serverless-ircd 0.6.0 → 0.8.0

package/.github/workflows/ci.yml

@@ -29,6 +29,7 @@ jobs:
   verify:
     name: typecheck / lint / test / coverage
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -40,7 +41,6 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: pnpm
 
       # DynamoDB Local capability for `aws-adapter` coverage.
       #
@@ -63,7 +63,7 @@ jobs:
       # (otherwise it blocks for ~60s waiting for Ryuk before falling
       # back, which is flaky and wastes CI minutes).
       - name: Setup Java (JRE for DynamoDB Local ZIP fallback)
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: temurin
           java-version: '11'
@@ -134,6 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     # Stryker is the slowest single task; it is independent of the
     # typecheck/lint/coverage chain and runs in parallel.
+    timeout-minutes: 45
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -145,13 +146,17 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 24
-          cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Build workspace (irc-core mutation targets)
-        run: pnpm build
+        # Scope the build to irc-core and its workspace deps only. The
+        # mutation spot-check mutates irc-core/protocol and irc-core/commands,
+        # so building the rest of the workspace (notably @serverless-ircd/web,
+        # which spawns `yarn` to build the Kiwi upstream SPA) is unnecessary
+        # and fails on runner images that don't ship yarn.
+        run: pnpm turbo run build --filter=@serverless-ircd/irc-core...
 
       - name: Stryker spot-check on irc-core/protocol
         # Mutation score threshold >=80% is enforced by the

package/.gitmodules

@@ -1,3 +1,6 @@
 [submodule "docs"]
 	path = docs
-	url = https://gitea.com/fowlmouth/ServerlessIRCd.wiki.git
+	url = https://gitea.com/ServerlessIRCd/ServerlessIRCd.wiki.git
+[submodule "apps/web/upstream"]
+	path = apps/web/upstream
+	url = https://github.com/kiwiirc/kiwiirc.git

package/CHANGELOG.md

@@ -7,25 +7,483 @@ and this project adheres to [Semantic Versioning](https://semver.org/) with
 the 0.x convention (any release may change anything).
 
 For the release process itself — versioning policy, pre-release checklist,
-cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
+cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.8.0] - 2026-08-08
+
+The main change in this release is **integrated IRC services**: NickServ,
+ChanServ, HostServ, OperServ, and MemoServ ship as part of the daemon
+itself — there is **no separate services process and no S2S link**. The
+service nicks are reserved and routed to dedicated pure reducers backed
+by a new `ServicesStore` port, with **persistent D1 (Cloudflare) and
+DynamoDB (AWS) backends** so registrations survive redeploys. Alongside
+it: the SASL `AccountStore` and NickServ accounts are **unified** under
+one scrypt-hashed credential store, `PASS <nick>:<password>` identifies
+at registration, the `draft/read-marker` `MARKREAD` verb lands, and a
+round of **AWS adapter hardening** (O(1) admission counter, strongly-
+consistent `$default` reads, WebSocket subprotocol echo fix).
+
+### Added — Integrated IRC services (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+The ten services tickets add the full
+services surface. Service names are reserved nicks recognized at
+`PRIVMSG` time and routed to dedicated pure reducers when a
+`ServicesStore` is bound; when no store is bound every services command
+replies `501` and the rest of the daemon is unaffected. See
+`docs/Services.md` for the operator reference.
+
+- **`ServicesStore` port + in-memory reference impl**: a synchronous,
+  injectable store holding NickServ / ChanServ / HostServ / MemoServ /
+  OperServ / read-marker state. Reducers stay pure — all side effects
+  flow through the store port. The `ReadMarkerStore` from v0.6.0 is
+  **folded into** `ServicesStore` so read-markers, `draft/pre-away`,
+  and account state share one persistence path.
+- **NickServ** (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET`):
+  registers the current nick, identifies to an account (setting the
+  read-only user mode **`+r`**, fanning `ACCOUNT` to `account-notify`
+  peers, then delivering unread MemoServ memos), and supports
+  `SET ENFORCE` — a registered nick held by a non-identified
+  connection is reclaimed on the `NICK` path (enforcement policy
+  mirrors Atheme/Anope). `IDENTIFY` falls back to SASL account
+  credentials when no NickServ row exists.
