Settle the means a certificate is validated with, and what the first release is - #270

The issue this belongs to

Closes #243
Closes #91

Three issues, one branch. #81 is the third and it is closed on its own evidence
rather than by this pull request, because what it needed was its condition
rewritten and a sentence put where the condition is read; the tree change here is
that sentence. All three land only documents, which is why they share a branch:
each on its own would move the mainline under the other two for nothing.

What changed

#243, and it is the one that was holding a milestone. docs/decisions/0243
names the means the core validates a certificate with - rustls driving
rustls-platform-verifier, which dispatches to each platform's own verifier -
admitted under 0103's clause for a dependency a landed record already requires.

What made this hard was not the choice of package. 0029 requires the platform's
own trust store and the platform's own path building and refuses a
client-supplied evaluation by name. 0103 refuses outright, as its fourth
behaviour, a dependency that writes to a log. Every candidate that satisfies the
first carries a logging facade, and the one shape the second admits treats every
root equally regardless of its status, which the first refuses. Two landed
records refused each other's answer, which 0011 had written down as its own
reversal condition before there was a graph to measure.

The record executes the ruling taken on #243 on 2026-08-30: 0103's fourth
behaviour narrows to writing to a log, and linking a facade whose sink is absent
is not that, on the standing condition that the core installs no logger and says
so. The facade's default sink is a no-op, read out of its own source rather than
assumed, so the property 0103 exists to guarantee is untouched.

The narrowing is written in 0243 rather than into 0103's own text. 0001 permits
three edits to a landed record and a change to what it decided is not among them;
a pointer that changes no sentence's meaning is. So 0103 and 0029 each receive a
pointer and nothing else.

#91. docs/decisions/0091 records what the first release contains - the
library for 0113's triples plus the probe #92 builds, a 0.x tag on this
repository alone with checksums and #87's attestations - and what it does not: no
user interface, no playback, no client, no package in any registry, no frozen
interface. Every item is a closed issue and every condition in the bar is a
closed issue, a green check or a run whose failure mode was demonstrated, so
nothing in it is a judgement somebody makes on the day.

#81. The codeql.yml row in docs/gate-parity.md gains what the leg proves
and what it does not.

What failure it prevents

For #243: the collision between 0029 and 0103 being met as a red gate on
somebody's branch, where the cheapest way out is to weaken whichever record is
nearer to hand. And, before that, a means chosen at a call site by whoever
reaches it first, which on this question is the package whose error type carries
no reason class at all - so nothing a client could show would survive a refusal.
Neither has happened here, because nothing in this tree reaches a network yet.

For #91: two failures, both of which have happened to other projects rather than
to this one. A scope decided at the tag is shaped by whatever compiled that week,
and the parts that did not compile leave no trace in it. And "is it ready" asked
on the day is answered by whoever is most tired of asking; a preview shipped as a
release is not withdrawn afterwards.

For #81: a green tick on Analyze (rust) read as evidence that the analysis
finds defects in this tree. It is not, and until now the parity row did not say
so.

Evidence

Everything below was run at the head being pushed.

git rev-parse HEAD
1471d5d4abd258155a0a2d158a710fa9ca26c7d1
git rev-parse origin/main
ded6d1fcbd9ad65b5a04fbf58c0a7d0e34dd2c10

The two commands CONTRIBUTING.md names:

cargo build --locked --all-targets ; echo "exit=$?"
Finished `dev` profile [unoptimized + debuginfo] target(s) in 1.33s
exit=0

cargo test --locked 2>&1 | grep -E '^test result:' \
  | awk '{p+=$4; f+=$6} END {printf "%d line(s), %d passed, %d failed\n", NR, p, f}'
9 line(s), 650 passed, 0 failed

The leg that reads what this change touches most:

bash .github/doc-paths/doc-paths.sh check ; echo "exit=$?"
ok    69 document(s), 208 named path(s) resolved, 0 excused as examples
Every path these documents name resolves against the tracked set.
exit=0

The readings 0243 rests on

Every cargo reading in that record was taken in a scratch crate outside this
tree, on this Windows machine, with the toolchain rust-toolchain.toml pins,
declaring rustls = "0.23" and rustls-platform-verifier = "0.7" and nothing
else. It resolves rustls v0.23.43 and rustls-platform-verifier v0.7.0. The
gate runs on ubuntu-latest, so the cross-compile results in particular are this
machine's and not the runner's.

