FEATURE-ci-v3-runtime-green: link Windows public audit clients to Winsock

Author: etr

ChangeLog

@@ -1,4 +1,6 @@
 Version 3.0.0 - 2026-10-10
+	Link the installed public TLS and HTTP/2 audit clients to Winsock on
+		Windows and name their executables with the platform suffix.
 	Resolve the Windows version-information system import in installed
 		package dependency audits.
 	Keep the HTTP/1 connection watchdog armed at a pending server drain

scripts/check-v3-public-http2.py

@@ -146,16 +146,23 @@ def run(args):
             flags = ['--libs'] + (['--static'] if linkage == 'static' else [])
             libraries = shlex.split(command(['pkg-config'] + flags + ['libhttpserver'], consumer, env))
             if linkage == 'static': libraries = [str(prefix / 'lib/libhttpserver.a') if f == '-lhttpserver' else f for f in libraries]
-            libraries += ['-pthread', '-Wl,-rpath,' + str(prefix / 'lib'), '-Wl,-rpath,' + str(provider / 'lib')] + shlex.split(args.sanitize)
-            executable = consumer / linkage
+            # Winsock is a system library on Windows and lives in libc on the
+            # POSIX targets, whose runtime search needs the explicit rpath.
+            if os.name == 'nt':
+                libraries += ['-lws2_32', '-lmswsock', '-lbcrypt']
+            else:
+                libraries += ['-pthread', '-Wl,-rpath,' + str(prefix / 'lib'), '-Wl,-rpath,' + str(provider / 'lib')]
+            libraries += shlex.split(args.sanitize)
+            suffix = '.exe' if os.name == 'nt' else ''
+            executable = consumer / (linkage + suffix)
             provenance = compile_probe(args.compiler, [consumer / 'http2_consumer.cpp'], cflags + shlex.split(args.sanitize),
                                        libraries, executable, command, env, source, build, prefix, False)
             validate_public(True, provenance['dependencies'], prefix, source, build)
             graph = audit.dependency_graph([str(executable)]); check_linkage(graph, linkage, prefix)
             violations = audit.graph_violations(graph, 'strict', args.tls, 'aggregate', audit.load_policy(), provider)
             require(not violations, 'dependency audit: ' + repr(violations))
             if args.tls == 'yes':
-                example = consumer / (linkage + '-example')
+                example = consumer / (linkage + '-example' + suffix)
                 example_compile = compile_probe(args.compiler, [consumer / 'http2.cpp'], cflags + shlex.split(args.sanitize),
                                                 libraries, example, command, env, source, build, prefix, False)
                 example_graph = audit.dependency_graph([str(example)]); check_linkage(example_graph, linkage, prefix)

scripts/check-v3-public-tls.py

@@ -330,17 +330,21 @@ def run(args):
             if identity == 'client-valid':
                 chain += (fixtures / 'client-intermediate.pem').read_bytes()
             (fixtures / (identity + '-chain.pem')).write_bytes(chain)
-        independent = consumer / 'independent-client'
+        independent = consumer / ('independent-client' + ('.exe' if os.name == 'nt' else ''))
+        # tls_client.cpp dials raw sockets: Winsock is a system library on
+        # Windows and lives in libc on the POSIX targets.
+        independent_system = ['-lws2_32'] if os.name == 'nt' else []
         command_log([args.compiler, '-std=c++20', '-I' + str(args.provider_prefix / 'include'),
                      consumer / 'tls_client.cpp', '-L' + str(args.provider_prefix / 'lib'),
-                     '-Wl,-rpath,' + str(args.provider_prefix / 'lib'), '-lssl', '-lcrypto', '-o', independent], consumer, env)
+                     '-Wl,-rpath,' + str(args.provider_prefix / 'lib'), '-lssl', '-lcrypto']
+                    + independent_system + ['-o', independent], consumer, env)
         receipt['independent_client'] = dict(executable=str(independent),
             sha256=hashlib.sha256(independent.read_bytes()).hexdigest(), dependencies=audit.dependency_graph([str(independent)]))
         check('libhttpserver' not in json.dumps(receipt['independent_client']['dependencies']), 'client links server library')
         command_log([independent, 'fixtures', fixtures], consumer, env, timeout=10)
         (fixtures / 'malformed.pem').write_text('malformed certificate')
         (fixtures / 'malformed-key.pem').write_text('malformed private key')
-        command_log([args.provider_prefix / 'bin/openssl', 'pkey', '-in', fixtures / 'acme-key.pem', '-aes-256-cbc', '-passout', 'pass:task194-test-only', '-out', fixtures / 'encrypted-key.pem'], consumer, env)
+        command_log([args.provider_prefix / 'bin' / ('openssl.exe' if os.name == 'nt' else 'openssl'), 'pkey', '-in', fixtures / 'acme-key.pem', '-aes-256-cbc', '-passout', 'pass:task194-test-only', '-out', fixtures / 'encrypted-key.pem'], consumer, env)
         (fixtures / 'extra.pem').write_bytes((fixtures / 'acme.pem').read_bytes() * 2)
         for name in ('mismatch-key', 'past-expiry', 'late-expiry'):
             shutil.copyfile(fixtures / 'acme.pem', fixtures / (name + '.pem'))

