2026-10-26: gate G0 with real ChatGPT. TLS 1.3, TLS_AES_256_GCM_SHA384 and X25519MLKEM768 measured on a Mac with OpenSSL 3.5.6. Blindness capture 121641-0d72: clean.
2026-10-26: a consent-page bug was fixed and merged. The page sent Origin: null because of its Referrer-Policy.
2026-10-27: the DNS of the devices zone was read from outside and the reading recorded: the CAA record is the one the policy asks for, wildcard certificates are forbidden, and the records point straight at the nodes. DNSSEC was not on then: the domain registry had not yet published the zone's DS record (it validates since 2026-10-29).
2026-10-27: the kill switch was tested end to end in a lab with the real tunnel node and a stand-in for ChatGPT. Not tested with real ChatGPT, on Windows or on Linux.
ALL