+- **ChanServ** (`REGISTER` / `DROP` / `SET` / `INFO` / `ACCESS` /
+  `LEVELS`): channel registration with a founder, the services-only
+  channel modes **`+r`** (registered), **`+R`** (block unidentified
+  join/message), and **`+M`** (moderated-identified), `ACCESS`/`LEVELS`
+  (SOP/AOP/VOP/HOP access lists), and auto-op on `JOIN` per access
+  level. The three services modes are settable only via ChanServ, not
+  via `MODE` (`472 ERR_UNKNOWNMODE` / `501`).
+- **HostServ** (`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE` /
+  `REJECT` / `LIST`): per-account vhost with `CHGHOST` fanout to shared
+  channels. `REQUEST` enters an **oper approval queue**; opers `APPROVE`
+  to activate or `REJECT` to drop it.
+- **OperServ** (`AKILL` / `JUPE` / `UNJUPE` / `RAW`): oper-gated
+  network management. `AKILL` records an `*@host` mask, `JUPE` reserves
+  a juped nick (rejected at `NICK` with `432 ERR_ERRONEUSNICKNAME`),
+  `RAW` is the escape hatch. Wired end-to-end: `PRIVMSG OperServ :…`
+  routes to the OperServ reducer.
+- **MemoServ** (`SEND` / `LIST` / `READ` / `DEL`): per-account memos
+  with queue delivery — unread memos are replayed at identify (NickServ
+  `IDENTIFY` / SASL login / PASS-based login), the same path that
+  replays `draft/read-marker` and `draft/pre-away`.
+
+### Added — Persistent services backends (`@serverless-ircd/cf-adapter`, `@serverless-ircd/aws-adapter`)
+
+Both adapters ship write-behind persistence for the `ServicesStore` so
+registrations, channel access lists, vhosts, memos, and read-markers
+survive a redeploy/reconnect.
+
+- **Cloudflare (D1)**: `D1ServicesStore` over the shared `ACCOUNTS_DB`
+  binding (the same D1 database used for SASL accounts since v0.4.0).
+  The ten services tables **auto-provision on cold start** (`CREATE
+  TABLE IF NOT EXISTS` inside `loadD1ServicesStore`), so a fresh deploy
+  self-provisions and an existing deploy re-runs the batch as a cheap
+  no-op. `ConnectionDO` load/flush hooks wrap each frame and teardown.
+- **AWS (DynamoDB)**: `DynamoServicesStore` plus a new `Services`
+  table definition and handler wiring so NLB-stream / `$default`
+  invocations hydrate + flush services alongside the existing account
+  store. Enabled when the `SERVICES_TABLE` env var / table name is
+  supplied.
+- **`PersistentServicesStore` base** (`irc-core`): the shared
+  write-behind base — mutates the inherited cache synchronously and
+  enqueues matching writes for `flush()`, so reducers stay free of IO.
+
+### Added — Unified accounts & registration login (`@serverless-ircd/irc-core`)
+
+- **Unified SASL + NickServ account store**: the SASL `AccountStore`
+  and NickServ `ServicesStore` now share one **scrypt-hashed**
+  credential shape. A NickServ registration *is* a SASL account —
+  SASL `PLAIN`'s services fallback verifies against a row created by
+  NickServ `REGISTER` without a second registration, and vice versa.
+  The plaintext password on `ServicesNickRow` is replaced with a
+  `HashedAccountCredential` (scrypt + random salt). `ingestAccountCredential`
+  adopts a pre-hashed SASL credential as a registered nick (idempotent;
+  existing records win).
+- **PASS-based account login**: a client may identify to its NickServ
+  account at registration by sending `PASS <nick>:<password>` (the same
+  literal the `SASL_ACCOUNTS` seed tooling uses). On success the
+  connection is logged in — emitting `900`/`903`, stamping `+r`, and
+  running the same read-marker / away / memo replay as SASL. A bare
+  `PASS <value>` (no colon) is always treated as a server-password
+  candidate. The shared login reduction (`applyAccountSuccess`) is
+  extracted and reused from SASL.
+- **Server-password gate with SASL short-circuit**: an optional gate
+  enforced in the registration reducer at `001` — when
+  `ServerConfig.serverPassword` is set, every connection must supply a
+  matching `PASS` (or authenticate via SASL / PASS-based account login)
+  before `RPL_WELCOME`, else `464 ERR_PASSWDMISMATCH` + disconnect.
+  Wired through all three adapters (`SERVER_PASSWORD` Worker secret /
+  Lambda env var / `--server-password` CLI flag).
