phase 2: task decomposition — 8-task port graph

- crate-init: skeleton, feature gates (ADR-003), TlsError (ADR-002)
- three parallel foundation ports: identity types, fingerprint, pem+signing
- port-server / port-client in parallel (each consumes the foundation;
  client also carries credentials.rs per ADR-005 co-location)
- integration-suite: invariant pins + feature-matrix + seam round-trips
- review-impl: spec-conformance gate — the API-freeze point before the
  alknet rewrite consumes the crate
- validated: taskgraph topo (5 generations), no cycles, critical path
  len 5, risk-path 1.45; medium risk concentrated on the two broad
  ports + the suite (each a diff against a fixed extraction source,
  not open-ended work)

tasks/integration-suite.md

@@ -0,0 +1,93 @@
+---
+id: integration-suite
+name: Integration suite — invariant pins + feature-matrix + seam round-trips (tests/)
+status: pending
+depends_on: [port-server, port-client]
+scope: broad
+risk: medium
+impact: phase
+level: implementation
+tags: [tests, integration, invariants, phase-gate]
+---
+
+## Description
+
+The `tests/` integration suite per ADR-006: the cross-module surfaces
+the in-module seed tests cannot cover. A full-crate crate has no
+workspace consumers to lean on, so this suite is the invariant gate
+before the alknet rewrite consumes the crate.
+
+### The suites
+
+1. **Server seam round-trips** — for each `TlsIdentity` variant
+   (X509 via generated PEM files in a tempdir, RawKey via
+   `Ed25519SecretKey::generate`, SelfSigned):
+   `TlsServerConfig::new` → `for_noq()` (all-features) /
+   `for_tcp_tls()` / `rustls_config()` all succeed; the rustls config
+   carries the expected ALPN list and `max_early_data_size`.
+2. **Client seam round-trips** — `TlsClientConfig::new` per
+   credentials cell → `for_noq()` / `into_rustls_config()`;
+   `enable_early_data` pinned true; ALPN single-value list.
+3. **Verifier-selection matrix** — the full `local_identity` ×
+   `remote_identity` construction matrix (the port-client unit
+   assertions promoted to integration level, exercising the public API
+   only).
+4. **The nine-scheme exact-list pin** — the regression-proof shape
+   (exact vec equality, not membership).
+5. **Root-store fallback** — `load_platform_root_cert_store` (or the
+   config built from it) yields a non-empty store even when the
+   platform store is empty (webpki-roots merge; assert non-emptiness
+   and count > 0).
+6. **ACME lifecycle** (`--features acme`): construct an `Acme` identity
+   with staging URL + tempdir cache; assert spawn-and-return semantics,
+   `acme-tls/1` in the ALPN list, and the resolver wiring (no network
+   I/O — do NOT hit Let's Encrypt).
+7. **Feature-matrix gate**: `default = []` compiles + tests pass;
+   `--features noq`; `--features tcp`; `--features acme`;
+   `--all-features` (the gate is also a CI-verifiable convention, but
+   the suite includes the combination that exercises every
+   feature-gated accessor).
+
+### Out of scope (explicitly)
+
+Real handshakes (transport crates' job — the scope boundary), network
+ACME orders, iroh (no iroh dep exists here), SOCKS5, dispatch.
+
+## Work
+
+1. Write the `tests/` files (one per suite group is fine).
+2. Promote any in-module assertions that exercise cross-module
+   behavior to integration level (keep the in-module ones too).
+3. Wire the exact-list and `enable_early_data` pins.
+
+## Verification
+
+- [ ] Full suite green across all five feature combos
+- [ ] The nine-scheme test asserts exact list equality
+- [ ] `enable_early_data == true` asserted on a client config
+- [ ] ACME test performs no network I/O (staging URL is constructed,
+      never contacted)
+- [ ] `cargo clippy --all-targets -- -D warnings`, `cargo fmt --check`,
+      `cargo doc --no-deps` (doc comments render)
+
+## Acceptance Criteria
+
+- [ ] All 7 suites exist and pass
+- [ ] The suite runs green with a single `cargo test --all-features`
+- [ ] `tests/` layout documented in the task Summary
+
+## References
+
+- docs/architecture/decisions/006-module-layout-and-tests.md (the test
+  plan)
+- docs/architecture/server.md + client.md (the invariants)
+- Prior art: the extracted crate's in-module tests
+  (`crates/alknet-tls/src/*.rs` `#[cfg(test)]` blocks)
+
+## Notes
+
+> Agent fills this during implementation.
+
+## Summary
+
+> Agent fills this on completion.