #215
• perf: compute X25519 with aws-lc-rs at the two per-session call sites by @jacek4yang in #216
• perf: give AES-256-GCM and ChaCha20-Poly1305 the same ring backend by @jacek4yang in #217
• perf: settle the SHA/HKDF/HMAC and Ed25519 provider questions on SHA-NI hardware by @jacek4yang in #218
• tooling: attribute server CPU without perf, from schedstat by @jacek4yang in #222
• tooling: retire the hotspot built-in lifecycle and report with record's privilege by @jacek4yang in #223
• tooling: give the profile harness nanosecond CPU accounting by @jacek4yang in #224
• tooling: wait for the exec with a readlink, not a 177 MB hash by @jacek4yang in #227
• release: stop the smoke test's readiness probe from waiting for a byte by @jacek4yang in #226
• tooling: stop sending shell escapes through the remote login shell by @jacek4yang in #230
• bench: stop a three-block interval from looking like a resolved bound by @jacek4yang in #231
• crypto: give entropy one owner and write the provider boundary down by @jacek4yang in #233
• crypto: add rr-crypto, the crate where cryptographic unsafe lives by @jacek4yang in #234
• crypto: compute X25519 with rr-crypto, and remove aws-lc-rs by @jacek4yang in #235
• crypto: generate REALITY keys with the implementation that imports them by @jacek4yang in #236
• reality: let real TLS 1.3 covers become reusable profiles by @jacek4yang in #237
• crypto: route the last production X25519 through rr-crypto (C3c complete) by @jacek4yang in #239
• fix(config): preserve the existing v1.8 Handoff landing during v2 upgrades by @jacek4yang in #241
• fix(tooling): make native soak fixtures match the current configuration contract by @jacek4yang in #242
• reality: hash profile classes as capability sets, not GREASE variance by @jacek4yang in #240
• release: finalize rust-reality v2.0.0 by @jacek4yang in #243
• deploy: preserve public routing during the v2 canary by @jacek4yang in #245
• bench: repair current-schema formal RTT configuration variants by @jacek4yang in #247
• docs: retire v2 tracking issues with durable reopen criteria by @jacek4yang in #248

