v1.9 Release Roadmap — stratum link security (provisional)

[VijitSingh97]

Single source of truth for the v1.9 release plan — same format as #364. Provisional: two stratum issues (one theme) + a warm-up wave; re-sequence when the cycle opens. (Renumbered v1.7 → v1.8 on 2026-07-14 when the config/telemetry work took the v1.7 slot; renumbered v1.8 → v1.9 on 2026-07-18 after "Config UX round 2" took the v1.8 slot. #595 parked here 2026-07-17 as a pre-stratum quick win. Upgrade-hygiene wave #629/#631/#632/#633 added 2026-07-18 from the prod v1.8.1 upgrade observations.)

The theme: v1.9 locks the last cleartext link — miner ↔ stack stratum. Everything else already rides Tor or the LAN trust boundary; the stratum leg still crosses the LAN unauthenticated (by default) and unencrypted. #208 turns on stratum auth by default by letting rigs fetch the password at setup; #261 wraps the link in TLS. Ordered: the #208 distribution channel is also how the #261 certificate fingerprint reaches the rigs — build it first or fingerprint distribution stays manual.

   Wave 0 — DECISIONS (the gap assessments name the options)
   #208: pick the retrieval channel (setup-time paste is the lazy correct default)
         + the default-flip migration story (don't brick existing fleets on upgrade)
   #261: pick terminator (xmrig-proxy native TLS — verify upstream) + port model
         (replace :3333 vs parallel TLS port for mixed-fleet migration) + trust model
         (self-signed + fingerprint pinning recommended)
                 │
                 ▼
   #208  auto-fetch stratum password → default-on auth   [mostly rigforge#113]
     └─► #261  stratum-over-TLS                           [lockstep with rigforge#115]
                 ▼
              SHIP 1.9

Warm-up — before the stratum work

Upgrade hygiene (from the 2026-07-18 prod v1.7.0 → v1.8.1 one-click — all observed live):

• One-click upgrade leaves current-> symlink and dir name on the old version, destroying the previous bundle #629 — one-click upgrade leaves current-> + dir name on the old version, destroying the previous bundle. The heavyweight of the wave: needs the extract-to-fresh-dir design (mind the DASHBOARD_DATA_DIR-inside-version-dir mount caveat, Standardize the deploy-box layout: upgrade maintains a symlink; dashboard data joins the shared data root #455). Prod's rollback is currently degraded to v1.6.2 and every one-click compounds it — do this first.
• Document the one-time false "502 — did not complete" when upgrading to v1.8.1 from a pre-#622 version #631 — document the one-time false "502 — did not complete" when upgrading from ≤ v1.7.x (docs only; the old client can't be patched retroactively).
• make test omits the frontend node suite — local run diverges from CI #632 — make test omits the frontend node suite — add test-frontend to the chain so local == CI.
• Validate the #622 502 ride-out live on bench (fixed poller vs a real proxy 502) #633 — validate the One-click upgrade shows "Upgrade did not complete — HTTP 502" on a successful upgrade #622 502 ride-out live on gouda (fixed poller vs a real caddy 502). Low-pri; may close as "existing coverage sufficient." Bench only — a prod one-click re-triggers One-click upgrade leaves current-> symlink and dir name on the old version, destroying the previous bundle #629 until One-click upgrade leaves current-> symlink and dir name on the old version, destroying the previous bundle #629 lands.

Efficiency:

• Reduce Tor CPU overhead: onion-dial churn + out-peers/healthcheck tuning #595 — reduce Tor CPU overhead (onion-dial churn + out-peers/healthcheck tuning). Standalone, not part of the stratum spine — a quick measure-and-tune efficiency check. Two config levers + one p2pool peer-hygiene look; no privacy-posture change. Shipping it early also frees the core the v1.10 co-located miner (Add opt-in local miner: co-locate a RigForge worker on the stack host #593) wants.

Docs:

• (PUNTED → v1.10) docs: refresh screenshots and images to current dashboard/branding #479 — refresh screenshots/images to current dashboard + branding. Blocked on the new Pithead logo; if the logo isn't ready when the cycle closes, punt again rather than screenshot the old wordmark.

The stratum work

• RigForge: fetch the stratum access-password at worker setup → default-on stratum auth (Phase 2 of #152) #208 — RigForge fetches the stratum password at worker setup → default-on stratum auth. Pithead side is small (docs + the "auto" default question); the implementation is rigforge#113. Interacts with v1.4's pithead rotate-secrets: regenerate the stack's internal credentials in one command #378 (rotate-secrets becomes fleet-practical once rigs can re-fetch).
• Stratum-over-TLS: encrypt the miner↔stack stratum link (follow-on to stratum auth #208) #261 — Stratum-over-TLS. Terminator, port model, and cert/trust decisions are Wave 0; rigforge#115 (pools[].tls + fingerprint pinning) lands in lockstep.

