# v0.7.0 Validation Matrix

| Field | Value |
|------|-----|
| Version | 0.7.0 |
| Status | FINAL |
| Created | 2026-05-17 |
| Updated | 2026-05-29 |

## Risk Pack × Verification Command Matrix

| Risk Pack | Verification Command | Covered Workstream | Associated Rule |
|-----------|---------|-----------------|----------|
| runtime-streaming | `make test-nginx-unit-streaming` | A | 1, 2, 38 |
| runtime-streaming | `make verify-chunked-native-e2e-smoke` | A | 1, 2, 38 |
| runtime-streaming | `make verify-streaming-failure-cache-e2e` | A, E | 1, 2, 38 |
| ffi-boundary | `make test-rust` | A, B | 15 |
| ffi-boundary | `make test-rust-fuzz-smoke` | A, B | 15 |
| ffi-boundary | `make build && make check-headers` | A | 15 |
| ffi-boundary | `make test-nginx-unit` | A, B | 15 |
| nginx-protocol-safety | `make test-nginx-unit` | A | Baseline |
| nginx-protocol-safety | `make test-nginx-integration` | A, B | Baseline |
| nginx-protocol-safety | `make test-e2e-rust` | A, B | Baseline |
| observability-metrics | `make test-nginx-unit` | A, B, E | 7, 8, 23 |
| observability-metrics | `make release-gates-check` | B, E | 7, 8, 23 |
| packaging-distribution | `make docs-check` | C, D | 9 |
| packaging-distribution | `dpkg-deb --info` / `rpm -qip` | C | 9 |
| packaging-distribution | `helm lint charts/nginx-markdown` | D | 9 |
| dynamic-config-hot-reload | `make test-nginx-unit` | E | 34, 35 |
| dynamic-config-hot-reload | `make verify-streaming-failure-cache-e2e` | E | 34, 35 |
| docs-tooling-drift | `make docs-check` | C, D, E | 9 |
| docs-tooling-drift | `make release-gates-check-strict` | E | 9 |
| release-governance | `make release-gates-check` | C, E | 13 |
| harness-remediation | `make harness-check` | All | 36 |
| harness-remediation | `make harness-check-full` | All | 36 |

## Workstream × Verification Command Matrix

| Workstream | Minimum Verification Set | Full Verification Set |
|-----------|-----------|-----------|
| A | `make test-nginx-unit-streaming && make test-rust && make verify-chunked-native-e2e-smoke` | + `make test-rust-fuzz-smoke && make test-nginx-integration && make test-e2e-rust && make coverage-c && make coverage-rust` |
| B | `make test-rust && make test-nginx-unit && make coverage-rust` | + `make test-rust-fuzz-smoke && make test-e2e-rust && make coverage-c` |
| C | `make docs-check` | + tag-only `release-packages.yml` release-gate job, DEB/RPM smoke, signature verification |
| D | `make docs-check && helm lint charts/nginx-markdown` | + K8s smoke, E2E when promoted beyond feasibility |
| E | `make test-nginx-unit && make docs-check && make harness-check` | + `make verify-streaming-failure-cache-e2e && make release-gates-check-strict && make harness-check-full` |

## Gate × Verification Command Matrix

| Gate | Verification Command | Blocking Condition |
|------|---------|---------|
| Gate 1 (P0 Correctness) | `make test-nginx-unit-streaming && make test-rust && make test-rust-fuzz-smoke && make verify-chunked-native-e2e-smoke && make coverage-c && make coverage-rust` | Any command non-zero exit |
| Gate 2 (Rust-first) | `make test-rust && make build && make check-headers && make test-e2e-rust` | Any command non-zero exit |
| Gate 3 (Package) | GitHub Release DEB/RPM artifacts build + install-layout validation + smoke tests + optional signature verification | Build, layout, smoke, checksum, or required signature failure |
| Gate 4 (K8s) | `helm lint`; K8s smoke remains feasibility scope unless explicitly promoted | helm lint fails |
| Gate 5 (Operability) | `make harness-check-full && make docs-check && make release-gates-check-strict` | Any command non-zero exit |

## Release Gate Policy

- Pull request and branch CI do not run release gates.
- Release gates run only from the tag publishing path in
  `.github/workflows/release-packages.yml` after package smoke tests pass and
  before GitHub Release publication.
- `make release-gates-check-070` remains the local comprehensive release
  readiness command for maintainers who have nightly fuzz tooling, `NGINX_BIN`,
  and release packages available. The tag publishing workflow is the canonical
  CI release gate for artifact publication.
- 0.7.0 GA includes GitHub Release DEB/RPM artifacts and package smoke tests.
  APT/YUM repository publication is not part of the 0.7.0 GA distribution
  channel until repository URLs, signing keys, and publication workflows are
  real and validated.
- K8s chart lint/render validation is a 0.7.0 gate. Live cluster smoke remains
  feasibility evidence unless explicitly promoted to a GA blocker.

## Final Release Scope

The 0.7.0 release baseline is final for source, Rust ABI, NGINX module,
release workflow, GitHub Release DEB/RPM artifacts, checksums, package smoke,
docs, and harness governance.

The following are not 0.7.0 GA blockers unless a maintainer explicitly
promotes them before tagging:

- APT/YUM repository publication.
- Live cluster K8s smoke beyond chart lint/render validation.
- Re-running local native E2E on a workstation without `NGINX_BIN`.

## Document Updates

| Version | Date | Author | Changes |
|------|------|------|------|
| 0.7.0-draft | 2026-05-17 | spec-agent | Initial v0.7.0 validation matrix |
| 0.7.0-impl | 2026-05-18 | codex | Added real command execution results and gate-scope notes |
| 0.7.0-final | 2026-05-29 | Kang | Marked matrix final, made release gates tag-only, and clarified package/K8s GA scope |

## Validation Run (2026-05-18)

| Command | Result | Evidence / Notes |
|------|------|------|
| `make build` | PASS | Rust library + cbindgen header generation completed |
| `make check-headers` | PASS | Header sync check passed |
| `make test-rust` | PASS | Rust unit/property/integration suite passed, including new header-plan lifecycle tests |
| `make test-nginx-unit` | PASS | Unit suite passed after adding missing include path for `ffi_layout_check_test` |
| `make test-nginx-unit-streaming` | PASS | Streaming unit suite passed (`All streaming tests passed!`) |
| `make test-e2e-rust` | PASS | e2e-harness smoke suite completed successfully after conversion output path fix |
| `make harness-check-full` | PASS | Harness/docs/security checks passed (with non-blocking warnings from existing detectors) |
| `make release-gates-check-070` | PASS | Strict mode: 15 PASS / 0 FAIL / 2 SKIP |

## Optional Validation Status

| Item | Result | Notes |
|------|------|------|
| Coverage (`make coverage-c`, `make coverage-rust`) | PASS | C and Rust coverage pipelines completed and generated lcov artifacts |
| Fuzz smoke (`make test-rust-fuzz-smoke`) | LOCAL TAG AUDIT | Required for final local tag audit unless explicitly waived by the release owner |
| Chunked native E2E smoke | LOCAL TAG AUDIT | Required for final local tag audit when `NGINX_BIN` is available |
| Package smoke | RELEASE-WORKFLOW | Tag publishing path builds DEB/RPM artifacts, validates install layout, and runs package smoke before publication |
| K8s smoke | FEASIBILITY | Chart lint/render remains GA blocking; live cluster smoke is non-blocking unless explicitly promoted |
