# VPN Runtime Post-Stabilization Next Steps

Date: 2026-05-12
Branch: `main`

## Goal

Provide a minimal operational sequence after pulling the stabilization chain.

## 1. Sync

```bash
git checkout main
git pull --ff-only origin main
```

## 2. Guard Validation

From repository root:

```powershell
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50
```

Windows `cmd` wrapper:

```cmd
scripts\smoke\run-vpnruntime-ci-guards.cmd
```

On UNC workspaces, `cmd.exe` may print a startup UNC warning, but the wrapper
uses `pushd` and still runs guard checks correctly.

Linux/macOS/WSL wrapper:

```bash
./scripts/smoke/run-vpnruntime-ci-guards.sh
```

Wrapper scripts pass arguments through to the PowerShell guard script, for example:

```cmd
scripts\smoke\run-vpnruntime-ci-guards.cmd -AntiFlakeCount 5 -TargetedCount 10 -SkipRace
```

```bash
./scripts/smoke/run-vpnruntime-ci-guards.sh -AntiFlakeCount 5 -TargetedCount 10 -SkipRace
```

Expected:

- all guard steps pass
- no flaky failures in targeted parallel flow-window test

## 3. CI Gate Expectations

`node-agent` workflow path should execute:

- `go test ./...`
- `go test ./internal/vpnruntime -count=20`
- targeted anti-flake test (`-count=50`, timeout `60s`)
- `go test -race ./internal/vpnruntime`
- one-shot guard script

## 4. Development Start Condition

Begin new feature work only when:

- local one-shot guard is PASS
- remote CI pipeline is green on `main`

## 5. If Flake Reappears

Immediate triage sequence:

1. Re-run targeted test locally with higher repeat count (`-count=100`).
2. Re-run one-shot guard script.
3. Capture failing output and update:
   - `docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md`
   - `docs/operations/VPNRUNTIME_STAGE_EXECUTION_2026-05-12.md`