# v0.7.0 Release Gates

| Field | Value |
|------|-----|
| Version | 0.7.0 |
| Status | IMPLEMENTATION BRANCH (Blocking gates scoped to runtime/ffi/quality) |
| Created | 2026-05-17 |
| Predecessor | 0.6.0 release gates |

## Gate 1: P0 Runtime Correctness

| Check Item | Verification Command | Blocking Condition |
|--------|---------|---------|
| NGINX streaming unit tests | `make test-nginx-unit-streaming` | Non-zero exit |
| Rust full test suite | `make test-rust` | Non-zero exit |
| Rust fuzz smoke | `make test-rust-fuzz-smoke` | Non-zero exit |
| Chunked E2E smoke | `make verify-chunked-native-e2e-smoke` | Non-zero exit |
| C coverage ≥ 80% | `make coverage-c` | aggregate < 80% |
| Rust coverage ≥ 80% | `make coverage-rust` | aggregate < 80% |
| Critical path coverage ≥ 90% | coverage report | critical < 90% |
| Pending chain persistence tests | (unit test) | Test failure |
| Fail-open replay tests | (unit test) | Test failure |
| Output ordering tests | (unit test) | Test failure |
| Bounded decompression tests | (unit + fuzz test) | Test failure |
| Accept negotiation tests | (table-driven test) | Test failure |
| FFI ABI drift check | `make build && make check-headers` | Header inconsistency |

**Prerequisites**: None
**Acceptance Criteria**: All check items pass

---

## Gate 2: Rust-first Architecture

| Check Item | Verification Command | Blocking Condition |
|--------|---------|---------|
| FFI boundary tests | `make test-rust && make test-nginx-unit` | Test failure |
| Header drift CI | (CI step) | Drift detected |
| Rust E2E tests | `make test-e2e-rust` | Test failure |
| Layout tests | (Rust unit test) | size/offset mismatch |
| Migration contract documentation coverage | docs review | FFI function not documented |
| Reason-code single source | (validator) | C side has independent constants |
| Delivery ≠ Decision counters | (unit test) | Semantics violation |

**Prerequisites**: Gate 1 passes
**Acceptance Criteria**: All check items pass

---

## Gate 3: Package Distribution

| Check Item | Verification Command | Blocking Condition |
|--------|---------|---------|
| DEB build full matrix | Tag `release-packages.yml` workflow | Build failure |
| RPM build full matrix | Tag `release-packages.yml` workflow | Build failure |
| DEB package signature | `gpg --verify` | Invalid signature |
| RPM package signature | `rpm -K` | Invalid signature |
| DEB metadata integrity | `dpkg-deb --info` | Missing field |
| RPM metadata integrity | `rpm -qip` | Missing field |
| NGINX ABI dependency declaration | Package metadata check | Dependency missing or mismatched |
| Install smoke | Tag `release-packages.yml` smoke-test matrix | Install or verification failure |
| Upgrade/rollback tests | Version switch test | Upgrade or rollback failure |
| Installation docs integrity | `make docs-check` | Docs missing or outdated |

**Prerequisites**: Gate 2 passes
**Acceptance Criteria**: GitHub Release DEB/RPM artifacts, checksums,
install-layout validation, and package smoke tests pass before publication.
APT/YUM repository publication is outside the 0.7.0 artifact channel until
repository URLs, signing keys, and publication workflows are real and
validated.

---

## Gate 4: Kubernetes/Ingress

| Check Item | Verification Command | Blocking Condition |
|--------|---------|---------|
| Helm chart lint | `helm lint charts/nginx-markdown` | Lint failure |
| Helm template rendering | `helm template test charts/nginx-markdown` | Rendering failure |
| K8s manifest dry-run | `kubectl apply --dry-run=client -f manifest/` | Verification failure |
| K8s smoke tests | Smoke script | Functionality not passing when promoted for the release |
| Custom image build | `docker build` | Build failure |
| F5 integration assessment | Documentation complete | Assessment incomplete |

**Prerequisites**: Gate 3 passes
**Acceptance Criteria**: Chart lint/render validation passes for 0.7.0 GA.
Live cluster smoke and F5 integration evidence are release evidence inputs and
become blocking only when explicitly promoted for the tag.

