# Current Implementation Status

Date: 2026-04-28

This is the current operational status for Codex continuation. It supersedes
older prompt fragments that still describe platform-core v2, WebSocket takeover
proof, or basic Windows client work as future tasks.

## Project Identity

The project is a Secure Access Fabric platform.

Current implementation focus:

- RDP work is paused by product decision
- preserve RDP as the first proven service baseline
- keep the C++ RDP Adapter as the active runtime when RDP work resumes
- RDP-Perf-6 dirty-region direct binary rendering is completed and
  build/probe/live-smoke-proven
- Product model clarified: Remote Server/Desktop Access is one managed product
  service. RDP/VNC/SSH are internal adapters selected by organization resource
  protocol, not separate organization-facing cluster services.
- preserve the proven backend/session/worker lifecycle
- preserve direct worker WSS and backend gateway fallback
- Stage C10 Fabric Core documentation consolidation and scoped cluster
  configuration distribution design is completed.
- Stage C11 signed scoped cluster snapshot model is completed.
- Stage C12 node local state store is completed.
- Stage C13 Fabric Storage / Config Storage service foundation is completed.
- Stage C14 peer directory and cache model is completed.
- Stage C15 Fabric Routing Engine skeleton is completed.
- Stage C16 secure node-to-node channel lifecycle is completed.
- Stage C17 planning is completed.
- Stage C17A synthetic mesh runtime skeleton is implemented and test-proven.
- Stage C17B route health and failover probe skeleton is implemented and
  test-proven.
- Stage C17C relay semantic hardening skeleton is implemented and test-proven.
- Stage C17D non-production synthetic test-service path experiment is
  implemented and test-proven.
- Stage C17E live node-to-node synthetic HTTP transport skeleton is
  implemented, build-proven, and smoke-proven. It remains disabled by default
  and carries synthetic traffic only.
- Stage C17F scoped synthetic peer/route config loading and route-health
  reporting is implemented, build-proven, and smoke-proven. It remains
  synthetic-only and does not enable production mesh traffic.
- Stage C17G Control Plane scoped synthetic config read boundary is
  implemented and backend/node-agent-test-proven. It remains synthetic-only and
  does not enable production mesh traffic.
- Stage C17H deployed multi-agent synthetic config smoke is implemented and
  runtime-proven on `docker-test`. Five running `rap-node-agent` containers
  consume backend-issued node-scoped synthetic config, direct and single-relay
  synthetic route-health observations return to the Control Plane, and
  production forwarding remains disabled.
- Stage C17I production forwarding gate foundation is implemented and
  test-proven. `rap-node-agent` now has an explicit
  `RAP_MESH_PRODUCTION_FORWARDING_ENABLED` gate, but `/mesh/v1/forward` still
  does not forward production payloads without a later approved runtime stage.
- Stage C17J production envelope contract is implemented and test-proven.
  `/mesh/v1/forward` validates route-bound production envelopes when the gate
  is enabled, accepts only `fabric_control` / `fabric.control` for this stage,
  rejects service channels, and still does not forward payloads.
- Stage C17K production envelope observation is implemented and test-proven.
  Valid production envelopes can be observed locally as metadata-only records
  after validation; rejected envelopes are not observed, observation failure
  fails closed, and payloads are still not forwarded.
- Stage C17L bounded production observation sink is implemented and
  test-proven. Accepted metadata-only production envelope observations can be
  retained locally with fixed capacity and oldest-entry drop behavior; payload
  bodies are not stored and payloads are still not forwarded.
- Stage C17M production observation sink wiring is implemented and
  test-proven. `rap-node-agent` can wire the bounded local metadata-only sink
  when `RAP_MESH_PRODUCTION_OBSERVATION_SINK_CAPACITY` is explicitly greater
  than zero; the wiring is disabled by default, exposes no read API, stores no
  payload bodies, and payloads are still not forwarded.
- Stage C17N production observation sink metrics are implemented and
  test-proven. Local sink metrics expose only capacity, current depth, accepted
  total, and dropped-oldest total; they expose no observation records, route
  IDs, message IDs, hashes, payload metadata, or payload bodies.
- Stage C17O production observation sink local metrics logging is implemented
  and test-proven. `rap-node-agent` logs aggregate sink metrics locally when
  the sink is explicitly enabled; this adds no read API, no Control Plane
  reporting, no payload storage, and no forwarding.
- Stage C17P production observation sink change-driven metrics logging is
  implemented and test-proven. `rap-node-agent` suppresses repeated identical
  local sink metrics logs; this adds no read API, no Control Plane reporting,
  no payload storage, and no forwarding.
- Stage C17Q production forwarding gate/runtime log boundary is implemented
  and test-proven. `rap-node-agent` logs production forwarding gate state
  separately from production forwarding runtime state; runtime state remains
  false and forwarding remains unavailable.
- Stage C17R production observation sink capacity guard is implemented and
  test-proven. `RAP_MESH_PRODUCTION_OBSERVATION_SINK_CAPACITY` remains
  disabled by default, rejects negative values, and rejects values above
  `10000`.
- Stage C17S production observation panic fail-closed hardening is implemented
  and test-proven. Observer errors and observer panics both fail closed as
  observation failure; forwarding remains unavailable.
- Stage C17T production envelope payload boundary is implemented and
  test-proven. Validated production `fabric.control` envelope payloads are
  bounded to `4096` bytes, and oversized envelopes are rejected before
  observation.
- Stage C17U production envelope created-at skew boundary is implemented and
  test-proven. Validated production `fabric.control` envelopes whose
  `created_at` is more than one minute in the future are rejected before
  observation.
- Stage C17V peer endpoint candidate model and NAT/connectivity hints are
  implemented and test-proven. Node-scoped synthetic mesh config now carries
  route-scoped endpoint candidates with transport, address, reachability, NAT
  type, connectivity mode, priority, policy tags, verification time, and
  metadata. This does not implement production route scoring, NAT traversal,
  shortcut routing, or forwarding runtime.
- Stage C17W peer endpoint candidate scoring model is implemented and
  test-proven. `rap-node-agent` can deterministically rank already-scoped
  endpoint candidates using soft inputs, but this does not open connections,
  choose production routes, or forward payloads.
- Stage C17X health-aware endpoint candidate scoring overlay is implemented
  and test-proven. Candidate scoring can optionally use local health
  observations keyed by `endpoint_id`, including latency, success/failure
  history, recent failure reason, reliability score, and observation freshness.
  This remains advisory scoring only.
- Stage C17Y Platform Owner synthetic mesh visibility is implemented and
  build/test-proven. `web-admin` now reads node-scoped synthetic mesh config
  and shows config enabled state, route counts, peer endpoints, endpoint
  candidates, C17X advisory scoring boundary, and `production_forwarding`.
  This remains platform-owner visibility only and does not enable production
  forwarding.
- Stage C17Z production fabric-control direct forwarding boundary is
  implemented and test-proven. `/mesh/v1/forward` no longer always returns
  unavailable after validation: when the explicit production gate is enabled,
  it can deliver valid route-bound `fabric.control` envelopes at the local
  destination or forward them to a direct next hop from explicit peer endpoint
  config. Service channels, arbitrary relay forwarding, multi-hop production
  route execution, and RDP/VPN/file/video/service workload traffic remain out
  of scope.
- Stage C17Z1 production fabric-control multi-hop route-path boundary is
  implemented and test-proven. Production `fabric.control` envelopes can carry
  `route_path` and `visited_node_ids`; relay nodes validate path position,
  forward only to the next path node, update TTL/hop/visited metadata, and
  reject loops. Service payloads remain unavailable.
- Stage C17Z2 production fabric-control forwarding observability boundary is
  implemented and test-proven. Node-agent now emits local
  `mesh_production_forward_event` logs for accepted, forwarded, delivered, and
  rejected production `fabric.control` envelopes. Logs are metadata-only and
  include no payload bodies, no read API, and no Control Plane reporting.
- Stage C17Z3 production fabric-control route-config boundary is implemented
  and test-proven. When scoped/control-plane mesh routes are available locally,
  production `fabric.control` envelopes must match configured route_id,
  cluster, source, destination, route path, next hop, allowed channel, expiry,
  max TTL, and max hop count before forwarding. Service payloads remain
  unavailable.
- Stage C17Z4 scoped peer directory and recovery seeds boundary is implemented
  and test/build-proven. Node-scoped mesh config now carries scoped
  `peer_directory` and explicit bounded `recovery_seeds`; node-agent parses and
  validates them, and Platform Owner Control Panel shows peer-directory/recovery
  seed counts. This does not implement connection management, NAT traversal,
  dynamic endpoint reporting, or service traffic.
- Stage C17Z5 node-agent peer cache runtime boundary is implemented and
  test-proven. Node-agent now builds a node-local `PeerCache` from scoped peer
  directory, recovery seeds, endpoints, endpoint candidates, and routes; selects
  a bounded warm peer set; probes warm peers through `/mesh/v1/health` when
  synthetic mesh testing is enabled; and reports metadata-only mesh-link
  observations. This does not implement a persistent connection manager,
  NAT traversal, dynamic endpoint reporting, or service payload forwarding.
- Stage C17Z6 dynamic endpoint reporting boundary is implemented and
  test-proven. Node-agent can report an explicit advertised mesh endpoint in
  heartbeat metadata, and Control Plane projects latest reported peer endpoints
  and candidates into node-scoped synthetic mesh config. This does not implement
  automatic public IP discovery, STUN/TURN/ICE NAT classification, persistent
  connection management, or service payload forwarding.
- Stage C17Z7 private/corporate endpoint candidate boundary is implemented and
  test-proven. Node-agent can report multiple advertised endpoint candidates,
  including private/corporate LAN candidates; scoring rewards `private-lan`,
  `corp-lan`, and `same-site`; and peer cache can select the best candidate
  address for warm-peer health. This does not implement automatic subnet
  discovery, persistent connection management, or service payload forwarding.
- Stage C17Z8 peer connection state machine boundary is implemented and
  test-proven. Node-agent now tracks warm-peer connection states
  (`disconnected`, `connecting`, `ready`, `degraded`, `backoff`), transitions
  on warm-peer health probes, applies bounded backoff after repeated failures,
  and reports metadata-only connection state in mesh-link observations. This
  does not implement persistent data-plane sockets or service payload
  forwarding.
- Stage C17Z9 peer recovery planner boundary is implemented and test-proven.
  Node-agent now plans a bounded stable ready-peer set, enters recovery mode
  when ready peers fall below target, selects bounded recovery probe
  candidates from warm peers, recovery seeds, and other connectable scoped
  peers, and reports metadata-only recovery state in heartbeat and mesh-link
  observations. This does not implement persistent data-plane sockets, NAT
  traversal, relay/rendezvous runtime, or service payload forwarding.
- Stage C17Z10 peer connection intent planner boundary is implemented and
  test-proven. Node-agent now classifies bounded peer work as maintain/probe/
  recover and classifies transport readiness as direct, private LAN,
  corporate LAN, outbound-only, or relay-required, with rendezvous-required
  metadata in heartbeat and mesh-link observations. This does not implement
  persistent data-plane sockets, STUN/TURN/ICE, NAT traversal,
  relay/rendezvous runtime, or service payload forwarding.
- Stage C17Z11 peer connection manager runtime boundary is implemented and
  test-proven. Node-agent now uses a reusable HTTP keep-alive client to perform
  real control-plane health probes for direct/private/corporate peers selected
  by connection intents, updates shared peer connection state, records
  `waiting_rendezvous` for outbound-only/relay-required peers, and reports
  metadata-only manager cycle state. This does not implement STUN/TURN/ICE,
  relay/rendezvous runtime, route leases, VPN runtime, or service payload
