feat: complete bounded TLS client/server streams

[jtenner]

Goal

Complete the bounded standard-Go TLS client/server stream and listener foundation while preserving the existing outbound release-readiness work. HTTP, HTTPS, and a portable TinyGo cryptographic TLS engine are explicitly outside this checkpoint.

This is a stacked draft on top of agent/tls-release-readiness. It must not be merged or described as completing the broader TLS/HTTPS/TinyGo grid.

Published state

• branch: agent/tls-full-grid
• head: eddbfa6
• base: agent/tls-release-readiness at 138411c76158704b80bc4e930acdfa048d8ee9ec
• draft status intentionally retained
• hosted CI run 30184215804 passed every required check for head eddbfa6 on July 26, 2026
• prior complete hosted evidence: run 30179421788 passed every required check for head 634d471 on July 25, 2026

No existing commits were amended, squashed, reordered, force-pushed, or otherwise rewritten.

What changed

• adds immutable host-defined TLS server profiles with static certificate/private-key ownership, TLS 1.3 defaults, explicit TLS 1.2 opt-in, optional verified client certificates, host-controlled ALPN, deep cloning, and unsafe callback/session/key-log rejection
• replaces caller-controlled tls.Config.Time callbacks with immutable tls.ValidationTime; nonnil clock callbacks are rejected before profile publication
• eagerly parses client and server certificate chains, verifies chain linkage and leaf/private-key correspondence, and accepts only standard in-memory RSA, NIST ECDSA, and Ed25519 private keys; delegated/HSM crypto.Signer callbacks are rejected because they cannot be deterministically canceled
• generalizes the bounded standard-Go three-worker TLS engine to client and server roles
• restores exact connection_info_v1 compatibility: offset 68 remains a boolean resumed value of exactly 0 or 1
• adds additive connection_info_v2 role and peer-authentication flags without exposing certificate chains or private keys
• requires explicit tls.AllowListeners() authority separately from server-profile storage; raw-TCP authority is never implied and applicable raw-TCP denies still constrain private listeners
• adds namespace, resource, instance, ABI, binding, quota, storage-plan, lifecycle, and policy support for TLS listen/accept
• expands wago_net_tls to 14 imports: additive connection_info_v2 plus a fixed 32-byte RFC 9266 channel_binding; accepted streams use the bounded handshake, read, write, shutdown, metadata, channel-binding, close, and poll operations
• preserves the shared namespace-local TCP port collision domain and private TCP ownership
• adds deterministic live two-namespace lneto integration for server auth and mTLS, ALPN, bidirectional plaintext, queue backpressure, clean two-way close_notify, abrupt truncation, listener reuse, quota/lease release, close/accept races, and namespace teardown
• proves immutable static SNI certificate selection and drain-close-relisten certificate rotation with a changed peer SPKI; already accepted streams retain their profile snapshot
• documents that closing a pinned lneto listener aborts undrained accepted streams; zero-downtime same-port handoff is not claimed
• fixes the hosted ordinary-Go timeout from Actions run 29757140541, job 88402308965, by pumping the final TLS 1.3 client flight before waiting for the peer handshake
• hardens deep TLS certificate cloning and finite DHCPv4 server lease expiration
• bounds every TinyGo-supported package with a ten-minute watchdog and one timeout-only retry, with a regression proving a wedged package cannot consume the six-hour hosted-job limit
• adds opt-in bounded per-instance client session resumption with exact entry/serialized-byte limits, LRU eviction, quota reservation, deterministic clearing, and 0-RTT forced off
• adds opt-in stateless server session tickets with one to four explicit ordered keys, including tested [new, old] to [new] rotation
• exposes only the fixed RFC 9266 tls-exporter channel binding; exporter label, context, and length are not guest-selectable
• caches successful private-transport establishment instead of re-running TryFinishConnect after TLS has started; this preserves abrupt EOF for crypto/tls truncation classification rather than allowing a retired TCP stream to surface a later connection-refused result

Commits added in this completion pass

• ba8b247 — fix: flush the final TLS client handshake flight
• 0a29624 — fix: preserve TLS connection info v1 ABI
• f5184e6 — feat: require explicit TLS listener authority
• beac180 — test: exercise live TLS client server lifecycle
• 0acb287 — docs: record TLS server foundation evidence
• d1e87c7 — test: preserve TLS metadata output atomicity
• a99aa77 — docs: record final TLS signoff target count
• e40fb5e — fix: harden TLS cloning and DHCP leases
• 27a766f — ci: bound TinyGo package hangs
• 2f9c2e5 — feat: add bounded TLS session resumption
• 634d471 — feat: expose fixed TLS channel binding
• 1d0ebcc — fix: bound TLS profile callbacks
• 530b011 — test: certify bounded TLS certificate rotation
• 06b2514 — fix: retain established TLS transport state
• eddbfa6 — docs: describe bidirectional TLS authority

The earlier PR commits 35b2fcf and 52c9d8d remain unchanged and in their original order.

Local validation

Passed on the current head:

• go test ./...
• go test -shuffle=on -count=1 ./...
• focused TLS race suites for the engine, lneto adapter, bindings, instance layer, and public registration
• 500 consecutive live lneto TLS lifecycle/truncation runs
• go vet ./...
• source-boundary, shell-syntax, and diff checks
• 17 TLS signoff package profiles resolving 164 named tests
• TinyGo root composition and internal/namespace/tls targeted tests; the exact five real-TLS packages remain standard-Go-only
• linux/386 internal/backend/gotls and internal/backend/lneto/tls; the public TLS package remains blocked only by the accepted pinned-Wago runtime.HostCtrlFrameBytes diagnostic
• linux/arm64 cross-compilation for the standard-Go TLS engine and public TLS registration binaries
• standard-library interoperability proving full TLS 1.3, resumed handshakes across ticket-key rotation, equal RFC 9266 channel bindings on both peers, static SNI selection, and certificate rotation snapshot behavior

Current hosted run 30184215804 completed the full exact 123-package TinyGo-supported matrix in 37m39s and passed custom test/shuffle/vet/source-boundary, race, standard-Go TLS signoff, and checkptr/386 jobs. Prior retained evidence also covers custom CLI inspection and the four-binary arm64 cross-build.

Hosted CI note

Run 30183264224 on intermediate head 530b011 found one shuffle-only lifecycle race: after the raw TCP peer half-closed without TLS close_notify, a later TryFinishConnect recheck could observe the retired TCP stream before the TLS engine consumed EOF, returning connection-refused instead of TLS protocol truncation. Commit 06b2514 caches the successful transport-establishment transition, adds client/server regression transports that fail any second finish-connect call, passes focused race tests, and passes 500 consecutive live truncation runs. Replacement run 30184215804 passed every required check after the follow-up comment-only authority correction in eddbfa6.

Explicitly incomplete

• no HTTP request/response API
• no HTTPS client or server API
• no portable TinyGo TLS client/server cryptographic engine
• no 0-RTT, STARTTLS/existing-handle transfer, DTLS, or QUIC transport surface
• no arbitrary guest exporter labels, dynamic verification/certificate callbacks, delegated/HSM signers, caller clock callbacks, or live mutation of immutable profiles
• no executed arm64 evidence
• no strict release adoption or provenance/review-bundle result while the current Wago topology audit remains blocked

TLS remains granular-only and outside aggregate register. No insecure TinyGo stub, plaintext shim, or device-offload-only substitution is included or claimed.