serverless-ircd 0.5.0 → 0.7.0

package/.github/workflows/ci.yml

@@ -42,6 +42,32 @@ jobs:
           node-version: 24
           cache: pnpm
 
+      # DynamoDB Local capability for `aws-adapter` coverage.
+      #
+      # The `aws-adapter` package's vitest `globalSetup` boots a real
+      # DynamoDB Local instance so the integration suite (handlers,
+      # aws-runtime, transactions, …) can be exercised under coverage.
+      # Without it, 171 of 294 tests `describe.skipIf` away and the
+      # package drops to ~42% coverage, blowing the 90% gate.
+      #
+      # The self-hosted Gitea runner image (`ubuntu-latest`) ships with
+      # neither Docker (testcontainers' Ryuk reaper fails with "Failed
+      # to connect to Reaper" without a `docker.sock` mount or
+      # privileged mode) nor a JRE. We install a JRE here via the
+      # canonical `setup-java` action so the globalSetup's ZIP fallback
+      # can fire — this is the only strategy the runner image can
+      # support without host-level privileged-mode configuration.
+      #
+      # `DDB_LOCAL_STRATEGY=zip` is pinned on the coverage step below
+      # so the globalSetup skips the testcontainers probe entirely
+      # (otherwise it blocks for ~60s waiting for Ryuk before falling
+      # back, which is flaky and wastes CI minutes).
+      - name: Setup Java (JRE for DynamoDB Local ZIP fallback)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '11'
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -52,6 +78,12 @@ jobs:
         run: pnpm typecheck
 
       - name: Test with coverage
+        # `DDB_LOCAL_STRATEGY=zip` pins the DynamoDB Local boot to the
+        # Java ZIP fallback (see the `Setup Java` step above for why).
+        # This skips the testcontainers probe so the runner does not
+        # block ~60s waiting for Ryuk before falling back.
+        env:
+          DDB_LOCAL_STRATEGY: zip
         run: pnpm coverage
 
       - name: Coverage gate (coverage-thresholds enforced per package)
@@ -90,7 +122,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: coverage
           path: |
@@ -119,7 +151,12 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Build workspace (irc-core mutation targets)
-        run: pnpm build
+        # Scope the build to irc-core and its workspace deps only. The
+        # mutation spot-check mutates irc-core/protocol and irc-core/commands,
+        # so building the rest of the workspace (notably @serverless-ircd/web,
+        # which spawns `yarn` to build the Kiwi upstream SPA) is unnecessary
+        # and fails on runner images that don't ship yarn.
+        run: pnpm turbo run build --filter=@serverless-ircd/irc-core...
 
       - name: Stryker spot-check on irc-core/protocol
         # Mutation score threshold >=80% is enforced by the
@@ -135,7 +172,7 @@ jobs:
 
       - name: Upload mutation report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: mutation-report
           path: packages/irc-core/reports/mutation

package/.github/workflows/deploy-aws.yml

@@ -38,8 +38,7 @@ name: deploy-aws
 #                          behaviour).
 
 on:
-  push:
-    branches: [main]
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 # OIDC web identity requires id-token write; contents:read for checkout.

package/.github/workflows/deploy-cf-tcp.yml

@@ -16,11 +16,7 @@ name: deploy-cf-tcp
 #   CF_TCP_ORIGIN_ADDRESS   Hostname/IP of the container origin.
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - 'apps/cf-tcp-container/**'
-      - '.github/workflows/deploy-cf-tcp.yml'
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 concurrency:

package/.github/workflows/deploy-cf.yml

@@ -25,8 +25,7 @@ name: deploy-cf
 # custom routes are wired.
 
 on:
-  push:
-    branches: [main]
+  # Automatic push trigger disabled; deploy only runs manually.
   workflow_dispatch:
 