  forwarding.
- Stage C17Z12 rendezvous/relay control-plane contract is implemented and
  docker-test-runtime-proven. Backend now issues node-scoped
  `rendezvous_leases` in synthetic mesh config, including explicit
  route-policy leases and derived leases for outbound-only or relay-required
  candidates when a route has a reachable HTTP relay control endpoint.
  Node-agent consumes those leases, resolves matching `waiting_rendezvous`
  intents into `relay_control`, probes relay `/mesh/v1/health`, records and
  maintains `relay_ready` for the peer control path, and reports manager
  metadata. This remains control-plane health only and does not enable
  RDP/VPN/service payload forwarding, arbitrary relay packet forwarding,
  STUN/TURN/ICE, or host network changes.
- Stage C17Z13 rendezvous lease telemetry is implemented and
  docker-test-runtime-proven. Node-agent heartbeat now emits
  `mesh_rendezvous_lease_report` with schema
  `c17z13.mesh_rendezvous_lease_report.v1`, local role
  (`relay`, `peer`, or `entry_or_observer`), relay admission, peer admission,
  TTL/renewal posture, `relay_ready`, and explicit no-payload boundary flags.
  Web-admin recent heartbeat tables show `rv leases`. This remains
  control-plane telemetry only and does not enable RDP/VPN/service payload
  forwarding, arbitrary relay packet forwarding, STUN/TURN/ICE, or host
  network changes.
- Stage C17Z14 rendezvous lease refresh contract is implemented and
  docker-test-runtime-proven. Node-agent refreshes renewal-needed, expired,
  invalid, or stale relay leases through the existing node-scoped synthetic
  config endpoint, reloads peer cache/leases/routes into the running synthetic
  mesh runtime, and reports `c17z14.mesh_rendezvous_lease_report.v1` with
  refresh counters plus stale relay withdrawal/reselection telemetry. This
  remains control-plane health only and does not enable RDP/VPN/service
  payload forwarding, arbitrary relay packet forwarding, STUN/TURN/ICE, or
  host network changes.
- Stage C17Z15 backend relay replacement policy is implemented and
  docker-test-runtime-proven. Backend reads recent
  `mesh_rendezvous_lease_report` stale-relay feedback, withdraws stale
  explicit rendezvous leases from node-scoped synthetic config, scores
  alternate relay candidates using route adjacency, endpoint priority,
  policy tags, and recent mesh-link health, and returns a replacement lease
  plus `rendezvous_relay_policy` decisions in `c17z15.synthetic.v1`.
  Node-agent reports `c17z15.mesh_rendezvous_lease_report.v1`, advertises the
  relay replacement contract capability, and keeps stale state bound to the
  exact lease/relay instead of smearing it across alternate leases for the same
  peer. This remains control-plane health only and does not enable
  RDP/VPN/service payload forwarding, arbitrary relay packet forwarding,
  STUN/TURN/ICE, or host network changes.
- Stage C17Z16 route/path decision artifact is implemented and
  docker-test-runtime-proven. Backend synthetic config now uses
  `c17z16.synthetic.v1` and includes `route_path_decisions` with original hops,
  effective hops, local previous/next hop, selected replacement relay,
  generation, score reasons, and explicit control-plane/no-payload flags.
  Node-agent stores the control-plane route generation and reports
  `c17z16.mesh_route_path_decision_report.v1` alongside
  `c17z16.mesh_rendezvous_lease_report.v1`. This remains route metadata only
  and does not enable RDP/VPN/service payload forwarding, arbitrary relay
  packet forwarding, STUN/TURN/ICE, or host network changes.
- Stage C17Z17 node-side route generation tracker is implemented and
  docker-test-runtime-proven. Backend synthetic config now uses
  `c17z17.synthetic.v1`; node-agent tracks Control Plane
  `route_path_decisions` apply/unchanged/withdraw transitions and reports
  `c17z17.mesh_route_generation_report.v1` alongside
  `c17z17.mesh_route_path_decision_report.v1` and
  `c17z17.mesh_rendezvous_lease_report.v1`. A first-observed
  `stale_relay_replacement` still emits a `withdrawn_by_replacement` record
  for the old stale relay path. This remains route metadata/control-plane
  health only and does not enable RDP/VPN/service payload forwarding,
  arbitrary relay packet forwarding, STUN/TURN/ICE, or host network changes.
- Stage C17Z18 synthetic route-health effective path runtime is implemented
  and docker-test-runtime-proven. Backend synthetic config now uses
  `c17z18.synthetic.v1`; node-agent refreshes Control Plane route decisions
  into a separate route-health route config, probes the selected effective
  path through the replacement relay, and reports
  `c17z18.mesh_route_health_config_report.v1` plus route-health observations
  with expected/observed hops and drift state. Backend latest mesh links now
  preserve `synthetic_route_health` separately from peer connection-manager
  observations, and web-admin shows route-health rows. This remains synthetic
  route-health/control-plane only and does not enable RDP/VPN/service payload
  forwarding, arbitrary relay packet forwarding, STUN/TURN/ICE, or host
  network changes.
- Stage C17Z19 synthetic route-health feedback scoring is implemented and
  docker-test-runtime-proven. Backend now consumes recent
  `synthetic_route_health` observations in the relay scoring loop: drift,
  unreachable status, or failure metadata can mark the exact selected relay
  stale and trigger replacement, while healthy low-latency route-health boosts
  alternate relay scoring. Node-agent route-health observations include
  rendezvous peer/lease metadata, migration `000022` adds the `synthetic`
  mesh service class, and web-admin marks relay policy `rh feedback`. This
  remains synthetic/control-plane only and does not enable RDP/VPN/service
  payload forwarding, arbitrary relay packet forwarding, STUN/TURN/ICE, or
  host network changes.
- Stage C17Z20 node-side route-health feedback refresh is implemented and
  docker-test-runtime-proven. After node-agent reports synthetic route-health
  drift, unreachable status, or failure metadata, it schedules a bounded
  node-scoped synthetic-config refresh, applies returned replacement route
  decisions to route-health config immediately, and reports
  `c17z20.mesh_route_health_feedback_refresh_report.v1` with attempt,
  success, failure, and suppressed-repeat counters. Web-admin route-health
  heartbeat summary now shows feedback refresh counters. This remains
  synthetic/control-plane only and does not enable RDP/VPN/service payload
  forwarding, arbitrary relay packet forwarding, STUN/TURN/ICE, or host
  network changes.
- Installation Authority foundation is implemented and backend/web-build
  verified. Production config now requires `INSTALLATION_AUTHORITY_MODE=strict`
  with a Product Root Ed25519 public key. First-owner bootstrap accepts signed
  activation manifests, stores installation authority and signed
  `platform_role_grants`, and strict platform-admin checks ignore direct
  PostgreSQL `users.platform_role` edits unless a valid grant exists. Web-admin
  shows installation status and first-owner bootstrap; dev/legacy SQL seed
  compatibility remains explicit and gated by
  `INSTALLATION_INSECURE_BOOTSTRAP_ENABLED`.
- Cluster Authority foundation is implemented and backend/agent/web-build plus
  docker-test lifecycle-smoke verified. Clusters now have Ed25519 authority
  keys, join-token scope material is signed, node approval/bootstrap material
  is signed, and Control Plane synthetic mesh config snapshots include a
  signed hash envelope with `authority_required=true`. Cluster authority
  private keys are encrypted at rest when `SECRET_ENCRYPTION_KEY_B64`/file is
  configured. `rap-node-agent` verifies signed Control Plane synthetic config
  and supports pinned authority public key/fingerprint through env or identity
  state. Web-admin shows cluster authority fingerprints in summaries,
  join-token output, approval rows, and synthetic config visibility. The
  docker-test run `dev-bootstrap-20260428-201430` proved fresh dev cluster
  creation, signed join token, real node-agent enrollment, platform-owner
  approval, automatic signed bootstrap polling, authority pin persistence,
  heartbeat, and signed synthetic-config verification. This is a control-plane
  trust contract only; it does not enable RDP/VPN/service payload forwarding or
  production relay packet forwarding.
- Node enrollment bootstrap polling is implemented and backend/agent-test plus
  docker-test lifecycle-smoke verified. After enrollment, `rap-node-agent`
  stores `pending_join_request_id`, polls
  `/node-agents/enrollments/{requestID}/bootstrap`, verifies the signed
  approval/bootstrap contract, and persists the approved `node_id`,
  `identity_status`, and cluster authority pin into `identity.json`. Polling is
  controlled by `RAP_ENROLLMENT_POLL_INTERVAL_SECONDS` and
  `RAP_ENROLLMENT_POLL_TIMEOUT_SECONDS`.
- Migration `000021_cluster_authority_keys` was hardened after the fresh
  docker-test replay found that PostgreSQL cannot change the
  `cluster_admin_summaries` view layout through `CREATE OR REPLACE VIEW`; the
  migration now drops and recreates the view in both up/down paths.
- `rap-node-agent` desired-workload polling/status reporting is now gated by
  `RAP_WORKLOAD_SUPERVISION_ENABLED=false` by default, avoiding repeated
  admin-only workload-status `403` logs while service runtime supervision is
  still a stub.
- Stage C18 VPN/IP tunnel service target design is completed as
  documentation/planning only.
- Stage C18A VPN/IP tunnel control-plane data model foundation is implemented
  and backend-test-proven.
- Stage C18B VPN/IP tunnel lease/fencing hardening is implemented and
  backend-test-proven.
- Stage C18C VPN/IP tunnel node-agent desired-state consumption/reporting is
  implemented and backend-test-proven.
- Version Storage / Update Repository is documented as a future Fabric Core
  service for signed releases, OS/arch artifacts, stable/current/candidate
  channels, update-cache mirroring, node-agent update supervision, rollback,
  and explicit data-structure migration bundles. Runtime updater behavior is
  not implemented.
- Web Ingress and Admin UI ownership model is documented:
  `docs/architecture/WEB_INGRESS_AND_ADMIN_UI_MODEL.md`.
- Admin endpoint placement decision is documented: storage/config-storage nodes
  do not automatically become cluster panels; Platform Owner Console remains
  global, Cluster Admin Endpoint requires explicit admin/web ingress role
  assignment, and Organization Admin Panel remains tenant-safe.
- Platform Owner Control Panel is implemented in `web-admin` and
  build-verified. Report:
  `artifacts/web-admin-platform-owner-control-panel-report.md`.
- Fabric service endpoint control-plane foundation is implemented:
  cluster-scoped `fabric_entry_points` and `fabric_egress_pools` are durable
  PostgreSQL objects for logical client ingress and logical egress zones. This
  is not production mesh routing yet.
- Fabric endpoint node assignment is implemented for the Platform Owner
  Control Panel: entry points and egress pools can show and assign active
  cluster nodes through control-plane APIs. This remains placement intent only;
  it does not start mesh routing or service traffic.
- Platform Owner Control Panel Fabric map now visualizes logical ingress,
  active cluster nodes, logical egress pools, endpoint-node placement intent,
  observed peer links, and node telemetry/service summaries in one cluster
  diagram. This remains a platform-owner topology view and must not be exposed
  to organization panels.
- Platform Owner Control Panel Fabric page also shows current node-scoped
  synthetic mesh config/candidate/scoring/route-health feedback visibility
  after C17Z20.
- Stage C17H deployed multi-agent synthetic config smoke on `docker-test` is
  complete; next mesh/Fabric work requires an explicit new staged prompt
- prepare the Secure Access Fabric platform-core foundation:
  clusters, node enrollment, native node-agent identity, role assignment,
  platform admin console, scoped configuration distribution, node-local state,
  Fabric Storage/Config Storage, and future multi-cluster administration
- Stage C1 backend cluster/node model foundation is implemented and verified.
- Stage C2 node enrollment hardening is implemented and verified.
- Stage C3 native `rap-node-agent` MVP scaffold is implemented and verified.
- Stage C4 Platform Admin Console MVP is implemented and build-verified.
- Stage C5 service workload supervision contract is implemented and verified.
- Stage C6 mesh control-plane preparation is implemented and verified.
- Stage C7 Mesh MVP skeleton is implemented and verified.
- Stage C8 multi-cluster/partition hardening is implemented and verified.
- Stage C9 organization admin foundation is implemented and verified.
- Current focus: Fabric Core / mesh transport foundation. RDP remains paused.
  C17Z20 is complete and remains peer/rendezvous control-plane health
  management, stale-relay replacement policy, route/path decision metadata, and
  synthetic route-health effective-path feedback scoring/refresh only, not
  production service mesh traffic.

