[INJECT-00] Epic: pure-Zig libinjection 4 compatibility

[chrisbbreuer]

Objective

Deliver a pure-Zig, allocation-conscious libinjection 4.0.0 implementation with an idiomatic Zig API, compatible C ABI, pinned differential corpus, fuzzing, benchmarks, Pantry packaging, and release artifacts.

Deliverables

• Implement the complete scoped behavior without Git submodules.
• Keep public APIs explicit about ownership, resource limits, and errors.
• Add focused unit, integration, compatibility, fuzz, and benchmark coverage as applicable.
• Update documentation and machine-readable compatibility status.

Acceptance criteria

• The scoped implementation and tests are merged on main.
• Zig formatting, focused tests, and the repository CI suite pass.
• No unexplained compatibility skips, silent fallbacks, leaks, or unbounded hostile-input paths remain.
• Benchmarks or security evidence is attached when this affects a hot or untrusted path.

Relationships

• Parent: Top-level tracking epic

Blocked by

None

Blocks

None

Roadmap

• INJECT-01: Bootstrap the Zig 0.17 Pantry package
• INJECT-02: Build the pinned upstream corpus and differential harness
• INJECT-03: Implement the allocation-free SQL tokenizer and reusable state
• INJECT-04: Implement folding, keyword classification, and fingerprints
• INJECT-05: Expose the idiomatic Zig SQLi API
• INJECT-06: Implement the HTML5 tokenizer
• INJECT-07: Implement compatible XSS detection
• INJECT-08: Provide libinjection 4-compatible C symbols and headers
• INJECT-09: Add fuzzing and hostile-input resource limits
• INJECT-10: Meet or exceed libinjection performance
• INJECT-11: Publish v1.0 with Pantry metadata, SBOM, and documentation

Baselines

• Zig 0.17-dev resolved and locked through Pantry.
• ModSecurity 3.0.16, Coraza 3.7.0, CRS 4.28.0, and libinjection 4.0.0 where applicable.