wgcloak/docs/DEVELOPMENT_STATE.md

Development state

Checkpoint: 2026-09-15 end of day. Branch: main. Latest commit: 586ff8f (checkpoint: integrate authenticated transports). The working tree is clean. Config and client-ID changes are included in this commit. The resumed recovery-only assignments after this commit made no edits.

Implemented behavior

• The package has a reusable Rust library and a thin binary. Integration tests import the library; module unit tests run once in the library test target.
• Client and server runtimes support authenticated direct UDP, QUIC DATAGRAM, HTTP/3 CONNECT-UDP with HTTP Datagrams, and TLS/TCP length-framed fallback. TLS client connections use normal certificate-chain and hostname verification. Shared-secret authentication precedes encrypted server backend-session activation.
• Client auto follows configured order and bounded probes, stops on authentication rejection, and reconnects with jittered 250 ms–30 s backoff. Successful connections reset the backoff. Client control supports explicit reconnect.
• The server runs enabled listeners concurrently, rejects incompatible UDP listener port conflicts, aggregates listener/session statistics, and gives sessions isolated backend UDP sockets. Admission limits cover sessions, per-IP sessions, pending handshakes, and authentication attempts.
• The Unix control socket uses a private runtime directory and mode 0600, refuses an active socket, and removes only a verified stale socket. status, stats, and shutdown are supported; reconnect is client-only. Config and certificate/key reload remain unsupported.
• A client currently tracks one most-recent local UDP application peer, so concurrent local sources can replace the return target. Direct UDP keepalives are one-way; silent peer loss may require explicit reconnect or a local transport error to be noticed.

Verification

The latest full gates passed on commit 586ff8f, including the config and client-ID changes:

• cargo fmt --all -- --check
• cargo check --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo test --all-targets --quiet — 76 tests passed.

The tree was clean at this checkpoint. No uncommitted file inventory applies.

Remaining work, prioritized

1. Add tests/encrypted_runtime.rs for daemon-level QUIC and TLS proof through the client runtime, encrypted transport, server runtime, and UDP echo backend. Cover auth rejection, session independence, control status/stats, and bounded shutdown. Lower-level transport tests are not a substitute.
2. Start fuzzing: fuzz/** and docs/FUZZING.md are unstarted. Cover packet parsers, authentication/framing boundaries, and malformed transport input.
3. Add benchmarks; benchmark targets and baselines are unstarted.
4. Decide a practical maximum datagram-size cap and justify it against transport overhead and MTU constraints; add boundary/config tests.
5. Decide whether config and certificate/key reload are optional or required by the spec/product scope. They are currently unsupported. Finish a final spec-to-implementation audit and update the acceptance checklist with evidence; do not claim unsupported behavior.

First tasks for tomorrow

1. Implement the focused daemon-level QUIC/TLS test in tests/encrypted_runtime.rs, then run cargo test --test encrypted_runtime -- --nocapture.
2. Run the full gate sequence after the test lands: cargo fmt --all -- --check, cargo check --all-targets, cargo clippy --all-targets -- -D warnings, and cargo test --all-targets --quiet.
3. Review the spec checklist, decide the datagram cap and reload scope, and record acceptance evidence plus the unstarted fuzz/benchmark work.