[SunsetWan]

Summary

• Establish the Starscream 5 baseline: iOS 15, Swift 6, and Strict Concurrency set to Complete.
• Centralize client/server handshake semantics and harden RFC 6455/RFC 7692 framing, compression, close handling, reconnect isolation, and resource limits.
• Add certificate/public-key pinning policies, mTLS identity support, and proxy configuration with an iOS 15–16 fallback and native iOS 17+ support.
• Complete the README work, add pull-request CI, and migrate the entire unit-test suite from XCTest to Swift Testing.

Breaking changes

This is intentionally a 5.0 major release. Custom Engine, Transport, CompressionHandler, and CertificatePinning implementations may need Sendable conformance and updated completion/decompression signatures. WebSocket is now final so its thread-safety contract is sound. The README and changelog include migration notes.

Apple API audit

• Uses the async URLSessionWebSocketTask APIs available before the iOS 15 baseline.
• Uses SecTrustEvaluateWithError and, on the new baseline, SecTrustCopyCertificateChain for trust and pinning evaluation.
• Uses Network.ProxyConfiguration on iOS 17+ and keeps an explicit, limited HTTP CONNECT fallback for iOS 15–16.
• Does not adopt the iOS 26-only Network.WebSocket API, preserving the iOS 15 deployment target.

Protocol highlights

• Strict client and server handshake validation, including version negotiation and extension selection.
• Correct mask, RSV, opcode, canonical length, fragmentation, UTF-8, control-frame, and close-handshake behavior.
• Exact permessage-deflate offer/selection validation, including quoted extension parameters and bounded decompression.
• Configurable limits defaulting to 16 MiB per frame and 64 MiB per message/decompressed message; oversized messages close with code 1009.
• Connection-generation isolation prevents callbacks from an old connection attempt from affecting a reconnect.

Validation

• SwiftPM, Swift 6 Complete Strict Concurrency, warnings-as-errors: 137 tests across 15 suites passed.
• Thread Sanitizer: 137 tests passed with no race diagnostics.
• iOS simulator, warnings-as-errors: 137/137 logical tests passed (223 expanded parameterized cases).
• Generic iOS Release build passed; SimpleTest and Autobahn example builds passed.
• Package manifest, podspec, Xcode projects, and whitespace checks passed.
• Final independent Standards and Spec reviews found no remaining P0/P1 issues.