IVV and IVVQ

Original wiki metadata (recorded baseline)

Status: Version-specific Documentation baseline: v4.10.4 Strategy approved: 29 September 2026

SysWarden distinguishes the assurance required for an intermediate release from full qualification of a new generation. This page explains the policy introduced for the v4.10.0 transition and future generations. It is not a release verdict and does not change the historical stable v4.04.3 procedures.

The two assurance tracks#

IVV means Integration, Verification and Validation. Intermediate Patch, Minor and Major releases require it. The release decision covers the exact candidate, CI and security results, package authenticity, installation and update behavior, and regressions selected through documented change-impact analysis.

IVVQ means Integration, Verification, Validation and Qualification. Version-specific Upgrade plans, including v5.00.0 LTS and v6.00.0, require the complete qualification plan: supported native profiles, lifecycle, migrations, HA endurance, performance, protected acceptance and verified restoration.

These are SysWarden's engineering assurance tracks, not external certification claims. Neither term promises freedom from defects.

Exact auto-versioning terminology#

The following version-specific arithmetic examples all start from v0.00.0:

Major advances the middle component to its next multiple of ten. It does not increment the first component. Upgrade increments the first component and resets the other two. Version-specific example: v4.xx.y to v5.00.0 is an Upgrade. This is the project's explicit versioning scheme; generic use of the word "major" must not replace it.

Preserve the recognized prefix in the first line of the resulting commit on main. Classification follows the original validated version transition, including across later corrective commits. A corrective PR cannot downgrade an Upgrade to IVV. The LTS label and a development estimate do not select the track or grant acceptance.

What remains mandatory for an intermediate release#

• Bind checks to exact source revisions, build inputs and package digests.
• Pass applicable CI, security and functional regression checks, including positive and negative tests of changed protections and shared dependencies.
• Cover affected installation, service lifecycle, update and recovery paths.
• Preserve native package signatures and verify the signed tag, immutable release manifest, Sigstore identity and final asset digests.
• Retain failed attempts, unresolved limitations and verified restoration.
• Complete the protected acceptance required by the selected release policy.

Long endurance campaigns are selected by impact and the release's claims for an intermediate release. They are not automatically repeated for every correction. A change to the HA mechanism or an observed regression can still require new native HA work. IVV is not permission to waive a blocking defect.

Historical evidence remains bound to its original commit and artifacts. An explicit continuity assessment may retain relevant evidence or justify a targeted replay. It must never silently relabel an old pass as a new result. The same applies to documentation-only changes: source and payload continuity must be established before evidence is admitted to a release decision.

v4.10.4 Patch acceptance#

The v4.10.4 release was published on 10 October 2026 after protected IVV and production review. The IVV producer accepted all fifteen checks. Independent consumption verified its original report and attestation, source continuity, native signatures, updater identity and tested package bytes. The IVV artifact is 11673285722.

The signed product is 0e966d409b6b9d19116597edee1feafad0c83688. The publication tag points to c4bb1f7fdf48fd80652b6870af5babda0b16ad6e with tag object 725bd2b5982b4388ec348dba615d9d251f2981ce. The reviewed plan keeps those product bytes frozen while separately binding publication tooling. Go 1.26.9 and the updated dependency closure are part of the rebuilt product; earlier packages and Go evaluation results cannot authorize it.

Fresh Debian 13 checks cover the official v4.10.3 updater, rejected modified update material, service/reload/reboot behavior, original VPN client bytes and encrypted traffic. Standalone uninstall, APT remove, APT purge and deferred purge after an administrator edit have independent observations.

AlmaLinux 10.2 checks cover standard installation, upgrade from v4.10.2, NetworkManager/firewalld coexistence, IPv6 discovery, Router Advertisements, DHCPv6 renewal, frontend and product reloads, reboot, SSH access and retained administrator groups and sudo policy. Standard RPM erase, CLI uninstall, dependency-absent retry and optional package-owned RPM recovery preserve unrelated protection and acknowledged administrator configuration.

The bounded kernel comparison has six paired rounds per family and 48,000 UDP request-response samples. It does not establish wire-rate throughput, physical core affinity, all-platform performance or HA endurance. APK has signature, construction and payload verification without a fresh Alpine lifecycle. External feed access observations cannot guarantee future availability. Both native test systems were restored and their baselines verified.

The protected publisher completed after owner production approval. All twelve files were independently downloaded without credentials and checked against the accepted bytes, native signatures, updater and exact-tag GitHub Sigstore provenance. The dated publication record preserves the exact identities, publisher attempt and evidence limits. Original failed attempts are retained; no historical verdict is relabeled as a fresh native pass.

Historical v4.10.3 Patch acceptance#

The v4.10.3 release was published on 8 October 2026 after protected Patch IVV and production review. The protected IVV run accepted all fourteen checks. Independent consumption verified its report attestation, source continuity, native signatures, signed updater and original tested product bytes. Its artifact is 11557873608.

The frozen signed and native-tested product is 0a0fa7e7669fe61c36b6ed84e27a42d71cc7063e. The signed publication tag points to 2bbb1df10f0b6957a8393dec71f7135af3e098ca; its tag object is 17a93dd2557360e61b0124500042fdf63f54d69b. The reviewed acceptance plan keeps runtime inputs and signed packages frozen while binding the later reviewed publication tooling separately.