Not current scope:

- Web/Admin UI implementation beyond documented ownership/model boundaries
- production mesh runtime
- VPN/IP tunnel runtime
- multi-cluster runtime
- node-agent updater runtime
- production Version Storage / Update Repository runtime
- automatic PostgreSQL migration execution by node-agent
- SSH/VNC adapters
- Linux/mobile clients
- DP-3B adaptive quality expansion
- RDP performance work, including RDP-Perf-7 or further RDP-Perf stages
- Stage 5.2 remaining RDP desktop UI proof
- organization admin UI implementation
- production authentication/session hardening for Web Admin

## Canonical Test Environment

- Docker test host: `192.168.200.61`
- SSH alias: `docker-test`
- Docker endpoint: `ssh://docker-test`
- Backend API: `http://192.168.200.61:8080/api/v1`
- Backend gateway: `ws://192.168.200.61:8080/api/v1/gateway/ws`
- C17A required no active runtime deployment. It is implemented in
  `rap-node-agent` tests only, behind a disabled-by-default feature flag, and
  carries synthetic `fabric.probe` / `fabric.probe_ack` messages only.
- C17B required no active runtime deployment. It is implemented in
  `rap-node-agent` tests only, behind the same disabled-by-default feature
  flag, and carries synthetic route health probes only.
- C17C required no active runtime deployment. It is implemented in
  `rap-node-agent` tests only, behind the same disabled-by-default feature
  flag, and models synthetic relay queues/QoS only.
- C17D required no active runtime deployment. It is implemented in
  `rap-node-agent` tests only, behind the same disabled-by-default feature
  flag, and carries only bounded `synthetic.echo` test-service payloads.
- C17E adds a live node-to-node synthetic HTTP transport skeleton and smoke
  harness. It remains behind `RAP_MESH_SYNTHETIC_RUNTIME_ENABLED=false` by
  default and does not authorize production mesh, RDP, VPN, file, video, or
  service workload traffic.
- C17F adds a scoped synthetic mesh config file boundary, prefers it over
  debug JSON, and reports synthetic route-health observations to the existing
  mesh links control-plane endpoint when testing flags allow synthetic links.
- C17G adds backend
  `/clusters/{clusterID}/nodes/{nodeID}/mesh/synthetic-config` and node-agent
  consumption of that config when no local scoped config file is set.
- C17H proves the C17G boundary in a deployed multi-agent `docker-test` smoke
  with synthetic traffic only.
- C17I adds an explicit node-agent production forwarding gate while keeping
  production forwarding unavailable.
- C17J adds route-bound production envelope validation on `/mesh/v1/forward`
  while keeping production forwarding unavailable.
- C17K adds local metadata-only accepted-envelope observation while keeping
  production forwarding unavailable.
- C17L adds a bounded local in-memory sink for accepted metadata-only
  observations while keeping production forwarding unavailable.
- C17M adds disabled-by-default node-agent wiring for the bounded local
  metadata-only observation sink while keeping production forwarding
  unavailable.
- C17N adds local metrics for the bounded observation sink while keeping
  production forwarding unavailable.
- C17O adds local node-agent logging for bounded observation sink metrics while
  keeping production forwarding unavailable.
- C17P adds change-driven suppression for unchanged local bounded observation
  sink metrics logs while keeping production forwarding unavailable.
- C17Q adds explicit local log separation for production forwarding gate state
  versus runtime state while keeping production forwarding unavailable.
- C17R adds a maximum capacity guard for the local production observation sink
  while keeping production forwarding unavailable.
- C17S adds panic-safe fail-closed observation handling while keeping
  production forwarding unavailable.
- C17T adds an explicit payload boundary for validated production
  `fabric.control` envelopes while keeping production forwarding unavailable.
- C17U adds an explicit future-skew boundary for validated production
  `fabric.control` envelope `created_at` while keeping production forwarding
  unavailable.
- C17V adds scoped peer endpoint candidates and NAT/connectivity hints to
  synthetic mesh config while keeping production forwarding unavailable.
- C17W adds deterministic local scoring for scoped peer endpoint candidates
  while keeping production forwarding unavailable.
- C17X adds an optional local health observation overlay for endpoint
  candidate scoring while keeping production forwarding unavailable.
- C17Y updates the Platform Owner Control Panel with node-scoped synthetic
  mesh config visibility while keeping production forwarding unavailable.
- C17Z adds gate-controlled production `fabric.control` local delivery and
  direct next-hop forwarding while keeping service channels unavailable.
- C17Z1 adds route-path-bound production `fabric.control` multi-hop forwarding
  while keeping service channels unavailable.
- C17Z2 adds local metadata-only production `fabric.control` forwarding event
  logs while keeping service channels unavailable.
- C17Z3 binds production `fabric.control` forwarding to local route config
  when configured routes are available while keeping service channels
  unavailable.
- C17Z4 adds scoped peer directory and bounded recovery seeds to node-scoped
  mesh config while keeping service channels unavailable.
- C17Z5 adds node-local peer cache and warm-peer health probes while keeping
  service channels unavailable.
- C17Z6 adds explicit advertised endpoint reporting and scoped config
  projection while keeping service channels unavailable.
- C17Z7 adds multiple public/private/corporate endpoint candidates and
  same-site scoring while keeping service channels unavailable.
- C17Z8 adds node-local warm-peer connection states and backoff while keeping
  service channels unavailable.
- C17Z9 adds bounded node-local peer recovery planning while keeping service
  channels unavailable.
- C17Z10 adds node-local peer connection intent and transport readiness
  metadata while keeping service channels unavailable.
- C17Z11 adds a real node-local peer connection manager for control-plane
  health while keeping service channels unavailable.
- C17Z12 adds node-scoped rendezvous/relay control-plane leases while keeping
  service channels unavailable.
- C17Z13 adds rendezvous lease telemetry while keeping service channels
  unavailable.
- C17Z14 adds node-scoped lease refresh/reload and stale relay telemetry while
  keeping service channels unavailable.
- C17Z15 adds backend stale-relay replacement policy and alternate relay
  scoring while keeping service channels unavailable.
- C17Z16 adds Control Plane route/path decision metadata while keeping service
  channels unavailable.
- C17Z17 adds node-side route generation apply/withdraw metadata while keeping
  service channels unavailable.
- C18 completed design/planning only and did not implement VPN/IP tunnel
  runtime. C18A completed control-plane data model foundation only. C18B
  completed lease/fencing control-plane hardening only. C18C completed
  node-agent desired-state consumption/reporting only. C18D, if accepted, must
  remain credential/config resolver boundary work and must not implement real
  VPN/IP tunnel runtime without a separate explicit prompt.
- Latest RDP performance reference image:
  `rap-rdp-worker:rdp-perf6-dirty-region`
- Stage 5.2 file-download runtime artifacts remain preserved for when RDP work
  resumes, but they are not the active next task.

