v0.5.0

Changelog

• fff3f6c Merge pull request #11 from khanhkit/chore/solo-branch-protection-policy
• 2c9f9db Merge pull request #12 from khanhkit/kitdev1/ap-iss-0028
• c0b888c Merge pull request #13 from khanhkit/kitdev3/ap-iss-0029
• a77f196 Merge pull request #14 from khanhkit/kitdev3/ap-iss-0030
• 7edf568 Merge pull request #15 from khanhkit/kitdev3/actions-clean-failure-history
• ded32f9 Merge pull request #16 from khanhkit/kitdev3/identity-v050
• 56f0518 Merge pull request #4 from khanhkit/kitdev3/ap-iss-0026
• 96a76cd Merge pull request #5 from khanhkit/kitdev3/ap-iss-0021
• 85582a7 Merge pull request #8 from khanhkit/green/integration-20260919
• 64ab62f Merge remote-tracking branch 'origin/main' into kitdev3/ap-iss-0029
• 99fb25d build(container): harden reproducible non-root runtime
• 201fc4e build: raise Go security floor to 1.25.13
• 2417597 chore(config): remove obsolete plaintext helper
• 5260f5a chore(config): reuse install option key
• 5a9a26c chore(guardian): document shell-free child execution
• cd45866 chore(proxy): clean intermediary verification defects
• 5d0dc3f ci: add hosted release candidate dry run
• 94ea63d ci: automate protected AD verification fixture
• 174d9a8 ci: constrain verified release promotion assets
• 90ba59f ci: defer external AD validation to manual TODO
• 73e8e3c ci: expose exact-ref verification dispatch
• e0540e9 ci: fix Windows fixture preflight
• fa3e90b ci: fix Windows fixture preflight matching
• 1b94bdf ci: gate fuzz and Windows auth verification
• 5321e65 ci: harden exact-SHA release supply chain
• 7f92c10 ci: isolate native SSPI dispatch job
• 26c40ec ci: isolate native Windows SSPI verification
• 8679ce1 ci: keep dry-run failure proof green
• c1519c5 ci: make fork distribution ownership authoritative
• bae3fc0 ci: prove immutable draft promotion
• 7655274 ci: register fork workflows
• 52f3a28 ci: require native runtime verification
• 24622d4 ci: restore native WinHTTP verification gate
• 1a4c7f6 ci: retrigger Windows SSPI verification
• 2a8d695 ci: verify release candidates before promotion
• c42e3e9 docs(auth): clarify downstream negotiate scope
• e452ecc docs(auth): make upstream Basic fallback explicit
• d132510 docs(cli): mark kerberos mode fail-closed
• 1c9fbaf docs(guardian): document process failure boundary
• 795b688 docs(proxy): define HTTP intermediary contract
• eecd8ad docs(proxy): document fail-closed gateway policy
• 954cfb9 docs(proxy): document managed tunnel lifecycle
• 2526b7f docs(routing): document proxy source precedence
• d83d182 docs(routing): document proxy source precedence
• 96e8055 feat(diagnostic): track upstream auth mechanism
• 049db23 feat(dns): add network-epoch cache invalidation
• fd90044 feat(guardian): add authenticated process-liveness core
• 6d8d1ff feat(guardian): add parent lifecycle orchestrator
• 787283f feat(guardian): add worker readiness and progress bridge
• bf3509a feat(guardian): integrate parent and worker entrypoints
• 97d456c feat(kerberos): define fail-closed proxy auth contract
• 73922b2 feat(observability): add local doctor and fatal diagnostics
• c52a086 feat(observability): harden logger and bounded event history
• 4004b20 feat(proxy): classify negotiated auth mechanism
• 8e69c45 feat(proxy): enforce kerberos contract and expose mechanism
• 3f8ba26 feat(supervisor): add bounded runtime recovery core
• 393bcb2 feat(supervisor): integrate runtime recovery with proxy paths
• 6059fdf fix(auth): enforce downstream verifier invariants
• acf08fb fix(auth): make parser bounds 32-bit obvious
• 389aa21 fix(auth): make upstream credentials challenge strict
• 5a96359 fix(config): make ingestion strict and source aware
• c7fea61 fix(config): make persistence atomic and serialized
• cf2269a fix(config): preserve UNC file URLs
• ac83de5 fix(config): preserve documented ini comments
• 2e69258 fix(config): report corrupt plaintext keyring
• d518f3f fix(deps): consume Go security floor
• 60ea955 fix(deps): consume Go security floor
• d00c21a fix(deps): update x/text past GO-2026-5970
• d0f5a97 fix(deps): update x/text past GO-2026-5970
• f82ee72 fix(deps): update x/text past GO-2026-5970
• 73237cb fix(deps): update x/text past GO-2026-5970
