Support matrix and release gate

This page describes what MEHS claims, how each claim is verified, and the checks expected before a release. Verification levels:

Native-tested: tests or a smoke test execute on that OS/target.
Target-checked: platform compatibility checks exist, but runtime behavior is not claimed.
Package-only: a binary/library is available but has not been run.
Unsupported: there is no implementation or verification; do not rely on it.

Platforms

Component	Linux x86_64	Windows x64	Windows x86	macOS	Android	iOS
General behavior checks	Native-tested	Native-tested	Native-tested	Native-tested	Native-tested	Package-only
Server (Debian 13 x86_64 reference)	Native-tested + end-to-end smoke	Native-tested (unit)	Native-tested (unit)	Native-tested (unit)	Native-tested + end-to-end smoke	n/a
CLI + local SOCKS5/HTTP proxy	Native-tested + end-to-end smoke	Native-tested (unit); manual end-to-end verified	Native-tested (unit); manual end-to-end verified	Native-tested (unit)	Native-tested + end-to-end smoke	Unsupported
C FFI	Native-tested (ABI, panic, lifecycle)	Native-tested (ABI, panic, lifecycle)	Native-tested (ABI, panic, lifecycle)	Native-tested; `aarch64`/`x86_64` target checks	Native-tested (ABI, panic, lifecycle)	Package-only
TUN mode	Manually verified end to end (network namespace, TCP + QUIC)	Manually verified (Wintun, administrator)	Manually verified (Wintun, administrator)	Implemented (`utun`); not runtime-tested	Host-provided descriptor; device lifecycle not runtime-tested	`NEPacketTunnelFlow` callbacks; host integration not runtime-tested

“Manual end-to-end verified” means a maintainer ran the client against a Debian 13 server; it is not a repeatable automated check.

TUN mode needs no remote gateway. If the client is killed, a detached cleanup process (and the next start) removes stale host routes; this cleanup was verified on Linux. Linux TUN has manual end-to-end verification over TCP and QUIC; Windows TUN has separate manual verification with Wintun. Neither is a repeatable automated end-to-end check. macOS and Android TUN are not runtime-tested; sleep/wake and network-change behavior is untested on every OS. Maintainers manually verified through proxy mode and Linux TUN: TCP, UDP, DNS, large transfers, WebSockets, persistent connections, SSH, gaming, video streaming, and Telegram/WhatsApp/Discord calls. Windows packages exist for x64, x86, and arm64 (the 0.9.2 arm64 release has not been run).

Transports and features

Capability	Status	Verification
TLS 1.3 / TCP data path (`mehs-data/1`)	Implemented	Smoke test (SOCKS5 + HTTP CONNECT through a real server)
QUIC data path	Implemented	Smoke test
SOCKS5 CONNECT, UDP ASSOCIATE; HTTP CONNECT	Implemented	Unit/integration tests; CONNECT and SOCKS5 TCP in smoke test
Optional file storage	Implemented, optional	Feature checks and tests
Example configurations	Parse and validate	Server and client FFI tests
CLI `--help` and documented invocation flags	Exercised	Smoke test
Live multi-path migration end to end	Manually verified (loopback, TCP→QUIC under injected TCP latency, live downloads uninterrupted)	Not included in automated checks
`xhttp`, `trusttunnel`, `notmehs` profiles	Supported (MEHS-native; no third-party interoperability)	Unit tests; end-to-end over TCP and QUIC
Per-app routing (`apps`)	Linux, Windows (proxy and TUN); unsupported elsewhere	Unit tests; Windows proxy end-to-end
Windows TUN	Verified working by maintainers (Wintun, administrator)	Manual
Raw-IP gateway service	Not implemented	n/a

FFI guarantees

Header error codes equal the exported constants and published values.
Every function in the public C interface is exported.
mehs_frame_view field offsets, size, and alignment are pinned.
Null and malformed arguments return error codes; every entry point catches panics and reports MEHS_PANIC. A panic is not forced by a test because no public input currently reaches one.
Lifecycle: create, sleep, wake, and destroy succeed in order; a failed create leaves no handle.
Host-provided handles (Android TUN fd, Wintun DLL path) are not covered by end-to-end FFI tests; Android's invalid-fd rejection is covered by a native unit test, but its VpnService lifecycle is not device-tested.

Compatibility and migration

/health and /v1/authorize report the frame protocol_version; the client checks the authorize response and fails before finalization when the version is missing or mismatched. mehs_protocol_version() exposes the local version to FFI hosts. This is an exact-version guard, not multi-version negotiation and not a guarantee that matching protocol numbers make arbitrary releases compatible.
Current 0.9.x operation requires client and server from the exact same MEHS release; 0.9.0 is incompatible with 0.8.x, and mixed 0.9.x patch pairs are not certified. A future stable 1.0.x line intends patch-level interoperability only for matching frame versions, ALPN/profile names, and authentication paths.
The C ABI is pinned; a deliberate change to it is an ABI break and must be called out in release migration notes.
Config schema_version is 1. Unknown fields are rejected, so configs must match the release that consumes them.

Release gate

A release is ready only when all of the following hold. Benchmark numbers and external audit completion are not gating criteria.

Platform behavior, feature compatibility, target checks, and end-to-end connectivity checks pass.
Release packages have been produced for Windows, Android, iOS, Linux client, and Debian 13 server from the intended release version.
End-to-end client/server behavior is verified for the release version.
There are no open release-blocker issues; known limitations in the public documentation and changelog match the released behavior.
Any ABI/config/wire change is recorded in release migration notes.
Release status continues to state that the wire protocol is not frozen and no independent audit has been done.