## Proven Baseline

### Backend

- Go backend builds and tests pass.
- PostgreSQL is the source of truth.
- Redis is live coordination/routing only.
- Auth foundation exists.
- Refresh rotation, auth sessions, devices, and trusted devices exist.
- Multi-tenant organization foundation exists.
- Resources and remote sessions are organization-scoped.
- Platform-core v2 models exist.
- Identity source foundation exists.
- Node and node-agent control-plane foundation exists.
- Session broker lifecycle is implemented.
- Worker coordination and stale worker monitoring are implemented.
- Structured localization-ready messaging exists.
- Per-resource `certificate_verification_mode = strict | ignore` exists.
- `strict` remains default.
- Clipboard policy mode exists.
- File transfer policy mode exists.
- Data-plane token/candidate generation exists.
- Production resource secret-readiness guard exists:
  - `APP_ENV=production` rejects plaintext credential-like resource metadata.
  - RDP/VNC/SSH resources require `secret_ref` in production.
  - development and smoke paths may still use plaintext metadata explicitly.
- Encrypted PostgreSQL-backed resource secret storage/resolver MVP exists:
  - `resource_secrets` stores ciphertext, nonce, key id, algorithm, version,
    safe metadata, and `payload_sha256`.
  - `PUT /api/v1/resources/{resourceID}/secret` creates/rotates a resource
    secret without returning plaintext.
  - session assignment resolves `secret_ref` only after organization, resource,
    session, worker, and lease checks.
- Production direct worker WSS TLS/PKI guard exists:
  - backend direct candidates advertise `tls_trust_mode`, `production_trusted`,
    `smoke_only`, and optional `tls_ca_ref` metadata.
  - production backend omits smoke-only direct candidates and keeps backend
    gateway fallback.
  - Windows client skips untrusted/smoke-only direct candidates in production.

### Worker / RDP Adapter

- Worker Docker build is reproducible.
- C++ worker is the active RDP runtime.
- FreeRDP is behind the RDP Adapter boundary.
- Worker registration, assignment consumption, heartbeat, leases, and worker
  events are implemented.
- Real RDP connection works.
- Detach/reattach/takeover/terminate/failure flows are proven.
- Reattach/takeover do not recreate the remote RDP session.
- Worker death/orphan active-session recovery is proven.
- Direct worker WSS endpoint exists.
- RS256 data-plane token validation exists.
- Current attachment/controller binding is enforced.
- Backend gateway fallback remains available.
- Direct binary `RAP2` render frames exist.
- Region-first BGRA rendering is the current stable path.
- Direct attach baseline full-frame repair exists.
- Region-loss full-frame repair exists.
- Ordered dirty-region delivery is accepted through `SessionRuntime`, worker
  direct WSS, Windows transport, and WPF presenter queues.
- Cursor adapter boundary exists.
- Text clipboard through FreeRDP `cliprdr` is accepted.
- Client-to-server file upload to controlled worker storage is accepted.
- Restricted transfer-drive visibility through FreeRDP RDPDR is runtime-proven:
  uploaded files are visible and openable inside the remote Windows session via
  `RAP_Transfers`.
- Backend gateway fallback/debug frame state reconstructs a full framebuffer by
  patching accepted region updates into Redis live state, so fallback screenshots
  are not left with region-sized payloads after region-first rendering.

### Windows Client

- Windows WPF client builds.
- Login, refresh, logout, organization selection, resource list, active sessions,
  and session window exist.
- Direct worker WSS selection exists with automatic backend gateway fallback.
- Binary direct render receive path exists.
- Real remote desktop is visible.
- Keyboard and mouse input are usable after RDP adapter hardening.
- Session window lifecycle is stable enough for current smoke work.
- Localization-ready resources and structured backend message resolution exist.
- Text clipboard UI/path exists.
- File upload UI/path exists.

## Current Known Gaps

- C1 cluster/node backend foundation is implemented. Remaining platform-core
  work continued through C2: production enrollment hardening and node-agent
  enrollment API. Runtime reports:
  `artifacts/c1-cluster-node-foundation-report.md`.
- `artifacts/c2-node-enrollment-hardening-report.md`.
- `artifacts/c3-rap-node-agent-mvp-report.md`.
- `artifacts/c4-platform-admin-console-report.md`.
- `artifacts/c5-service-workload-supervision-contract-report.md`.
- `artifacts/c6-mesh-control-plane-preparation-report.md`.
- `artifacts/c7-mesh-mvp-skeleton-report.md`.
- `artifacts/c8-multi-cluster-hardening-report.md`.
- `artifacts/c9-organization-admin-foundation-report.md`.
- `artifacts/c10-fabric-core-config-distribution-design-report.md`.
- `artifacts/c11-signed-scoped-cluster-snapshot-model-report.md`.
- `artifacts/c12-node-local-state-store-report.md`.
- `artifacts/c13-fabric-storage-config-service-report.md`.
- `artifacts/c14-peer-directory-cache-model-report.md`.
- `artifacts/c15-fabric-routing-engine-skeleton-report.md`.
- `artifacts/c16-secure-node-to-node-channel-lifecycle-report.md`.
- `artifacts/c17-mesh-routing-runtime-implementation-plan-report.md`.
- `artifacts/c17a-synthetic-mesh-runtime-skeleton-report.md`.
- `artifacts/c17b-route-health-failover-probes-report.md`.
- `artifacts/c17c-relay-semantic-hardening-report.md`.
- `artifacts/c17d-non-production-test-service-path-report.md`.
- `artifacts/c17e-live-node-to-node-synthetic-transport-report.md`.
- `artifacts/c17f-scoped-synthetic-route-config-report.md`.
- `artifacts/c17g-control-plane-scoped-synthetic-config-report.md`.
- `artifacts/c17v-peer-endpoint-candidate-model-report.md`.
- `artifacts/c17w-peer-endpoint-candidate-scoring-report.md`.
- `artifacts/c17x-health-aware-endpoint-candidate-scoring-report.md`.
- `artifacts/c17y-platform-owner-synthetic-mesh-visibility-report.md`.
- `artifacts/c18-vpn-ip-tunnel-service-target-design-report.md`.
- `artifacts/c18a-vpn-control-plane-data-model-report.md`.
- `artifacts/c18b-vpn-lease-fencing-hardening-report.md`.
- `artifacts/c18c-vpn-node-agent-desired-state-report.md`.
- RDP correctness baseline is accepted. Remaining visual/performance limitation:
  window drag behaves like older/slow-link RDP clients by showing a drag frame,
  and repaint after releasing a moved window is workable but not yet polished.
- RDPGFX is gated and disabled by default because the current live target resets
  the connection when RDPGFX is advertised.
- Encoded graphics/codecs/tiles are not production-accepted.
- Server-to-client file download core data path is runtime-proven through both
  direct worker WSS and backend gateway fallback. Stage 5.2 lifecycle blocking
  is runtime-proven for detach, old-client takeover, and worker failure. Stage
  5.2 still needs manual Windows-client UI proof before full runtime
  acceptance.
- External KMS/Vault integration and master-key rotation are not implemented.
- Worker production assignment currently receives resolved credentials through
  transient assignment metadata; a future resolver pull/token flow should reduce
  Redis control-queue exposure.
- The current dev/smoke RDP proof path can still resolve credentials from
  resource metadata outside production.
- Production direct-worker certificate issuance/rotation and platform CA
  distribution are not automated yet.
- Backend test coverage is thin outside `sessionbroker`.
- Windows client automated tests are missing.
- Worker probes exist, but a full automated adapter conformance suite does not.
- Several documents were updated during P0, but future work must keep them in
  sync after every accepted stage.

## Current Verification Snapshot

Additional C17A synthetic mesh runtime skeleton verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- direct synthetic `fabric.probe` / `fabric.probe_ack`: PASS
- single-relay synthetic `fabric.probe` / `fabric.probe_ack`: PASS
- feature flag / kill-switch disabled path: PASS
- wrong cluster rejection: PASS
- wrong node rejection: PASS
- unauthorized channel rejection: PASS
- expired route rejection: PASS
- TTL exhaustion rejection: PASS
- loop rejection: PASS
- unavailable peer rejection: PASS
- existing mesh health and production-forwarding-disabled behavior: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17B route health and failover probe verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- C17A direct/single-relay synthetic probes remain intact: PASS
- route health `fabric.route_health` / `fabric.route_health_ack`: PASS
- local route success observation: PASS
- local route failure observation: PASS
- preferred route failure with fallback route use: PASS
- warm fallback route promotion metric/log boundary: PASS
- route cache invalidation on policy version change: PASS
- same-version route cache preservation: PASS
- feature flag / kill-switch disabled path: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17C relay semantic hardening verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- C17A direct/single-relay synthetic probes remain intact: PASS
- C17B route health/failover probes remain intact: PASS
- synthetic relay envelope validation: PASS
- QoS dequeue order `fabric_control` > `route_control` > `telemetry`: PASS
- telemetry backpressure drops oldest stale telemetry only: PASS
- reliable fabric/control queue full rejects instead of dropping: PASS
- relay rejects wrong cluster, wrong node, unauthorized channel, unsupported
  message, TTL exhaustion, and loop: PASS
- relay disabled / kill-switch path: PASS
- relay queue depth metrics: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17D non-production test-service path verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- C17A direct/single-relay synthetic probes remain intact: PASS
- C17B route health/failover probes remain intact: PASS
- C17C relay validation/QoS/backpressure remains intact: PASS
- direct `synthetic.echo` service-path test: PASS
- single-relay `synthetic.echo` service-path test: PASS
- forced fallback `synthetic.echo` service-path test: PASS
- bounded payload max-size behavior: PASS
- wrong organization rejected: PASS
- unsupported service type rejected: PASS
- oversized payload rejected: PASS
- unauthorized channel rejected: PASS
- missing request id rejected: PASS
- runtime disabled / kill-switch path: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17E live node-to-node synthetic transport verification:

```powershell
go test ./...
go run ./cmd/mesh-live-smoke
go build -o bin/rap-node-agent.exe ./cmd/rap-node-agent
go build -o bin/mesh-live-smoke.exe ./cmd/mesh-live-smoke
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- live HTTP peer transport for synthetic envelopes: PASS
- direct `node-a -> node-b` synthetic probe over HTTP endpoints: PASS
- single-relay `node-a -> node-r -> node-b` synthetic probe over HTTP endpoints:
  PASS
- bounded `synthetic.echo` test-service over relay HTTP path: PASS
- disabled-by-default `rap-node-agent` synthetic mesh endpoint: PASS
- production `/mesh/v1/forward` remains disabled: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17F scoped synthetic route config verification:

