v0.8.0

Release v0.8.0: protocol face hardened in place (frame type bytes renumbered into 0x20-0x2F control-plane pairs with Error 0xFF, the signed policy face is deny_unknown_fields, hub/ingress packs' listen is mandatory, and the QUIC control plane now fails closed with an Error frame instead of soft-failing older hubs — old packs re-render, peers rebuild together), config face made explicit (TLS validation rejects instead of warning, edge override fields, listen required), issuer store auto-backup (every identity change produces a versioned offline recipient-encrypted backup; the lost-store recovery path degrades from a full mesh rebuild to restoring one file), one-way blackhole detection (first-class liveness roundtrip, always-on off-tree probes, hub removal notification), egress drain made event-driven (two sleep(100ms) polls replaced by an inner-QUIC drain barrier), canonical pack rendering (all fields always written, rendered_by provenance stamp), CRL source pinned statically by identity_mode, GUI node-detail frequency layering and mesh observability faces, and nextest enforced as the single test runner

v0.7.0

Release v0.7.0: binary rename interflow -> interflow-cli (CLI/mesh/registrar named by role, clap name derived from the package), control-plane wire payloads single-sourced across the h2 and QUIC transports (Hello/HelloAck/RouteRequest/RouteAck/Error/RegisterResponse family), mesh QUIC pack model (manifest [mesh.hub] quic_listen and agent transport reach the engine config), the QUIC-switch GUI operating surface, and CI hardening: the test job's five cargo stages and the pebble environment contract now live in one script (scripts/ci_test_stages.sh) that the release export also runs as a local parity preflight before committing — the public tree always passes its own test job

v0.5.0

Release v0.5.0: issuance UX (CLI four-command flow and GUI issue wiza…

v0.4.0

Release v0.4.0: identity-first as the only deployment path (mesh incl…

v0.3.0

Release v0.3.0

v0.2.1

Release v0.2.1: h2 session-churn fix, configurable edge log level, CI…

v0.2.0

Release v0.2.0: config schema v3 and a paired-deployment protocol (tw…

v0.1.3

interflow v0.1.3

Highlights:
- Edge self-dial agent self-heals: a connection-level death of the edge's internal hub dial used to zombie the whole gateway (site-wide 502 until a manual process restart; the in-process poll watchdog died with the poll loop and the connection-death signal was dropped unused). The internal agent now runs the same supervised auto-reconnect path as every expose client — in-process rebuild and re-registration within seconds.
- SessionSlot tunnel facade: embedders (the edge listener) hold one AgentTunnel across session rebuilds; sends during a reconnect gap fail fast with a bounded, actionable error instead of hanging or black-holing.
- Recovery-stack hardening: bounded abort-on-timeout joins in the session wind-down (a stuck child can no longer park the supervisor forever); /poll and /stream/up request-establishment timeouts (15s default, request_establish_timeout_secs override) covering the no-response-headers hang form invisible to both the watchdog and the connection-death detector; outer edge health watch (--agent-recovery-timeout-secs, default 120s) exits for a systemd restart only when the supervisor itself goes silent or fails without retry — normal reconnect cycling never trips it.
- Observability: per-attempt "Agent connecting (attempt=N)" logs; interflow_agent_session_join_timeout_total and interflow_agent_tunnel_establish_timeout_total metrics.

Verified: cargo test --workspace green (10 new: session-slot facade e2e, strangled-request e2e red-verified, health-watch e2e, bounded-join unit); serial e2e 112 green; clippy/fmt clean.

(Repointed to include the CI flake fix for the new facade e2e — production code identical.)

v0.1.2

interflow v0.1.2

Highlights:
- Single-target failure isolation: an edge route pointing at a dead backend (a plain config error) plus the public side's normal retry loop used to drain the agent-wide stream-open budget and take down every healthy route on the same agent. Now: a per-target circuit breaker on the agent (windowed failure counting, cooldown, probe-based self-healing), a gate reorder so cheap target-aware rejections consume none of the shared open-rate budget, close-reason propagation agent->hub->edge (empty payload stays wire-compatible with old peers), and route-level breakers on the edge — a tripped route's new connections are closed at the internet edge without a tunnel Open.
- Expose QUIC transport path: edge --quic-listen + client --transport quic (config-level assembly on top of the mesh QUIC plane).
- Deps: tokio 1.52.3 -> 1.53.1.

Verified: cargo test --workspace 300 green (12 new: breaker state-machine unit tests, mesh e2e isolation/self-heal/opt-out, edge route-breaker e2e); clippy/fmt clean.

v0.1.1

interflow v0.1.1

Highlights:
- Fix P0: one-way idle teardown of receive-only push streams — SSE/token-stream consumers (zero client bytes after the request) were killed at exactly idle_timeout=300s regardless of response traffic. Idle is now a shared budget: activity in either direction keeps the stream alive; both-direction silence for the full budget still tears it down.
- Egress session-level send-path health: when the send path is wedged (demand present, nothing getting through for 30s), the whole session fails over to reconnect instead of executing streams one by one.
- Always-on QUIC transport stats sampling (egress + hub, 10s, debug level): cwnd / rtt / lost packets / congestion events / black holes.
- Test harness only (not in shipped binaries): UDP impairment proxy rebuilt as bounded FIFO delay lines with overflow accounting; quic egress-stall case closed (harness convicted, quinn exonerated).

Verified: 900s dual-transport (h2 + QUIC) soak green — 262,254 / 262,237 chunks, zero corruption, zero stall signatures.