 # Prevent two deploys racing the same DO namespace.

package/.gitmodules

@@ -1,3 +1,6 @@
 [submodule "docs"]
 	path = docs
 	url = https://gitea.com/fowlmouth/ServerlessIRCd.wiki.git
+[submodule "apps/web/upstream"]
+	path = apps/web/upstream
+	url = https://github.com/kiwiirc/kiwiirc.git

package/CHANGELOG.md

@@ -10,6 +10,480 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.7.0] - 2026-08-04
+
+The headline is the **web client (Phase 14)**: a vendored **Kiwi IRC**
+SPA served at `/app/` and a static project landing page served at `/`
+directly by the Cloudflare Worker, with **Cross-Site WebSocket
+Hijacking (CSWSH) defense** wired into the WS upgrade path. The browser
+opens a native `wss://` straight to the existing IRC-over-WebSocket
+endpoint — no proxy, gateway, or transport adaptation in the hot path.
+Alongside it: a round of **test hardening** (mutation-killing tests for
+`irc-core`'s parser / batch / numerics, and CF-harness / scenario fixes
+for slow transports).
+
+### Added — Web client (`@serverless-ircd/web`, `@serverless-ircd/cf-worker`)
+
+Six Phase 14 tickets light up the project's browser surface. The Worker
+becomes the single origin for the landing page, the SPA, **and** the
+WebSocket. Same-origin by default — which is what makes the CSWSH
+defense almost zero-config.
+
+- **`apps/web` workspace package (`@serverless-ircd/web`)**: a new
+  pnpm workspace package owning the Kiwi build orchestration and config
+  schema. The package layout reserves `dist/app/` for the Kiwi SPA
+  (served at `/app/`) and `dist/index.html` for the landing page
+  (served at `/`). No `@serverless-ircd/*` runtime dependency —
+  Kiwi talks to the Worker over plain WebSocket.
+- **Kiwi IRC vendored as a git submodule** (`apps/web/upstream/`,
+  tag-pinned): `scripts/build.mjs` patches the upstream `publicPath`
+  to `/app/`, runs `yarn build` inside the submodule, copies
+  `upstream/dist/` → `apps/web/dist/app/`, then layers our validated
+  `static/config.json` over the upstream default. The patch runs in
+  `finally` so the submodule stays clean; every hashed asset URL comes
+  out `/app/static/...` instead of root-relative. `.gitmodules` updated;
+  `biome.json` ignores `apps/web/upstream/**`. `git submodule update
+  --init` is now part of the contributor quickstart.
+- **Per-env config matrix + Zod schema** (`apps/web/src/config-schema.ts`,
+  `apps/web/src/build-env.ts`): `static/config.json`,
+  `static/config.staging.json`, `static/config.prod.json` are validated
+  against a Zod schema **before** being baked into
+  `dist/app/static/config.json`. `pnpm --filter web build` accepts a
+  `--env <staging|prod>` flag (unit-tested in isolation from the slow
+  Kiwi build). A malformed config (missing `server`, out-of-range
+  `port`, non-`#` channel, `direct: false`, …) aborts the build with
+  an aggregated, field-listing error rather than shipping a broken SPA.
+  The Kiwi `startupOptions.server` uses the `{{hostname}}` template
+  (resolved by the browser to `window.location.hostname` at load time),
+  so **one build artifact targets staging, prod, and preview deploys
+  without a per-env hostname**.
+- **Cloudflare Worker `[assets]` binding** (`apps/cf-worker/wrangler.toml`,
+  `apps/cf-worker/src/worker.ts`): the non-WS, non-`/health` branch of
+  the worker's `fetch` falls through to `env.ASSETS`, which serves
+  `apps/web/dist`. Per-env (`[env.staging.assets]`) blocks ship so
+  `wrangler deploy --env staging` deploys the Worker and the SPA in
+  one command. `run_worker_first = true` is set so WS upgrades aren't
+  intercepted by the asset platform serving `dist/index.html` at `/`
+  with a `200 OK` (the WS endpoint and the landing page share path
+  `/`; only the Worker can tell them apart).
+- **Static landing page** (`apps/web/landing/index.html`): framework-
+  free HTML + inline CSS, no JavaScript. The project's front door —
+  explains what ServerlessIRCd is, links to `/app/` (the IRC client),
+  the docs, and the source repo. The build copies it verbatim to
+  `dist/index.html`. Renders without JS; responsive; the build-smoke
+  suite asserts the `/app/` link, the docs link, and the viewport meta
