# Dosh Release Evidence - 2026-06-20

Runtime code benchmarked: `b44ff8e Improve release and benchmark tooling`

Release docs/default cleanup after that benchmark removed personal host aliases from
public examples and test fixtures; it did not change release runtime paths.

Environment:

- Host: local homelab runner
- Benchmark harness: `make bench-docker-mosh`
- Container SSH server: OpenSSH 9.6p1 on Ubuntu
- Same container, key, DNS, loopback, and Dosh server path for all Docker samples

## Release Artifacts

Generated locally with:

```bash
sh scripts/package-release.sh
```

Artifacts:

| artifact | sha256 |
| --- | --- |
| `dosh-linux-x86_64.tar.gz` | `cd77264d160fb87c6fd51009a6fbe826c9d2c00b23a57b4b3b98433af5a06b65` |
| `dosh-0.1.0-linux-x86_64.tar.gz` | `cd77264d160fb87c6fd51009a6fbe826c9d2c00b23a57b4b3b98433af5a06b65` |
| `dosh-macos-aarch64.tar.gz` | `0425b378c5b644646a6b22508875d5ae677ee358923d27e0a72bbcfbb9ae5774` |
| `dosh-0.1.0-macos-aarch64.tar.gz` | `0425b378c5b644646a6b22508875d5ae677ee358923d27e0a72bbcfbb9ae5774` |

The installer verifies `<artifact>.sha256` when the sidecar is published.

## Docker SSH/Mosh Benchmark

Command:

```bash
make bench-docker-mosh
```

### Cold SSH Bootstrap

| metric | n | min ms | median ms | p95 ms | mean ms | max ms |
| --- | ---: | ---: | ---: | ---: | ---: | ---: |
| `ssh_true_ms` | 3 | 216.58 | 220.27 | 224.64 | 220.66 | 225.12 |
| `dosh_attach_ms` | 3 | 232.37 | 235.56 | 239.13 | 235.82 | 239.53 |

Raw samples:

- `ssh_true_ms`: [216.58, 220.27, 225.12]
- `dosh_attach_ms`: [235.56, 232.37, 239.53]

Gate: `dosh_attach_ms avg 235.82ms <= ssh avg 220.66ms + 500.00ms`

### ControlMaster SSH Bootstrap

| metric | n | min ms | median ms | p95 ms | mean ms | max ms |
| --- | ---: | ---: | ---: | ---: | ---: | ---: |
| `ssh_true_ms` | 3 | 7.29 | 7.50 | 47.51 | 22.25 | 51.95 |
| `dosh_attach_ms` | 3 | 16.62 | 17.01 | 17.77 | 17.16 | 17.85 |

Raw samples:

- `ssh_true_ms`: [51.95, 7.29, 7.50]
- `dosh_attach_ms`: [17.01, 16.62, 17.85]

Gate: `dosh_attach_ms avg 17.16ms <= ssh avg 22.25ms + 500.00ms`

### Native Cold Auth

| metric | n | min ms | median ms | p95 ms | mean ms | max ms |
| --- | ---: | ---: | ---: | ---: | ---: | ---: |
| `ssh_true_ms` | 5 | 215.72 | 222.68 | 227.05 | 221.32 | 227.82 |
| `dosh_cold_native_ms` | 5 | 8.63 | 8.84 | 9.16 | 8.88 | 9.23 |

Raw samples:

- `ssh_true_ms`: [216.40, 223.99, 227.82, 222.68, 215.72]
- `dosh_cold_native_ms`: [8.84, 8.63, 9.23, 8.88, 8.84]

Gate: `dosh_cold_native_ms avg 8.88ms <= ssh avg 221.32ms + 0.00ms`

### Cached Attach

| metric | n | min ms | median ms | p95 ms | mean ms | max ms |
| --- | ---: | ---: | ---: | ---: | ---: | ---: |
| `dosh_cached_attach_ms` | 10 | 8.07 | 8.96 | 9.83 | 8.98 | 9.84 |

Raw samples:

- `dosh_cached_attach_ms`: [8.07, 9.09, 9.02, 8.66, 8.71, 8.90, 8.45, 9.84, 9.25, 9.82]

Gate: `dosh_cached_attach_ms avg 8.98ms <= 25.00ms`

### Mosh Comparison

| metric | n | min ms | median ms | p95 ms | mean ms | max ms |
| --- | ---: | ---: | ---: | ---: | ---: | ---: |
| `ssh_true_ms` | 3 | 216.48 | 218.93 | 219.49 | 218.32 | 219.55 |
| `dosh_attach_ms` | 3 | 229.59 | 233.00 | 233.31 | 231.98 | 233.35 |
| `mosh_start_true_ms` | 3 | 527.13 | 563.34 | 573.09 | 554.89 | 574.18 |

Raw samples:

- `ssh_true_ms`: [219.55, 216.48, 218.93]
- `dosh_attach_ms`: [233.00, 229.59, 233.35]
- `mosh_start_true_ms`: [563.34, 527.13, 574.18]

## Soak And Fuzz Evidence

- `cargo test`: `153 passed, 1 ignored`
- `make soak-local`: `sleep_roaming_soak_30m ... ok`, finished in `1803.54s`
- `make fuzz-smoke`: passed all configured targets for 20s each:
  `packet_decode`, `from_body`, `authorized_keys`, `known_hosts`,
  `handshake_structs`, `attach_ticket`

## Public Claim Boundary

This evidence supports:

- Dosh cached attach and native auth are much faster than cold SSH/Mosh startup in
  this benchmark environment.
- Dosh remains mosh-shaped, not mosh-compatible.
- Dosh does not claim generic SSH replacement compatibility.
- Native v1 security still needs external review before making hard public security
  claims.