Checklist (all six PASS):
1. API surface == ADR-004 — every accessor signature verified verbatim
2. TlsError == ADR-002 — six variants, #[non_exhaustive], typed sources,
AcmeConfig holds exactly the two config-mismatch cases
3. Invariants: all five server invariants + client 0-RTT half +
fail-closed structure, each with a passing behavioral test at unit
and integration level
4. Deltas vs extraction: all ADR-pinned; two surfaced divergences
recorded as ADR amendments — zero un-pinned divergences remain
5. Feature hygiene: default = [] lean, tokio subset (no full),
doc comments on public API, no inline // comments, no panics
6. Docs sync: ADR-002 + ADR-003 amendment notes; overview/server/client
Draft → Reviewed; README carries the API-freeze lifecycle note
5 findings, all low severity, all resolved forward (table in task Notes)
Verification: cargo test (81), cargo test --all-features (92),
clippy -D warnings, fmt --check, doc --no-deps,
publish --dry-run — all green. API FROZEN for the alknet rewrite.
port-identity-types (src/identity.rs):
- TlsIdentity (four variants), Ed25519SecretKey, AcmeDirectory ported
verbatim from alknet-core config.rs; OQ-TLS-02 + server-only docs
on the variants; 9 in-module tests incl. Debug-no-leak
- dep decision: rand_core 0.6 (+getrandom) with ed25519-dalek
rand_core feature, NOT rand (lockfile rand 0.10/rand_core 0.10
traits are incompatible with ed25519-dalek 2.2's CryptoRngCore);
rand stays out of the tree entirely
port-fingerprint (src/fingerprint.rs):
- fingerprint_from_cert_der, extract_ed25519_raw_key_from_spki,
DerParser ported verbatim; production code sha2 + manual DER
(+hex for the normalized formats)
- 16 tests: 7 ported + 9 new malformed-DER edges (the extraction
had none despite the invariant naming them)
- empty-input behavior: matches extraction's actual code (always
Some via the SHA-256 fallback); doc records the deviation from
the stale None claim
port-pem-signing (src/pem.rs, src/signing.rs):
- load_cert_chain/load_private_key remapped to TlsError::CertLoad
per ADR-002; InvalidData no-key path kept
- Ed25519SigningKey rewired to crate::identity::Ed25519SecretKey
(the one intentional change); rcgen PEM round-trip test added
lib.rs re-export block: fingerprint + pem + signing + identity lines
landed; server/client/credentials pending their port tasks
Verification: cargo test (36), cargo test --all-features (37),
clippy -D warnings (default+all-features), fmt --check, feature
checks (noq/tcp/acme) — all green
- crate-init: skeleton, feature gates (ADR-003), TlsError (ADR-002)
- three parallel foundation ports: identity types, fingerprint, pem+signing
- port-server / port-client in parallel (each consumes the foundation;
client also carries credentials.rs per ADR-005 co-location)
- integration-suite: invariant pins + feature-matrix + seam round-trips
- review-impl: spec-conformance gate — the API-freeze point before the
alknet rewrite consumes the crate
- validated: taskgraph topo (5 generations), no cycles, critical path
len 5, risk-path 1.45; medium risk concentrated on the two broad
ports + the suite (each a diff against a fixed extraction source,
not open-ended work)
- rust-version 1.85 -> 1.88 (ecosystem-wide resolution from the audit
sessions; matches noq 1.2's floor, sits below iroh 1.91)
- Cargo.lock: time 0.3.36 pin removed (existed only to keep the 1.85
claim satisfiable); tree re-floated to current
- phase-0: MSRV thread marked RESOLVED; OQ-TLS-08 narrowed to the
quinn->noq feature-rename half; lesson recorded (rust-version is
passive metadata — claims must be compile-checked, not assumed)
Verified: cargo test, test --all-features, clippy -D warnings,
fmt --check, rustup run 1.88 cargo check
glm-5.3-flash