chore: retarget upstream portal-tunnel v2.4.3 #95

Merged

ada merged 3 commits from codex/release-v2.4.3-20260917T064325Z-v2.4.3 into master

2026-09-17 07:37:58 +00:00

ada commented

2026-09-17 07:04:46 +00:00

Collaborator

Summary

retarget the Rust relay to upstream portal-tunnel v2.4.3 (commit 119d143bc1ad4d38e8cf6a427fa89deb9b8fff25)
preserve the original client address across canonical public SNI-to-API handoff
replace persistent/manual IP bans with v2.4.3 weighted source/global pre-auth admission and Retry-After responses
remove legacy IP-ban APIs and migrate banned_ips out of policy.json while preserving identity policy
reject unsupported static relay caching explicitly and retain the v2.4.2-v2.4.0 protocol-9 interoperability window
advance v2.4.3 official-client and Axis B fixture pins

Upstream assessment

tunnel/discovery protocol remains 9
relay-scoped hotfixes affect peer-address preservation, admission control, and IP-ban policy
upstream static cache is documented as unsupported and fails startup when enabled

Checks

cargo fmt --check
cargo test --locked (194 passed, 3 ignored fixture tests)
cargo clippy --locked --all-targets -- -D warnings
Go IVNP helper tests
container tag, Compose, and Axis B harness integrity checks
v2.4.3 IVNP capability compatibility
v2.4.3 Go-issued JWT verification
retained v2.3.8 direct-token compatibility
ARM64 Go/Rust API shape comparison with matched cache capabilities
official v2.4.3 HTTP, lifecycle/restart, TCP, and UDP client smokes on ARM64
Windows GNU target compile check
Forgejo PR CI: running on final head

Release audit trail

dev counter trail: none consumed yet
tagged dev artifact/digest: pending post-merge CI build
live verification: pending
production image/deploy: pending
release note: pending production promotion

Final release attempt

merged revision: 3561a0d5c2
PR and master CI: passed
consumed dev tags: v2.4.3+rs.1-dev.1 through dev.4
dev.4 Axis A: passed for v2.4.3, v2.4.2, v2.4.1, v2.4.0
dev.4 Axis B: public fixture endpoint failed before any Rust-middle bridge evidence; logs preserved
production tag/image: not created
production state: rolled back to v2.4.2+rs.1 with v2.4.2 clients

## Summary - retarget the Rust relay to upstream portal-tunnel v2.4.3 (commit 119d143bc1ad4d38e8cf6a427fa89deb9b8fff25) - preserve the original client address across canonical public SNI-to-API handoff - replace persistent/manual IP bans with v2.4.3 weighted source/global pre-auth admission and Retry-After responses - remove legacy IP-ban APIs and migrate banned_ips out of policy.json while preserving identity policy - reject unsupported static relay caching explicitly and retain the v2.4.2-v2.4.0 protocol-9 interoperability window - advance v2.4.3 official-client and Axis B fixture pins ## Upstream assessment - tunnel/discovery protocol remains 9 - relay-scoped hotfixes affect peer-address preservation, admission control, and IP-ban policy - upstream static cache is documented as unsupported and fails startup when enabled ## Checks - cargo fmt --check - cargo test --locked (194 passed, 3 ignored fixture tests) - cargo clippy --locked --all-targets -- -D warnings - Go IVNP helper tests - container tag, Compose, and Axis B harness integrity checks - v2.4.3 IVNP capability compatibility - v2.4.3 Go-issued JWT verification - retained v2.3.8 direct-token compatibility - ARM64 Go/Rust API shape comparison with matched cache capabilities - official v2.4.3 HTTP, lifecycle/restart, TCP, and UDP client smokes on ARM64 - Windows GNU target compile check - Forgejo PR CI: running on final head ## Release audit trail - dev counter trail: none consumed yet - tagged dev artifact/digest: pending post-merge CI build - live verification: pending - production image/deploy: pending - release note: pending production promotion ## Final release attempt - merged revision: 3561a0d5c230b75c9d7d2f71c0ab4af858345b14 - PR and master CI: passed - consumed dev tags: v2.4.3+rs.1-dev.1 through dev.4 - dev.4 Axis A: passed for v2.4.3, v2.4.2, v2.4.1, v2.4.0 - dev.4 Axis B: public fixture endpoint failed before any Rust-middle bridge evidence; logs preserved - production tag/image: not created - production state: rolled back to v2.4.2+rs.1 with v2.4.2 clients

ada added 1 commit

2026-09-17 07:04:46 +00:00