Labels

Automatic HTTPS via ACME

JWT, JWKS, and forward-auth

Build tags, Dockerfile, Makefile

Response cache

CI workflows, release, SBOM, signing

TOML schema, validation, and hot reload

Admin Console (web UI)

Router, handler, and middleware pipeline

systemd unit, Windows service

gRPC proxying and transcoding

HTTP/3 over QUIC

NGINX config import

Mutual TLS / client certificates

Metrics, tracing, and access logs

WASM plugins

Reverse proxy and upstream pools

Secret references and log redaction

Consul and Kubernetes discovery

Layer-4 (TCP/UDP) stream proxying

TLS termination and certificate handling

Web application firewall

Changes a semver-guarded contract

Touches the no-feature-without-a-Console-surface rule (ADR 0004)

Dependency updates (Dependabot)

Pull requests that update docker code

Multi-day / needs breaking down

Up to a couple of days

A few hours or less

Intermittently failing test

Blocks the GA bar (ADR 0003)