Full Changelog: v1.9.0...v2.0.0

rust-reality v1.9.0

What's Changed

• docs(evidence): close the v1.8 dual-VPS gap and record the throughput investigation by @jacek4yang in #107
• docs(evidence): reject the relay-buffer download hypothesis on mechanism by @jacek4yang in #108
• config(runtime): support partial derived-policy overrides by @jacek4yang in #109
• docs(handoff): correct the configuration diagnosis and record #108/#109 by @jacek4yang in #110
• config(runtime): fail closed when a field is set through both channels by @jacek4yang in #111
• docs(evidence): record the v1.4.0 historical baseline and reject two mechanisms by @jacek4yang in #112
• runtime(explain): name the input language behind every pinned policy field by @jacek4yang in #113
• docs(evidence): ledger the per-connection control path from accept to splice by @jacek4yang in #114
• test(runtime): guard the reload generation boundary with mutation-checked tests by @jacek4yang in #115
• docs(evidence): ledger framed copies and allocations, and keep the 4-record buffer by @jacek4yang in #116
• dev(rr-dev): establish the development workspace, process layer and doctor by @jacek4yang in #117
• docs(handoff): record the audit checkpoint and the rr-dev entry point by @jacek4yang in #118
• dev(tools): rename the tooling workspace root from dev/ to tools/ by @jacek4yang in #119
• dev(rr-dev): migrate documentation validation and untrack tooling build output by @jacek4yang in #120
• dev(rr-dev): port the release evaluator's statistical core with bit-exact parity by @jacek4yang in #121
• dev(rr-dev): add the typed evidence and pairing layers with mutation-tested boundaries by @jacek4yang in #122
• dev(rr-dev): add the protected-metric contract layer by @jacek4yang in #123
• dev(rr-dev): make the verdict/reporting boundary structural, and assign every script a disposition by @jacek4yang in #124
• dev(rr-dev): reproduce the evaluator report serialisation byte for byte by @jacek4yang in #125
• docs(evidence): record the evaluator parity baseline and a blocking replay dependency by @jacek4yang in #126
• evidence(durability): archive recoverable replay inputs by content identity (ADR 0009) by @jacek4yang in #127
• docs(spec): transcribe the evaluator evidence loader in full by @jacek4yang in #128
• dev(rr-dev): implement the evidence loader and reproduce the recorded matrix metrics by @jacek4yang in #129
• dev(rr-dev): transfer evaluator authority to cargo dev perf evaluate and delete the Python evaluator by @jacek4yang in #130
• dev(scripts): delete an orphaned script and correct one disposition from audit by @jacek4yang in #131
• check: migrate active-probe + perf-contract validators into cargo dev check by @jacek4yang in #132
• release: migrate the release scripts into cargo dev release by @jacek4yang in #133
• fuzz: migrate fuzz-targets.py and fuzz-smoke.sh into cargo dev fuzz by @jacek4yang in #134
• history: move v1.5.0/v1.5.1/v1.6.0 release-gate harnesses to inert evidence by @jacek4yang in #135
• config: migrate config-identity-fingerprint into cargo dev config fingerprint by @jacek4yang in #136
• perf: migrate perf-stat/perf-c2c evidence into cargo dev perf environment by @jacek4yang in #137
• bench: add the typed benchmark lifecycle foundation by @jacek4yang in #138
• deploy: migrate the release-canary evaluator into cargo dev deploy canary by @jacek4yang in #139
• bench: correct stale handoff and add tunnel-config/summary building blocks by @jacek4yang in #140
• bench: migrate real-path suite onto cargo dev bench run by @jacek4yang in #141
• bench: migrate xray suite onto cargo dev bench run --suite xray by @jacek4yang in #142
• bench: migrate vision-direct onto cargo dev bench run --suite vision-direct by @jacek4yang in #143
• checks: own the matrix pipe-page budget in Rust by @jacek4yang in #144
• deploy: add cargo dev deploy netem data-quality validator by @jacek4yang in #145
• deploy: complete netem mechanism evaluation (ABBA bootstrap) by @jacek4yang in #146
• check: eliminate external Python performance gate by @jacek4yang in #148
• bench: migrate the core A/B ABBA harnesses onto cargo dev bench by @jacek4yang in #149
• bench: migrate the matrix suite onto cargo dev bench run --suite matrix by @jacek4yang in #150
• bench: migrate the DNS, routing and VLESS-encryption comparisons by @jacek4yang in #151
• bench: migrate the TLS-shape, interop and IPv6 harnesses by @jacek4yang in #152
• bench: migrate the soak, profiles and resource-pressure harnesses by @jacek4yang in #153
• deploy: migrate the deployment control plane and benchmark by @jacek4yang in #154
• chore: establish repository taxonomy foundations by @jacek4yang in #156
• docs: canonical documentation, agent constitution, and durable-state normalization by @jacek4yang in #157
• refactor: normalize CLI and assets module responsibilities by @jacek4yang in #158
• chore: enforce canonical repository architecture by @jacek4yang in #159
• docs: record GitHub repository governance by @jacek4yang in #161
• refactor(transport): own descriptor admission mechanism by @jacek4yang in #163
• refactor(transport): isolate relay construction policy by @jacek4yang in #164
• refactor(linux): isolate splice syscalls behind rr-linux by @jacek4yang in #165
• refactor(transport): own relay idle deadline by @jacek4yang in #166
• fix(rr-dev): bound external tool execution by @jacek4yang in #168
• fix(rr-dev): enforce fail-closed JSON evidence parsing by @jacek4yang in #169
• fix(rr-dev): bound process trees and captured output by @jacek4yang in #170
• fix(rr-dev): fail closed on invalid statistics by @jacek4yang in #171
• fix(rr-dev): fail closed on inconsistent evidence identity by @jacek4yang in #172
• fix(rr-dev): preserve completed evidence on republish by @jacek4yang in #173
• fix(rr-dev): fail closed when origin guard is unavailable by @jacek4yang in #174
• fix(rr-dev): publish matrix only after final checks by @jacek4yang in #175
• fix(rr-dev): restore setup rate before publication by @jacek4yang in #176
• fix(rr-dev): freeze no-CCS logs before publication by @jacek4yang in #177
• fix(rr-dev): bind hotspot capture artifacts by @jacek4yang in #178
• fix(rr-dev): align hotspot warmup bounds by @jacek4yang in #179
• fix(rr-dev): retain bounded perf diagnostics by @jacek4yang in #180
• fix(rr-dev): stop perf on target exit or deadline by @jacek4yang in #181
• fix(rr-dev): normalize stripped PIE hotspot samples by @jacek4yang in #182
• fix(rr-dev): skip unoffset non-DSO perf rows by @jacek4yang in #183
• perf(nxr): reuse keyed HMAC state by @jacek4yang in #184
• feat(rr-dev): freeze identity...