+  tag so they cannot regress.
+- **`/health` is an explicit route**: the previous catch-all plaintext
+  liveness string now lives at `GET /health` so `/` is free for the
+  landing page. WS upgrades still route to `ConnectionDO`.
+
+### Added — CSWSH defense (`@serverless-ircd/cf-worker`)
+
+WebSocket upgrades do **not** follow the same-origin policy. A
+malicious page can `new WebSocket('wss://irc.example.com/')` from the
+victim's browser and drive an IRC session with the victim's
+credentials. The Worker now rejects upgrades whose `Origin` is not
+allowed — see `apps/cf-worker/src/origin-allowlist.ts` and
+`docs/WebClientGuide.md` §5.
+
+- **Two enforcement modes, evaluated in order:**
+  1. **Explicit allowlist** — when the `WEB_ORIGINS` var is set, only
+     listed origins proceed. Use this for cross-origin deployments
+     (SPA on a different domain than the Worker, e.g. Cloudflare
+     Pages).
+  2. **Auto-derive (same-origin)** — when `WEB_ORIGINS` is unset/empty
+     (the default), the Worker compares the browser's `Origin` against
+     the request's own origin (`${protocol}//${host}`). If they match,
+     the page opening the WS is the same origin as the server → safe.
+- **`WEB_ORIGINS` is optional.** Because mode 2 is the default and
+  requires zero per-env configuration, most deployments never need to
+  set it: the SPA and the Worker are on the same origin. It works for
+  `*.workers.dev`, custom domains, and preview URLs alike.
+- **Non-browser clients pass through unchanged.** curl, WeeChat, the
+  `tcp-ws-forwarder`, and scripted test harnesses never send `Origin`;
+  their upgrades are allowed in both modes so existing tooling keeps
+  working.
+- **No fail-open path.** A browser-sent `Origin` that is not allowed
+  → `403 Forbidden`. The extreme edge case (no allowlist AND
+  `Host` undeterminable, which never fires on Cloudflare) is
+  fail-closed `403`. The pure policy is exhaustively unit-tested in
+  `apps/cf-worker/tests/origin-allowlist.test.ts`; the worker
+  integration is covered by `tests/ws-origin.test.ts`.
+
+### Added — Documentation (`docs/WebClientGuide.md`)
+
+End-to-end contributor/operator doc covering: how the SPA, landing
+page, and WS endpoint fit on one origin; prerequisites (incl. `yarn`
+for the Kiwi build only); the quickstart (`git submodule update --init`
+→ `pnpm --filter web build:staging` → `pnpm deploy:cf:staging`); a
+walkthrough of the build pipeline and the per-env config matrix; the
+CSWSH rationale and the optional `WEB_ORIGINS` var; local dev
+(`wrangler dev` serves everything on `http://localhost:8787`); an
+optional Cloudflare Pages alternative for cross-origin prod deploys;
+the optional `webircgateway` SockJS fallback (strictly opt-in, not
+needed for normal operation); landing-page customisation; and a
+troubleshooting section. The acceptance criterion is that a new
+contributor can deploy a staging SPA following only this doc.
+
+### Added — Test hardening (`@serverless-ircd/irc-core`, `@serverless-ircd/cf-adapter`, `@serverless-ircd/irc-test-support`)
+
+- **Mutation-killing tests for `irc-core`**: the parser, batch, and
+  numerics suites were expanded to kill surviving Stryker mutants —
+  command-token anchors, strict source-prefix shape, malformed-input
+  diagnostic text, middle-param whitespace collapsing,
+  `unescapeTagValue` boundary conditions; empty-batch framing metadata
+  surviving elision; and `numericToName` round-trip parity against the
+  registry. A generated Stryker mutation report is committed under
+  `packages/irc-core/reports/mutation/`.
+- **CF harness / scenario fixes for slow transports**: the CF test
+  harness now waits for the end of the registration burst (`376` /
+  `422`) instead of `001`, so late MOTD frames do not pollute
+  `received` after a test clears it. The NOTICE scenario now only
+  rejects NOTICE-relevant error numerics (rather than any numeric),
+  preventing delayed welcome / MOTD lines from false-positiving the
+  RFC no-error-replies check. No production code changed.
+
+### Changed
+
+- **Cloudflare Worker routing.** `/health` is the new liveness route;