specs/tasks/FEATURE-ci-v3-runtime-green.md

@@ -156,3 +156,10 @@ Full local `make check -j1` (TLS=no, g++ 15.2, WSL2): 232/235 pass, 2 platform s
 - [x] Verified against the real MSYS2 mingw64 packages (python 3.14.9-1, openssl 3.6.5-1, libgcc 16.2.0-6, winpthreads, libstdc++): after adding `version.dll` to `WINDOWS_SYSTEM`, the full `_ssl` client closure resolves -- remaining names are WINDOWS_SYSTEM entries or MSYS2 runtime DLLs that the same run's own recorded suite graphs already resolve through `V3_PACKAGE_DLL_DIRS`. The mingw-built integration closures (from the run's suites.json) import only allowlisted system DLLs.
 - [x] One-line allowlist addition in `scripts/audit-v3-installed-package.py`; `version.dll` is a documented System32 component (version-information APIs). `test-v3-installed-package.py` 60/60; `test-v3-installed-consumer.py` 97/97 (one unrelated compile-timing flake on the first local run, clean on rerun).
 - [ ] Full mingw64 CI evidence past the client audit.
+
+## Stage 10: Windows public audit client linkage (2026-10-30)
+
+- [x] Evidence: the 2026-10-30 mingw64 package job (124062430922) and the Windows acceptance job (124062636691) both advanced past every earlier gate (installed suites, traffic cells, compiled operations and the Python TLS client audit of stage 9) and failed at the same place: linking the independent TLS client in `check-v3-public-tls.py`, with `undefined reference to __imp_WSAStartup/__imp_socket/__imp_htons/__imp_htonl/__imp_connect/__imp_closesocket` (tls_client.cpp already carries its own `_WIN32` Winsock path; only the link line lacked the system library).
+- [x] Repair in `scripts/check-v3-public-tls.py`: the independent client is named with the platform `.exe` suffix and linked with `-lws2_32` on `os.name == 'nt'` (POSIX targets unchanged), and the provider `openssl` tool is invoked with its explicit `.exe` name on Windows, matching `run-v3-release-ci.py`.
+- [x] Same-class parity repair in `scripts/check-v3-public-http2.py` (preemptive, code-audit driven, not yet exercised on Windows): consumers and examples get the `.exe` suffix and the `ws2_32/mswsock/bcrypt` system libraries replace the POSIX-only `-pthread`/`-rpath` line, matching the `check-v3-installed-consumer.py`/`check-v3-public-tls.py` convention; runtime DLL resolution stays on the `runtime_environment` PATH/V3_PACKAGE_DLL_DIRS mechanism. Local gates: `test-v3-public-http2.py` 6/6, `py_compile` on both scripts.
+- [ ] Full mingw64/Windows CI evidence past the public TLS client link.