rust-reality v1.8.0

What's Changed

• refactor(session): extract runtime-independent session state by @jacek4yang in #100
• refactor(session): prove the irreversible write boundary by type by @jacek4yang in #101
• test(session): fuzz semantic event sequences against a reference model by @jacek4yang in #102
• refactor(runtime): make the Tokio adapter boundary explicit and enforced by @jacek4yang in #103
• refactor(transport): give each raw capability the policy it can honour by @jacek4yang in #104
• docs(perf): record the v1.8 memory audit and one rejected optimisation by @jacek4yang in #105
• release: rust-reality v1.8.0 by @jacek4yang in #106

Full Changelog: v1.7.0...v1.8.0

rust-reality v1.7.0

rust-reality v1.7.0

rust-reality v1.7.0 moves avoidable network setup RTTs out of authenticated
connection critical paths:

• authenticated REALITY cover TCP warming removes the cover TCP handshake RTT
  on a valid live-cover warm hit;
• validated prebuilt REALITY cover profiles remove the remaining synchronous
  cover ClientHello-to-flight dependency on an authenticated profile hit;
• adaptive single-use Handoff, NXR, and TCP-preconnected SOCKS5 pools remove
  the LINE-to-LANDING/upstream TCP handshake from the per-flow critical path on
  a valid warm checkout.

Warm sockets are prepaid transport state, not authentication authority.
Handoff and NXR still construct and validate fresh per-session authentication
and replay state. SOCKS5 still performs method negotiation, optional
authentication, and CONNECT after checkout. Unauthenticated, replayed, or
incompatible REALITY traffic continues to use the real cover/fallback path,
and every warm-pool miss falls back immediately to a normal cold connection.

Validation evidence

• The controlled warm-transport mechanism gate retained 108/108 valid records
  with zero failures. All nine release-gating Handoff, NXR, and SOCKS5 cells
  passed; at 50, 100, and 200 ms controlled RTT, measured removed setup latency
  was 0.9987–1.0017 TCP RTT.
• Handoff and NXR replay/authentication tests, two-phase bounded LANDING
  pre-authentication, byte-exact retry cutoffs, generation isolation, FD
  accounting, pressure handling, active probes, fuzz shards, sanitizers, and
  stock Xray-core 26.7.28 interoperability passed for the frozen release
  source.
• The exact official x86_64 generic artifact completed the active dual-VPS
  production canary over Handoff, including sustained traffic, churn, bounded
  bursts, LINE reload, LANDING restart/recovery, and byte-exact 1 MiB and
  32 MiB integrity checks.
• Release checksums and release-manifest.json were verified after download;
  packaged x86_64 generic and musl smoke tests passed.

