CFPP unified 0.8.0-rc1 candidate - verification report
Date: 2026-10-12
Workstation: macOS ARM64. Go 1.24.13.

EXECUTED AND PASSED
- go test ./...
- go test -race ./...
- go vet ./...
- Python unittest discovery: 70 tests, 54.891 seconds, OK.
  Coverage: topology planner26, Docker route helpers18, reconcile20,
  controller rollout6 (HUP/INT/TERM additionally tested as subcases).
- Controller tests execute the transaction body and generated rollback inside a
  relocated temporary tree with external system commands stubbed. No production
  directories/services are used. Timer stop failure refuses replacement; successful
  update retains config/daemon; command and explicit failures/signals roll back.
- Reconcile tests include process-group SIGTERM after a route mutation, ownership,
  stale topology, foreign routes, missing hooks, config fingerprint changes,
  local Docker context, and route/inventory restoration.
- Static CGO_ENABLED=0 Linux/amd64 builds: ELF x86-64, statically linked.
- Directory, flat-online-template and embedded one-file package verification.
- Archive integrity, checksums, online file lists, configurable ceilings,
  payload contents, rendered JSON, helper Bash syntax and documentation links.
- Release tar owners normalized to uid/gid0; no macOS owner IDs are required.

NOT EXECUTED / NOT CERTIFIED
- The new Linux kernel network namespace tests cannot run on macOS.
- Actual Docker daemon / CF high-defense upstream paths and customer login.
- Linux distro/version, kernel, iptables-legacy/iptables-nft backend matrix.
- Full live systemd install/uninstall/rollback on actual Linux hosts.
- Strict rp_filter and asymmetric/multiple-uplink return-path validation.
- Performance/load/memory tests at configured ceilings.
- Windows full transparent mode, IPv6, UDP/QUIC, PPv2, Kubernetes/CNI,
  rootless/overlay/macvlan/ipvlan, and native Docker nftables support.

The user's earlier rc2 transcript showed its private Docker-route test and
network-only upgrade passed. That is historical evidence for rc2, not execution
of this v0.8.0-rc1 test suite and not proof of the customer's application login.

Release status: local built and packaged candidate, NOT production-certified.
No customer server or public download endpoint was changed during this build.
The existing-install path upgrades helpers while retaining the old running
daemon/configuration; it does not migrate daemon capabilities or IP/NIC scope.

Primary reference material (implementation confidence is still test-dependent):
https://developers.cloudflare.com/spectrum/how-to/enable-proxy-protocol/
https://docs.docker.com/engine/network/firewall-iptables/
https://github.com/systemd/systemd/blob/main/man/systemd.exec.xml
