Follow-up to #28. The VPN feature is logically complete and extensively tested; these items can't be verified in the current CI/dev environment because they need external resources (real hardware, kernel WireGuard, or a Windows host). Tracking them separately so #28 can close.
1. Live interop against kernel/wireguard-go
The Zig core is proven byte-identical to an independent RFC-validated reference (handshake messages, transport keys, canonical InitialChainKey), which is strong evidence of wire-correctness. A live interop test — our initiator ⇄ real wireguard-go/kernel WireGuard responder and vice versa — would confirm it against the canonical implementation. Needs wireguard-go or the kernel module in CI (neither is present today).
Notes for whoever picks this up:
- Raw transport mode (
VpnPeer({ raw: true })) already carries bare IP packets, WireGuard-wire-shaped. - The cookie/mac2 DoS primitives exist (
native/src/cookie.zig) but aren't wired into the live handshake retry path — real WG only needs them under load (mac2 = 0 is valid otherwise), but full compliance under load wants the responder cookie-reply flow.
2. Two-host routed ping e2e
The root-gated test (test/vpn.tun-root.test.ts) opens a real TUN device and reads a kernel-routed packet on a single host. A full ping 100.100.x.y across two live interfaces needs two hosts (or two netns) with root — worth adding as a netns-based Linux CI job.
3. Windows TUN (wintun)
The crypto core + UDP datapath already cross-compile to Windows (x64/arm64) and work; only the layer-3 TUN device is unsupported there (TunDevice.open() throws a clear message). Real Windows support needs the wintun userspace driver (a signed wintun.dll) and a ring-buffer session API (not fd-based), plus a Windows CI runner to test.
4. Internet exit-node e2e
RoutingTable handles 0.0.0.0/0 / ::/0 default routes and exitNodeCommands()/enableExitNode() build the forwarding + NAT setup. An end-to-end "route all traffic through a peer to the internet" test needs root, IP forwarding, and outbound connectivity from a controlled host.