The graph, per triple:

cargo tree -e normal --target TRIPLE --prefix none | sed 's/ (\*)$//' \
  | sort -u | grep -v '^verifier-probe' | grep -v '^$' | wc -l
aarch64-linux-android        29
armv7-linux-androideabi      29
aarch64-apple-ios            17
aarch64-apple-tvos           17
aarch64-apple-darwin         17
x86_64-pc-windows-msvc       13
x86_64-unknown-linux-gnu     13

against what this tree carries today:

cargo metadata --format-version 1 --locked | jq -r '.packages[].name' | wc -l
10

Every licence expression across the union of the seven, thirty-nine packages:

awk -F'\t' 'NR==FNR{l[$1]=$2;next}{print l[$0]}' licences shipping | sort | uniq -c | sort -rn
     26 MIT OR Apache-2.0
      2 MIT
      2 ISC
      2 Apache-2.0 OR MIT
      2 Apache-2.0 OR ISC OR MIT
      1 Unlicense OR MIT
      1 ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0)
      1 ISC AND (Apache-2.0 OR ISC)
      1 BSD-3-Clause
      1 (MIT OR Apache-2.0) AND Unicode-3.0

Nine of the ten are satisfied by 0103's admitted set. The tenth is not, and the
record says so rather than admitting it quietly; #268 is where it is asked.

The facade's default sink, which is what the narrowing rests on:

grep -n '' log-0.4.34/src/lib.rs | sed -n '456p;1320,1327p'
456:static mut LOGGER: &dyn Log = &NopLogger;
1320:impl Log for NopLogger {
1321:    fn enabled(&self, _: &Metadata) -> bool {
1322:        false
1323:    }
1324:
1325:    fn log(&self, _: &Record) {}
1326:    fn flush(&self) {}
1327:}

and that this core installs none today:

git grep -n 'set_logger\|set_boxed_logger' origin/main -- src/ ; echo "exit=$?"
exit=1
git grep -nE '^log =|^tracing' origin/main -- Cargo.toml ; echo "exit=$?"
exit=1

What #81's condition is now measured against

The leg refuses a report carrying a finding, run here rather than described:

bash .github/codeql/codeql.sh check .github/codeql/fixtures/one-finding.sarif ; echo "exit=$?"
-- what the analysis says it did
1 run(s), 2 rule(s) loaded, 1 finding(s) reported.

-- what it found
      REFUSED  rust/a-finding  src/session/mod.rs:12  (error)

1 finding(s) refused, 0 excused by the register.
exit=1

and the one-change neighbour two quotation marks away passes:

bash .github/codeql/codeql.sh check .github/codeql/fixtures/no-finding.sarif ; echo "exit=$?"
The analysis loaded 2 rule(s) over this tree and reported 0 finding(s), 0 of them excused by name.
exit=0

bash .github/codeql/codeql.sh selftest ; echo "exit=$?"
Every fixture held. The rules the gate applies are the rules these fixtures ran.
exit=0

What a guard here refuses, and the proof it bites

This change adds no guard. It edits no check, no workflow and no script, and the
runs above are the existing legs judging the documents rather than new ones being
proven.

The proof shown for #81 is of a guard that already exists, and it is quoted
because the issue's rewritten condition is now discharged against exactly it. Its
direction was watched in both: one-finding.sarif is refused and its one-change
neighbour is not.

What this does not cover

No dependency is taken. Cargo.toml and Cargo.lock are untouched by this
branch. 0243 decides the means; the manifest entry, and the line 0103 requires
beside it, arrive under #27 and #29.

Nothing here is compiled against that means. The cross-compile readings in
0243 come from a scratch crate on this Windows machine, not from the runner and
not from this tree, and the record says so in its own text. Six of seven triples
fail in aws-lc-sys's build script for want of a C toolchain and the host builds;
what the runner would do with an NDK and an Apple SDK present is not measured
here.

0029's reversal condition is not discharged. The reason classes were read out
of the crate's source, which is not a refusal on a wire. Whether two platforms
produce different classes for one certificate is still unmeasured, and 0243 says
what it gives that condition is something to take the measurement with.

Three residuals are named and none is closed here. Nothing refuses a logger
installed tomorrow (#266). 0001 has no shape for a record that narrows one clause
of another, so a reader of 0103 who does not follow its pointer reads the fourth
behaviour one clause wider than the rule in force (#267). One licence expression
in the Android graph carries a term 0103's set names in neither half, so that
half of the means is not licensed by this board yet (#268).

One reading in 0103 no longer reproduces, and this branch does not repair it.
It pastes git grep -l '#103' -- docs/decisions with three files and the command
returns five. It is #269, and repairing it is not one of the three edits 0001
permits, so it needs its own decision rather than a line in this diff.

#81's narrower condition is not a claim that the wider one holds. That the
loaded pack finds a defect of this kind in this language is unproven. Two
deliberate defects were written and reverted, once before this crate declared a
dependency and once after, and both runs reported nothing.

No leg that needs the network or the runner ran here. codeql.yml,
zizmor.yml, scorecard.yml, dependencies and targets were not run on this
machine. shellcheck is not installed here, so the shell leg is unrun; this
branch adds and edits no shell.

Who has read it

Nobody but me. There was no second reader available for this change, and the
evidence above stands in place of one rather than the question being left open.