```powershell
go test ./...
go run ./cmd/mesh-live-smoke
go build -o bin/rap-node-agent.exe ./cmd/rap-node-agent
go build -o bin/mesh-live-smoke.exe ./cmd/mesh-live-smoke
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- scoped synthetic config file load: PASS
- wrong cluster rejected: PASS
- wrong node rejected: PASS
- expired route rejected: PASS
- scoped config preferred over debug JSON: PASS
- synthetic route-health reporting boundary added: PASS
- C17E live direct/relay smoke remains intact: PASS
- production `/mesh/v1/forward` remains disabled: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17G Control Plane scoped synthetic config verification:

```powershell
go test ./...
```

Run from:

```powershell
backend
agents\rap-node-agent
```

Result:

- backend node-scoped synthetic config endpoint/service: PASS
- disabled testing flag returns no routes and no peer endpoints: PASS
- unrelated route intent does not leak to requesting node: PASS
- production forwarding remains false in config: PASS
- node-agent consumes Control Plane config when local scoped config file is not
  set: PASS
- local `RAP_MESH_SYNTHETIC_CONFIG` remains preferred debug fallback: PASS
- C17F live direct/relay smoke remains intact: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

Additional C17H deployed multi-agent synthetic config smoke verification:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\fabric\c17h-multi-agent-synthetic-smoke-ssh.ps1 -KeepRunning
go test ./...
```

Run from:

```powershell
backend
agents\rap-node-agent
```

Result:

- deployed backend on `docker-test` stayed ready at `http://192.168.200.61:18080/api/v1`: PASS
- five running `rap-node-agent` containers loaded `source=control_plane`
  synthetic config: PASS
- scoped config route counts: node-a=2, node-r=1, node-b=1, node-c=1,
  node-idle=0: PASS
- direct route-health observation reported reachable to Control Plane: PASS
- single-relay route-health observation reported reachable to Control Plane:
  PASS
- Platform Owner cluster summary showed 5 nodes and 5 healthy nodes: PASS
- all scoped configs kept `production_forwarding=false`: PASS
- backend `go test ./...`: PASS
- node-agent `go test ./...`: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17H runtime report:

- `artifacts/c17h-deployed-multi-agent-synthetic-config-smoke-report.md`

Additional C17I production forwarding gate verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- `RAP_MESH_PRODUCTION_FORWARDING_ENABLED` config gate: PASS
- `/mesh/v1/forward` remains disabled by default: PASS
- explicit gate enabled still reports unavailable production runtime: PASS
- backend tests: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17I report:

- `artifacts/c17i-production-forwarding-gate-report.md`

Additional C17J production envelope contract verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- route-bound production envelope contract validation: PASS
- invalid payload hash rejected: PASS
- service channel rejected: PASS
- gate-enabled `/mesh/v1/forward` still returns unavailable runtime after
  successful validation: PASS
- backend tests: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17J report:

- `artifacts/c17j-production-envelope-contract-report.md`

Additional C17K production envelope observation verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- valid production envelope triggers metadata-only observation: PASS
- rejected production envelope does not trigger observation: PASS
- observation failure fails closed: PASS
- gate-enabled `/mesh/v1/forward` still returns unavailable runtime after
  validation/observation: PASS
- backend tests: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17K report:

- `artifacts/c17k-production-envelope-observation-report.md`

Additional C17L bounded production observation sink verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- bounded metadata-only sink stores accepted observations: PASS
- oldest observation is dropped when capacity is exceeded: PASS
- payload hash/length metadata is preserved: PASS
- payload body is not stored by the sink: PASS
- gate-enabled `/mesh/v1/forward` still returns unavailable runtime after
  validation/observation/sink storage: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17L report:

- `artifacts/c17l-bounded-production-observation-sink-report.md`

Additional C17M production observation sink wiring verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- `RAP_MESH_PRODUCTION_OBSERVATION_SINK_CAPACITY` config loading: PASS
- negative sink capacity rejected: PASS
- observer wiring disabled by default: PASS
- observer wiring created only when capacity is greater than zero: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17M report:

- `artifacts/c17m-production-observation-sink-wiring-report.md`

Additional C17N production observation sink metrics verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- empty sink metrics start at zero depth/accepted/dropped: PASS
- bounded sink metrics track capacity/current depth: PASS
- accepted observations increment accepted total: PASS
- oldest-entry drop increments dropped total: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17N report:

- `artifacts/c17n-production-observation-sink-metrics-report.md`

Additional C17O production observation sink local metrics log verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- sink wiring remains disabled by default: PASS
- enabled sink keeps configured capacity: PASS
- nil mesh state metrics logging is safe: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17O report:

- `artifacts/c17o-production-observation-sink-local-metrics-log-report.md`

Additional C17P production observation sink change-driven metrics log
verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- first metrics snapshot logs locally: PASS
- unchanged metrics do not log again: PASS
- changed metrics log again: PASS
- metrics equality helper detects identical/different snapshots: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17P report:

- `artifacts/c17p-production-observation-sink-change-driven-metrics-log-report.md`

Additional C17Q production forwarding gate/runtime log boundary verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- production forwarding gate state is logged separately from runtime state:
  PASS
- default gate/runtime log state remains false/false: PASS
- gate-enabled log state remains true/false: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17Q report:

- `artifacts/c17q-production-forwarding-gate-runtime-log-boundary-report.md`

Additional C17R production observation sink capacity guard verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- normal sink capacity config still loads: PASS
- negative sink capacity rejected: PASS
- too-large sink capacity rejected: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17R report:

- `artifacts/c17r-production-observation-sink-capacity-guard-report.md`

Additional C17S production observation panic fail-closed verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- observer error fails closed: PASS
- observer panic fails closed: PASS
- nil observer is allowed: PASS
- rejected envelopes are not observed: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17S report:

- `artifacts/c17s-production-observation-panic-fail-closed-report.md`

Additional C17T production envelope payload boundary verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- valid fabric-control envelope still passes validation/observation: PASS
- oversized fabric-control envelope rejected: PASS
- oversized rejected envelope does not call observer: PASS
- invalid payload hash still rejected: PASS
- service channel still rejected: PASS
- existing mesh/forwarding tests remain green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17T report:

- `artifacts/c17t-production-envelope-payload-boundary-report.md`

Additional C17U production envelope created-at skew verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- valid fabric-control envelope still passes validation/observation: PASS
- future-created fabric-control envelope rejected: PASS
- future-created rejected envelope does not call observer: PASS
- existing payload/hash/channel/time validation remains green: PASS
- RDP/runtime/data-plane behavior changed: no
- production service traffic over mesh: no

C17U report:

- `artifacts/c17u-production-envelope-created-at-skew-report.md`

Additional C17V peer endpoint candidate model verification:

```powershell
go test ./...
```

Run from:

```powershell
backend
agents\rap-node-agent
```

Result:

- backend synthetic config includes route-scoped peer endpoint candidates:
  PASS
- unrelated peer endpoints and endpoint candidates do not leak across route
  paths: PASS
- candidate validation rejects unknown transport/NAT, route-path mismatch,
  node mismatch, and invalid metadata: PASS
- node-agent scoped config loads valid peer endpoint candidates: PASS
- node-agent scoped config rejects invalid peer endpoint candidates: PASS
- production forwarding remained unavailable: PASS
- production service traffic over mesh: no

C17V report:

- `artifacts/c17v-peer-endpoint-candidate-model-report.md`

Additional C17W peer endpoint candidate scoring verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- direct/fresh/public endpoint candidate ranks above relay and stale
  candidates: PASS
- tie-breaking by priority/node/endpoint is deterministic: PASS
- relay and outbound fallback candidates are retained instead of dropped:
  PASS
- production forwarding remained unavailable: PASS
- production service traffic over mesh: no

C17W report:

- `artifacts/c17w-peer-endpoint-candidate-scoring-report.md`

Additional C17X health-aware endpoint candidate scoring verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- local health observations can promote lower-latency, high-reliability
  candidates: PASS
- failure history and recent failure reasons penalize candidates: PASS
- stale observations do not contribute fresh latency benefits: PASS
- production forwarding remained unavailable: PASS
- production service traffic over mesh: no

C17X report:

- `artifacts/c17x-health-aware-endpoint-candidate-scoring-report.md`

Additional C17Y Platform Owner synthetic mesh visibility verification:

```powershell
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
go test ./...
```

Run from:

```powershell
web-admin
backend
agents\rap-node-agent
```

Result:

- web-admin TypeScript/Vite build: PASS
- backend tests: PASS
- node-agent tests: PASS
- Platform Owner Fabric page reads node-scoped synthetic mesh config: PASS
- Fabric page shows route/endpoint/candidate counts and production forwarding
  state: PASS
- production forwarding remained unavailable: PASS
- RDP/runtime/data-plane behavior changed: no

C17Y report:

- `artifacts/c17y-platform-owner-synthetic-mesh-visibility-report.md`

Additional C17Z production fabric-control direct forwarding verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
```

Run from:

```powershell
agents\rap-node-agent
backend
web-admin
```

Result:

- local destination delivery for valid `fabric.control`: PASS
- direct next-hop forwarding for valid `fabric.control`: PASS
- no-transport path still returns runtime unavailable: PASS
- invalid/hash/channel/time/payload boundaries remain enforced: PASS
- service channels remain rejected: PASS
- web-admin build with updated C17Z boundary wording: PASS
- RDP/runtime service payload behavior changed: no

C17Z report:

- `artifacts/c17z-production-fabric-control-direct-forwarding-report.md`

Additional C17Z1 production fabric-control multi-hop route-path verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
```

Run from:

```powershell
agents\rap-node-agent
backend
web-admin
```

Result:

- route-path-bound multi-hop `fabric.control` forwarding: PASS
- wrong next hop rejected: PASS
- duplicate route path loop rejected: PASS
- visited node metadata propagated to the destination: PASS
- service channels remain rejected: PASS
- RDP/runtime service payload behavior changed: no

C17Z1 report:

- `artifacts/c17z1-production-fabric-control-multihop-route-path-report.md`

Additional C17Z2 production fabric-control forwarding observability
verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
```

Run from:

```powershell
agents\rap-node-agent
backend
web-admin
```

Result:

- accepted production `fabric.control` events logged: PASS
- forwarded production `fabric.control` events logged: PASS
- delivered production `fabric.control` events logged: PASS
- rejected production `fabric.control` events logged: PASS
- payload bodies are not logged: PASS
- service channels remain rejected: PASS
- RDP/runtime service payload behavior changed: no

C17Z2 report:

