FlowSplice 0.4.1

Shared transport fix

FlowSplice 0.4.1 fixes a TCP Carrier backpressure deadlock affecting long-running Home and Travel runtimes. A full inbound event queue previously blocked outbound progress, heartbeats and cancellation. Carrier shutdown could also retain sockets and capacity while waiting to deliver a terminal event.

The shared carrier pump now keeps these operations responsive with bounded buffering and releases transport resources before reporting closure. This applies to the shared Rust SDKs and the classic and PTY native clients that embed them.

SDK distribution

Rust crates are distributed through this Git repository. Pin Git consumers to the 0.4.1 tag. The SDK example lockfile now selects the 0.4.1 implementation.

Validation and provenance

The complete CI quality/test and Docker E2E jobs pass at e67e0ec087e3a03f19c530fe69fdc9398e4fb9ec. Targeted regressions reproduce the original transport failure and pass with the fix. Linux real-tmux tests and native Android, iPhone, iPad and macOS verification cover the coordinated release.

Private release candidates were compiled from fe619b03cf4f6f213e5814affd4dc314194e7f0d. The tag adds only a test-input correction for shell interrupt flushing and the SDK example lockfile update; runtime implementation and runtime dependency inputs are identical. Private deployment packages and identities are not attached to this public source release.

FlowSplice 0.4

FlowSplice 0.4

FlowSplice 0.4 is a source release from main, pinned to
0c54fd78c6b4c8f28f346d617105a84dfe2cbcba. Cargo package versions are 0.4.0;
the release tag is 0.4. The project remains pre-stable; this source release does
not introduce GA or backward-compatibility guarantees.

Distribution and SDKs

This release publishes source code and release notes only, with no binary assets or
crates.io packages. Deployment-specific native installers are built privately.

• Two supported SDK entry points: flowsplice-home-core and flowsplice-travel-core.
• SDK default builds require no generated Web assets. The generic Travel application
  explicitly enables its frontend feature and builds the assets first.
• Business grants, endpoint credentials, trust, catalog and statistics query types are
  accessible through the SDK entries.
• English SDK guides, business Home provisioning instructions, compiled README examples
  and a standalone TCP foobar sample pinned to the SDK fixes.
• TCP flows drain queued close acknowledgements before releasing Travel tasks, supporting
  either endpoint closing its write half first.

Validation and limits

Validation for the pinned source revision:

• Local policy/build/lint checks, 252 workspace tests, nine additional Travel regression
  cases, and two README compilation examples passed.
• Independent default-feature and feature-disabled consumers compiled, linked and ran
  against the GitHub source. Both modes were also verified with literal tag = "0.4"
  dependencies, with their lockfiles resolving to the revision above.
• GitHub CI
  passed the standalone SDK checks, build/lint checks, native browser tests and Docker
  E2E suite.
• The GitHub full Rust test job still failed in
  flowsplice-pty-home::tests::closing_attach_does_not_submit_partial_input_or_end_shell
  with a terminal output marker timeout. The overall CI run is not green.
• The standalone foobar sample was rebuilt against the SDK fixes; that rebuild is not
  a new end-to-end execution of the sample.

The full workspace build requires the generic applications' generated web/dist
assets. Run make web before building all workspace targets, or use make check,
which performs that preparation. This requirement does not apply to ordinary SDK
default builds.

Selecting the release

Git consumers can select tag = "0.4". The existing tag was corrected in place to
the revision above. A consumer locked to 012ae80 still uses the source before the
SDK fixes: moving a tag does not update an existing Cargo.lock. Refresh cached tag
references, update the FlowSplice Git dependencies with cargo update, verify the
resolved revision, and commit the updated consumer lockfile.

See the SDK guide,
business Home setup,
standalone example and
GitHub Release.

Repository release notes.

FlowSplice 0.3.1

FlowSplice 0.3.1

FlowSplice 0.3.1 completes the 0.3 native Travel client generation, with Android,
iOS/iPadOS, and macOS applications sharing the Rust Travel Core with the CLI.
The project remains pre-stable; this release does not introduce compatibility or GA guarantees.

Distribution

This GitHub release publishes source code and release notes only. It has no binary
attachments. Deployment-specific installers are distributed privately.

Native clients require a deployment public root injected into an application
resource before signing. This authenticates the deployment during discovery and
enrollment without an additional manual fingerprint comparison. The network cannot
replace that root. Client private keys are still generated on the device, and Home
approval is still required.