These results demonstrate removal of one TCP-handshake RTT on valid warm hits.
They do not claim zero network latency, universal 0-RTT, or perfect warm
availability during startup or an instantaneous burst. The active dual-VPS
canary is a high-density release gate; longer-horizon soaking remains
non-blocking operational evidence.

What's Changed

• Immutable release-build recovery: #94
• Authenticated REALITY cover TCP warming: #95
• Validated prebuilt REALITY cover profiles: #96
• Adaptive LINE-to-LANDING/upstream warm TCP: #97
• v1.7.0 release metadata: #98
• Fail-closed VPS cutover and rollback health: #99

Full Changelog: v1.6.1...v1.7.0

rust-reality v1.6.1

rust-reality v1.6.1 is a focused hardening release. It adds complete fuzz-CI discovery, structured synthetic REALITY authentication fuzzing, deterministic active-probe regression coverage, bilingual release-data consistency, reproducible Linux x86_64 cache/PMU performance evidence, and an official fully static x86_64 musl archive.

Highlights:

• Every fuzz target declared by fuzz/Cargo.toml is discovered and exercised in bounded CI shards, with deeper scheduled runs and retained failure artifacts.
• Synthetic REALITY transcripts cover successful authentication, UUID/short-ID ownership mismatch, timestamp/session boundaries, transcript mutation, replay duplicates, and rollback paths without production secrets.
• A deterministic local active-probe suite covers 17 authentication, TLS/fallback-shape, fragmentation, cover-failure, close, and resource-pressure cases.
• English and Chinese current-release performance data now share a machine-readable source and semantic consistency checks.
• The performance foundation records protected workload cells, immutable binary identities, hot-structure size and allocation baselines, and fail-closed perf stat/perf c2c collection.
• linux-x86_64-musl is a baseline x86-64 static-PIE archive for Alpine, other musl systems, and minimal containers. It has no dynamic interpreter or shared-library dependency; the release remains all-or-nothing across GNU generic, musl, x86-64-v3, and aarch64 tiers.

Validation:

• Xray-core comparator: 26.7.28, commit 5ca6f4b, Go 1.26.0, SHA-256 23d228d78d699306c4782d6b400e2afa97c9bc9f291ae623448b5504904c5268.
• Performance baseline: published v1.6.0 Linux x86_64 generic binary, SHA-256 0aedbc3fac6e4810743a0b08288f51e4aaf325013dd8d26f48efa2e478dc7440.
• Formal evaluator: all 40 protected metrics passed, zero regressions; 867 matrix samples were valid and none were discarded.
• Exact Xray interoperability, all fuzz targets, descriptor pressure/recovery, IPv4/IPv6 local end-to-end transfer, package smoke, sanitizer CI, and release soak passed.
• The musl artifact passed its full release suite and static ELF checks on Ubuntu 22.04/musl 1.2.2 as well as the development host.
• The production data path did not change, so this release makes no new throughput or latency claim and retains v1.6.0 comparison values as historical evidence.

Configuration migration:

No configuration migration is required from v1.6.0. Existing v1.6.0 configurations remain the current canonical shape; validate before restart with:

rust-reality check --config config.json

rust-reality v1.6.0

rust-reality v1.6.0

Breaking changes and operator migration (v1.5.x → v1.6.0)

rust-reality is forward-only: the v1.6.0 binary contains no migration engine
and accepts no v1.5-only syntax. Migration is a short manual edit plus
rust-reality check --config config.json.

1. policy.* → advanced.limits.* (field names identical)

The top-level policy object is removed. Move every value to the
identically named field under advanced.limits:

v1.5	v1.6
policy.resourceGovernor.*	advanced.limits.resourceGovernor.*
policy.directBarrier.*	advanced.limits.directBarrier.*
policy.relay.*	advanced.limits.relay.*

Note: when advanced.limits.relay is present it must be complete (all
fields); copy the full policy.relay object, not a subset.