• c3aa110 fix(dns): coalesce immutable bounded cache entries
• f82e3e2 fix(guardian): distinguish worker-requested normal stop
• da28b18 fix(kerberos): decouple refresh lifecycle from callers
• 2df407a fix(kerberos): make cleanup terminal across refresh
• a6b04c3 fix(kerberos): publish refresh completion after cleanup
• 64c509a fix(pac): bound and preload PAC generations
• 55b6849 fix(pac): bound and preload PAC generations
• 629fa34 fix(pac): canonicalize bounded deterministic semantics
• e016ddf fix(pac): canonicalize bounded deterministic semantics
• 8831264 fix(proxy): bound replayable request bodies
• e43d68e fix(proxy): bound upstream connection lifecycle
• 7f6d9b3 fix(proxy): classify only selected SPNEGO mechanism
• 740588b fix(proxy): enforce HTTP intermediary boundary
• 2246c74 fix(proxy): narrow resolver helper result
• eb4ffe6 fix(proxy): narrow resolver helper result
• 1b06c24 fix(proxy): own Windows SSPI auth sessions
• 50fbb34 fix(proxy): own hijacked tunnel lifecycle
• 70886d8 fix(proxy): own system resolver lifecycle
• c22fbdf fix(proxy): own system resolver lifecycle
• 0e58dbe fix(proxy): preserve authoritative route membership
• d3ada08 fix(proxy): recognize wrapped NTLM negotiation
• c1309af fix(proxy): retain authenticated upstream transports
• b105054 fix(proxy): secure gateway admission and control
• cb3820b fix(proxy): simplify SSPI failure return
• 2cae267 fix(routing): canonicalize proxy and bypass parsing
• 28179f4 fix(routing): canonicalize proxy and bypass parsing
• 644d8e1 fix(routing): make env regression portable
• 3a2a872 fix(routing): make env regression portable
• ab35996 fix(routing): make env regression portable
• 38ed427 fix(routing): make proxy source precedence explicit
• bf85efd fix(routing): make proxy source precedence explicit
• 4720010 fix(server): avoid self-test readiness probe sockets
• 4f81c94 fix(server): bound control lifecycle shutdown
• 730f5a4 fix(startup): create missing Windows Run key
• 385ef55 fix(startup): harden Windows run contract
• ce30051 fix(startup): persist config before Windows install
• 2c50ba9 fix(systemproxy): bound WinHTTP proxy resolution
• 4eba170 fix(systemproxy): bound WinHTTP proxy resolution
• c8dee52 fix(systemproxy): persist WinHTTP resolver lifecycle
• a5df026 fix(systemproxy): persist WinHTTP resolver lifecycle
• daa5f49 fix: close self-test idle connections before shutdown
• 4fb83db merge: AP-ISS-0026 runtime supervisor
• 225b3d7 merge: consume AP-ISS-0003 transport ownership
• 0bf63a6 merge: consume AP-ISS-0006 Windows CI lineage
• 1b40051 merge: consume AP-ISS-0007 routing lineage
• ab4075d merge: consume AP-ISS-0008 parser fuzz targets
• 79770ec merge: consume AP-ISS-0011 final startup contract
• 46e0f96 merge: consume AP-ISS-0012 final gateway contract
• b9203fd merge: consume AP-ISS-0012 frozen gateway contract
• fed5c97 merge: consume AP-ISS-0013 downstream auth contract
• aeea6ca merge: consume AP-ISS-0015 final intermediary contract
• dbd8f2f merge: consume AP-ISS-0016 request-body contract
• 0bcaeb2 merge: consume AP-ISS-0024 dependency security fix
• 88ef295 merge: consume AP-ISS-0024 release contract
• 5db0cfb merge: consume release verification lineage
• eaa3e2c merge: integrate Process Guardian lineage
• eeab3b0 merge: sync latest main before green integration
• c34626d refactor(proxy): commit auth mechanism per handshake
• ade7112 release: migrate distribution identity to khanhkit
• 8538810 style(proxy): canonicalize kerberos mechanism name
• dbc46ec style(routing): canonicalize SOCKS schemes
• df7f57a style(routing): canonicalize SOCKS schemes
• 24a051e style(routing): canonicalize SOCKS schemes
• 2e40231 style(routing): canonicalize proxy env keys
• f07e4aa style(routing): canonicalize proxy env keys
• 24beb27 style(startup): satisfy project formatter
• f520bdc test(auth): add fuzz and rejection benchmarks
• 42dfbc4 test(auth): capture downstream verifier regressions
• 0dc0a6c test(auth): capture upstream challenge policy regressions
• 9fb79b1 test(auth): fuzz strict upstream challenge policy
• 96b0ad0 test(auth): make Basic fallback opt-in explicit
• 2f3d161 test(auth): verify strict downstream auth contract