Operators building native clients must supply their own external trust and signing
configuration; see private Travel packaging.
Actual deployment public keys, certificates, private keys, signing profiles, and
private installers are excluded from Git and public release assets. Deployment-neutral
CLI executables use separately supplied trust configuration.

Highlights

• Native enrollment, local mapping management, runtime status, and recovery on
  Android, iOS/iPadOS, and macOS, backed by one shared Rust engine.
• Android foreground-service lifecycle, network-change recovery, protected password
  storage, and bounded screen-off wake-lock behavior.
• iOS/iPadOS background continuity through a mixable audio session, with optional
  Live Activity presentation and explicit recovery cancellation.
• An independent macOS desktop application with menu-bar controls, route diagnostics,
  and a signed/notarized private distribution pipeline.
• Binary business-data frames, adaptive status observation, and reduced idle work.

Review fixes

The ten findings from the 0.3 branch review have been addressed:

1. Pin deployment trust throughout discovery and enrollment.
2. Cancel and join accepted flows when stopping the native runtime.
3. Restore bounded frame-write deadlines.
4. Roll back listeners when startup fails partway through.
5. Update TCP traffic counters during active transfers.
6. Recover persistent statistics after a reconnect and lost acknowledgment.
7. Flush UDP statistics incrementally across time buckets.
8. Let authenticated Relay endpoint updates supersede automatic bootstrap hints.
9. Expose Stop while iOS audio/runtime recovery is pending.
10. Handle non-restorable iOS identity/password state with a recovery path.

Clean Apple builds also install dependencies for both embedded Web frontends before
building the native products.

Validation and limits

Validation during development included Rust formatting/check/Clippy, 117 workspace
tests, five isolated review regression scenarios, the 75-check Docker E2E matrix,
native platform tests, signed-artifact verification, and physical iPad/Android
installation and launch acceptance. The user completed client acceptance testing.
These checks do not establish a professional third-party security audit or measured
battery consumption.

Preserve application data and the established signing identity when upgrading;
uninstalling a client is not an upgrade procedure. On Android, a cold launch while
stopped can show an empty mapping list until Start loads the runtime state. This
presentation does not by itself establish that saved mappings were deleted.

Physical overnight endurance and comparative energy measurements remain separate
validation work. There is no authenticated automatic updater, update anti-rollback,
or reproducible-build attestation. See the README for deployment,
trust, and loopback-service boundaries.

FlowSplice 0.2.1

FlowSplice 0.2.1

0.2.1 修复 Relay 对外地址由 Server 配置写死的问题，并引入明确的主动/被动 Relay 控制模式。升级时必须在同一维护窗口更新 Server 和全部 Relay。

主要变化

• 公网固定地址 Relay 使用被动模式，由 Server 主动连接。
• OpenWrt Relay 使用主动模式，自行连接 Server；Server 不再保存它们的地址。
• OpenWrt Relay 从 netifd 自动发现当前逻辑网络、L3 设备和 IPv4/IPv6 地址，地址变化后自动更新或撤销注册，不依赖 DDNS。
• Server 按已认证的 Relay 身份维护完整内存目录，并将排序、带持久代数的完整目录广播给所有 Relay。
• Relay 会校验并原子替换完整目录；旧控制会话不能覆盖或删除替代会话的注册状态。
• OpenWrt 包为非 root flowsplice 账户增加仅限 network.interface.*.status 的 ubusd 权限，并在安装后自动重载 ACL。
• 现有 Relay 证书、私钥和信任材料可以继续使用，无需重新签发证书。

验证

• make check 和全部 89 个 Rust 测试通过。
• 无拉取 Docker 功能/故障 E2E 通过全部 75 项检查。
• OpenWrt IPK 的包结构、渲染器、翻译和最小 ubusd ACL 回归测试通过。
• 协调部署验证了三个被动 Relay、两个主动 Relay、动态网络地址注册，以及所有 Relay 收到相同的五项完整目录。

发布物

• Linux x86-64 与 ARM64 静态可执行文件包
• macOS Apple Silicon 通用可执行文件包
• Home / Travel macOS 部署中立样例包
• OpenWrt ARM64 IPK
• SHA256SUMS

Home / Travel 公开样例包只包含通用二进制、中文 Quick Start、使用 IANA 保留示例名称的 .example.toml 和内部校验文件。公开发布物不含实际 IP、真实基础设施主机名或子域名、部署配置、证书、密钥、deployment root、signed trust、固定信息、拓扑或凭据。

macOS 可执行文件使用 ad-hoc 签名，不是 Apple Developer ID 签名，也未 notarize。