- `artifacts/c17z2-production-fabric-control-forwarding-observability-report.md`

Additional C17Z3 production fabric-control route-config verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- configured production `fabric.control` route forwarding: PASS
- unknown configured route rejection: PASS
- wrong configured next-hop rejection: PASS
- existing direct and route-path forwarding tests: PASS
- service channels remain rejected: PASS
- RDP/runtime service payload behavior changed: no

C17Z3 report:

- `artifacts/c17z3-production-fabric-control-route-config-boundary-report.md`

Additional C17Z4 scoped peer directory/recovery seed verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
```

Run from:

```powershell
backend
agents\rap-node-agent
web-admin
```

Result:

- backend scoped peer-directory projection: PASS
- backend recovery seed projection/ordering: PASS
- node-agent scoped config validation: PASS
- web-admin peer directory/recovery seed counters: PASS
- RDP/runtime service payload behavior changed: no

C17Z4 report:

- `artifacts/c17z4-scoped-peer-directory-recovery-seeds-report.md`

Additional C17Z5 node-agent peer cache runtime verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- peer cache warm selection: PASS
- recovery seed warm promotion: PASS
- endpoint candidate scoring integration: PASS
- node-agent config loading with peer runtime config: PASS
- warm-peer health probe code compiles in node-agent: PASS
- RDP/runtime service payload behavior changed: no

C17Z5 report:

- `artifacts/c17z5-node-agent-peer-cache-runtime-report.md`

Additional C17Z6 dynamic endpoint reporting verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- node-agent advertised endpoint config loading: PASS
- heartbeat endpoint report payload: PASS
- backend projection of reported endpoint into scoped config: PASS
- backend projection of reported endpoint candidate into scoped config: PASS
- peer directory counts include reported endpoint/candidate: PASS
- RDP/runtime service payload behavior changed: no

C17Z6 report:

- `artifacts/c17z6-dynamic-endpoint-reporting-report.md`

Additional C17Z7 private/corporate endpoint candidate verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result:

- multiple advertised endpoint heartbeat payload: PASS
- private/corporate endpoint candidate preservation: PASS
- corporate/private endpoint scoring preference: PASS
- peer cache selects corporate LAN address for warm health: PASS
- backend tests remain green: PASS
- RDP/runtime service payload behavior changed: no

C17Z7 report:

- `artifacts/c17z7-private-corporate-endpoint-candidates-report.md`

Additional C17Z8 peer connection state-machine verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- ready/degraded transitions: PASS
- repeated-failure backoff transition: PASS
- backoff probe suppression/recovery: PASS
- snapshot state counters: PASS
- node-agent warm-peer health metadata compiles with connection states: PASS
- RDP/runtime service payload behavior changed: no

C17Z8 report:

- `artifacts/c17z8-peer-connection-state-machine-report.md`

Additional C17Z9 peer recovery planner verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- bounded steady ready-peer selection: PASS
- recovery seed candidate selection during ready deficit: PASS
- active backoff candidate suppression: PASS
- target capped by connectable peer count: PASS
- node-agent recovery report metadata compiles: PASS
- RDP/runtime service payload behavior changed: no

C17Z9 report:

- `artifacts/c17z9-peer-recovery-planner-report.md`

Additional C17Z10 peer connection intent planner verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- corporate/private direct intent classification: PASS
- outbound-only rendezvous-required classification: PASS
- relay-required rendezvous-required classification: PASS
- private endpoint classification without explicit candidate hints: PASS
- heartbeat intent report without advertised endpoint: PASS
- RDP/runtime service payload behavior changed: no

C17Z10 report:

- `artifacts/c17z10-peer-connection-intent-planner-report.md`

Additional C17Z11 peer connection manager runtime verification:

```powershell
go test ./...
```

Run from:

```powershell
agents\rap-node-agent
```

Result:

- direct control-plane health probe through manager: PASS
- relay/rendezvous-required peer deferred: PASS
- repeated failure enters backoff and is suppressed: PASS
- heartbeat manager report compiles: PASS
- RDP/runtime service payload behavior changed: no

C17Z11 report:

- `artifacts/c17z11-peer-connection-manager-runtime-report.md`

Additional C17Z12 rendezvous/relay control-plane contract verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
```

Run from:

```powershell
backend
agents\rap-node-agent
```

Result:

- backend node-scoped `rendezvous_leases` contract and no unrelated leak: PASS
- scoped config rendezvous lease validation: PASS
- rendezvous-required intent resolved to relay_control with lease: PASS
- peer connection manager probes relay health and records `relay_ready`: PASS
- peer recovery planner maintains `relay_ready` peers in steady mode: PASS
- web-admin synthetic config visibility for rendezvous leases: PASS
- RDP/VPN/service payload behavior changed: no

Docker-test C17Z12 runtime smoke:

```powershell
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Result from run `c17z12-20260428-142108`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- C17Z12 web-admin view on `http://192.168.200.61:5174/`: PASS
- C17Z12 containers left running on `docker-test`: PASS
- backend auto-derived `rendezvous_leases` for outbound-only node C via relay
  node R: PASS
- entry node A resolved `waiting_rendezvous` to `relay_control`: PASS
- A -> C manager observation through relay was `reachable`: PASS
- A -> C connection state was `relay_ready`: PASS
- direct baseline synthetic route delivery: PASS
- production forwarding remained disabled: PASS

C17Z12 report:

- `artifacts/c17z12-rendezvous-relay-control-plane-contract-report.md`

Additional C17Z13 rendezvous lease telemetry verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build && popd"
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result from docker-test run `c17z13-20260428-145133`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- web-admin on `http://192.168.200.61:5174/`: PASS
- entry node A heartbeat reports
  `c17z13.mesh_rendezvous_lease_report.v1`: PASS
- entry node A reports `entry_observer_count=1` and
  `relay_control_ready_count=1`: PASS
- relay node R reports `admitted_as_relay_count=1`: PASS
- outbound-only node C reports `admitted_as_peer_count=1`: PASS
- expired lease skip and active lease reselection test: PASS
- lease telemetry boundary flags keep payload forwarding disabled: PASS
- A -> C relay-control manager observation remains `reachable` and
  `relay_ready`: PASS

C17Z13 report:

- `artifacts/c17z13-rendezvous-lease-telemetry-report.md`

Additional C17Z14 rendezvous lease refresh verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result from docker-test run `c17z14-20260428-151435`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- web-admin on `http://192.168.200.61:5174/`: PASS
- entry node A heartbeat reports
  `c17z14.mesh_rendezvous_lease_report.v1`: PASS
- entry node A reports `refresh_contract=node_scoped_synthetic_config_get`,
  `refresh_needed_count=1`, and `refresh_success_count=2`: PASS
- relay node R reports `admitted_as_relay_count=2` and refresh success: PASS
- outbound-only node C reports `admitted_as_peer_count=2` and refresh
  success: PASS
- stale relay withdrawal/reselection fields are present and zero in the
  healthy smoke path: PASS
- refresh telemetry boundary flags keep payload forwarding disabled: PASS
- direct baseline synthetic route delivery: PASS
- A -> C relay-control manager observation remains `reachable` and
  `relay_ready`: PASS

C17Z14 report:

- `artifacts/c17z14-rendezvous-lease-refresh-report.md`

Additional C17Z15 rendezvous relay replacement verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result from docker-test run `c17z15-20260428-153917`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- web-admin on `http://192.168.200.61:5174/`: PASS
- backend synthetic config schema `c17z15.synthetic.v1`: PASS
- entry node A heartbeat reports
  `c17z15.mesh_rendezvous_lease_report.v1`: PASS
- entry node A initially receives an explicit stale relay lease through old
  relay R with bad relay endpoint `http://127.0.0.1:19210`: PASS
- Control Plane withdraws the stale old-relay lease and issues a replacement
  `stale_relay_replacement` lease through alternate relay S: PASS
- replacement lease metadata includes
  `relay_replacement_contract=stale_relay_feedback_policy` and
  `replacement_for_stale_relay=true`: PASS
- relay S reports `admitted_as_relay_count=1`: PASS
- R or S reports `last_refresh_reason=stale_relay` and refresh success: PASS
- direct baseline synthetic route delivery remains available: PASS
- payload forwarding boundary flags keep RDP/VPN/service forwarding disabled:
  PASS

C17Z15 report:

- `artifacts/c17z15-rendezvous-relay-replacement-report.md`

Additional C17Z16 route/path decision artifact verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result from docker-test run `c17z16-20260428-160621`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- web-admin on `http://192.168.200.61:5174/`: PASS
- backend synthetic config schema `c17z16.synthetic.v1`: PASS
- entry node A heartbeat reports
  `c17z16.mesh_rendezvous_lease_report.v1`: PASS
- entry node A heartbeat reports
  `c17z16.mesh_route_path_decision_report.v1`: PASS
- Control Plane route/path decision removes stale relay R from effective hops
  and selects alternate relay S as next hop for A -> C: PASS
- route/path decision report includes generation, score reasons,
  `control_plane_only=true`, `route_path_forwarding_runtime=false`, and
  `production_payload_forwarding=false`: PASS
- replacement lease through alternate relay S remains `relay_ready`: PASS
- direct baseline synthetic route delivery remains available: PASS
- payload forwarding boundary flags keep RDP/VPN/service forwarding disabled:
  PASS

C17Z16 report:

- `artifacts/c17z16-route-path-decision-report.md`

Additional C17Z17 route generation tracker verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
agents\rap-node-agent
backend
```

Result from docker-test run `c17z17-20260428-165118`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- web-admin on `http://192.168.200.61:5174/`: PASS
- backend synthetic config schema `c17z17.synthetic.v1`: PASS
- entry node A heartbeat reports
  `c17z17.mesh_rendezvous_lease_report.v1`: PASS
- entry node A heartbeat reports
  `c17z17.mesh_route_path_decision_report.v1`: PASS
- entry node A heartbeat reports
  `c17z17.mesh_route_generation_report.v1`: PASS
- route generation tracker reports active decisions, applied decisions,
  withdrawn decisions, total withdrawn count, and `generation_changed=true`:
  PASS
- first-observed replacement records old relay path withdrawal as
  `withdrawn_by_replacement`: PASS
- route generation boundary flags keep `control_plane_only=true`,
  `route_path_forwarding_runtime=false`, `service_workload_traffic=false`, and
  `production_payload_forwarding=false`: PASS
- replacement lease through alternate relay S remains `relay_ready`: PASS
- direct baseline synthetic route delivery remains available: PASS
- payload forwarding boundary flags keep RDP/VPN/service forwarding disabled:
  PASS

