Harden Curier for v0.1.0

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.

[zekageri]

Summary

Harden Curier's lifecycle, endpoint handling, cryptographic qualification, and release CI before the v0.1.0 tag.

What changed

• move final worker deletion into end() so successful shutdown returns only after normal or capability-created task allocations are reclaimed
• preserve all worker-owned state after an end() timeout so a later call can finish cleanup
• replace callback-context implementation leaking with deterministic fatal misuse handling
• reject malformed endpoint authorities, invalid DNS labels, ambiguous ports, backslashes, and unbracketed IPv6 before constructing the VAPID audience
• make IPv6 validation portable across host builds and Arduino ESP32/lwIP targets
• refactor RFC 8291 encryption through a shared path that accepts deterministic internal test inputs
• add a byte-for-byte RFC 8291 Appendix A encrypted-body test using the corrected 144-byte length from RFC errata 5230
• decode generated VAPID claims and independently verify the raw ES256 signature
• add an internal compile-time HTTP transport seam for deterministic target testing
• add target tests for queue capacity, exactly-once callbacks, callback requeue, callback end() behavior, retries, retry cancellation, shutdown timeout recovery, and repeated lifecycle heap recovery
• expand CI and release dependencies to include crypto tests, lifecycle audits, and runtime-test compilation
• update README, lifecycle, memory, protocol, security, changelog, and release documentation

Root cause

The worker previously signaled completion and then deleted itself. This allowed end() to release runtime state and report success before task deletion had completed. Destroying Curier from its callback avoided use-after-free by releasing the implementation pointer, but permanently leaked the runtime. Endpoint parsing also allowed malformed authorities that could be interpreted differently by VAPID audience construction and the HTTP client.

Validation

GitHub Actions passes:

• release metadata validation
• source lifecycle and dependency audit
• clang-format and whitespace checks
• host endpoint and retry tests
• RFC 8291 known-answer encryption and VAPID signature tests
• all examples on ESP32, ESP32-S3, ESP32-C3, and ESP32-P4
• lifecycle stress compilation on the complete board matrix
• deterministic runtime-semantics compilation on ESP32

Before marking ready

Run LifecycleSmoke and RuntimeSemantics on a real PSRAM-capable production target and confirm stable internal/PSRAM heap and successful runtime output.