+
+### Added — `draft/read-marker` `MARKREAD` verb (`@serverless-ircd/irc-core`)
+
+- The timestamp-based `MARKREAD` command from the read-marker draft
+  lands alongside the existing `+draft/read-marker=<msgid>` tag path.
+  `MARKREAD <target>` (GET) replies with the stored marker's timestamp;
+  `MARKREAD <target> <timestamp>` (SET) advances the marker, with
+  timestamp↔msgid translation against the message store. Failure modes
+  use `standard-replies` `FAIL MARKREAD …`. The mark fanout is
+  **scoped to the originator's account** (spec compliance), not
+  broadcast to every cap-enabled peer.
+
+### Added — Cloudflare adapter (`@serverless-ircd/cf-adapter`)
+
+- **Client source IP capture at WebSocket upgrade**: reads
+  `CF-Connecting-IP` (with `X-Real-IP` fallback) from the upgrade
+  request and seeds `ConnectionState.host`, so WHOIS / hostmasks carry
+  a real `@host` segment instead of an `undefined` fallback.
+- **Ghost-member pruning via alarm**: when a WebSocket `close` event is
+  lost (client drop, edge hiccup), the DO's alarm prunes the ghost
+  member from its channels on the next sweep, preventing stale roster
+  entries.
+
+### Changed — AWS adapter (`@serverless-ircd/aws-adapter`, `@serverless-ircd/aws-stack`)
+
+- **O(1) admission counter**: `$connect`'s full-table `Scan COUNT` is
+  replaced with an atomic increment/decrement on a single meta row,
+  dropping admission cost from O(connections) to O(1). Reservations
+  roll back on rejection or a failed `Put`; the sweeper and stats
+  exclude the meta row.
+- **Strongly-consistent `$default` reads + observability**: `$default`
+  now reads the `Connections` row strongly consistent (closes a
+  read-after-write `410` window), warns on a missing row, logs
+  `postToConnection` failures (previously silently swallowed), and
+  emits a summary log per invocation.
+- **`ServerName` / `NetworkName` as CFN parameters**: server identity
+  is now a CloudFormation parameter (was env-var-only), and the
+  sweeper Lambda's `loadServerConfigFromLambdaEnv` is wired with the
+  server-identity env vars it requires. `SweeperScheduleExpression`,
+  `PingCheckerScheduleExpression`, and `ApiGatewayLoggingLevel` are
+  also exposed as parameters.
+- **WebSocket subprotocol echo fixed**: API Gateway WebSocket
+  `IntegrationResponse` uses `route.response.header.*` (not
+  `method.response.header.*`, which is REST API only), so the
+  `Sec-WebSocket-Protocol` header was not being echoed back to clients.
+  AWS now correctly negotiates the IRCv3 subprotocol. Subprotocol
+  advertisement is forced text-only (`text.ircv3.net`) to match the
+  Lambda response-stream path.
+- **APIGW logging role corrected** and Biome lint/format applied.
+
+### Changed
+
+- **`MODE +o` echo on oper-up**: the connection that grants oper now
+  receives a `MODE` echo, matching the cross-connection oper-up path.
+- **NICK change broadcast fix**: nick changes now broadcast to every
+  shared-channel peer (a code path that dropped peers under certain
+  roster shapes is corrected).
+- **Server version from `package.json`**: the default `serverVersion`
+  advertised in `002`/`003` is derived from the workspace
+  `package.json` at build time (was a hardcoded placeholder when the
+  config omitted it).
+- **Web client SPA path `/app/` → `/webclient/`**: the vendored Kiwi
+  IRC SPA is now served at `/webclient/` (the `[assets]` publicPath
+  and config are repointed). Operators with custom Kiwi configs or
+  bookmarks must update to `/webclient/`.
+- **Source / issue links migrated to Gitea**; landing-page copy
+  tightened and the upstream-install guard hardened.
+
+### Changed — CI / tooling
+
+- `actions/setup-java` bumped to v5; pnpm pinned to 11.20.0. CI jobs
+  are bounded by explicit timeouts and the unreachable pnpm cache step
+  is dropped.
+
+### ⚠️ Migration required
+
+- **Cloudflare: services are enabled when `ACCOUNTS_DB` is bound.** The
+  D1 binding is the same one introduced in v0.4.0 for SASL accounts;
+  the ten services tables **self-provision on cold start** (no manual
+  `wrangler d1 execute` needed). If `ACCOUNTS_DB` is already bound,
+  services are now live after deploy — no action. If it is unset,
+  services commands reply `501` and the daemon is otherwise unchanged.