C17Z17 report:

- `artifacts/c17z17-route-generation-tracker-report.md`

Additional C17Z18 route-health effective path verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
.\scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
backend
agents\rap-node-agent
```

Result from docker-test run `c17z18-20260428-174559`:

- backend API on `http://192.168.200.61:18120/api/v1`: PASS
- web-admin on `http://192.168.200.61:5174/`: PASS
- backend synthetic config schema `c17z18.synthetic.v1`: PASS
- entry node A heartbeat reports
  `c17z18.mesh_rendezvous_lease_report.v1`: PASS
- entry node A heartbeat reports
  `c17z18.mesh_route_path_decision_report.v1`: PASS
- entry node A heartbeat reports
  `c17z18.mesh_route_generation_report.v1`: PASS
- entry node A heartbeat reports
  `c17z18.mesh_route_health_config_report.v1`: PASS
- synthetic route-health runtime uses the replacement effective path
  A -> alternate relay S -> outbound-only C: PASS
- route-health drift detection stays false for the selected effective path:
  PASS
- backend latest mesh links preserve `synthetic_route_health` separately from
  `peer_connection_manager`: PASS
- web-admin Fabric links show route-health observation type, selected relay,
  and effective/observed path: PASS
- payload forwarding boundary flags keep RDP/VPN/service forwarding disabled:
  PASS

C17Z18 report:

- `artifacts/c17z18-route-health-effective-path-report.md`

Additional C17Z19 route-health feedback scoring verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\fabric\c17z19-route-health-feedback-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
backend
agents\rap-node-agent
web-admin
```

Result from docker-test run `c17z19-20260428-214427`:

- isolated backend API on `http://192.168.200.61:18122/api/v1`: PASS
- fresh migration replay through `000022_synthetic_mesh_service_class`: PASS
- `synthetic` mesh route intent service class accepted by PostgreSQL: PASS
- initial fast-path relay selection prefers `node-s`: PASS
- injected synthetic route-health drift for selected relay `node-s` causes
  stale relay replacement through `node-t`: PASS
- route path decision records `node-t` as selected relay and `node-s` as stale
  relay: PASS
- healthy low-latency route-health for `node-t` keeps `node-t` selected with
  `route_health_reachable`, `route_health_no_drift`,
  `route_health_quality`, and `route_health_latency` score reasons: PASS
- signed synthetic config is still required and present: PASS
- payload forwarding boundary flags keep RDP/VPN/service forwarding disabled:
  PASS

C17Z19 report:

- `artifacts/c17z19-route-health-feedback-report.md`
- `artifacts/c17z19-route-health-feedback-smoke-result.json`

Additional C17Z20 route-health feedback refresh verification:

```powershell
go test ./...
cmd /c "pushd \\nas\MST\codex\rdp-proxy\web-admin && npm run build"
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\fabric\c17z12-rendezvous-relay-smoke-ssh.ps1 -KeepRunning
```

Run from:

```powershell
backend
agents\rap-node-agent
web-admin
```

Result from docker-test run `c17z18-20260428-221601`:

- multi-agent backend API on `http://192.168.200.61:18120/api/v1`: PASS
- backend/node-agent images rebuilt on docker-test: PASS
- node A reports `c17z20.mesh_route_health_config_report.v1`: PASS
- node A reports
  `c17z20.mesh_route_health_feedback_refresh_report.v1`: PASS
- route-health failure triggers immediate config refresh before normal
  periodic interval: PASS
- heartbeat reports feedback refresh attempts/successes/failures/suppressed:
  PASS
- replacement route-health effective path through alternate relay remains
  active: PASS
- payload forwarding boundary flags keep RDP/VPN/service forwarding disabled:
  PASS

C17Z20 report:

- `artifacts/c17z20-route-health-feedback-refresh-report.md`

Dev cluster enrollment/bootstrap lifecycle verification:

```powershell
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\fabric\dev-cluster-enrollment-bootstrap-smoke-ssh.ps1 -KeepRunning
```

Result from docker-test run `dev-bootstrap-20260428-201430`:

- isolated backend API on `http://192.168.200.61:18121/api/v1`: PASS
- fresh migration replay through `000021_cluster_authority_keys`: PASS
- first-owner dev bootstrap through `/installation/bootstrap-owner`: PASS
- signed join token, real node-agent enrollment, pending join request, and
  platform-owner approval: PASS
- node-agent automatic bootstrap polling verified signed approval and
  persisted cluster authority pin: PASS
- node heartbeat after bootstrap: PASS
- signed `c17z18.synthetic.v1` Control Plane synthetic config verified and
  loaded by node-agent: PASS
- workload supervision stub is disabled by default, so no repeated admin-only
  desired-workload `403` loop is produced: PASS
- production/service payload forwarding remains disabled: PASS

Dev enrollment/bootstrap report:

- `artifacts/dev-cluster-enrollment-bootstrap-smoke-report.md`

Commands run during P0 baseline freeze:

```powershell
go test ./...
dotnet build .\clients\windows\RemoteAccessPlatform.Windows.slnx
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-region-repair rdp-worker-graphics-adapter-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-region-repair rdp-worker-cursor-adapter-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-region-repair rdp-worker-service-adapter-protocol-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-region-repair rdp-worker-dataplane-bind-probe --scenario valid
```

Additional accepted P1 baseline verification:

```powershell
go test ./...
dotnet build .\clients\windows\RemoteAccessPlatform.Windows.slnx
docker -H ssh://docker-test build --tag rap-rdp-worker:rdp-p1-region-order2 --file workers/rdp-worker/Dockerfile workers/rdp-worker
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-p1-region-order2 rdp-worker-graphics-adapter-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-p1-region-order2 rdp-worker-cursor-adapter-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-p1-region-order2 rdp-worker-service-adapter-protocol-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:rdp-p1-region-order2 rdp-worker-dataplane-bind-probe --scenario valid
pwsh -ExecutionPolicy Bypass -File scripts\smoke\drive-visibility-smoke.ps1 -WorkerImage rap-rdp-worker:rdp-p1-region-order2 -OutputFrame artifacts\stage5-drive-visibility-frame-p1-rerun.bmp
```

Result:

- backend tests: PASS
- Windows build: PASS, 0 warnings, 0 errors
- worker probes: PASS
- P1 worker image build: PASS
- P1 smoke-worker deployment: PASS, `worker:registration:rdp-worker-1`
  reports `status=online`
- P1 manual visual smoke: PASS, idle Task Manager updates, Start menu/hover,
  mouse, keyboard, and session close work; window drag is usable with old-client
  style frame-only movement and non-perfect release repaint
- Stage 5.1.1 restricted drive visibility smoke: PASS, remote Notepad opened
  `stage5-upload-text.txt` from the redirected `RAP_Transfers` drive

Additional P3 security-readiness verification:

```powershell
go test ./...
docker -H ssh://docker-test build --tag rap-rdp-worker:p3-security-probes --file workers/rdp-worker/Dockerfile workers/rdp-worker
$scenarios = @('valid','starting','wrong-worker','wrong-attachment','wrong-user','wrong-organization','wrong-resource','channels-too-broad','failed-state','terminated-state')
foreach ($scenario in $scenarios) {
  docker -H ssh://docker-test run --rm rap-rdp-worker:p3-security-probes rdp-worker-dataplane-bind-probe --scenario $scenario
}
```

Result:

- backend tests: PASS, including production secret-readiness guard tests
- sessionbroker data-plane policy test: PASS
- worker P3 probe image build: PASS
- direct bind denial probes: PASS for valid/starting/wrong-worker/
  wrong-attachment/wrong-user/wrong-organization/wrong-resource/
  channels-too-broad/failed-state/terminated-state

Additional P3.1 secret resolver verification:

```powershell
go test ./...
```

Result:

- encrypted secret AES-256-GCM round trip: PASS
- wrong AAD decrypt rejection: PASS
- assignment-time resolved secret merge: PASS
- session metadata plaintext mutation prevention: PASS
- production missing resolver denial: PASS
- development metadata fallback compatibility: PASS

Additional P3.2 direct worker TLS/PKI guard verification:

```powershell
go test ./...
dotnet build clients\windows\RemoteAccessPlatform.Windows.slnx
```

Result:

- production backend omits smoke-only direct worker WSS candidates: PASS
- production-trusted direct candidate metadata: PASS
- Windows client build with production/smoke direct TLS guard: PASS

Additional P3.3 production secret/TLS test-stand smoke:

```powershell
docker -H ssh://docker-test build --tag rap-backend-smoke:p3-3 --file - backend
Get-Content -Raw backend\migrations\000009_resource_secrets.up.sql |
  docker -H ssh://docker-test exec -i rap_postgres psql -U rap_user -d remote_access_platform -v ON_ERROR_STOP=1 -f -
pwsh -ExecutionPolicy Bypass -File scripts\smoke\drive-visibility-smoke.ps1 `
  -WorkerImage rap-rdp-worker:rdp-p1-region-order2 `
  -ResourceName "P3.3 Secret RDP Resource" `
  -OutputFrame artifacts\p3-3-secret-backed-drive-frame.bmp
```

Result:

- backend image `rap-backend-smoke:p3-3`: PASS
- backend production-like start with `SECRET_ENCRYPTION_KEY_FILE`: PASS
- secret-backed RDP resource through `PUT /api/v1/resources/{id}/secret`: PASS
- real RDP session through resolver-backed assignment: PASS
- resource/session metadata plaintext credential checks: PASS
- audit plaintext credential checks: PASS
- production backend omits smoke-only direct worker WSS candidate: PASS
- development/smoke backend advertises explicit smoke-only direct worker WSS
  candidate: PASS
- backend gateway fallback smoke with rendering/input/clipboard/file upload:
  PASS
- secret-backed detach/reattach/takeover API lifecycle regression: PASS

Additional P3.4 production direct-worker WSS trust design/prep:

- production worker WSS certificate model: documented
- platform CA vs public CA recommendation: documented
- worker certificate SAN and identity binding rules: documented
- app-local Windows client trust approach: documented
- rotation/revocation/fallback behavior: documented
- future `platform_ca` smoke plan: documented
- runtime behavior changed: no

