TalkingBytes 2.1 runtime and Foundation integration hardening

[abmmhasan]

Summary

Prepares TalkingBytes 2.1 as the Foundation 3 communication/runtime hardening release.

This PR keeps TalkingBytes protocol-focused and framework-neutral while hardening persistent-runtime behavior, cancellation, state isolation, transport cleanup, observability, optional-capability boundaries, native composition, and Foundation integration seams.

Highlights

Runtime and lifecycle hardening

• removes primary runtime dependence on process-global CommunicationEventBus state while retaining the compatibility facade
• standardizes elapsed/deadline timing on the monotonic clock where wall time is not protocol-significant
• adds cooperative cancellation across retry, HTTP multi, mailbox watch, gRPC streaming/inbound exchange, webhook retry, and sendmail process paths
• defines and tests mutable collaborator lifetimes for cookies, resilience state, mailbox/native clients, fakes, and spies
• adds repeated-run/Fiber isolation and soak coverage

HTTP

• replaces chunked cURL multi scheduling with a rolling bounded-concurrency window
• preserves request ordering, redirect security, cleanup, and stop-scheduling semantics
• adds active cancellation cleanup and native resolved-config composition
• expands HTTP benchmark coverage

gRPC

• adds host-controlled inbound accepted-exchange/source contracts for Foundation-managed worker lifecycles
• prevents internal exception details from crossing the wire boundary
• removes exception-driven generated-stub call-shape probing
• keeps native/generated gRPC capabilities cold until selected
• preserves incremental streaming and adds cancellation/finalization coverage
• adds native/generated composition helpers and benchmarks

Email

• propagates injected event/clock/sleeper dependencies through sender, receiver, mailbox, and parser graphs
• hardens SMTP/IMAP/POP3 persistent-runtime timing and cancellation
• extracts deterministic sendmail child-process control with bounded output, timeout/cancellation, graceful/forced termination, optional POSIX process-group cleanup, and portable fallback
• keeps parser/spool limits and locking/quarantine semantics intact
• adds resolved transport/fallback/retry/rate-limit/DKIM composition and EmailLimits::fromArray()
• fixes charset fallback error-handler stack restoration

Webhook

• strengthens replay semantics and fail-closed behavior
• adds cooperative retry cancellation and resolved-config composition
• minimizes/redacts protocol observability
• upgrades native delivery signatures to v2, binding timestamp + event + delivery ID + exact raw body

Webhook security compatibility note

TalkingBytes 2.1 native senders emit t=<timestamp>,v2=<hmac>, and native receivers require that bound v2 format.

This intentionally closes two security gaps in the previous native delivery format: event substitution and replay-identity substitution through an unsigned delivery ID. Native 2.0 senders and 2.1 receivers are therefore not wire-compatible and must be upgraded together.

Low-level/direct WebhookSignature::buildHeader($body, $timestamp) and verifier usage retain legacy v1 support for explicit direct integrations; the native sender/receiver path does not downgrade.

Optional capability policy

• no runtime PCNTL dependency or pcntl_* path
• POSIX remains best-effort/optional for Unix sendmail descendant cleanup
• gRPC, IMAP-related helpers, Sodium/Ed25519, and other optional capabilities stay cold until selected
• Sodium references remain confined to the Ed25519 DKIM boundary
• no Foundation, CacheLayer, Omnibus, DBLayer, Pathwise, or other Infocyph runtime dependency was added

Validation

Release-candidate head: 67ba1d3b75ea0484df320425d207e2ef2b98c19d

Exact-head Security & Standards run: #99 / 35757068541 — green.

Validated on:

• PHP 8.4 and PHP 8.5
• prefer-stable and prefer-lowest dependency matrices
• PHPStan and Psalm/security analysis
• Pest, Pint, PHPCS, Deptrac, Rector
• Composer validation/audit and stable runtime constraints
• clean Composer install
• native PHPBench suites on PHP 8.4/8.5
• Mailpit integration
• optional-capability coldness
• warning-free Sphinx documentation
• runtime isolation/cancellation/soak/security regression suites

There are no unresolved PR review threads and no open repository issues blocking this release.

Foundation 3 handoff

After release, Foundation point 26.9 can consume the 2.1 APIs and remove duplicated protocol composition while retaining Foundation-owned concerns:

• named application profile lookup
• DI lifetime selection
• path/secret resolution and production policy
• CacheLayer-backed webhook replay storage
• worker/supervisor signal lifecycle
• process supervision for application commands
• gRPC handler/service lookup
• notification/template routing and application observability policy