wgcloak/docs/DEVELOPMENT_STATE.md

Development state

Checkpoint: 2026-09-14, end of day. Development is paused at a compilable checkpoint; no commit was made.

Branch and worktree

• Branch: main.
• git status --short reports the project files as untracked, including Cargo.toml, Cargo.lock, src/, tests/, documentation, examples, and packaging files. There is no useful committed baseline to compare against in this checkout.
• Multiple agents have been working in the shared directory. Review all diffs and ownership boundaries before committing; in particular, do not assume an untracked file was created by this task or that a concurrent edit is final.

Implemented and wired behavior

The current tree contains the following work, subject to integration review:

• Operational assets: MIT LICENSE, Linux-focused README.md, .gitignore, client/server TOML examples, architecture/protocol/security/operations/ troubleshooting documents, an implementation checklist, and systemd client and server templates.
• TLS/TCP transport primitives in src/transport/tls_tcp.rs: bounded incremental/coalesced u16-big-endian framing, truncated/oversized-frame handling, PEM/DER certificate and private-key loading, challenge-response authentication, authenticated data/heartbeat/close framing, idle timeout, and bounded shutdown.
• HTTP/3 support primitives in src/transport/http3.rs: CONNECT-UDP request validation, QUIC varints, RFC 9297 HTTP Datagram context encoding, capsule encoding, and project authentication messages. The module does not fake CONNECT-UDP with POST or ordinary streams.
• Runtime orchestration in src/transport/mod.rs, src/client/mod.rs, and src/server/mod.rs instantiates direct UDP, QUIC, and TLS/TCP connectors or listeners. TLS backend creation occurs after the authenticated session is established. HTTP/3 currently returns an explicit Unsupported result from runtime selection because the actual h3 datagram adapter is not complete.
• The client and server start the Unix control server. Client reconnect and reload commands currently cause a reconnect attempt; server shutdown is handled by the encrypted listener paths, while direct-UDP/control lifecycle still needs review.
• h3-quinn was enabled with its datagram feature; tokio-rustls and rustls-native-certs were added for TLS runtime integration.

Files changed in this work

Primary files touched by the operations/integration work are:

• Cargo.toml, Cargo.lock
• src/transport/mod.rs
• src/transport/tls_tcp.rs
• src/transport/http3.rs
• src/client/mod.rs
• src/server/mod.rs
• tests/tls_tcp.rs, tests/http3.rs, tests/integration_transports.rs
• .gitignore, LICENSE, README.md
• examples/*, packaging/systemd/*, and the other files under docs/

src/transport/quic.rs was edited by another concurrent agent and is outside the TLS/integration ownership listed above. Preserve that ownership boundary when resolving conflicts.

Verification and current failures

• TOML examples were parsed successfully with Python tomllib.

• TLS/TCP focused tests passed: cargo test --test tls_tcp --quiet (7 tests).

• HTTP/3 focused tests passed: cargo test --test http3 --quiet (4 tests).

• cargo check passed after the transport integration edits.

• The TLS loopback integration test compiles but currently panics while constructing a rustls configuration because no process-level crypto provider is installed:

  Could not automatically determine process-level CryptoProvider from Rustls crate features.

  The runtime/test setup must explicitly install the ring provider (or enable exactly one provider feature) before building rustls configurations.

• The supervisor's latest failure reprobe reports that the QUIC focused tests now pass. Run the complete suite again after fixing the rustls provider; the earlier complete-suite run had QUIC handshake-timeout failures before the concurrent QUIC-agent fixes landed.

• Clippy has not reached a clean result. Existing included test/source modules produce many dead-code and lint diagnostics, and integration code also needs a final lint pass after the provider fix.

Remaining gaps, prioritized

1. Fix and verify explicit rustls crypto-provider initialization, then run the TLS loopback test and the complete test suite.
2. Finish a real h3 0.0.8/h3-quinn 0.0.10 HTTP/3 CONNECT-UDP datagram adapter, or retain the explicit Unsupported path with a precise documented dependency/API blocker. Do not substitute POST, capsules-only streams, or ordinary HTTP request bodies for HTTP Datagrams.
3. Review runtime lifecycle semantics: direct-UDP control shutdown wiring, actual file-backed config reload, client TLS heartbeat scheduling, and authentication-error mapping so auto fallback stops on rejected credentials.
4. Run repository-wide formatting, tests, and clippy; inspect the shared untracked tree and reconcile concurrent quic.rs changes before any commit.

First three tasks tomorrow

1. Install/select the rustls ring provider once at runtime and in the integration test setup; rerun TLS loopback plus cargo test.
2. Inspect the enabled h3-quinn datagram API and implement/test the smallest standards-correct CONNECT-UDP client/server adapter; otherwise record the exact unsupported API/dependency condition in the public docs.
3. Perform an end-to-end lifecycle review and repository-wide fmt, check, test, and clippy pass, resolving only changes within each agent's ownership.