+- **AWS: new `Services` DynamoDB table + `SERVICES_TABLE`.** To enable
+  services, supply a services table name (`SERVICES_TABLE` env var /
+  CDK `servicesTableName` prop); the table is created by the CDK stack.
+  Without it, services are unbound.
+- **NickServ / SASL credentials are now scrypt-hashed at rest.** A
+  NickServ `REGISTER` creates the same hashed credential shape SASL
+  uses; the `password` column on the NickServ row is replaced by
+  `algorithm` / `salt` / `hash`. Existing seeded SASL accounts are
+  adopted as registered nicks idempotently. Operators re-seeding via
+  `tools/seed-*-accounts.ts` see no change (the tools already hashed).
+- **Web client SPA moved to `/webclient/`.** Update any bookmarks,
+  custom Kiwi configs, or `WEB_ORIGINS` entries pointing at `/app/`.
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The new read-only user mode `r` (registered) and the
+  services channel modes `r`/`R`/`M` are runtime state, not persisted
+  DO fields; the `ReadMarkerStore` fold moves read-markers into the
+  services backend (D1/DynamoDB), out of DO storage. **Code rollback
+  across this release is safe.**
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- **Services are not binary-compatible with Atheme or Anope.** There is
+  no S2S protocol, so an existing Atheme/Anope services process cannot
+  connect, and existing services databases cannot be imported.
+  Operators migrating from a services-aware network must re-register
+  nicks and channels. See `docs/Services.md` §12.
+- **The web client remains partial.** The Playwright headless-browser
+  e2e against the deployed staging frontend is still pending; the SPA
+  is exercised via the WS smoke (`scripts/smoke.mjs`) and the `apps/web`
+  unit / build-smoke suite. The web client remains Cloudflare-only (the
+  `[assets]` binding is a Worker feature).
+- Same transport limits as v0.7.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  clear the 90% gate; the remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
+
+### Security
+
+- **NickServ / SASL credentials are now uniformly scrypt-hashed.** The
+  unified account store means a NickServ-registered nick and a SASL
+  account share one hashed credential — never plaintext, in memory or
+  at rest. The server-password gate and CSWSH defense are unchanged
+  from v0.7.0; no other auth path changed.
+
+---
+
+## [0.7.0] - 2026-08-04
+
+The main change in this release is the **web client**: a vendored **Kiwi IRC**
+SPA served at `/app/` and a static project landing page served at `/`
+directly by the Cloudflare Worker, with **Cross-Site WebSocket
+Hijacking (CSWSH) defense** wired into the WS upgrade path. The browser
+opens a native `wss://` directly to the IRC-over-WebSocket
+endpoint — no proxy, gateway, or transport adaptation in the request path.
+Alongside it: a round of **test hardening** (mutation-killing tests for
+`irc-core`'s parser / batch / numerics, and CF-harness / scenario fixes
+for slow transports).
+
+### Added — Web client (`@serverless-ircd/web`, `@serverless-ircd/cf-worker`)
+
+Six tickets add the project's browser surface. The Worker
+becomes the single origin for the landing page, the SPA, **and** the
+WebSocket. Same-origin by default — which is what makes the CSWSH
+defense almost zero-config.
+
+- **`apps/web` workspace package (`@serverless-ircd/web`)**: a new
+  pnpm workspace package owning the Kiwi build orchestration and config
+  schema. The package layout reserves `dist/app/` for the Kiwi SPA
+  (served at `/app/`) and `dist/index.html` for the landing page
+  (served at `/`). No `@serverless-ircd/*` runtime dependency —
+  Kiwi talks to the Worker over plain WebSocket.
+- **Kiwi IRC vendored as a git submodule** (`apps/web/upstream/`,
+  tag-pinned): `scripts/build.mjs` patches the upstream `publicPath`
+  to `/app/`, runs `yarn build` inside the submodule, copies
+  `upstream/dist/` → `apps/web/dist/app/`, then layers our validated
+  `static/config.json` over the upstream default. The patch runs in
+  `finally` so the submodule stays clean; every hashed asset URL comes
+  out `/app/static/...` instead of root-relative. `.gitmodules` updated;
+  `biome.json` ignores `apps/web/upstream/**`. `git submodule update
+  --init` is now part of the contributor quickstart.
