v0.8.0

flare v0.8.0

A protocol-surface release: flare gains a sans-I/O QUIC v1 + HTTP/3
stack, a gRPC unary server, HTTP caching and reliability
middleware, and a full migration to the Mojo 1.0.0b2 toolchain. 214
commits since v0.7.0.

QUIC v1 (sans-I/O core + reactor)

• Wire codecs: variable-length integers (RFC 9000 §16), long/short
  packet headers (§17), transport-frame codec (§19), and transport
  parameters (§18).
• State machines: per-stream (§3) and per-connection (§10) lifecycle in
  flare.quic.state.
• Crypto: pluggable QuicCrypto trait with RFC 9001 initial-secret
  math and an OpenSslQuicCrypto production backend — AEAD
  (RFC 9001 §5.3) and header-protection mask (§5.4) via dedicated
  flare_quic_aead_* / flare_quic_hp_mask FFI thunks.
• Server I/O: UDP-listener bind with per-datagram dispatch,
  QuicConnection.handle_packet wired end-to-end, and a PTO / idle /
  ack-delay TimerWheel.
• Optional rustls QUIC backend: a rustls_wrapper Rust crate +
  build_rustls.sh, FFI binding, and live-fire handshake fixtures
  (incl. miri).
• Coverage: loopback integration plus handshake/CID and crypto fuzz
  harnesses; RFC 9001 Appendix A conformance vectors.

HTTP/3 + QPACK

• Frame codec + SETTINGS payload (RFC 9114 §7).
• Sans-I/O drivers: H3Connection, a request-stream reader state
  machine, and a response-stream writer.
• Server path: peer uni-stream dispatch, SETTINGS/GOAWAY consumption,
  and the feed_stream_chunk -> take_request -> emit_response -> take_response_frames loop.
• QPACK static-table encoder/decoder (RFC 9204).
• Conformance round-trip suite + fuzz_h3_server (200K execs).

ALPN protocol routing

• Wire-protocol routing decision layer; http.server.bind_with_h3
  opens the UDP listener and routes by ALPN; ALPN-driven WebSocket
  dispatch (WsClient.connect_prefer_h2, auto-client wire dispatcher).

gRPC (unary)

• LPM framing codec + canonical status codes; GrpcServerAdapter
  bridges unary RPCs over HTTP/2.
• Typed surface: GrpcRequestHeaders, GrpcUnaryReply with ok/err
  factories; grpc-status-details-bin base64 trailers; binary/text
  metadata key discipline.
• Hardening: run_unary_call never raises (errors map to typed
  outcomes), case-insensitive te: trailers, fuzz_grpc_lpm_decoder.

HTTP caching & middleware

• RFC 9111 Cache-Control directive parser + bounded store; a
  Cache[Inner, S] middleware with two-level Vary lookup and
  is_fresh freshness checks.
• Retry + Timeout reliability middleware (RFC 9110-aligned backoff).
• H1LeniencyConfig named relaxation flags wired into the H1 parser.

WebSocket

• permessage-deflate context-takeover (persistent LZ77 across
  messages).
• RFC 6455 §5 conformance fixture corpus + runner; forked-server I/O
  round-trip suite.

Developer surface

• Template inheritance: {% block %} / {% extends %}.
• OpenAPI 3.1 spec model + deterministic JSON emitter.
• TestClient[H] for in-process handler exercises.

Performance

• HPACK Huffman: table-driven decoder, 3.6x-4.2x over the scalar
  path.
• One-pass exact-length response serialization; per-header
  to_lowercase allocation removed; UTF-8 validation bypassed on the
  H1 parse hot path.
• No regression vs Go net/http and nginx (single-worker) or
  hyper/axum/actix-web (multi-worker); per-percentile sigma published in
  docs/benchmark.md.

Correctness & hardening

• HTTP client: reject 16-digit chunk-size to stop a signed-Int
  overflow driving an out-of-bounds read in the chunked decoder.
• HTTP parser: sanitize unvalidated request-line bytes before echoing
  them in error messages.
• TLS FFI: keep owned path/SNI buffers live across OpenSSL calls;
  NUL-terminate cert/key/CA paths; install the rustls QUIC cdylib as
  .dylib on macOS.
• Auth: forward caller-supplied Authorization on H1 and h2c-upgrade
  paths (needed for S3 / AWS SigV4).
• io_uring: size SQE/CQE mmaps from the entry count, not the
  ring-entries offset.
• HTTP/2: stop take_completed_streams re-dispatching already-served
  streams; stream slab keyed on stream_id with a fast-path table.
• New fuzz harnesses across quic (varint, long-header,
  transport_params), qpack, h3 (frame), grpc, and cache-control; h1
  wire-grammar conformance corpus.

Structure (v0.8 decomposition)

• A 1000-line-per-module bar enforced by
  tools/check_reactor_size.sh. Split the server reactor into epoll +
  uring modules, relocated unified-reactor dispatch, extracted client
  parse/send, the io_uring ABI codec, quic/http2 value types, and the
  extractor parsers.
• Lifecycle: migrated __copyinit__ / __moveinit__ to __init__
  overloads; removed stub-only public surfaces and a stale
  prelude.mojo shadow.

Mojo 1.0.0b2 migration

• reflect[T] alias form, non-nullable UnsafePointer,
  MutExternalOrigin -> MutUntrackedOrigin, and StringSlice
  construction via CStringSlice.
• Dependencies pinned to json v0.2.1 and mozz v0.1.4; quiche
  baseline bumped 0.22.0 -> 0.24.5.