---

## Gate 5: Operability + Docs + Harness

| Check Item | Verification Command | Blocking Condition |
|--------|---------|---------|
| Harness full verification | `make harness-check-full` | Non-zero exit |
| Docs check | `make docs-check` | Non-zero exit |
| Release gates strict | `make release-gates-check-strict` | Non-zero exit |
| Release workflow tool preflights | `make release-gates-check-070` | Required binary inspection tool missing or unchecked |
| Rust toolchain consistency | `make release-gates-check-070` | `rust-toolchain.toml`, `rust-version`, or workflow toolchain drift |
| Release artifact build invariants | `make release-gates-check-070` | Package workflow omits `--locked`, intended features, target triple, or canonical/legacy marker |
| New config validator | (validator) | New directive without validator |
| New metric validator | (validator) | New metric without validator or name mismatch |
| New reason-code validator | (validator) | Rust+C+docs+metrics misaligned |
| Package metadata validator | (validator) | Metadata incomplete |
| K8s manifest validator | (validator) | Lint not passing |
| README update | docs review | Version or features not updated |
| CHANGELOG update | docs review | [0.7.0] section missing |
| AGENTS.md update | docs review | New rules not reflected |
| Workflow path-filter update | CI review | New surfaces not covered |

**Prerequisites**: Gate 1 passes (can run in parallel with Gates 2-4)
**Acceptance Criteria**: All check items pass

---

## Gate 6: Fuzz & Packaging Infrastructure (Release Integration)

| Check Item | Verification Command | Blocking Condition |
|--------|---------|---------|
| Fuzz targets exist and buildable | `validate_fuzz_packaging_070.py` (fuzz:targets-exist) | fuzz/Cargo.toml missing or no [[bin]] targets |
| ClusterFuzzLite PR workflow exists | `validate_fuzz_packaging_070.py` (fuzz:cflite-pr-workflow) | .github/workflows/cflite_pr.yml missing |
| Nightly batch fuzz workflow exists | `validate_fuzz_packaging_070.py` (fuzz:cflite-batch-workflow) | .github/workflows/cflite_batch.yml missing |
| Corpus pruning mechanism exists | `validate_fuzz_packaging_070.py` (fuzz:corpus-pruning) | .github/workflows/cflite_cron.yml missing or no prune mode |
| Fuzz guide document complete | `validate_fuzz_packaging_070.py` (fuzz:guide-exists, fuzz:guide-rules) | fuzz/README.md missing or FUZZ-001..007 rules absent |
| Release package workflow exists | `validate_fuzz_packaging_070.py` (pkg:release-workflow) | .github/workflows/release-packages.yml missing |
| Artifact naming includes NGINX version | `validate_fuzz_packaging_070.py` (pkg:nfpm-config, pkg:artifact-naming-workflow) | nFPM config or workflow missing NGINX_VERSION |
| SHA256SUMS generation logic exists | `validate_fuzz_packaging_070.py` (pkg:sha256sums) | No SHA256SUMS generation in release workflow |
| Install/compatibility documentation | `validate_fuzz_packaging_070.py` (docs:install, docs:compatibility) | Installation or compatibility docs missing |
| Package smoke test job exists | `validate_fuzz_packaging_070.py` (pkg:smoke-test-job) | No smoke test job in release workflow |
| Harness rules FUZZ-001..007 defined | `validate_fuzz_packaging_070.py` (fuzz:guide-rules) | fuzz/README.md missing rule definitions |

**Prerequisites**: Gate 1 passes
**Acceptance Criteria**: All check items pass. Validated by `python3 tools/release/gates/validate_fuzz_packaging_070.py`.

---

## Go/No-Go Decision

| Gate | Owner | Decision Point | Criteria |
|------|--------|-----------|------|
| Gate 1 | Module developer | After Phase 0 completion | All PASS |
| Gate 2 | Module developer | After Phase 1 completion | All PASS |
| Gate 3 | Platform engineer | After Phase 2 completion | All PASS |
| Gate 4 | Platform engineer | After Phase 3 completion | All PASS |
| Gate 5 | Full team | After Phase 4 completion | All PASS |
| Gate 6 | Release engineer | After fuzz/packaging integration | All PASS |

**Final Go**: 0.7.0 release blocking scope is Gates 1 through 6 as defined
above. Gate 3 is satisfied by the tag `release-packages.yml` build,
install-layout, checksum, and smoke-test chain. Gate 4 is satisfied by chart
lint/render validation; live cluster smoke and F5 integration evidence are
recorded as release evidence inputs when promoted for a tag.

## Document Updates

| Version | Date | Author | Changes |
|------|------|------|------|
| 0.7.0-draft | 2026-05-17 | spec-agent | Initial v0.7.0 release gates definition |
| 0.7.0-impl | 2026-05-18 | codex | Added implementation-era package/K8s gate scope notes |
| 0.7.0-int | 2026-05-20 | spec-33 | Add Gate 6 (Fuzz & Packaging Infrastructure) reflecting validate_fuzz_packaging_070.py checks |
| 0.7.0-final | 2026-05-29 | Kang | Finalized 0.7.0 package/K8s gates and moved release gate execution to tag publication |