+- **Per-env config matrix + Zod schema** (`apps/web/src/config-schema.ts`,
+  `apps/web/src/build-env.ts`): `static/config.json`,
+  `static/config.staging.json`, `static/config.prod.json` are validated
+  against a Zod schema **before** being baked into
+  `dist/app/static/config.json`. `pnpm --filter web build` accepts a
+  `--env <staging|prod>` flag (unit-tested in isolation from the slow
+  Kiwi build). A malformed config (missing `server`, out-of-range
+  `port`, non-`#` channel, `direct: false`, …) aborts the build with
+  an aggregated, field-listing error rather than shipping a broken SPA.
+  The Kiwi `startupOptions.server` uses the `{{hostname}}` template
+  (resolved by the browser to `window.location.hostname` at load time),
+  so **one build artifact targets staging, prod, and preview deploys
+  without a per-env hostname**.
+- **Cloudflare Worker `[assets]` binding** (`apps/cf-worker/wrangler.toml`,
+  `apps/cf-worker/src/worker.ts`): the non-WS, non-`/health` branch of
+  the worker's `fetch` falls through to `env.ASSETS`, which serves
+  `apps/web/dist`. Per-env (`[env.staging.assets]`) blocks ship so
+  `wrangler deploy --env staging` deploys the Worker and the SPA in
+  one command. `run_worker_first = true` is set so WS upgrades aren't
+  intercepted by the asset platform serving `dist/index.html` at `/`
+  with a `200 OK` (the WS endpoint and the landing page share path
+  `/`; only the Worker can tell them apart).
+- **Static landing page** (`apps/web/landing/index.html`): framework-
+  free HTML + inline CSS, no JavaScript. The project's entry page —
+  explains what ServerlessIRCd is, links to `/app/` (the IRC client),
+  the docs, and the source repo. The build copies it verbatim to
+  `dist/index.html`. Renders without JS; responsive; the build-smoke
+  suite asserts the `/app/` link, the docs link, and the viewport meta
+  tag so they cannot regress.
+- **`/health` is an explicit route**: the previous catch-all plaintext
+  liveness string now lives at `GET /health` so `/` is free for the
+  landing page. WS upgrades still route to `ConnectionDO`.
+
+### Added — CSWSH defense (`@serverless-ircd/cf-worker`)
+
+WebSocket upgrades do **not** follow the same-origin policy. A
+malicious page can `new WebSocket('wss://irc.example.com/')` from the
+victim's browser and drive an IRC session with the victim's
+credentials. The Worker now rejects upgrades whose `Origin` is not
+allowed — see `apps/cf-worker/src/origin-allowlist.ts` and
+`docs/WebClientGuide.md` §5.
+
+- **Two enforcement modes, evaluated in order:**
+  1. **Explicit allowlist** — when the `WEB_ORIGINS` var is set, only
+     listed origins proceed. Use this for cross-origin deployments
+     (SPA on a different domain than the Worker, e.g. Cloudflare
+     Pages).
+  2. **Auto-derive (same-origin)** — when `WEB_ORIGINS` is unset/empty
+     (the default), the Worker compares the browser's `Origin` against
+     the request's own origin (`${protocol}//${host}`). If they match,
+     the page opening the WS is the same origin as the server → safe.
+- **`WEB_ORIGINS` is optional.** Because mode 2 is the default and
+  requires zero per-env configuration, most deployments never need to
+  set it: the SPA and the Worker are on the same origin. It works for
+  `*.workers.dev`, custom domains, and preview URLs alike.
+- **Non-browser clients pass through unchanged.** curl, WeeChat, the
+  `tcp-ws-forwarder`, and scripted test harnesses never send `Origin`;
+  their upgrades are allowed in both modes so existing tooling keeps
+  working.
+- **No fail-open path.** A browser-sent `Origin` that is not allowed
+  → `403 Forbidden`. The extreme edge case (no allowlist AND
+  `Host` undeterminable, which never fires on Cloudflare) is
+  fail-closed `403`. The pure policy is exhaustively unit-tested in
+  `apps/cf-worker/tests/origin-allowlist.test.ts`; the worker
+  integration is covered by `tests/ws-origin.test.ts`.
