- crate-init: skeleton, feature gates (ADR-003), TlsError (ADR-002)
- three parallel foundation ports: identity types, fingerprint, pem+signing
- port-server / port-client in parallel (each consumes the foundation;
client also carries credentials.rs per ADR-005 co-location)
- integration-suite: invariant pins + feature-matrix + seam round-trips
- review-impl: spec-conformance gate — the API-freeze point before the
alknet rewrite consumes the crate
- validated: taskgraph topo (5 generations), no cycles, critical path
len 5, risk-path 1.45; medium risk concentrated on the two broad
ports + the suite (each a diff against a fixed extraction source,
not open-ended work)