diff --git a/CHANGELOG.md b/CHANGELOG.md index 210e14d5..29617492 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -47,10 +47,17 @@ flag, or page that no existing user can encounter without opting into it. differences alone stay silent; client-only problems do not request a service restart. -- Local-network bootstrap downloads now use separate firewall rules for connected - local networks and the tailnet. Verification recognizes equivalent rule spellings - and reads enforcement evidence correctly; if rules were written but verification - could not finish, the message says so instead of reporting a refused write. +- Bootstrap downloads use separate firewall rules for connected local networks and + the tailnet. The fifth pre-release field window exposed a rule-heavy Windows host + where a redundant query hit the three-second limit before either rule was written. + Elevated admission now verifies and derives any repair from one pre-write census; + NetSecurity operations have a bounded 30-second allowance rather than the short + probe budget. The sixth window then exposed a separate defect: explicitly writing + `-Package Any` left both rules inactive. Bootstrap now omits that package argument + and recognizes enforcement on active profiles without rejecting an inactive + companion profile. Non-OK rules, missing success evidence, and NoLocalUser + remain unverified. A failed post-write verification still says the rules may + already be present. - Unlisted-peer presence checks in endpoint listings use a 2.5-second timeout diff --git a/docs-site/src/changelog.md b/docs-site/src/changelog.md index 99740508..11c33765 100644 --- a/docs-site/src/changelog.md +++ b/docs-site/src/changelog.md @@ -41,10 +41,17 @@ flag, or page that no existing user can encounter without opting into it. compatibility problem affects them, without forcing a disconnection. Version differences alone stay silent; client-only problems do not request a service restart. -- Local-network bootstrap downloads now use separate firewall rules for connected - local networks and the tailnet. Verification recognizes equivalent rule spellings - and reads enforcement evidence correctly; if rules were written but verification - could not finish, the message says so instead of reporting a refused write. +- Bootstrap downloads use separate firewall rules for connected local networks and + the tailnet. The fifth pre-release field window exposed a rule-heavy Windows host + where a redundant query hit the three-second limit before either rule was written. + Elevated admission now verifies and derives any repair from one pre-write census; + NetSecurity operations have a bounded 30-second allowance rather than the short + probe budget. The sixth window then exposed a separate defect: explicitly writing + `-Package Any` left both rules inactive. Bootstrap now omits that package argument + and recognizes enforcement on active profiles without rejecting an inactive + companion profile. Non-OK rules, missing success evidence, and NoLocalUser + remain unverified. A failed post-write verification still says the rules may + already be present. - Unlisted-peer presence checks in endpoint listings use a 2.5-second timeout instead of 10 seconds. A peer that does not answer remains unknown, not offline. Compatibility delta: Workflows recent [{"conclusion":"success","databaseId":34751777743,"headBranch":"main","headSha":"f4e7635cf00063df91062248e1f5458924d0f5c5","status":"completed"},{"conclusion":"success","databaseId":34676423540,"headBranch":"main","headSha":"7cdcf5da6c286cba78f98f026eb10b91e3e3b824","status":"completed"},{"conclusion":"success","databaseId":34676052412,"headBranch":"main","headSha":"f55ea9c76eadd86a835831618d8233462021f12f","status":"completed"},{"conclusion":"success","databaseId":34665283524,"headBranch":"main","headSha":"15460d706f952c0200d140621b09bf1671dc6906","status":"completed"},{"conclusion":"success","databaseId":34664097060,"headBranch":"main","headSha":"9a39e8dabfb70fa96ae674d9205640869522bcb0","status":"completed"},{"conclusion":"success","databaseId":34663033237,"headBranch":"main","headSha":"912c3878c25077247d72fd7a46dc9d8a97172c0a","status":"completed"},{"conclusion":"success","databaseId":34604321383,"headBranch":"main","headSha":"6255cc76c094315b8ae8218e59bd8cd8fef52174","status":"completed"},{"conclusion":"success","databaseId":34603173012,"headBranch":"main","headSha":"b92ec4ec85fcdd53dbd8bdfc79e2505f17820f67","status":"completed"},{"conclusion":"success","databaseId":34600390807,"headBranch":"main","headSha":"c20c9109611fb828d9418d4a9770e505a12e0d6c","status":"completed"},{"conclusion":"success","databaseId":34599213919,"headBranch":"main","headSha":"a8d136110820a20b5ea26b7a6acea165286b84f0","status":"completed"},{"conclusion":"success","databaseId":34594601442,"headBranch":"main","headSha":"4b54a95d22d9b756e0294d2e401b7e35d82ed83d","status":"completed"},{"conclusion":"success","databaseId":34594273673,"headBranch":"main","headSha":"e28bc27de1967e9cb748f1fd0ba881f1309dfb8f","status":"completed"},{"conclusion":"success","databaseId":34589408286,"headBranch":"main","headSha":"6a7dd6b760b01349d343775b58408335c63626d6","status":"completed"},{"conclusion":"success","databaseId":34583826781,"headBranch":"main","headSha":"d80239dfa444e9be4d938c88f010c1b2a7893bad","status":"completed"},{"conclusion":"success","databaseId":34580045779,"headBranch":"main","headSha":"b12d4619ca97999c21e830c15716083e0f9d9487","status":"completed"},{"conclusion":"failure","databaseId":34556292801,"headBranch":"main","headSha":"f020c4c77b6b0496bc84f40aa0cce691c8900ee6","status":"completed"},{"conclusion":"failure","databaseId":34555345283,"headBranch":"main","headSha":"e5a2fed9badcac399e2fb825a1fc035cee981a39","status":"completed"},{"conclusion":"success","databaseId":34550300527,"headBranch":"v0.69.0","headSha":"16df0e41be04ca4614a792f7e70e4d1bdec60b24","status":"completed"},{"conclusion":"failure","databaseId":34550282074,"headBranch":"main","headSha":"16df0e41be04ca4614a792f7e70e4d1bdec60b24","status":"completed"},{"conclusion":"failure","databaseId":34548980458,"headBranch":"assembly/v0.69.0","headSha":"16df0e41be04ca4614a792f7e70e4d1bdec60b24","status":"completed"},{"conclusion":"failure","databaseId":34481993681,"headBranch":"golden/crossnode-294-r2","headSha":"a9e786b24fe4e541dcd394ef428f225d72f3024a","status":"completed"},{"conclusion":"success","databaseId":34474627303,"headBranch":"assembly/v0.69.0","headSha":"a9e786b24fe4e541dcd394ef428f225d72f3024a","status":"completed"},{"conclusion":"failure","databaseId":34467873057,"headBranch":"main","headSha":"de5a44bc338d679f3c63f6d0f68826eb9e575d73","status":"completed"},{"conclusion":"failure","databaseId":34462915181,"headBranch":"diag/294-margins-ci-base","headSha":"1a7f7f5552745103ff4fd4e38ad1a22d35a3ef72","status":"completed"},{"conclusion":"success","databaseId":34460168501,"headBranch":"docs/ir93-95-golden294","headSha":"cd694e096a412d34e8deb68c13f790c1bf2b3459","status":"completed"},{"conclusion":"cancelled","databaseId":34459787065,"headBranch":"docs/ir93-95-golden294","headSha":"c5f6f7fded5a0121aa6a2445634678704324136c","status":"completed"},{"conclusion":"failure","databaseId":34458491560,"headBranch":"diag/294-margins-ci-head","headSha":"1bd0a41d67c0389bea3879bbf18b56763ba0dc1e","status":"completed"},{"conclusion":"success","databaseId":34458392199,"headBranch":"docs/ir93-95-golden294","headSha":"d71e02a50b5ce44bd85a31b9f1247262efe9bf6f","status":"completed"},{"conclusion":"cancelled","databaseId":34457400447,"headBranch":"diag/294-margins-ci-head","headSha":"161eb5543372b92e153a6f568134a59e2ccc075d","status":"completed"},{"conclusion":"cancelled","databaseId":34446095808,"headBranch":"assembly/v0.69.0","headSha":"a9e786b24fe4e541dcd394ef428f225d72f3024a","status":"completed"}]