3 Commits

Include renames

Author	SHA1	Message	Date
glm-5.3-flash	d82956385b	record S-1/N-1 remediation status + the N-4 parenthetical correction ... - review 001: §Status carries the remediation status (S-1 + N-1 landed in e86b8ba, OQ-TLS-09 open, probe permanent) and the N-4 correction summary; §S-1 remediation-task line updated; §N-1 marked remediated; §N-4 gains the corrected mechanism chain (rustls 0.23.41/0.23.44 send [RawPublicKey] iff the resolver's only_raw_public_keys() is true — no "offers both types" behavior exists; a raw-key client fails IncorrectCertificateTypeExtension against this verifier; the S-1 probe presents the SPKI under the default X.509 offer instead) - task fix-accept-any-cert-verifier-posture: drop the placeholder fill-in lines (Notes/Summary carry the actual record) - task docs-pin-c1-c4-n3-n4: N-4 work item rewritten from the corrected chain so the implementing agent does not re-derive it; references point at the rustls source lines and the probe's resolver choice	2026-09-11 07:38:21 +00:00
glm-5.3-flash	e86b8ba1b5	task 1: S-1 remediation — no-pop posture doc + OQ-TLS-09 + permanent impersonation pin ... - AcceptAnyCertVerifier doc: the presented CertificateVerify signature is not verified (no proof-of-possession) — the server-extracted fingerprint is attacker-suppliable from observed public cert/SPKI bytes; states the two safe patterns (auth-layer challenge-response / a verifying verifier) and points at OQ-TLS-09 - FingerprintPinVerifier doc (N-1): fixed the "stolen-but-stale fingerprint" phrasing (the cert is presented fresh each handshake; the signature check defeats a stolen/observed cert used by a party without the private key) and added the server-verifier cross-reference - OQ-TLS-09 recorded (open, high): which layer owns server-path proof-of-possession — three options; deferral noted (needs the auth-layer design or an API call before the first consumer) - tests/impersonation_posture.rs (tcp-gated): the S-1 probe made permanent, both variants — X.509 victim cert + attacker key and RFC 7250 victim SPKI + attacker key complete the handshake, application data flows, and the server extracts the victim's fingerprint; any future pop change must fail/update this test with the doc + OQ - server.md / client.md synced with the same posture - task note: the review's N-4 parenthetical ("alknet's client resolver offers both types") is inaccurate — rustls 0.23.41/0.23.44 offer [RawPublicKey] iff the resolver's only_raw_public_keys() is true; task 6 should write N-4 from the rustls sources Verified: cargo test 68 default / 77 all-features (+2) green; clippy -D warnings clean (default + all-features); fmt clean; cargo doc --no-deps warning-free	2026-09-10 22:00:57 +00:00
glm-5.3-flash	d7db6b17a6	review-001 decomposition: 6 remediation tasks from verified findings ... Verify every review-001 finding before decomposition: - S-1 re-confirmed by fresh executable probe (X.509 + raw-key impersonation both complete the handshake with the victim's fingerprint extracted server-side) - U-2/U-3 uncovered-line inventory re-derived from cargo llvm-cov (--all-features); matches Part C exactly - rcgen 1975/4096 defaults, rustls cert-type negotiation arm, packaging list, doc texts: all verified against sources Tasks (all verified, none speculative): - fix-accept-any-cert-verifier-posture (S-1 + N-1 + OQ-TLS-09 + probe) - handshake-tests (U-3 suites 1-3; suite 4 lives in the S-1 task) - coverage-cheap-closes (U-2's seven groups) - acme-event-loop-test (U-1; depends on coverage-cheap-closes for the tracing-capture pattern) - config-validation-and-trivia (C-2 ALPN dedup, C-3 empty-domains, N-6 excludes, N-7 https doc line) - docs-pin-c1-c4-n3-n4 (C-1, C-4, N-3 decision note, N-4 negotiation note) Graph: acme-event-loop-test is generation 2; the rest run in generation 1. taskgraph validate: 14 tasks, no cycles. Verification: cargo test (default + --all-features) green before and after; probe file deleted after its run.	2026-09-10 21:16:13 +00:00