[cppla]

Summary

• Add autocar init for new native deployments: matching server/client JSON, pinned certificate, independent random token, private file modes, no overwrite, and no server private key in the client bundle.
• Add CLI-only client/server --check to validate local configuration and credentials without DNS, connections, listeners, or file writes. Keep numeric-port requirements confined to offline checks and reject check in saved JSON.
• Fix explicitly empty client CA files silently disabling native mTLS; reject empty/malformed CA files and align web-mode client-CA validation.
• Bound CA, certificate and private-key files to 4 MiB with regular-file checks before and after opening; preserve valid symlinks and key permissions. Add bounded subprocess regression tests for FIFO misconfiguration.
• Extend the Docker integration path to exercise generated configuration, isolated offline checks, client/server credential separation, and the existing real traffic/authentication tests.
• Document safe transfer, permissions, certificate renewal, and the distinction between local preflight and live connectivity checks. No protocol/default changes, version bump, or release.

Validation

• make check and make race (Go 1.25.13): passed.
• Go 1.27.1 race suite: passed; final CLI package race regression also passed.
• Generated-bundle QUIC/TLS/auto real payload test: repeated normal and race runs passed. Uses test-only local dialers; production destination policy is unchanged.
• Cross-builds: linux/amd64, linux/arm64, darwin/arm64, windows/amd64 passed.
• Reachable vulnerability scan: zero reachable vulnerabilities (four module-level advisories are reported as not called).
• Docker non-root, no-network, read-only-root smoke: init, both preflight commands, and credential modes passed using a bounded 16 MiB tmpfs.
• Full local Docker integration: image build succeeded, execution stopped with ENOSPC because the local Docker VM disk is full. Run-owned resources were cleaned; no unrelated Docker data was removed. Final head 7cee63f3deba31986bdf521b4b6097304ffe24dc passed full Linux container integration, multi-platform OCI build, netem and CodeQL in GitHub CI: CI, netem, CodeQL.

Scope of evidence

These changes improve deployment safety and local diagnostics. No traffic-indistinguishability or comparative superiority claim is made; the previously cancelled large corpus is not restarted by this PR.

Post-merge verification

Merged as 29608a9603a8c643a42668ba2acd54dba3b0eeba; its source tree exactly matches reviewed head 7cee63f3deba31986bdf521b4b6097304ffe24dc. Main-branch CI, CodeQL, and Linux netem integration all passed, including full Docker integration and four-platform builds. No release or version tag was created.

[Copilot]

Copilot review overview

🟢 Approval recommended

The reviewed changes have no unresolved blocking issues and all approval assessments are positive.

Review effort: Lite
Findings: None

What changed in this PR

Adds secure native deployment bundle generation, offline configuration checks, stricter CA validation, and expanded documentation and integration coverage.

Changes:

• Adds autocar init with separated credentials and secure permissions.
• Adds network-free client/server preflight checks.
• Updates CA handling, tests, Docker integration, and deployment guidance.

File	Description
scripts/​docker-integration.sh	Exercises generated bundles and offline checks.
README.md	Documents bundle setup and preflight checks.
docs/​DEPLOYMENT.md	Adds deployment, transfer, permissions, and renewal guidance.
cmd/​autocar/​web_cli_test.go	Tests whitespace CA rejection.
cmd/​autocar/​server.go	Adds server checks and strict CA validation.
cmd/​autocar/​preflight.go	Implements offline validation helpers.
cmd/​autocar/​preflight_test.go	Tests offline behavior and validation failures.
cmd/​autocar/​main.go	Registers the init command.
cmd/​autocar/​init.go	Generates private paired deployment bundles.
cmd/​autocar/​init_test.go	Tests bundle contents and security properties.
cmd/​autocar/​init_integration_test.go	Tests generated-bundle traffic.
cmd/​autocar/​config_file.go	Rejects persisted check configuration.
cmd/​autocar/​client.go	Adds client offline checks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.