+  the root `/` now serves the landing page from the `[assets]`
+  binding. WS upgrades still route to `ConnectionDO`. Operators who
+  scraped the root `/` for the plaintext health string must update
+  to `/health`.
+
+### ⚠️ Migration required
+
+- **New optional runtime var: `WEB_ORIGINS`.** Optional — same-origin
+  auto-derive is the default. Set it only for cross-origin SPA
+  deployments (SPA on Cloudflare Pages, Worker serving the WS only,
+  etc.):
+  ```toml
+  # apps/cf-worker/wrangler.toml
+  [vars]
+  WEB_ORIGINS = "https://irc.example.com,https://web.example.com"
+  ```
+- **New build prerequisite for the SPA.** Building `apps/web` needs
+  the Kiwi submodule (`git submodule update --init apps/web/upstream`)
+  and `yarn` (provided by `corepack enable`). The CF deploy workflow
+  runs `pnpm build` (which builds the SPA + landing page) before
+  `wrangler deploy`. If you deploy manually and skip the SPA build,
+  the Worker still works but `/app/` and `/` return 404 from the asset
+  layer.
+- **`/health` is the new liveness route.** Operators who scraped `/`
+  for the plaintext health string must update to `/health`.
+- **New workspace package.** `apps/web` is a new private package
+  (`@serverless-ircd/web`); `pnpm install` picks it up automatically
+  from the existing `pnpm-workspace.yaml` glob.
+- **No persisted-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. **Code rollback across this release is safe** — the
+  web-client work adds the `[assets]` binding and the `/health` route
+  but touches no Durable Object state.
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- **Phase 14 is partial.** The Playwright headless-browser e2e
+  against the deployed staging frontend remains pending
+  — the SPA is exercised via the existing WS smoke
+  (`scripts/smoke.mjs`) and the new `apps/web` unit / build-smoke
+  suite, but no browser-driven end-to-end test runs in CI yet.
+- **The web client is Cloudflare-only.** The `[assets]` binding is a
+  Cloudflare Worker feature; AWS deployments continue to require an
+  external static host for the SPA (and must add the SPA's origin to
+  the Worker-style `WEB_ORIGINS` equivalent if/when an AWS-side
+  CSWSH check lands).
+- Same transport limits as v0.6.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  clear the 90% gate (v0.6.0); the remaining packages
+  (`cf-adapter`, `local-cli`, `load-test`, `cf-tcp-container`,
+  `tcp-ws-forwarder`, `irc-test-support`, and now `web`) are **above
+  the gate but below 100%** — follow-ups drive each to 100%.
+- The IRC services Phase 13 work (NickServ / ChanServ / HostServ /
+  OperServ / MemoServ) is pending; `draft/read-marker` and
+  `draft/pre-away` ship with in-memory reference stores, so marker /
+  away persistence does not survive an adapter restart until a
+  services backend lands.
+
+### Security
+
+- **CSWSH defense added.** WebSocket upgrades from browsers now
+  require an allowed `Origin`. Same-origin auto-derive is the default
+  (zero config); explicit `WEB_ORIGINS` allowlist for cross-origin
+  setups. Non-browser clients (no `Origin`) pass through unchanged.
+  There is no fail-open path. See `docs/WebClientGuide.md` §5. No
+  other auth path changed (SASL `PLAIN` / `EXTERNAL`, oper gate,
+  admission limits, and cloaking are unchanged from v0.6.0).
+
+---
+
+## [0.6.0] - 2026-08-03
+
+The headline is the **IRCv3 extension sweep (Phase 12)**: ten negotiated
+caps and the user-mode-`S` TLS indicator land in one release, taking the
+negotiated capability surface from "modern baseline" to "draft-leading-
+edge". Alongside it: the **required-`serverName` config gate** (the
+last open v0.5.0 follow-up), a new **`tools/load-test`** client farm
+(Phase 7's 10k-connection harness), and the **coverage / CI unblocks**
+that lift `aws-adapter` over the 90% gate and switch `cf-adapter` /
+`cf-worker` to istanbul (clearing the v0.5.0 workerd-incompatibility
+caveat). Deploy workflows are now **manual-only** (`workflow_dispatch`).
+
+### Added — IRCv3 extensions (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+The ten Phase 12 cap tickets light up the remaining negotiated-cap
