A resource ceiling on every remote input, and compliance that actually persists

A sustained hardening wave gave the runtime a ceiling wherever a remote peer chooses the cost. HTTP gained a total request deadline and a connection admission cap; JSON parsing caps nesting depth, which was a remote unauthenticated stack overflow; chunked decoding is linear rather than quadratic; Redis replies, OCI registry bodies and HTTP/2 bodies are all bounded; a Content-Length remote abort and a Zip Slip arbitrary write are closed; a TLS file-descriptor use-after-free is refcounted; a 32-bit size wrap in gRPC decode is fixed; three TLS WANT_READ busy-spins and a blocking connect inside the global pool mutex are gone; and the SSRF and egress allowlist now applies at every dialer rather than one.

A separate pass drew on twenty CVEs from 2024 to 2026 plus the CWE Top 25 and added net.request_guard for per-request body, URI, header and query-parameter bounds, a per-key rate limiter with fail-closed overflow, and a path sanitizer that rejects URL-encoded traversal (%2e, %2f, %5c, %00) rather than only literal ... Two detector gaps were found and closed on a later sweep: csrf_origin_check used a substring test, so https://example.com.attacker.net passed the same-origin fallback, and the SSRF guard only recognised dotted-decimal IPv4, so 0177.0.0.1, 2130706433, 0x7f000001 and 127.1 all walked past a 127. prefix check; both now normalise and match exactly.

The most consequential finding was not an exploit. An adopter audit found that std.compliance was twenty functions of pure string formatting with zero persistence: calling audit_entry() made a GDPR obligation feel discharged while the string vanished if you dropped it. It is now backed by the same tamper-evident chain the AI Act log uses, keyed-HMAC-SHA256-linked, fsync'd and append-only, with compliance_audit_verify returning true only if every record still links, which is the operator-verifiable proof a DORA Art.

17 or NIS2 Art. 23 examiner asks for. Editing one field in a written record breaks the chain and verification catches it. The rest of the compliance surface was audited and confirmed genuine, and audit_entry survives as an explicitly labelled formatter that persists nothing.