Fluxheim 1.6.0

[eldryoth]

Fluxheim 1.6.0 Release Notes

Fluxheim 1.6.0 starts the Pingora-exit foundation line. This release is the
baseline and guardrail release for the 1.6 series; runtime behavior is intended
to remain unchanged while the project records the evidence and policy needed to
remove Pingora safely in later 1.6.x releases.

Added

• Added the first 1.6 modularity policy and legacy exception inventory. New or
  newly split Rust implementation files should target 300 lines and stay under
  500 lines; existing oversized files are tracked explicitly so the exception
  list can shrink across the Pingora-exit line.
• Added scripts/validate-modularity-policy.sh to report and validate the
  current oversized Rust-file inventory against
  docs/modularity-exceptions.md.
• Added docs/runtime-baseline.md and
  scripts/capture-runtime-baseline.sh to record locked dependency trees,
  per-profile Pingora dependency presence, release metadata, and default
  release-binary size before the runtime cutover work begins.
• Added scripts/capture-runtime-performance-baseline.sh and wired it into
  release-mode runtime baseline capture. It records local startup time, idle
  RSS/file descriptors, static HTTP latency, cache MISS/HIT latency,
  load-balancer route timing, keep-alive throughput, and fresh TLS connection
  timing.
• Added docs/pingora-dependency-exceptions.tsv and
  scripts/validate-pingora-dependency-policy.sh so the 1.6 line has a
  release-gated inventory of allowed Pingora crates per official profile.
• Added docs/runtime-parity-fixtures.md,
  docs/runtime-parity-fixtures.tsv, and
  scripts/validate-runtime-fixtures.sh to pin the smoke scripts, examples,
  and TLS fixtures that define runtime parity before HTTP/cache/LB/TLS
  cutovers begin.
• Added initial fluxheim-runtime and fluxheim-server workspace crates for
  Fluxheim-owned shutdown, background task, listener, and server-runner
  boundary traits. The current Pingora runtime path is unchanged.
• Added typed PolicyEpoch, PolicyProof, RuntimeFact, decision, reason,
  and visibility primitives in fluxheim-runtime for later policy-proof
  adoption. They are not wired into request handling in this release.
• Added docs/extraction-dependency-graph.md to record the intended split
  order for snapshot, protocol, tracing/observability, headers, ACME,
  runtime/server, cache, proxy, and admin modules before the Pingora cutover.
• Added the runtime-facts and policy-proofs planning model. The goal is typed,
  bounded, redacted evidence for Fluxheim decisions such as config promotion,
  route policy, cache admission, load-balancer selection, and admin mutation
  without putting a database in the request path.

Changed

• Updated project version surfaces to 1.6.0.
• Updated documentation language so the 1.5.x line is treated as closed and
  future load-balancer health-check work is no longer described as a later
  1.5.x item.
• Refreshed ROADMAP.md so 1.6.x is consistently documented as the
  Pingora-exit line, shared Wasm extensibility is moved to 1.7, and HTTP/3
  remains after the runtime boundary is stable.
• Hardened scripts/validate-pingora-dependency-policy.sh so documented
  Pingora removal targets are enforced against the current Fluxheim version
  instead of acting as a set-membership inventory only.
• Tightened release-gate scripts by requiring modularity exceptions to be
  listed as structured table rows and by giving the UDP smoke negative
  assertion a longer observation window.

Notes

• This is not yet a Pingora-removal release. It establishes the baseline,
  modularity gate, and security model for the staged 1.6.x migration.
• The legacy modularity exception inventory is intentionally large at the
  start of the line. The purpose is to make oversized files visible and reduce
  them release by release rather than hide the debt.

