CP-13
MASQUE Tunnel Protocol
✅ Shipped
MASQUE_H3, MASQUE_H2, CONNECT_TCP protocol support. TOFU TLS pinning via SHA-256 fingerprint. Lifecycle: PENDING → ACTIVE → DEGRADED → OFFLINE.
Enterprise v4.4
CR-06
Async TCP Health Probing
✅ Shipped
probe_tunnel() async TCP health-check on configured endpoint. Marks tunnel ACTIVE on first success, DEGRADED after 2 failures, OFFLINE after 5.
Enterprise v4.4
CR-15
QUIC/HTTP3 Support
✅ Shipped
Caddy v2 UDP 443 for QUIC/HTTP3. Alt-Svc header injection. HSTS enforced. hostname-based routing: api/app/analytics/landing subdomains.
Pro v4.7