2. runtime.resourceMode → runtime.profile

v1.5	v1.6
runtime.resourceMode: "standard"	runtime.profile: "shared"
runtime.resourceMode: "dedicated"	runtime.profile: "dedicated"
(field unset)	nothing; the auto profile applies

Caution: v1.5's unset resourceMode behaved as an unconditional standard.
The v1.6 auto profile resolves to dedicated inside a fully bounded
cgroup v2; pin runtime.profile: "shared" to keep the exact v1.5 posture.

3. Pinned limits now select the tuning mode explicitly

Any pinned value under advanced.limits should be paired with
runtime.tuning.mode: "fixed" to keep the exact v1.5 numbers; the default
startup mode derives unpinned fields from the machine at boot. Run
rust-reality runtime explain --config config.json to see the resolved
plan before starting the server.

4. config migrate removed

The v1.6.0 binary has no migration command. Apply tables 1–3 by hand, then:

rust-reality check --config config.json

5. config autotune output schema

config autotune --dedicated now writes runtime.profile: "dedicated".
The measurement report schema is bumped to schemaVersion: 2 with the
resourceMode field renamed to profile.

6. Defaults changed under the relay limits

• The splice pipe capacity is 512 KiB (was 256 KiB); the worst-case
  relay-memory accounting doubles per pipe, so the built-in
  advanced.limits.relay.maxPooledPipes default is 256 (was 512), keeping
  the default accounted pool total at 256 MiB. Configurations pinning
  maxPooledPipes or running pipePool: false may need a higher
  maxRelayMemoryBytes; check reports the exact shortfall.

7. Removed interfaces (library consumers)

config::load_config_with_report, config::ConfigLoadReport,
Config::normalize, the Config.policy field,
RuntimeConfig::resource_mode, and the config::migrate module are gone;
config::load_config is the single load API.

New in v1.6.0

• runtime.profile / runtime.tuning / advanced.limits configuration
  model with startup derivation and runtime explain.
• Adaptive soft-ceiling controller (runtime.tuning.mode: "adaptive") with
  runtime.statusFile and rust-reality runtime report [--json].
• Compiler-grade configuration diagnostics (file:line:column, source
  excerpt, caret span, expected vs actual, secret redaction) across
  check, startup, and reload.
• Measured performance: 512 KiB splice pipes (fallback cpuPerGiB 0.953
  [0.925, 0.974]) and Vision framed-uplink batching (+5.5% c32, 3.5× fewer
  origin writes); formal release evaluator PASS on all 40 protected metrics
  with zero regressions vs v1.5.1.
• Attack-surface fuzz program: 12+ targets incl. config, Vision transitions,
  TLS 1.3 record round-trips, Handoff/NXR round-trips, differential
  transcript hashing, and a diagnostic-renderer target.

Upgrade procedure

1. Stop the v1.5 service.
2. Edit the configuration per tables 1–3 (and 6 if limits are pinned).
3. rust-reality check --config config.json — fix anything it reports
   (the diagnostics name the file, line, column, and the v1.6 replacement).
4. rust-reality runtime explain --config config.json to review the
   resolved plan (optional but recommended when runtime.profile is unset).
5. Install v1.6.0 and start the service.

Verified release evidence

• Formal release gates: evaluator PASS, 40/40 protected metrics, zero regressions vs the published v1.5.1 binary.
• Xray 26.7.28 comparison (frozen SHA-256 23d228d7…, unmodified client, byte-verified, balanced ABBA): setup 1.07–1.09× with p99 up to 3.9× lower; bulk 0.98–1.61×; routing 1.01–2.45× flat to 10,000 rules; DNS burst 1.25×; RSS 8.3 vs 39.5 MiB; setup CPU 571 vs 925 µs (0.62×).
• Fallback relay cpuPerGiB 0.953 [0.925, 0.974] (512 KiB splice pipes); framed uplink +5.5% c32 with 3.5× fewer origin writes (batched).

Assets

SHA-256 for every asset is in SHA256SUMS; the release manifest records exact build identities.

