[tannevaled]

What

rbgo's foundational network layer: a real stream socket backed by Go's net, plus client-side TLS over crypto/tls. rbgo already binds many network-capable clients (grpc/mysql/mongodb/redis/pg) but exposed no general Ruby socket — redis/pg had to take an injected IO-like duck. This lands the transport those clients (and Net::HTTP) actually sit on.

Module surface

require "socket":

• TCPSocket (net.Dial) — read([n]) / gets([sep]) / readpartial(n) / write(*a) / print / puts / << / flush / sync / close / closed? / eof? / setsockopt (no-op) / peeraddr / local_address / addr. MRI-faithful EOF semantics (read(n)→nil at EOF, readpartial→EOFError).
• TCPServer (net.Listen) — new([host,] port) / accept→connected TCPSocket / close / addr / local_address / listen / closed?.
• Ancestry TCPServer < TCPSocket < IPSocket < BasicSocket, plus Socket with the common address-family/type constants (AF_INET, SOCK_STREAM, …) and SocketError. BasicSocket is rooted at Object rather than IO on purpose — IO's instance methods assume an *IOObj receiver and would panic on a socket value; the socket surface re-implements the IO methods that matter.

require "openssl" (upgrades the former not-implemented shell):

• OpenSSL::SSL::SSLSocket over crypto/tls — new(io[, ctx]) wraps a TCPSocket; connect runs the client handshake; shares the read/write surface with TCPSocket; io/to_io/context/hostname=/peer_cert.
• OpenSSL::SSL::SSLContext gains verify_mode / cert / key / ca_file / … accessors. verify_mode drives crypto/tls verification and defaults to VERIFY_NONE (nil), matching a bare MRI SSLContext.

Proof (hermetic, no external network)

Every assertion runs a Ruby script through the rbgo engine against an in-process loopback server started inside the test:

• raw TCPSocket HTTP GET vs net/http/httptest — asserts the body;
• SSLSocket HTTPS GET vs httptest.NewTLSServer (self-signed, default VERIFY_NONE ctx) — asserts the body;
• TCPServer + Thread accept loop;
• plus TestSocketThroughRbgoBinary, which builds and runs the actual cmd/rbgo binary against an httptest server and asserts its stdout.

GOWORK=off go build ./... && go vet ./... && go test ./... all green; 100% line coverage on the new binding code (loopback servers + error-injection for the raising arms).

Deferred follow-ups

Raw Socket.new / UDPSocket / UNIXSocket, server-side TLS, client-certificate auth, and the full cert/verify surface (peer_cert etc.).

Next step this unblocks

The Net::HTTP binding (a go-ruby-net-http codec over this transport) — net/http is currently a load-time shell whose networking methods raise NotImplementedError; it now has a real socket to sit on.

🤖 Generated with Claude Code