+surface, and the two non-cap Phase 12 tickets (ISUPPORT tokens and
+user mode `S`) round out the wire-visible advertisement. Each cap
+ships a pure reducer (where applicable), an actor route case,
+advertisement in `SUPPORTED_CAPABILITIES` (or conditional
+advertisement for `sts`), and unit + actor coverage. The
+pure-reducer / dispatch pipeline is unchanged — every cap is plumbed
+through `ctx` and emitted `Effect[]`, never performed in the handler.
+
+- **`account-notify`**: pushes `:nick ACCOUNT <name|*>`
+  to peers in shared channels (excluding the sender unless
+  `echo-message`) on SASL login / logout. Closes the
+  `account-tag` / `extended-join` / `account-notify` triple modern
+  clients render fully.
+- **`msgid`**: every PRIVMSG / NOTICE / TAGMSG fanned out
+  to a cap-enabled peer carries `@+msgid=<id>` from
+  `IdFactory.nonce()`. The nonce is **shared between the live fanout
+  and the `draft/chathistory` record** so a peer sees the same id live
+  and on replay. Legacy peers see no `msgid` tag.
+- **`standard-replies`**: a data-driven
+  `numericToStandardReply` table replaces a curated subset of bare
+  numerics (`461`, `403`, `432`, `433`, SASL failures, …) with
+  `FAIL`/`WARN`/`NOTE COMMAND code context :description` for
+  cap-enabled clients. Legacy clients still receive the unchanged
+  numeric. Numeric-only replies (MOTD lines, NAMES, …) stay on their
+  numeric form.
+- **`MONITOR`**: the modern `ISON` replacement. Implements
+  `MONITOR + nick{,nick}` / `- nick` / `C` / `L` / `S` with the
+  `730 RPL_MONONLINE` / `731 RPL_MONOFFLINE` / `732 RPL_MONLIST` /
+  `734 ERR_MONLISTFULL` numerics. Online/offline transitions push
+  `730`/`731` **asynchronously** via the Registry's nick reserve /
+  release hooks (a new `MonitorStore` port + push callback). The
+  ceiling is config-driven (`MONITOR=<n>`, default 30).
+- **`labeled-response`**: a client-sent `+label=<id>` is
+  plumbed through `ctx` and every reply caused by that message is
+  wrapped in a single `BATCH +id labeled-response … BATCH -id`. A
+  command that produces no reply emits an empty labeled batch (spec-
+  mandated). The label travels on every reducer's emitted effects,
+  so multi-reply commands accumulate under one batch.
+- **`sts`**: Strict Transport Security. The cap is
+  **conditionally advertised** — only when `ServerConfig.sts`
+  (`{ duration, port, preload? }`) is supplied. On a plaintext
+  listener a compliant client upgrades; on the TLS listener the
+  duration is still sent to lock in the policy. Defaults:
+  `duration = 30 days`, `port = 6697`.
+- **`draft/typing`**: `TAGMSG <target> +draft/typing=
+  active|paused|done` broadcasts to channel members (or routes to a
+  nick target), excluding the sender unless `echo-message`. The
+  `+draft/typing=*` client tag is whitelisted for clients without
+  `message-tags` (per the spec's client-tag exception). Broadcast
+  delivery uses **OR-semantics**: a recipient qualifies if it
+  negotiated `message-tags` **or** `draft/typing` (a new `caps` field
+  on `BroadcastEffect`).
+- **`draft/multiline`**: a cap-enabled
+  client sends `BATCH +id draft/multiline :target` + N PRIVMSG/NOTICE
+  lines + `BATCH -id`. The server concatenates per spec (with `\n`),
+  enforces a configurable byte budget (`multilineMaxBytes`, default
+  4096), and broadcasts the batched replay to multiline peers / a
+  single joined PRIVMSG (carrying `+draft/multiline`) to legacy
+  peers. **Nick-target routing**, **chathistory recording** (one
+  record per batch carrying the joined body, assigned `msgid`, and
+  the `+draft/multiline` client tag), and **tag gating** (the
+  `+draft/multiline` tag is stripped for peers without
+  `message-tags`) all land in the completion ticket.
+- **`draft/read-marker`**: persists the per-`(account,
+  channel)` last-read marker in a new `ReadMarkerStore` port,
+  propagates updates via `+draft/read-marker=<msgid>` tags, and
+  seeds a fresh connection's marker from the persisted value at
+  identify time. `CHATHISTORY BEFORE` honours the marker when no
+  explicit pivot is supplied.
+- **`draft/pre-away`**: persists the away reason in a
+  new `AwayStore` port keyed by account. On identify (or SASL login)