Checksums And Signatures

• Commit: e7a877c0c5795038b061918cb72ac769ea09b98a
• Local gate: GitHub CI green before tag; local release metadata checks passed
• CodeQL/code scanning: no open release-blocking alerts before tag
• Source archive checksums:
  • b1ad465cc4cf2f974026652463c9a5f9642f5bb00501bae861ce14a8e24290f8 fluxheim-1.6.0.tar.gz
  • b8ea622c0ac422e8cc21653ed3e4f8e75470e63947b7a6f055a91d64b294cbcf fluxheim-1.6.0.zip
• Binary checksums:
  • x86_64:
    • 06e79e0f55f8a1d3eec9706d515eada500dd9467037e1433189b49383806e9ae fluxheim-1.6.0-full-x86_64-linux.tar.gz
    • 9d53b83faa5660a4a076a3f7242af9d8fc7d8e400dfc56f4c560564866571877 fluxheim-1.6.0-cache-x86_64-linux.tar.gz
    • 76fb55f9b92be790a0e0f1b87fc90a1c89ef2c34c7b3b1a7c9bd9e4dc65be760 fluxheim-1.6.0-proxy-x86_64-linux.tar.gz
    • 84a560583c989729141f395c62861b6c2c539a54f11f2be7f9afa37dbd8d2046 fluxheim-1.6.0-php-x86_64-linux.tar.gz
    • b95a1287dd4f75249de5acca81a5ba32198c9b8aa9fd7e00e3a25f66f216657d fluxheim-1.6.0-load-balancer-x86_64-linux.tar.gz
    • a79d6314494a79904dfec8303b687469714de0314b0ce1e1fc65ffedeb442b23 fluxheim-1.6.0-config-tester-x86_64-linux.tar.gz
  • aarch64:
    • 400a0052eab623d18648737ecf2b040784c277634ade69c5c39c48eaf8f5bf2a fluxheim-1.6.0-full-aarch64-linux.tar.gz
    • c93641096cdc73b1dfa51befe3c546d9360ad68e382fcc6b921b3753812f5a68 fluxheim-1.6.0-cache-aarch64-linux.tar.gz
    • 3e75cd88746dcf5f49a5ef54c0dce1b4f6253aa87afa424197b9f8940252933a fluxheim-1.6.0-proxy-aarch64-linux.tar.gz
    • ac5dfb98ad9899acafeaf32507ad14fef00fd09e1e49845b85a26107372b293a fluxheim-1.6.0-php-aarch64-linux.tar.gz
    • a9d8c920e89b42d606956b21951864fb2d83328f86fb93c05f2b8550d0cd690b fluxheim-1.6.0-load-balancer-aarch64-linux.tar.gz
    • 01048c9c8c42d4f59690de54f58e0ff419060646be1ee76681f65006f27b5d86 fluxheim-1.6.0-config-tester-aarch64-linux.tar.gz
  • macos:
    • 54cf354be32f54f8bdc6af45330749bbbcd183db32d992922b29e1bdd0bcdb09 fluxheim-1.6.0-dev-aarch64-macos.tar.gz
• SBOM checksums:
  • 9e35709c936277d9215df6ba99f008a70fee7380ee8691c04a26307e83ebfb3e fluxheim.spdx.json
  • c7c50c3f6a175da9169d67f4e18abeed645dfdc6639633282659acdd2fac18ee fluxheim.cyclonedx.json
• Reproducible build:
  • be9bf213c90d99751102edba6c5a280aa61407cf936a5cf5f8640e3863a3467a x86_64
  • 869eaea4d8923417185d5c76037870921dd221984a164bfadef06c85f7b5acec aarch64
  • 1752b5ab8ed9dceb592899449aee5440ff1ad73772869338dddb2a2ba1c9ada1 macos
• Full Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:4c6862453e272acae0f554566d697adaaf6aa85d6f17bea928eeec44bd5c2f34
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:076ff3e24df120075b5778c63888ba2ca4370bbde890789f6e19b7c6ebec551e
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:18c7798e227d36b751b52014341c0a5d3563393e8e0778e65cd6505de50f1280
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:10e999b52b6d17d39d03429a70933046780c4c8121bf85b9d376769fca614814
• Cache Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:75f2845a1477ce83d67a09688e66d6735ffca9681ee955b6ab96d18b9ec152bf
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:999cf2a1c057f40709920210068a2aabcd537f48d556b878550d6ae5594adc33
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:7dd894d3d986db530a4a3757219abc2b7c6490a1f16152ae67e4d0b600080fb4
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:1c9d946730eaa79f2b147c570690779222ca130fce894dd6dbaf40a09000d719
• Proxy Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:26906c17a0137414959cfd7229eb9fa75d7ccdbd6e214add856799ef93c3e333
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:74db31fa8d36f9669befb87321abd5c71a31232355c4c8ae62c41f43419950dd
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:61f65b0969861b7c8bb115aab0db42cb99c32410eb269bf8046e196c1fcd5e92
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:140b43f59d748985a0e47d2df539ecf4898726bc247a2a872830ab1e606f4c04
• PHP Build Container digests:
  • Wolfi: ghcr.io/valkyoth/fluxheim@sha256:6172dc9d37e50167c576eceaf828369c2a03683e869eaa6b3d18c5207998f554
  • Alpine: ghcr.io/valkyoth/fluxheim@sha256:2cf37a853e712c444f6747f33f17d5516c69f900c0ff994cd7761087bd70deda
  • SUSE Micro: ghcr.io/valkyoth/fluxheim@sha256:1adefe8bd370790bc868e5930fc325c565de5b013e12284e30f6297e8c013732
  • Debian: ghcr.io/valkyoth/fluxheim@sha256:3ab02af49fe41092aa0878100daae8bb0aea9e6853bdfd071b13457ed8f52165
• Tag signature:
  • Good "git" signature for 1921261+eldryoth@users.noreply.github.com with ED25519 key SHA256:EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4

---

This discussion was created from the release Fluxheim 1.6.0.