+
+### Added — Documentation (`docs/WebClientGuide.md`)
+
+End-to-end contributor/operator doc covering: how the SPA, landing
+page, and WS endpoint fit on one origin; prerequisites (incl. `yarn`
+for the Kiwi build only); the quickstart (`git submodule update --init`
+→ `pnpm --filter web build:staging` → `pnpm deploy:cf:staging`); a
+walkthrough of the build pipeline and the per-env config matrix; the
+CSWSH rationale and the optional `WEB_ORIGINS` var; local dev
+(`wrangler dev` serves everything on `http://localhost:8787`); an
+optional Cloudflare Pages alternative for cross-origin prod deploys;
+the optional `webircgateway` SockJS fallback (strictly opt-in, not
+needed for normal operation); landing-page customisation; and a
+troubleshooting section. The acceptance criterion is that a new
+contributor can deploy a staging SPA following only this doc.
+
+### Added — Test hardening (`@serverless-ircd/irc-core`, `@serverless-ircd/cf-adapter`, `@serverless-ircd/irc-test-support`)
+
+- **Mutation-killing tests for `irc-core`**: the parser, batch, and
+  numerics suites were expanded to kill surviving Stryker mutants —
+  command-token anchors, strict source-prefix shape, malformed-input
+  diagnostic text, middle-param whitespace collapsing,
+  `unescapeTagValue` boundary conditions; empty-batch framing metadata
+  surviving elision; and `numericToName` round-trip parity against the
+  registry. A generated Stryker mutation report is committed under
+  `packages/irc-core/reports/mutation/`.
+- **CF harness / scenario fixes for slow transports**: the CF test
+  harness now waits for the end of the registration burst (`376` /
+  `422`) instead of `001`, so late MOTD frames do not pollute
+  `received` after a test clears it. The NOTICE scenario now only
+  rejects NOTICE-relevant error numerics (rather than any numeric),
+  preventing delayed welcome / MOTD lines from false-positiving the
+  RFC no-error-replies check. No production code changed.
+
+### Changed
+
+- **Cloudflare Worker routing.** `/health` is the new liveness route;
+  the root `/` now serves the landing page from the `[assets]`
+  binding. WS upgrades still route to `ConnectionDO`. Operators who
+  scraped the root `/` for the plaintext health string must update
+  to `/health`.
+
+### ⚠️ Migration required
+
+- **New optional runtime var: `WEB_ORIGINS`.** Optional — same-origin
+  auto-derive is the default. Set it only for cross-origin SPA
+  deployments (SPA on Cloudflare Pages, Worker serving the WS only,
+  etc.):
+  ```toml
+  # apps/cf-worker/wrangler.toml
+  [vars]
+  WEB_ORIGINS = "https://irc.example.com,https://web.example.com"
+  ```
+- **New build prerequisite for the SPA.** Building `apps/web` needs
+  the Kiwi submodule (`git submodule update --init apps/web/upstream`)
+  and `yarn` (provided by `corepack enable`). The CF deploy workflow
+  runs `pnpm build` (which builds the SPA + landing page) before
+  `wrangler deploy`. If you deploy manually and skip the SPA build,
+  the Worker still works but `/app/` and `/` return 404 from the asset
+  layer.
+- **`/health` is the new liveness route.** Operators who scraped `/`
+  for the plaintext health string must update to `/health`.
+- **New workspace package.** `apps/web` is a new private package
+  (`@serverless-ircd/web`); `pnpm install` picks it up automatically
+  from the existing `pnpm-workspace.yaml` glob.
+- **No persisted-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. **Code rollback across this release is safe** — the
+  web-client work adds the `[assets]` binding and the `/health` route
+  but touches no Durable Object state.
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- **The web client is partial.** The Playwright headless-browser e2e
+  against the deployed staging frontend remains pending
+  — the SPA is exercised via the existing WS smoke
+  (`scripts/smoke.mjs`) and the new `apps/web` unit / build-smoke
+  suite, but no browser-driven end-to-end test runs in CI yet.
+- **The web client is Cloudflare-only.** The `[assets]` binding is a
+  Cloudflare Worker feature; AWS deployments continue to require an
+  external static host for the SPA (and must add the SPA's origin to
+  the Worker-style `WEB_ORIGINS` equivalent if/when an AWS-side
+  CSWSH check lands).
+- Same transport limits as v0.6.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `aws-adapter` and `aws-stack`
+  clear the 90% gate (v0.6.0); the remaining packages
+  (`cf-adapter`, `local-cli`, `load-test`, `cf-tcp-container`,
+  `tcp-ws-forwarder`, `irc-test-support`, and now `web`) are **above
+  the gate but below 100%** — follow-ups drive each to 100%.
