Objective
Qualify and extend zig-tls for WAF termination, upstream TLS, HTTP ALPN, and controller-agent mTLS without expanding into unrelated TLS work.
Deliverables
- Implement the complete scoped behavior without Git submodules.
- Keep public APIs explicit about ownership, resource limits, and errors.
- Add focused unit, integration, compatibility, fuzz, and benchmark coverage as applicable.
- Update documentation and machine-readable compatibility status.
Acceptance criteria
- The scoped implementation and tests are merged on
main. - Zig formatting, focused tests, and the repository CI suite pass.
- No unexplained compatibility skips, silent fallbacks, leaks, or unbounded hostile-input paths remain.
- Benchmarks or security evidence is attached when this affects a hot or untrusted path.
Relationships
- Parent: Top-level tracking epic
Blocked by
None
Blocks
None
Roadmap
- TLS-01: Add WAF interoperability and hostile-peer stress coverage
- TLS-02: Add rotating session-ticket key rings
- TLS-03: Expose verified peer identity and bounded handshake controls
- TLS-04: Publish and pin the WAF-ready release
Baselines
- Zig 0.17-dev resolved and locked through Pantry.
- ModSecurity 3.0.16, Coraza 3.7.0, CRS 4.28.0, and libinjection 4.0.0 where applicable.