+  the server re-applies the away state and emits the `AWAY` line +
+  `306 RPL_NOWAWAY` as if the user had sent `AWAY :reason`
+  themselves. `AWAY` (unset) clears the persisted reason.
+- **ISUPPORT tokens for the new caps**: `005
+  RPL_ISUPPORT` now advertises `STATUSMSG=@+`, `EXTBAN=<prefix>,q`,
+  `ACCOUNTEXTBAN=a` (services-gated), `TYPING`, and `MULTILINE`.
+  `MONITOR=<n>` honours `serverConfig.monitorLimit`. Tokens are
+  config-derived where applicable.
+- **User mode `S` (TLS connected)**: the transport's
+  TLS fact is surfaced end-to-end as a read-only user mode. Set
+  once by the registration reducer from `ConnectionState.secure`;
+  emitted in `221 … +S`; rejected by `MODE nick +/-S` with `501
+  ERR_UMODEUNKNOWNFLAG`; surfaced in WHOIS via the new `276
+  RPL_WHOISSECURE`. Each adapter asserts `secure: true` where the
+  platform terminates TLS (API Gateway, CF edge, Spectrum, NLB TLS
+  listener).
+
+### Changed — Required server identity
+
+The last open v0.5.0 follow-up closes. The `irc.example.com`
+placeholder `DEFAULT_SERVER_CONFIG` is **removed** from
+`irc-core`; the shared `ServerConfigSchema` rejects a missing
+`serverName` / `networkName` so every adapter **fails fast at boot**
+with a readable, field-listing error.
+
+- **`@serverless-ircd/irc-core`**: `DEFAULT_SERVER_CONFIG` removed.
+- **`@serverless-ircd/irc-test-support`**: ships a clearly test-scoped
+  `makeTestServerConfig()` baseline (`irc.test.local`) so unit tests
+  construct a `ServerConfig` without re-introducing a production
+  default.
+- `apps/cf-worker` + `apps/cf-tcp-container`: loaders require
+  `SERVER_NAME`; `wrangler.toml` samples switched to
+  `irc.your-domain.invalid`.
+- `apps/aws-stack` + `apps/local-cli`: keep obviously-local fallbacks
+  (`irc.localhost`) documented as *"production MUST override"*;
+  `local-cli` gains `--server-name` / `--network-name` flags.
+
+### Added — Load-test harness (`@serverless-ircd/load-test`)
+
+PLAN §7 / Phase 7's 10k-connection harness. A synthetic WebSocket IRC
+client farm: opens N connections, registers (NICK/USER), joins a
+channel, and optionally chats. Captures **p50 / p95 / p99 latency per
+phase** (connect / register / join / message) plus the **drop rate**,
+and prints a markdown report to stdout (or `--report <path>`).
+
+```bash
+pnpm --filter load-test start -- \
+  --target wss://irc.staging.example.com/ \
+  --connections 10000 --concurrency 200 --ramp-ms 60000 \
+  --channel '#loadtest' --messages 3 --platform cf-staging \
+  --report reports/cf-staging-2026-08-03.md
+```
+
+The package ships its own vitest suite (config parsing, framing,
+harness, metrics, report) at ≥90% coverage; no production source in
+the irc-core / irc-server packages changed to support it.
+
+### Added — Coverage / CI unblocks
+
+- **`aws-adapter` clears the 90% gate.** The self-hosted runner image
+  ships with neither Docker nor a JRE, so the package's
+  testcontainers / Java-ZIP DynamoDB Local boot fell through to
+  strategy 3 and 171 of 294 integration tests `describe.skipIf`-ed
+  away — dropping coverage to ~42% and blowing the gate. CI now
+  installs Temurin JRE 11 via `actions/setup-java@v4` and pins
+  `DDB_LOCAL_STRATEGY=zip` on the coverage step so the ZIP fallback
+  fires deterministically. The full aws-adapter suite now runs on
+  every coverage job. New integration tests cover
+  `broadcastWallops` fan-out, `reserveNick` non-conditional error
+  propagation, `refreshChannel` empty-members / topic-preservation
+  paths, NLB header fallbacks, scan-row type guards, and
+  `CREATED_AT` overflow handling. `tools/ci-hardening` gained a
+  self-check asserting the JRE install + strategy pin remain wired.
+- **`aws-stack` coverage command repaired.** The CDK `NodejsFunction`
+  in the test synth re-bundled the Lambda asset via esbuild ~80
+  times per coverage run and OOM-ed CI before vitest could print a
+  report. A new `makeLambda()` factory switches between
+  `NodejsFunction` (production synth) and an inline-zip `Function`
+  stub (tests) via the `IRC_AWS_STACK_TEST_NO_BUNDLE` env var. The
+  stub preserves every CloudFormation shape the suite asserts on