+- The IRC services work (NickServ / ChanServ / HostServ /
+  OperServ / MemoServ) is pending; `draft/read-marker` and
+  `draft/pre-away` ship with in-memory reference stores, so marker /
+  away persistence does not survive an adapter restart until a
+  services backend lands.
+
+### Security
+
+- **CSWSH defense added.** WebSocket upgrades from browsers now
+  require an allowed `Origin`. Same-origin auto-derive is the default
+  (zero config); explicit `WEB_ORIGINS` allowlist for cross-origin
+  setups. Non-browser clients (no `Origin`) pass through unchanged.
+  There is no fail-open path. See `docs/WebClientGuide.md` §5. No
+  other auth path changed (SASL `PLAIN` / `EXTERNAL`, oper gate,
+  admission limits, and cloaking are unchanged from v0.6.0).
+
+---
+
 ## [0.6.0] - 2026-08-03
 
-The headline is the **IRCv3 extension sweep (Phase 12)**: ten negotiated
+The main change in this release is the **IRCv3 extension sweep**: ten negotiated
 caps and the user-mode-`S` TLS indicator land in one release, taking the
 negotiated capability surface from "modern baseline" to "draft-leading-
 edge". Alongside it: the **required-`serverName` config gate** (the
-last open v0.5.0 follow-up), a new **`tools/load-test`** client farm
-(Phase 7's 10k-connection harness), and the **coverage / CI unblocks**
+last open v0.5.0 follow-up), a new **`tools/load-test`** client pool
+(the 10k-connection harness), and the **coverage / CI unblocks**
 that lift `aws-adapter` over the 90% gate and switch `cf-adapter` /
 `cf-worker` to istanbul (clearing the v0.5.0 workerd-incompatibility
 caveat). Deploy workflows are now **manual-only** (`workflow_dispatch`).
 
 ### Added — IRCv3 extensions (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
 
-The ten Phase 12 cap tickets light up the remaining negotiated-cap
-surface, and the two non-cap Phase 12 tickets (ISUPPORT tokens and
+The ten cap tickets add the remaining negotiated-cap
+surface, and the two non-cap tickets (ISUPPORT tokens and
 user mode `S`) round out the wire-visible advertisement. Each cap
 ships a pure reducer (where applicable), an actor route case,
 advertisement in `SUPPORTED_CAPABILITIES` (or conditional
@@ -135,10 +593,10 @@ with a readable, field-listing error.
 
 ### Added — Load-test harness (`@serverless-ircd/load-test`)
 
-PLAN §7 / Phase 7's 10k-connection harness. A synthetic WebSocket IRC
-client farm: opens N connections, registers (NICK/USER), joins a
+The PLAN §7 10k-connection harness. A synthetic WebSocket IRC
+client pool: opens N connections, registers (NICK/USER), joins a
 channel, and optionally chats. Captures **p50 / p95 / p99 latency per
-phase** (connect / register / join / message) plus the **drop rate**,
+stage** (connect / register / join / message) plus the **drop rate**,
 and prints a markdown report to stdout (or `--report <path>`).
 
 ```bash
@@ -253,11 +711,11 @@ resolves it.
   `irc-test-support`) are **above the gate but below 100%** —
   follow-ups drive each to 100%.
 - The IRC services (NickServ / ChanServ / HostServ / OperServ /
-  MemoServ) Phase 13 work is pending; `draft/read-marker` and
+  MemoServ) work is pending; `draft/read-marker` and
   `draft/pre-away` ship with in-memory reference stores, so marker /
   away persistence does not survive an adapter restart until a
   services backend lands.
-- The web client Phase 14 work (vendor Kiwi IRC, serve SPA from the
+- The web client work (vendor Kiwi IRC, serve SPA from the
   Worker, WS Origin allowlist) is pending.
 
 ### Security
@@ -272,8 +730,8 @@ resolves it.
 
 ## [0.5.0] - 2026-08-02
 
-The headline is **protocol completion**: the deferred IRC verbs land
-(Phase 11), and the S2S / obsolete RFC 2812 verbs are **formally
+The main change in this release is **protocol completion**: the deferred IRC verbs land,
+and the S2S / obsolete RFC 2812 verbs are **formally
 dropped** rather than left "deferred". With this release every standard
 IRC verb a modern client expects is implemented — the only remaining
 `421 ERR_UNKNOWNCOMMAND` paths are the deliberately-unimplemented S2S
@@ -283,10 +741,10 @@ client compatibility matrix) and the required-`serverName` config gate.
