ycb_envoy_ceb006ba457fe

what a new run launched now would send

On downstream mTLS, Envoy currently advertises the trusted-CA distinguished names in the TLS CertificateRequest. With a large trusted_ca set that list can exceed client TLS record limits, or some clients mishandle a large CA set, so otherwise-valid handshakes fail.

Add a CertificateValidationContext option (default false) that, when enabled on the server, omits those CA names from CertificateRequest while still using the configured trusted CAs to validate any presented client certificate. Upstream connections are unaffected. Honor the option in the built-in cert validator and the SPIFFE cert validator; validators that never set a client CA list may ignore it.

Acceptance: with the option false, CA names are still advertised as today; with it true, the client must observe an empty/absent advertised CA list even though require-client-cert mTLS still completes when the client presents a cert signed by trusted_ca; changing the option must change session-id digest material so sessions cannot resume across different settings, but leaving it at the default must not alter session-id bytes versus pre-change behavior.

Interface contract — the change must expose exactly this surface:
api: CertificateValidationContext.suppress_client_ca_list (bool, field 18, default false). C++ config API: CertificateValidationContextConfig::suppressClientCaList() const (and impl/mocks/test fakes).

Work only inside this repository checkout. Make the code change the task
describes, keeping the diff focused — no drive-by refactors.

When you are done, leave your changes committed or in the working tree;
they are collected automatically.

Stay on this snapshot checkout (`task/ycb_envoy_ceb006ba457fe`). Never checkout, pull, or rebase onto `main`. That branch is a README-only orphan.
Stay on this HEAD. Do not fetch another default branch. Push only on the Cursor-created `crazy-cursor/…` side branch from this HEAD.

Some past runs of this task were launched with a different prompt (the prompt template changed since, or those runs predate this benchmark's stored prompt). Each run persists the exact prompt it sent at launch — that per-launch record is the audit trail; this page shows only the current one.