phase 2: task decomposition — 8-task port graph

- crate-init: skeleton, feature gates (ADR-003), TlsError (ADR-002)
- three parallel foundation ports: identity types, fingerprint, pem+signing
- port-server / port-client in parallel (each consumes the foundation;
  client also carries credentials.rs per ADR-005 co-location)
- integration-suite: invariant pins + feature-matrix + seam round-trips
- review-impl: spec-conformance gate — the API-freeze point before the
  alknet rewrite consumes the crate
- validated: taskgraph topo (5 generations), no cycles, critical path
  len 5, risk-path 1.45; medium risk concentrated on the two broad
  ports + the suite (each a diff against a fixed extraction source,
  not open-ended work)

tasks/crate-init.md

@@ -0,0 +1,83 @@
+---
+id: crate-init
+name: Crate skeleton — module files, feature gates, error type, re-exports
+status: pending
+depends_on: []
+scope: narrow
+risk: low
+impact: project
+level: implementation
+tags: [scaffold, crate-init]
+---
+
+## Description
+
+Initialize the alktls module skeleton per ADR-006: replace the
+placeholder `src/lib.rs` with the eight-module layout
+(`identity`, `credentials`, `fingerprint`, `server`, `client`, `pem`,
+`signing` + `lib.rs`), the feature gates per ADR-003
+(`default = []`; `noq`, `tcp`, `acme`), and the `TlsError` type per
+ADR-002. Modules may be stubs (`pub fn` bodies `todo!`-free — empty
+with doc comments) but the module map, features, deps, and error enum
+land now so subsequent tasks are additive, not structural.
+
+### What lands here
+
+- `Cargo.toml` final shape: deps per ADR-003's TOML block (`noq` +
+  `noq-proto` optional, default-features off; `tokio-rustls`;
+  `rustls-acme`; the always-present set per the overview's dependency
+  posture).
+- `src/lib.rs`: crate docs (the overview's shape), `TlsError` (the
+  ADR-002 enum verbatim, including the `noq`-gated `NoqWrap` variant),
+  and the re-export block (the documented public API surface).
+- Empty module files with `//!` doc headers only — no function bodies.
+- `.taskgraph.toml` not needed (default `./tasks` works).
+
+### What does NOT land here
+
+- Any ported logic (subsequent tasks).
+- Any test beyond a compile assertion that the error enum matches.
+
+## Work
+
+1. Rewrite `Cargo.toml` features/deps per ADR-003.
+2. Write `src/lib.rs` with the ADR-002 `TlsError` + module
+   declarations + re-exports.
+3. Create the seven module files with doc headers.
+4. Verify the feature matrix compiles (all four combos below).
+
+## Verification
+
+- [ ] `cargo build` (default, `default = []`) passes
+- [ ] `cargo test --all-features` passes (noq + tcp + acme all resolve)
+- [ ] Each feature alone: `cargo check --features noq`, `--features tcp`,
+      `--features acme`
+- [ ] `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`
+- [ ] `TlsError` is `#[non_exhaustive]` with exactly the ADR-002
+      variants (`CertLoad`, `SelfSigned`, `Rustls`, `VerifierBuild`,
+      `NoqWrap` noq-gated, `AcmeConfig`)
+
+## Acceptance Criteria
+
+- [ ] The module map matches ADR-006 (one module per file, re-exported
+      from `lib.rs`; public API surface is the re-export block)
+- [ ] Feature gates match ADR-003 exactly
+- [ ] No `todo!`/`unimplemented!`/panics in library code — stubs are
+      empty or error-returning, never panicking
+
+## References
+
+- docs/architecture/decisions/002-tlserror-shape.md (the enum)
+- docs/architecture/decisions/003-noq-replaces-quinn.md (features, deps)
+- docs/architecture/decisions/006-module-layout-and-tests.md (module map)
+- docs/architecture/overview.md (dependency posture)
+
+## Notes
+
+> Agent fills this during implementation. Document any decisions,
+> deviations from architecture, or relevant context discovered.
+
+## Summary
+
+> Agent fills this on completion. Brief description of what was
+> implemented, files changed, and any follow-up needed.