[jtenner]

Summary

• define and test the exact TinyGo-supported networking surface while keeping the real outbound TLS engine explicitly standard-Go-only
• add a named standard-Go TLS signoff matrix and retain both TLS and TinyGo logs in CI/release evidence
• expand arm64 cross-build evidence to root networking, gotls, mixed lneto TLS transport, and public TLS composition
• bind TLS/TinyGo/arm64 platform evidence into provenance schema v3 while retaining schema-v2 verification compatibility
• refresh the complete benchmark baseline with TLS handshake, fixed-ring, authorization, TCP-port-lease, and live round-trip measurements
• document the client-only, granular-only, experimental TLS release boundary and the fail-closed strict-gate blocker

TLS scope is unchanged: no server TLS, no aggregate registration, no tls/register, no net-tls bundle, and no TinyGo TLS stub.

Validation completed locally

• go test ./...
• shuffled full tests
• full and focused race tests
• go vet ./...
• source-boundary and checkptr scripts
• Linux/386 package matrix
• standard-Go TLS signoff: 10 ordinary package profiles, 7 race package profiles, 109 resolved named test targets; all 17 package runs passed
• TinyGo 0.41.1 supported matrix using both the development workspace and a release-style exact modfile: 128 repository packages discovered, 123 supported packages passed, 5 standard-Go-only packages retained explicitly
• fuzz discovery: 44 targets in 33 packages; all passed a final 3-second smoke run; each of the four TLS-owned targets also passed an individual 30-second run
• focused TLS repetitions: 100x ordinary and 20x race, including mixed TCP/TLS local-port leases, TLS-scoped loopback, exactly-once EOF, truncation, and teardown
• custom CLI inspection: standard Go and TinyGo matched for all 12 canonical bundles
• arm64: all four configured binaries cross-compiled; local execution is skipped-no-runner
• benchmark baseline: 172 top-level targets in 50 packages and 195 expanded result names, five 200 ms samples with GOMAXPROCS=1 and -benchmem

Representative TLS 1.3 handshake median: approximately 1.465 ms/op, 388,334 B/op, 935 allocs/op. Fixed ring, profile authorization, TCP port leasing, and live TCP round-trip retained zero-allocation results.

Hosted CI

The initial PR run completed successfully for test/shuffle/vet, race, checkptr/386,
standard-Go TLS signoff, the TinyGo-supported package surface, and CodeQL. The
TinyGo job exercised all 123 supported packages with pinned TinyGo 0.41.1 and
completed in 46m56s. Fuzz and benchmark smoke jobs were skipped as intended for
a pull-request event; they run on their configured scheduled/manual events.

Strict release gate

Attempted with:

RUN_WASI=1 FUZZTIME=30s scripts/release-signoff.sh

using exact clean reconstructed inputs, including production Wago commit 97e6f91e6c822491577faa86f3c30aa5a8fff1e8 with tree adbba31c51996f1c1d6d3c2069de8ddf0afd94ee and ordered parents 54499ba5135f69a062e23a7255f4a408d6cecf8c, ffd5ef4b122cbd019897eeea3503789ab5860e4a.

The gate stopped fail-closed during current-plugin-topology-audit, before repository test execution, because Wago origin/main has moved to 7794acc82692aac4ff98756a46a017d0d8768087, beyond the reviewed ff04a6b1 topology. The upstream lifecycle and preview-1 integrations must be re-reviewed and re-ported before adoption. No provenance manifest or review bundle was produced by the stopped run.

Remaining release blockers

• accepted arm64 runner execution evidence is still required; local evidence is cross-build-only
• current Wago topology must be re-reviewed before the strict release gate can proceed
• real TLS remains intentionally unsupported under TinyGo 0.41.1

For these reasons this PR is intentionally opened as a draft and does not claim production TLS readiness.

2026-11-02 restack

Rebased onto net da38690138eb9fa83b0c09fd3113cb88f952ae66; current head is dd08034bb40e8acf5682450eceda9ad15332f35d. CI dependency preparation and go.mod target Wago 90f2b57dafa7f8c3cc7e3aca38b91148f15e1d1e (v0.1.0-beta.8.0.20261031153428-90f2b57dafa7). Runtime inspection uses the current plugin loader. The current platform manifest is 129 repository packages, 124 TinyGo-supported packages, and five standard-Go-only TLS packages. The TLS peer test now waits on a bounded wall-clock deadline while continuously servicing ciphertext, avoiding a checkptr-sensitive scheduler-iteration race after the handshake. Full ordinary, shuffle, vet, source-boundary, race, checkptr, backend-neutral 386, wagodebug, wago_regalloccheck, three-mode benchmark-compilation, and 17-run TLS signoff gates passed locally. July benchmark results remain historical; no benchmark timing was executed during this restack. Rewritten commits, including the new test-harness commit, are unsigned because no desktop signing agent was available.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T16:57:00.657387Z	dd08034	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-07T17:00:37.484438Z	dd08034	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.