v0.8.0

Changed

• A startup warning when server.alpn does not offer h3. The key stays legal for interop debugging, but a list without h3 starts a server every client fails against with no_application_protocol, so warnings() now names the configured list at startup instead of leaving handshake errors as the only trace.
• A reload that ignores a changed server.listen now says so. SIGHUP cannot move the listening socket; when the reloaded file names a different address the server logs one warning with the bound and configured addresses rather than staying silent.
• Release tarballs carry docs/. Both scripts point the operator at docs/configuration.md or docs/deployment.md at the moment they refuse an install, so the pages now travel with the binary; the release workflow also refuses to publish a tag whose commit has no successful CI run.
• The installer names --binary when the binary is not where it looked, so an operator working from a release tarball is told the flag instead of being sent to cargo build.
• Release builds use fat LTO with one codegen unit. Measured on Linux against the default profile: the stripped binary is 11.5% smaller and a 64-byte datagram (the shape of a DNS query through the tunnel) costs 13-17% less CPU each way; MTU-sized datagrams and bulk TCP move 2-8%. The release link takes about a minute longer; nothing else changes.
• Refactor batch, behaviour unchanged. tunnel/mod.rs is split into status.rs (RFC 9209 vocabulary and the response helpers) and quota.rs; the per-connection Context is held in an Arc; the at-capacity admission decision, the closing log line and the GOAWAY handling are named functions instead of select! arms; the buffered HTTP/3 frame types are an enum so the frame parser is exhaustive and its last unreachable! is gone; four copies of the bounded-response match are one helper; MAX_VARINT is VARINT_MAX_LEN.

Fixed

• The max_streams_bidi ceiling's error message still described the credit as paid at every handshake; since the pre-authentication clamp it is granted once, by a connection's first authenticated request, which is what the message says now.
• docs/configuration.md documented the compiled-in MTU defaults while every install runs above them (initial_mtu = 1242, mtu_upper_bound = 1464 from the shipped example); the doc now says so, in the same shape as the existing initial_rtt_ms note.
• docs/deployment.md leads with the release tarball: download URL shape and the two supported targets, sha256sum --ignore-missing -c SHA256SUMS (a plain -c fails because the file lists both architectures), the prerequisites a stock Ubuntu 24.04 image has and lacks, a conditional firewall line, the one-sentence rollback rule for releases before v0.4.5, and the -c / --binary flags that existed only in --help.
• docs/architecture.md names the QPACK/Huffman differential oracle as the third independent judge of the in-tree codec.

Testing

• New CI gates: shellcheck over script/*.sh; clippy with --all-features; the mirrored build step in cross.yml and release.yml is asserted equal by a test and editing either file runs the cross-build; the docs/ copy in the tarball is asserted; the fuzz targets are type-checked on stable with --locked; the fuzz and root manifests are asserted to pin the same quinn-proto revision.
• Operator-only test binaries are behind the operator-runs feature (it_bench, it_resolver_pool): cargo test no longer links them to run nothing, and naming one without the feature is an error rather than an empty pass.
• The shipped example configuration is pinned to the defaults it documents: every optional key is uncommented and compared field by field, the key set per section is asserted, and the three intended deviations are listed so a fourth cannot slip in.
• The fuzz lockfile is asserted to record the crate's current version, after the v0.8.0 bump itself tripped the new --locked fuzz job in CI; the installer's port range check is written as an if so the runner's older shellcheck stops reporting SC2015.
• it_auth_log scopes each credential assertion to its own scenario; the last cross-file test scaffolding is collected into tests/common/; the narrowest timing bound in the suite now has the same 2.5x margin as its neighbours.
• fuzz/ moves to edition 2024 with a refreshed lockfile (the current crate version, aws-lc-rs, no ring in any shipped target's graph) and the eight targets were run against the corpus: zero crashes.
• Cross-implementation interop (masque-go + aioquic) and the full suite were re-run against this tree before tagging, both green with a clean server log.

---

Static musl builds for x86_64 and aarch64. Verify with SHA256SUMS.

Each archive carries the binary, LICENSE, README.md and the script/ and docs/ directories, so the self-signed installer runs straight out of it — and so does the documentation it refers you to:

tar xzf volto-*-x86_64-unknown-linux-musl.tar.gz
cd volto-*-x86_64-unknown-linux-musl
sudo script/install-selfsigned.sh --binary ./volto

Or skip the manual download entirely: script/deploy.sh fetches the newest release itself, verifies it against SHA256SUMS and installs or updates in place — with --enable-timer it keeps the host on the latest release with a daily systemd timer. It bootstraps a bare host in one line:

curl -fsSL https://raw.githubusercontent.com/vcarus/volto/main/script/deploy.sh | sudo bash -s -- --enable-timer

Full Changelog: v0.7.0...v0.8.0