+  while making bundling a no-op. New
+  `tests/synth-no-bundle.test.ts` + `tests/coverage-command.test.ts`
+  lock both branches and assert the `pnpm coverage` run prints an
+  `All files` row.
+- **`cf-adapter` / `cf-worker` switch to istanbul coverage.** This
+  **resolves the v0.5.0 known limitation**: `@vitest/coverage-v8`
+  v4.1.x imports `node:inspector/promises`, which the
+  `@cloudflare/vitest-pool-workers` (workerd) pool cannot resolve.
+  Both packages now use `@vitest/coverage-istanbul` so `pnpm
+  coverage` loads under workerd. Edge-case suites were expanded
+  (serialize/deserialize/migrate, connection-do pure helpers,
+  `broadcastWallops` fan-out, `changeNick` shard routing,
+  ChannelDO broadcast/cache, RegistryDO `listEntries`, SASL seed
+  parsing).
+
+### Changed — Deploy workflows are now manual-only
+
+`deploy-cf.yml`, `deploy-cf-tcp.yml`, and `deploy-aws.yml` dropped
+their `push: branches: [main]` triggers and now run on
+`workflow_dispatch` only. Staging deploys are no longer fired
+automatically on every merge to `main`; a maintainer kicks them off
+by hand. The release runbook (`docs/Release-Process.md`) is the
+canonical reference either way — there was never a CI auto-deploy to
+production.
+
+### Changed — `@vitest/coverage-istanbul` peer
+
+The root lockfile (`pnpm-lock.yaml`) registers the
+`@vitest/coverage-istanbul` peer introduced by the cf-adapter /
+cf-worker coverage switch. No operator action; `pnpm install`
+resolves it.
+
+### ⚠️ Migration required
+
+- **`serverName` is now required at boot.** Operators who relied on
+  the silent `irc.example.com` placeholder must supply an explicit
+  value via their adapter's config knob:
+  - **Cloudflare Worker / TCP container**: set `SERVER_NAME` (and
+    `NETWORK_NAME` if desired) in `wrangler.toml` `[vars]` or via
+    `wrangler secret put`. The samples switched to
+    `irc.your-domain.invalid` — replace with your real hostname.
+  - **AWS**: the CDK stack's `serverName` prop / `SERVER_NAME` env
+    var. The local fallback is `irc.localhost` and is explicitly
+    documented as "production MUST override".
+  - **`local-cli`**: new `--server-name <h>` / `--network-name <n>`
+    flags (default `irc.localhost` / `LocalNet`).
+  A missing value now throws an aggregated `"Invalid server
+  config:"` error at boot listing every offending field.
+- **No persisted-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The user-mode-`S` work adds a `secure` field and a
+  `userModes.tls` field to the persisted shape, but both are purely
+  **additive with `false` defaults** and the cf-adapter `migrate()`
+  path backfills them on pre-feature records. **Code rollback across
+  this release is safe.**
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- Same transport limits as v0.5.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- `STATS` ships the `u` + `l` query letters; the full RFC matrix
+  (`k`, `K`, `q`, `g`, `x`, `z`, …) is intentionally out of scope for
+  v1 — unknown letters get the charybdis-style empty body + `219`.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  now clear the 90% gate, and `cf-adapter` / `cf-worker` run under
+  istanbul; the remaining packages (`cf-adapter`, `local-cli`,
+  `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
+- The IRC services (NickServ / ChanServ / HostServ / OperServ /
+  MemoServ) Phase 13 work is pending; `draft/read-marker` and
+  `draft/pre-away` ship with in-memory reference stores, so marker /
+  away persistence does not survive an adapter restart until a
+  services backend lands.
+- The web client Phase 14 work (vendor Kiwi IRC, serve SPA from the
+  Worker, WS Origin allowlist) is pending.
+
+### Security
+
+- None. No vulnerabilities have been reported or fixed in this
+  release. The new caps add surface area but ship no new auth path
+  (the SASL `PLAIN` / `EXTERNAL` paths and the oper gate are
+  unchanged); the required-`serverName` change rejects misconfigured
+  deploys at boot rather than advertising a placeholder identity.
+
+---
+
 ## [0.5.0] - 2026-08-02
 
 The headline is **protocol completion**: the deferred IRC verbs land