What's Changed

• feat(config): v1.6 runtime profile/tuning model with advanced.limits and policy alias by @jacek4yang in #67
• feat(runtime): adaptive ceiling semaphores for governor pools and direct barrier by @jacek4yang in #68
• refactor(runtime): extract StartupPlan derivation from autotune into runtime::plan by @jacek4yang in #69
• feat(config): add config migrate for the v1.5 to v1.6 model by @jacek4yang in #70
• docs: establish the forward-only engineering doctrine by @jacek4yang in #71
• feat(runtime): derive the startup policy and size the bootstrap from the machine by @jacek4yang in #72
• refactor(config)!: forward-only v1.6 — remove migrate, policy alias, resourceMode by @jacek4yang in #73
• test(fuzz): expand fuzzing into an attack-surface-driven program by @jacek4yang in #74
• config: compiler-grade diagnostics with source spans, redaction, and targeted removed-field errors by @jacek4yang in #75
• feat(runtime): adaptive soft-ceiling controller (tuning.mode=adaptive) by @jacek4yang in #76
• chore(bench): v1.6.0 release-gate harness by @jacek4yang in #77
• chore(bench): v1.6 gate harness repository path fix by @jacek4yang in #78
• chore(bench): v1.6-native config in fallback A/B harness by @jacek4yang in #79
• chore(bench): per-implementation config filter in fallback A/B harness by @jacek4yang in #80
• perf(relay): 512 KiB splice pipe capacity — halved splice syscalls, −5% fallback CPU/GiB by @jacek4yang in #81
• perf(vision): batch the framed uplink — 3.5× fewer origin writes, +5.5% framed upload by @jacek4yang in #82
• release: v1.6.0 by @jacek4yang in #83

Full Changelog: v1.5.1...v1.6.0

rust-reality v1.5.1

What's Changed

• fix(dns): isolate static/dynamic cache identities, optional system reuse window by @jacek4yang in #61
• perf(logging): log.output none mode and lazy per-connection debug events by @jacek4yang in #62
• perf(tls13): incremental transcript hash in the server flight by @jacek4yang in #63
• test(gates): v1.5.1 gate harness and README comparison cells by @jacek4yang in #64
• fix(bench): pass large routing rule sets through a file, not a jq argument by @jacek4yang in #65
• release: v1.5.1 by @jacek4yang in #66

Full Changelog: v1.5.0...v1.5.1

rust-reality v1.5.0

What's Changed

• feat: separate dual-stack listeners and adaptive dialing by @jacek4yang in #47
• merge: integrate prior v1.5 work with autonomous dual-stack by @jacek4yang in #48
• feat: shared DNS resolver with TTL cache, singleflight, and admission governance by @jacek4yang in #49
• test: real IPv6 end-to-end validation harness by @jacek4yang in #50
• fix: shape the generated EE ALPN to the cover's observed record slot by @jacek4yang in #51
• ci(release): explicit per-arch tier matrix with aggregated verified publish by @jacek4yang in #52
• perf: adaptive routing indices with exact first-match semantics by @jacek4yang in #53
• fix(config): reject udp routing rules that can never match by @jacek4yang in #54
• docs: v1.5.0 release documentation (DNS, routing, release matrix, migration, IPv6) by @jacek4yang in #55
• fix: reject DNS policy drift on reload instead of ignoring it by @jacek4yang in #56
• fix(ci): anchor aggregate input allowlist to the exact tier set by @jacek4yang in #57
• test: v1.5.0 release performance-gate harness and evidence by @jacek4yang in #58
• release: v1.5.0 by @jacek4yang in #59
• fix(ci): fetch the tag object before verifying release identity by @jacek4yang in #60

Full Changelog: v1.4.0...v1.5.0

rust-reality v1.4.0

What's Changed

• release: v1.4.0 by @jacek4yang in #46

Full Changelog: v1.3.0...v1.4.0

rust-reality v1.3.0

What's Changed

• release: v1.3.0 by @jacek4yang in #45

Full Changelog: v1.2.0...v1.3.0