Rolled in during the cycle (2026-07-18)

• Configuration form: sections mixing top-level keys render ambiguous duplicate labels ("view_key" twice) #640 → PR fix(#640): full dotted labels in config sections that mix top-level keys #641 — config form: full dotted labels in sections mixing top-level keys.
  Operator-filed during the cut window; reviewed + merged, rides v1.9.0.
• Dashboard: surface XvB raffle wins (chart markers, wins list, log) #644 → PR feat(dashboard): show XvB raffle wins on the chart and in a log #642 — dashboard shows XvB raffle wins (chart markers, wins list, log).
  Operator-filed during the cut window; retroactive tracking issue Dashboard: surface XvB raffle wins (chart markers, wins list, log) #644 carries the design
  record. Verifier PASS; security pass found one MEDIUM (unbounded storage of rows mirrored
  from the untrusted winners file) — fixed pre-merge with parse/table/read bounds. Rides
  v1.9.0.
• One-click upgrade: snapshot config.json/.env before mutating, and name the restore point in the result #637 → PR One-click upgrade names its restore point (#637) #647 — one-click upgrade names its restore point. Operator-filed during the
  cut window; completes One-click upgrade leaves current-> symlink and dir name on the old version, destroying the previous bundle #629's rollback story (in-place path snapshots config/.env fail-closed,
  symlink-safe, pruned to three pairs; both paths name the restore point in the result + modal).
  Reviewed line-by-line in-session; rides v1.9.0.
• PR docs: view-key export steps + payout-confirmation discoverability #643 — payout-confirmation docs: key-export steps + discoverability. Docs-only,
  fills a gap in shipped Confirm payouts on-chain with a view-only wallet (monero-wallet-rpc against the local node) #381/Confirm Tari payouts on-chain with a view-only minotari wallet (sibling of #381) #462; no tracking issue needed. Rides v1.9.0.
• Roll-in cutoff: after docs: view-key export steps + payout-confirmation discoverability #643/One-click upgrade names its restore point (#637) #647 the v1.9.0 content is FROZEN — later PRs (e.g. feat(#520): opt-in live XMR/XTM price feed over Tor + fiat estimates on the earnings card #646 price
  feed, per its own note) ride the next release.
• Release-box fix (no issue): gouda ran EOL node 18, which cannot load the vendored preact
  ESM — the first v1.9.0 cut stopped at the stage-2 test gate the moment make test omits the frontend node suite — local run diverges from CI #632 wired the frontend
  suite into make test (working exactly as intended: that skew was previously invisible).
  Box upgraded to node 20 LTS via nodesource; recorded in gouda's ~/README.md.

Release status — ✅ SHIPPED (v1.9.0 published 2026-07-19T01:14Z)

• Published: tag v1.9.0 = 7649402; images digest-pinned; main merged (release: v1.9.0 — stratum link security #649) + back-merged
  (release: back-merge main into develop after v1.9.0 #650), invariant verified. Release notes = CHANGELOG [1.9.0].
• gouda live on v1.9.0 via the real Dashboard: new-version warning + one-click upgrade button #59 control upgrade (release-smoke Post-publish release smoke test: real cosign verify + real dashboard upgrade against the published bundle (#376/#59) #459), layout contract
  restored (current -> pithead-v1.9.0, pithead-v1.8.0 rollback). NOTE: that upgrade ran under
  the v1.8.1 runner — the LAST in-place one; the One-click upgrade leaves current-> symlink and dir name on the old version, destroying the previous bundle #629 fresh-dir path goes live-proven on the next
  one-click (same as-designed lag as One-click upgrade shows "Upgrade did not complete — HTTP 502" on a successful upgrade #622's poller fix).
• Stratum-over-TLS: encrypt the miner↔stack stratum link (follow-on to stratum auth #208) #261 validated live, mixed fleet on one port: pinned rig TLSv1.3 + shares accepted; WRONG
  pin refused ("Failed to verify server certificate fingerprint"); cleartext rig coexists.
  Fingerprint cb1c0159…c34c8de3, cert under the shared data root. miner-1 restored to baseline.
• Reduce Tor CPU overhead: onion-dial churn + out-peers/healthcheck tuning #595 measured: control conns 352→90/hr, HSDir fails 971→235/hr, tor CPU 32-44%→14-21%
  (early windows; caveats on the issue). Lever 3 deliberately dropped.
• Validate the #622 502 ride-out live on bench (fixed poller vs a real proxy 502) #633 closed (server half proven live; client half tier-1; prod's next one-click is the
  final observation). docs: refresh screenshots and images to current dashboard/branding #479 punted to v1.10 (logo gate cleared; needs an operator capture
  session).
• Prod deploy remains the operator's one-click — v1.9.0 is ready for it; the upgrade INTO
  v1.9.0 is prod's last in-place extraction, everything after keeps versioned dirs + rollback.

All milestone issues closed or punted-with-comment. Closing this tracker with the milestone.

[VijitSingh97]

v1.9.0 shipped 2026-07-19 — final status in the body. 12 issues closed against the milestone (the planned 9 minus the punted #479, plus rolled-in #640/#644/#637), 4 operator PRs reviewed + rolled in during the cut window, worker side pre-existed (rigforge#151/#21). Next: v1.10 — Deployment flexibility (#532 + punted #479).