Ghost FTP 0.99.20 — Phase 4 server bootstrap (development Preview)

Previous published release: v0.99.19. The Phase 4 source is not yet published or approved for external production deployments.

Added in this development cycle

• Independent ghost-server/ Go 1.23 module, separate from desktop and Android clients, with a standalone Windows-cross-compilable executable.
• A real, read-only explicit FTPS listener with AUTH TLS, TLS 1.2+, credential verification after TLS, mandatory PBSZ 0 and PROT P for all passive data connections, rooted directory listing and binary download.
• Security-first non-writable default: remote upload, delete, rename, active-mode FTP and account modification return refusals. Missing certificate, private key or sufficiently strong password prevent startup.
• Integration tests cover encrypted login, wrong passwords, real protected download bytes and traversal/symlink denials, with go test -race, go vet, and Windows cross-compilation in new Ghost FTP Server Phase 4 CI.

Outstanding acceptance

The server is a proof-of-function, not a Windows service or production FTP/FTPS platform. It lacks admin UI, write pipeline, per-user ACL/quota, login throttling, certificate renewal, secure Windows service installation, operational logging and real full client↔server E2E. Symlink traversal checks are not atomic against hostile concurrent local filesystem changes.

Phase 2 secure native Swift FTPS/SFTP issue #223 remains open. Phase 3 has 17/75 actual screenshot comparisons but 0/75 accepted pixel-perfect 1:1. Beginning Phase 4 does not mark either prior phase complete. No production release/tag or server installer until acceptance.

Additional Windows service distribution (Phase 4)

• A separate Windows CI job compiles an unsigned NSIS
  ghost-server-windows-x64-setup-unsigned.exe and produces SHA-256
  checksums alongside the portable SCM-enabled Windows executable.
• Installation deliberately leaves service registration, credentials,
  certificate provisioning and firewall configuration to the administrator.
  Uninstall refuses to orphan an active or registered service.
• This is not yet a signed production setup, nor a completed end-to-end
  GUI administration workflow.

Local administration dashboard

An optional local-only web dashboard (http://127.0.0.1:2821/admin/) is
implemented with embedded, dependency-free HTML, CSS and JavaScript.
It has real active-session/uptime/TLS/upload policy metrics, a separately
provisioned 32+ byte bearer token, a loopback-only bind rule, Host checking
and restrictive CSP. Its API is read-only, not a full user/ACL and
configuration editor. No HTTP listener exists without -admin-token-file.

This is a monitoring and diagnostic control plane; it does not complete
production administrator controls or cross-device E2E.

Explicitly authorized file mutations (development)

An additional -allow-destructive option (requiring
-allow-uploads) gates regular-file DELE, empty-directory RMD
and no-overwrite regular-file RNFR/RNTO. All are server-root scoped;
file renames use a hardlink commit and only remove the source afterward.
If the removal fails, the server reports an error and keeps both copies
rather than silently destroying data. Tests exercise occupied destinations,
path traversal and deny-by-default behavior. This does not constitute
a complete production multi-user ACL/quotas/retention solution.