Fresh Debian 13 observations cover the actual official v4.02.8 updater, pre-unpack refusal, an actual v4.10.2 half-configured upgrade, explicit old VPN retirement, migration of recognized unmanifested current VPN files, preserved client identity and encrypted traffic, interrupted migration, filesystem renumbering, authenticated update and optional OSINT installation behavior.

Four independent removal campaigns cover standalone uninstall, APT remove alone, APT purge, and remove followed by an administrator edit and deferred purge. Each preserves administrator configuration and effective unrelated protection after shared-service reloads and its own real reboot. The combined scope includes 576 IPv4 and IPv6 packet outcomes and 213 administrator paths. The complementary campaign contains eleven successful encrypted VPN probes; the final restored baseline passes 147 controls.

This remains targeted IVV. Recognized templates and disposable keys do not represent every customized installation or historical upgrade chain. A modern owned-manifest traffic profile uses explicit temporary operator forwarding rules; the patch does not automatically repair unrelated firewall policy. HTTPS fixtures and controlled interruption do not establish live-feed availability or power-loss durability. Original failed attempts remain retained evidence. Earlier platform and HA observations keep their original identities; no new all-platform lifecycle or HA endurance claim is made.

The protected publisher completed on its second attempt. The first attempt stopped on a private draft asset download; independent readback verified the unchanged draft before the standard protected retry. All twelve public files were independently downloaded without credentials and checked against exact digests, native signatures, signed updater material and GitHub Sigstore provenance for the release tag. The dated publication record preserves exact identities, the failed-attempt boundary and a manifest verification command.

Use the canonical historical recovery guide for operational steps. Unknown ownership or changed evidence remains a refusal; release acceptance is not a guarantee that every local recovery is complete.

Historical v4.10.2 Patch acceptance#

The v4.10.2 release was published on 2 October 2026 after protected Patch IVV and production review. The protected IVV run accepted all eleven checks. Its immutable artifact is 11247310563; independent consumption verified its report attestation, original product provenance, updater signature and exact tested package bytes.

The frozen signed and native-tested product is 94d97f07cb5a054669dd66d6efd28ba55db5d173. The signed publication tag points to 4bb302512636b001ecf78490177d3d4883513838; its tag object is e2cf94187648b532de9816934195110af3371444. The later publication source changes only the reviewed acceptance tooling, tests and documentation. The acceptance plan binds the full public-release source delta, including the unpublished v4.10.1 changes. The v4.10.1 tag and retained private draft remain unchanged.

The Debian 13 campaign used recognized historical templates with synthetic keys and the relevant hardening subset. It covered active-service and ownership refusals, guided retirement after historical PostDown, stale-plan rejection, retry after a controlled archive I/O failure, current and administrator VPN preservation, interrupted native removal, missing-payload repair, signed update, native purge and same-version reinstall, two reboot checks and final restoration.

This is targeted IVV. It does not reproduce every customized installation or historical upgrade chain. The archive failure is not a power-loss test. Operator configuration and lists were restored explicitly from private backups after purge. The update observation used the attested candidate CLI. The patch claims no new all-platform native campaign, HA endurance or broad performance result. Original failed harness captures are retained without relabeling them as passes. The original v4.10.0 IVV remains historical support under its original identities.

The protected publisher succeeded with the same accepted package and updater bytes. All twelve public release files passed independent download, inventory, checksum, signature and GitHub Sigstore provenance verification. The exact checksum manifest also has an additional verified personal Sigstore signature, recorded in Rekor entry 3060931957. The publication record and verification bundle provide the exact identities and verification command. Private host captures, configuration, operational identifiers and credentials are not part of the public release.

Historical v4.10.0 implementation status#

The v4.10.0 Major transition completed protected IVV acceptance and was published on 1 October 2026. The protected run accepted all twelve checks, preserving each evidence set's original candidate. The tested product is 8c3405758a9b369924f466d12652e99d3a84dc56; the signed publication commit is 3cc06b62d42b5adadc46fc9a252fece5adf670c1.

All twelve public release files were downloaded and verified independently, including their original GitHub provenance attestations. The exact checksum manifest has a verified Sigstore signature; see Rekor entry 3035233768.

The original protected publisher failed on a private-draft metadata read using GitHub's published-only tag endpoint. The owner explicitly approved recovery with the already verified draft ID. All frozen content, tag, protection and snapshot checks were retained; only the metadata read endpoint changed. Public downloads and signatures were reverified. The failed workflow remains recorded as failed. This bounded exception does not change normal publication policy.

This is an intermediate IVV validation, not full IVVQ. The historical HA endurance runs retain their original candidate; the current HA replay is functional. Native traffic evidence is IPv4, with IPv6 list and kernel-state checks. The private APK 3 qualification-bundle update path is outside the plan. Historical deployment runbooks retain their v4.04.3 boundary; later source builds do not inherit this release verdict.

PR273 introduced the release classification. PR280 supplied the protected intermediate acceptance producer and independent consumers. The dated policy source remains the classification reference. Frozen qualification contracts and historical verdicts are preserved.