generation 3: port server + client — the two big ports
port-server (src/server.rs, 614 lines):
- TlsServerConfig with ADR-004 accessors: for_noq(&self) (borrow +
inner-clone + NoqWrap via #[from]), for_tcp_tls(&self) adopted
(infallible TlsAcceptor), rustls_config(&self) adopted
- acme_handle renamed per ADR-006; the defensive Acme arm returns
TlsError::AcmeConfig (unreachable! eliminated)
- error sites remapped to typed variants (Rustls/SelfSigned/AcmeConfig)
- ACME path verbatim: DirCache + directory + contacts + resolver +
acme-tls/1 + spawned event loop (tracing lines ported), returns
immediately, detached handle
- 14 tests incl. the nine-scheme exact-list pin, ACME
spawn/return/ALPN assertion (blackhole URL — no network I/O),
no-feature AcmeConfig, for_tcp_tls/rustls_config round-trips
port-client (src/credentials.rs + src/client.rs):
- ConnectionCredentials/RemoteIdentity wholesale with load-bearing
Option-semantics docs (None = public-X.509 state, Some = pin)
- verifier selection matrix + client-auth presentation matrix
test-pinned at unit level; enable_early_data=true pinned;
root-store fallback asserted non-empty
- FingerprintPinVerifier: pin match/mismatch + raw-key signature
routing (verify_tls13_signature_with_raw_key) asserted
- resolvers/verifier made pub for the re-export block
Cargo.toml (two required deltas):
- noq feature gains aws-lc-rs: lockfile resolves noq-proto 1.3.0
where ServerConfig::with_crypto is #[cfg(any(aws-lc-rs, ring))];
ADR-003's TOML block was written against the 1.2 API. Amendment
note recorded in tasks/port-server.md for the review-impl sync
- acme = [dep:rustls-acme, dep:futures] — ADR-006 already gates
the futures dep on acme; the scaffold omitted it
lib.rs: re-export block complete (all eight modules)
Verification: cargo test 68, --all-features 75, --features noq 72,
clippy -D warnings, fmt --check, doc --no-deps (0 warnings) — green
glm-5.3-flash
0cd565fc28