[WAF-06] Implement the five-phase transaction lifecycle and interventions

Objective

Implement connection and URI setup, all five SecLang phases, detection-only mode, phase legality, interventions, early exits, logging finalization, and per-transaction isolation.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-03

Blocks

• WAF-07
• WAF-08
• WAF-23
• WAF-24
• WAF-28
• WAF-29
• WAF-32
• WAF-40
• WAF-46
• WAF-48

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

Lifecycle foundation shipped in f1e24b7: every requested connector entry point, strict phase transitions, header/body limits, response inspection lifecycle, logging, detection-only interventions, and misuse tests. CI passed: https://github.com/zig-utils/zig-waf/actions/runs/29893318643. The issue remains open for phase rule execution and intervention precedence.

Dependency update: WAF-03 is complete and closed with the generation ownership, concurrent pinning, atomic reload, reclamation, feature-discovery, ADR, benchmark, and hosted CI evidence in /zig-utils/zig-waf/issues/4. WAF-06 is now unblocked and is the next engine implementation target.

Completed in ca95a8dfd645f9d547ef19d12f28a7b30c7547c9 and 0033a4a84ad67049c72f020e305c15bd6de05d48. The public ABI now uses the five stable SecLang phases (request headers=1, request body=2, response headers=3, response body=4, logging=5), with connection setup correctly remaining pre-phase while connection scalars stay available. The transaction state machine enforces legal ordering, enabled interventions expose explicit phase interruption, drop terminates further inspection, detection-only decisions retain evidence without early exit, duplicate interventions fail explicitly, response/intervention status bounds are valid HTTP ranges, and logging can finalize exactly once even after termination. Focused tests cover phase numbers, invalid transitions, enabled/detection-only behavior, terminal drop, per-transaction isolation, and C ABI discovery. The ReleaseFast lifecycle benchmark is a hosted gate; the local evidence run measured 301 ns per complete connector lifecycle for the current no-rules engine. Formatting, unit tests, C smoke tests, native compile, x86_64 Linux cross-compile, dependency-lock verification, ownership benchmark, and lifecycle benchmark all pass in hosted CI: https://github.com/zig-utils/zig-waf/actions/runs/29932335215. Detailed disruptive-action precedence remains correctly scoped to WAF-15.