• a43a616 test(bench): make e2e harness reproducible
• 6a534ff test(ci): harden Windows integration gates
• 4e22a64 test(ci): isolate WinHTTP native race gate
• 04e3615 test(ci): parse-check AD bootstrap on Windows
• bd940ea test(ci): verify bounded WinHTTP resolver on Windows
• acd5c58 test(cli): make kerberos error oracle platform-aware
• ca4d3a2 test(config): capture persistence safety regressions
• 710053c test(config): define strict ingestion regressions
• c8af59e test(config): verify atomic failure and corruption reporting
• 1d90b7a test(guardian): clean helper process teardown
• fce007d test(guardian): define main dispatch boundaries
• e49a68f test(guardian): define parent process fault contracts
• 8617d3b test(guardian): define process-lifecycle contracts
• e738636 test(guardian): expand real process fault matrix
• 7ba13b2 test(guardian): fuzz protocol and soak restarts
• c538f5f test(kerberos): capture lifecycle regressions
• 66b521d test(kerberos): cover cleanup during refresh
• bfae398 test(kerberos): simplify refresh wait helper
• f215413 test(kerberos): synchronize cleanup-after-refresh regression
• 6a7ef58 test(kerberos): verify async refresh lifecycle
• 7ac997e test(kerberos): verify delayed PTY password reader
• 960c0dc test(observability): define local doctor contracts
• 5ab676d test(observability): define logger and event contracts
• 1563445 test(observability): harden Windows verification
• 1bce832 test(proxy): accept bounded slow-header termination
• d0f19ae test(proxy): add native Windows SSPI fixture
• b9701a5 test(proxy): add real AD Kerberos SSPI fixture
• 972bf8d test(proxy): await async kerberos reload
• 384b838 test(proxy): capture HTTP intermediary boundary gaps
• de8fb4a test(proxy): capture gateway security regressions
• e8836fa test(proxy): capture hijacked tunnel lifecycle gaps
• 396b3d0 test(proxy): close unexpected SSPI retry response
• 25c5763 test(proxy): codify kerberos feature validation
• 4195551 test(proxy): cover SSPI continuation lifecycle
• d333161 test(proxy): exercise slow-client gateway bounds
• a552e04 test(proxy): make response cleanup explicit
• 71cdd53 test(proxy): read complete Via header chain
• 974cc6d test(proxy): run native SSPI fixture on Windows CI
• a82b003 test(proxy): stress HTTP intermediary lifecycle
• 1cadbb0 test(proxy): stress managed tunnel shutdown
• a313480 test(proxy): verify upstream lifecycle cleanup semantics
• fae9dc7 test(routing): add Windows bypass fixture
• ec4332f test(routing): add Windows bypass fixture
• 6af7466 test(routing): isolate automatic proxy discovery in CI
• f84f9f4 test(routing): isolate automatic proxy discovery in CI
• 77db74a test(server): capture lifecycle control gaps
• 684a3bc test(server): verify bounded startup lifecycle
• 7da7b69 test(startup): add native Windows registry fixture
• 97f2132 test(startup): enforce config persistence order
• 9065e1f test(startup): restore Windows registry safely
• 71b00b1 test(supervisor): cover network epochs and hot paths
• aa75a5e test(supervisor): define runtime recovery contracts
• 65c9d78 test(systemproxy): prepare native WinHTTP fixtures
• 061c298 test(systemproxy): prepare native WinHTTP fixtures
• d9e1445 verify: add real AD Kerberos testcase
• 8790bee verify: add single-VM AD bootstrap contract
• d499304 verify: consume AD bootstrap parser regression
• 6673fcf verify: consume AP-ISS-0002 lint fix
• 4b3df8e verify: consume AP-ISS-0008 CI regression fix
• a061be4 verify: consume AP-ISS-0008 lint follow-up
• 2c2becb verify: consume Go 1.25.13 security floor
• ca12a44 verify: consume latest AP-ISS-0024 CI fixes
• 810b334 verify: integrate AP-ISS-0002 with AP-ISS-0024 CI
• 915ff99 ⚡️ move maintenance off the request path, reduce hot-path contention
• 1cfe44b ⚡️ perf and correctness batch: transport reuse, PAC VM pool, dnscache, relay rewrite
• a832d98 ✨ handle SIGINT/SIGTERM with a bounded graceful shutdown
• e7142a1 🐛 correctness batch: IPv6 IPSet, CONNECT v6 literals, /8, digest hardening
• 95126d9 👷 add benchmark harness: make bench, e2e script, methodology doc
• d273c06 📝 docs pass: README, architecture refresh, changelog, TODO status
• 9c47eda 🚚 split proxy.go into cohesive files
• b0ebd12 🚨 fix connect lint warning