 
 ### Added — Deferred IRC verbs (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
 
-Six Phase 11 tickets light up the remaining command surface. Each ships
+Six tickets add the remaining command surface. Each ships
 a pure reducer, an actor route case (no more `421`), new numerics in
 `protocol/numerics.ts`, and unit + actor coverage. (The remaining two
-Phase 11 tickets are drops — see below.)
+tickets are drops — see below.)
 
 - **`KILL`** (oper-gated force-disconnect): `KILL <nick>
   <comment>` resolves the target via the nick registry + a live
@@ -340,7 +798,7 @@ Phase 11 tickets are drops — see below.)
   channel-scoped). The originator is always excluded (skip-self,
   matching NOTICE/PRIVMSG semantics). Empty message → `461`. The `+w`
   user mode was already accepted by `MODE` and advertised in `004
-  RPL_MYINFO`; this lights up the consumer.
+  RPL_MYINFO`; this enables the consumer.
 - **`SETNAME`** (realname change): `SETNAME :<realname>`
   updates `state.realname` so a subsequent `WHOIS` reflects the new
   value in `311 RPL_WHOISUSER`. No broadcast is emitted in v1 (there
@@ -350,7 +808,7 @@ Phase 11 tickets are drops — see below.)
 
 ### Changed — S2S & obsolete verbs formally dropped (`@serverless-ircd/irc-core`)
 
-The remaining two Phase 11 tickets convert the "deferred" framing into
+The remaining two tickets convert the "deferred" framing into
 an explicit **drop**. There is no behaviour change on the wire — the verbs
 already returned `421 ERR_UNKNOWNCOMMAND` — but the framing, comments,
 and reserved numerics are cleaned up so the codebase no longer carries
@@ -447,13 +905,13 @@ dead scaffolding.
 
 ## [0.4.0] - 2026-07-31
 
-The headline is **dual transport**: both adapters now speak a real
+The main change in this release is **dual transport**: both adapters now speak a real
 `irc+tls :6697` (TLS-over-TCP) surface for stock IRC clients in
 production — not just the local CLI — alongside the WebSocket path. This
 lands **SASL `EXTERNAL` via mTLS**, the **remaining standard IRC verbs**
 (WHOWAS, VERSION, TIME, ADMIN, INFO, USERHOST, ISON), a **Cloudflare
 D1-backed SASL account store**, config-driven server identity, and a
-**Node 24 / pnpm 11** toolchain. Phase 7 (TLS hardening & raw TCP) is
+**Node 24 / pnpm 11** toolchain. TLS hardening & raw TCP is
 complete.
 
 ### Added — Dual transport: WebSocket + `irc+tls :6697`
@@ -523,7 +981,7 @@ pipeline is unchanged.
 
 - The `002` / `003` / `004` registration replies now reflect
   `ServerConfig.serverVersion` / `createdAt` — the hardcoded
-  `'0.1.0'` / `'Phase 1'` placeholders are gone. A build step
+  `'0.1.0'` version / placeholder strings are gone. A build step
   (`scripts/generate-build-info.mjs`) bakes the package version and a
   build timestamp into `RPL_CREATED` (`003`) when the config omits them.
 
@@ -791,7 +1249,7 @@ AWS are now both deployable.
 ### Added — Shared test harness (`@serverless-ircd/irc-test-support`)
 
 - New workspace package owning the parametrized IRC scenario suite
-  (`runIrcScenarios`, 31 Phase 2 scenarios) and the
+  (`runIrcScenarios`, 31 scenarios) and the
   `IrcHarnessFactory` / `IrcHarness` / `ClientHarness` seam each
   adapter implements. Ships the reference `inMemoryHarnessFactory`.
   cf-adapter and aws-adapter integration tests both consume it, so the
@@ -822,7 +1280,7 @@ AWS are now both deployable.
   end-to-end rather than advertised-only.
 - The local CLI now binds a **second RFC-style TCP listener** by default
   (`--tcp-port`, default `<port> + 1`) alongside the WebSocket listener,
-  so stock IRC clients can dial in directly without the forwarder.
+  so stock IRC clients can connect directly without the forwarder.
   Pass `--no-tcp` for WebSocket-only. `--motd-file` loads the MOTD from
   disk.