Harden claims and add multi-certificate TLS SNI

[loreste]

Summary

• enforce the no-tracing-GC runtime contract and add adversarial rejection fixtures
• harden bounds, ownership, structured concurrency, CMap synchronization, and secure HTTP/TLS paths
• add multi-certificate TLS SNI with exact and longest left-most wildcard selection
• add claims, stdlib, cross-target, artifact, and live-SNI gates with matching documentation

Validation

• cargo test: 46 passed, 0 failed
• cargo build --release: passed
• release suite: 338 passed, 0 failed
• stdlib gate: 71 package files, 0 failures
• claims gate: passed, including normal and strict Rust comparison thresholds
• cross-target artifacts: Windows PE32+, Linux musl x86-64/ARM64, WASI WebAssembly, Intel macOS Mach-O
• live SNI loopback test: exact, wildcard, longest wildcard, and default certificate selection passed

Documentation boundary

The repository documents the evidence and limits in docs/STATUS.md, docs/SECURITY.md, and docs/RELEASE.md. docs/CLAIMS.md remains intentionally ignored and was not committed.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 116 files, which is 16 over the limit of 100.

To get a review, narrow the scope:
• coderabbit review --type committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: accc298e-09dc-4b03-8e92-8d4fbacb1243

📥 Commits

Reviewing files that changed from the base of the PR and between c136fb4 and 273b706.

📒 Files selected for processing (117)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• .gitignore
• CHANGELOG.md
• LANGUAGE_SPEC.md
• README.md
• docs/ABI.md
• docs/BUILTINS.md
• docs/CLI.md
• docs/COMPAT.md
• docs/DEBUG.md
• docs/ERGONOMICS.md
• docs/EXAMPLES.md
• docs/GENERAL_PURPOSE_PLAN.md
• docs/GO_SYNTAX_CHECKLIST.md
• docs/GUIDE.md
• docs/IDENTITY.md
• docs/KEYWORDS.md
• docs/LANGUAGE.md
• docs/PAIN_POINTS.md
• docs/PERFORMANCE.md
• docs/RELEASE.md
• docs/ROADMAP.md
• docs/SECURITY.md
• docs/SPEED.md
• docs/STATUS.md
• docs/STDLIB.md
• docs/VISION.md
• docs/WASM.md
• docs/book/README.md
• docs/book/src/ch00-introduction.md
• docs/book/src/ch01-preface.md
• docs/book/src/ch02-getting-started.md
• docs/book/src/ch03-language-tour.md
• docs/book/src/ch04-ownership.md
• docs/book/src/ch05-errors.md
• docs/book/src/ch06-concurrency.md
• docs/book/src/ch07-stdlib.md
• docs/book/src/ch08-networking.md
• docs/book/src/ch11-speed-safety.md
• docs/book/src/ch12-cross-platform.md
• docs/book/src/ch13-tooling.md
• docs/book/src/ch15-appendix.md
• docs/howto/01-getting-started.md
• docs/howto/04-packages.md
• docs/howto/05-concurrency.md
• docs/howto/06-memory.md
• docs/howto/09-release-builds.md
• docs/howto/10-collections.md
• docs/howto/README.md
• examples/bad/cookie_injection.mko
• examples/bad/fan_capture.mko
• examples/bad/gc_removed.mko
• examples/bad/gc_removed_package/main.mko
• examples/bad/gc_removed_package/mako.toml
• examples/bad/kick_mutable_closure_capture.mko
• examples/bad/kick_mutable_lambda_capture.mko
• examples/bad/release_bounds_oob.mko
• examples/bad/unsafe_index_without_block.mko
• examples/extras.mko
• examples/h2_server.mko
• examples/h3_server.mko
• examples/hello.c
• examples/testing/cmap_stress_test.mko
• examples/testing/crew_fan_test.mko
• examples/testing/fan_named_test.mko
• examples/testing/fs_storage_test.mko
• examples/testing/gc_app/gc_trace_test.mko
• examples/testing/hpack_headers_test.mko
• examples/testing/http2_detect_test.mko
• examples/testing/http2_prod_test.mko
• examples/testing/import_paths_test.mko
• examples/testing/kick_sync_closure_test.mko
• examples/testing/residual_seeds_test.mko
• examples/testing/sql_unify_test.mko
• examples/testing/tls_handshake_test.mko
• examples/testing/tls_server_test.mko
• examples/testing/tls_sni_live_test.mko
• llms-full.txt
• packaging/README.md
• runtime/mako_cmap.h
• runtime/mako_db.h
• runtime/mako_dio.h
• runtime/mako_goext.h
• runtime/mako_gpu.h
• runtime/mako_http.h
• runtime/mako_log.h
• runtime/mako_platform.h
• runtime/mako_quiche.h
• runtime/mako_rt.h
• runtime/mako_std.h
• runtime/mako_tls.h
• runtime/mako_ws.h
• scripts/claims-gate.sh
• scripts/fill-release-packaging.sh
• scripts/package-deb.sh
• scripts/package-msi-seed.sh
• scripts/package-release.sh
• scripts/stdlib-gate.sh
• scripts/verify-target-artifact.sh
• src/cc.rs
• src/codegen/mod.rs
• src/incremental.rs
• src/main.rs
• src/tooling.rs
• src/types/mod.rs
• std/crypto/tls/tls.mko
• std/log/slog/slog.mko
• std/print/print.mko
• website/index.html
• website/showcase.md
• website/tutorials/backend-api.md
• website/tutorials/cloud.md
• website/tutorials/concurrency.md
• website/tutorials/database.md
• website/tutorials/ffi.md
• website/tutorials/game-server.md

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Review on demand using usage pricing

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/claims-proof-and-sni

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}