Additional P3.5 app-local platform CA trust smoke:

```powershell
dotnet build clients/windows/src/RemoteAccessPlatform.Windows.App/RemoteAccessPlatform.Windows.App.csproj
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/prepare-platform-ca-direct-worker.ps1 `
  -DockerSshAlias docker-test `
  -LocalCaOutputPath artifacts/p3-5-platform-ca.crt `
  -WorkerHost 192.168.200.61 `
  -WorkerId rdp-worker-1 `
  -ClusterId default
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/windows-smoke/desktop-smoke.ps1 `
  -DefaultResourceName "P3.3 Secret RDP Resource" `
  -PreferDirectDataPlane:$true `
  -AllowInsecureDirectDataPlaneTlsForSmoke:$false `
  -DirectDataPlaneConnectTimeoutMs 2500 `
  -DirectDataPlaneColorMode full_color `
  -DirectDataPlanePlatformCaBundle "\\192.168.220.200\mst\codex\rdp-proxy\artifacts\p3-5-platform-ca.crt" `
  -BackendEnvironment production `
  -SkipOrgSwitchAndTokenRefresh `
  -DockerSshAlias docker-test
```

Result:

- Windows client app-local platform CA bundle support: PASS
- worker WSS test cert with IP SAN and URI SAN: PASS
- backend `platform_ca` candidate metadata: PASS
- production client direct worker WSS selected without insecure TLS bypass:
  PASS
- direct binary render over trusted WSS: PASS
- input/lifecycle smoke over trusted WSS: PASS
- unknown CA rejected and backend gateway fallback activated: PASS
- `smoke_insecure` production case used backend gateway fallback: PASS
- backend gateway fallback remained usable: PASS

P3.5 runtime report:

- `artifacts/p3-5-app-local-platform-ca-smoke-report.md`

New P3.6 hardening finding:

- stale Redis live/worker events after backend restart can crash the backend
  with `invalid session state transition: terminated -> active`
- Redis was safely cleared for the test stand because PostgreSQL is the source
  of truth
- next step should make stale worker events idempotent, not add product
  features

P3.6 stale worker event / restart idempotency hardening:

```powershell
go test ./...
docker -H ssh://docker-test build --tag rap-backend-smoke:p3-6 --file - backend
```

Runtime smoke:

- start real secret-backed RDP session
- wait for PostgreSQL state `active`
- terminate session
- stop backend
- push stale `session_connected` to Redis `worker:events`
- restart backend
- verify backend stays up
- verify PostgreSQL state remains `terminated`
- verify new normal RDP session still reaches `active`

Result:

- stale `session_connected` for terminal session ignored: PASS
- stale render telemetry for terminal session does not recreate live state:
  PASS
- backend restart survives stale Redis worker event: PASS
- terminal PostgreSQL session is not reopened: PASS
- normal new RDP session after restart: PASS

P3.6 runtime report:

- `artifacts/p3-6-stale-worker-event-idempotency-report.md`

Stage 5.2 server-to-client file download design pass:

- safest v1 model selected: restricted `RAP_Transfers\ToClient` outbound
  drop zone
- no Windows agent, SMB/WebDAV, remote filesystem browser, arbitrary path
  download, or expanded drive mapping
- download remains policy-gated by `file_transfer_mode`
- direct worker WSS remains preferred; backend gateway remains fallback
- implementation prompt is documented for the next step

Design document:

- `docs/architecture/RDP_FILE_DOWNLOAD_STAGE_5_2.md`

Stage 5.2 server-to-client file download implementation:

```powershell
go test ./...
dotnet build clients/windows/src/RemoteAccessPlatform.Windows.App/RemoteAccessPlatform.Windows.App.csproj
docker -H ssh://docker-test build --tag rap-rdp-worker:stage5-2-download --file workers/rdp-worker/Dockerfile workers/rdp-worker
docker -H ssh://docker-test run --rm rap-rdp-worker:stage5-2-download rdp-worker-graphics-adapter-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:stage5-2-download rdp-worker-cursor-adapter-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:stage5-2-download rdp-worker-service-adapter-protocol-probe
docker -H ssh://docker-test run --rm rap-rdp-worker:stage5-2-download rdp-worker-dataplane-bind-probe --scenario valid
docker -H ssh://docker-test build --tag rap-backend-smoke:stage5-2-download --file - backend
```

Result:

- backend tests: PASS
- Windows build: PASS, 0 warnings, 0 errors
- worker image build: PASS
- worker probes: PASS
- backend smoke image build: PASS
- live runtime proof: pending

Build report:

- `artifacts/stage5-2-file-download-build-report.md`

Stage 5.2 server-to-client file download runtime proof, core data path:

```powershell
docker -H ssh://docker-test build --tag rap-rdp-worker:stage5-2-download-direct-block --file workers/rdp-worker/Dockerfile workers/rdp-worker
docker -H ssh://docker-test tag rap-rdp-worker:stage5-2-download-direct-block rap-rdp-worker:stage5-2-download
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode server_to_client -Transport direct_worker_wss -OutputDirectory artifacts/stage5-2-download-smoke-direct-fixed2
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode bidirectional -Transport direct_worker_wss -OutputDirectory artifacts/stage5-2-download-smoke-direct-bidirectional
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode client_to_server -Transport direct_worker_wss -ExpectBlocked -OutputDirectory artifacts/stage5-2-download-smoke-direct-client-to-server-block-fixed
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode disabled -Transport direct_worker_wss -ExpectBlocked -OutputDirectory artifacts/stage5-2-download-smoke-direct-disabled-fixed
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode server_to_client -Transport backend_gateway -OutputDirectory artifacts/stage5-2-download-smoke-backend-regression-after-direct-block
```

Result:

- direct worker WSS `server_to_client`: PASS, text and binary size/hash match
- direct worker WSS `bidirectional`: PASS, text and binary size match
- direct worker WSS `client_to_server`: PASS, download blocked with
  `access denied`
- direct worker WSS `disabled`: PASS, download blocked with `access denied`
- backend gateway fallback `server_to_client`: PASS, text and binary size/hash
  match
- direct WSS smoke harness bug fixed: PowerShell TLS callback now uses a static
  .NET delegate and URL query construction now uses `?` correctly
- direct WSS policy feedback bug fixed: disallowed file download now returns
  `file_download.blocked` instead of silently dropping the request

Stage 5.2 server-to-client file download lifecycle proof:

```powershell
docker -H ssh://docker-test build --tag rap-rdp-worker:stage5-2-download --file workers/rdp-worker/Dockerfile workers/rdp-worker
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode server_to_client -Transport direct_worker_wss -LifecycleScenario detach -OutputDirectory artifacts/stage5-2-download-lifecycle-detach-fixed
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode server_to_client -Transport direct_worker_wss -LifecycleScenario takeover_old_controller -OutputDirectory artifacts/stage5-2-download-lifecycle-takeover-fixed
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode server_to_client -Transport direct_worker_wss -LifecycleScenario worker_failure -OutputDirectory artifacts/stage5-2-download-lifecycle-worker-failure
pwsh -NoProfile -ExecutionPolicy Bypass -File scripts\smoke\file-download-smoke.ps1 -AllowMode server_to_client -Transport direct_worker_wss -OutputDirectory artifacts/stage5-2-download-smoke-direct-after-lifecycle-fix
```

Result:

- detach: PASS, PostgreSQL state `detached`, outcome `file_download.blocked`,
  reason `session is not active`
- old-client takeover: PASS, stale attachment receives `session.taken_over`
  and cannot continue download
- worker failure: PASS, PostgreSQL state `failed`, audit `session_failed`,
  direct WebSocket closes and download cannot continue
- post-fix direct download regression: PASS, text and binary size match
- direct WSS stale attachment feedback bug fixed: stale attachment now receives
  `session.taken_over` instead of observing silence

Runtime report:

- `artifacts/stage5-2-file-download-runtime-report.md`

Coverage warning:

- this is not a full live RDP smoke pass
- most confidence for RDP UX still comes from manual/live smoke history
- automated regression coverage must be expanded before production readiness

## Correct Next Step

C17Z20 is complete. Do not automatically continue into VPN runtime, RDP work, or
service workload traffic.

The next step must be chosen as a new explicit staged prompt. Until then, keep
the proven C17A-C17Z20 mesh proof/gate/contract/observation/config/scoring/
visibility/fabric-control-forwarding/forwarding-observability/route-config
boundary/scoped-peer-directory/peer-cache-runtime/dynamic-endpoint-reporting
private/corporate endpoint candidate/peer-connection-state/recovery-planner
/connection-intent/connection-manager/rendezvous-lease-telemetry/lease-refresh
/relay-replacement-policy/route-path-decision/route-generation-tracker/
synthetic-route-health-effective-path/route-health-feedback-scoring/
route-health-feedback-refresh set preserved. Production forwarding remains
explicitly gate-controlled and limited to `fabric.control`; service payload
forwarding remains unavailable.

Do not start:

- RDP performance work
- Stage 5.2 RDP download UI proof
- production service mesh runtime traffic
- VPN/IP tunnel runtime implementation
- C18D VPN credential/config resolver work
- TUN/TAP, host route, or firewall manipulation
- general relay packet routing
- service workload traffic over mesh
- RDP/VNC/SSH/file/video traffic over mesh
- QUIC/WebRTC
- service workload execution
- backend/session lifecycle changes
- Windows client changes

RDP status:

- RDP is paused by product decision.
- RDP-Perf-6 is completed and smoke-proven.
- The C++ RDP Adapter remains the preserved runtime baseline for when RDP work
  explicitly resumes.
- C10-C17 planning are completed as documentation/planning. C17A, C17B, C17C,
  C17D, C17E, C17F, C17G, C17H, C17I, C17J, C17K, C17L, C17M, C17N, C17O, C17P, C17Q, C17R, C17S, C17T, C17U, C17V, C17W, C17X, C17Y, C17Z, C17Z1, C17Z2, C17Z3, C17Z4, C17Z5, C17Z6, C17Z7, C17Z8, C17Z9, C17Z10, C17Z11, C17Z12, C17Z13, C17Z14, C17Z15, C17Z16, C17Z17, C17Z18, C17Z19, and C17Z20 are implemented/proven
  with synthetic traffic, explicit production-forwarding gate checks, envelope
  contract validation, metadata-only observation, or bounded local observation
  retention/wiring/metrics/local logging/capacity guard/fail-closed hardening
  and payload/time-boundary validation only. C18 planning is completed as
  documentation only. C18A
  control-plane data model foundation is implemented and backend-test-proven.
  C18B lease/fencing hardening is implemented and backend-test-proven. C18C
  node-agent desired-state consumption/reporting is implemented and
  backend-test-proven. C18 runtime is not authorized.