[kixelated]

Problem

A binary cannot replace transitive aws-lc-rs dependencies by renaming its own dependency to rind-aws-lc-rs.

Approach

Add an unpublished aws-lc-rs 1.999.0 shim beside ring, re-exporting the published rind-aws-lc-rs 1.x adapter. Forward its supported features and wipe; leave fips unavailable. The consumer fixture and migration instructions are in moq-dev/rind#497.

Impact

• A binary can patch aws-lc-rs 1.x throughout its tree with one [patch.crates-io] entry. No wire change or new cryptographic implementation.
• s2n-quic-crypto and jsonwebtoken are supported consumers. rustls, rustls-webpki, and rcgen's aws-lc-rs features remain unsupported because rind lacks ML-DSA and ML-KEM-1024.

Alternatives

Per-crate dependency renames cannot replace transitive dependencies. Reuse the adapter instead of copying its implementation.

Validation

• The companion fixture passed s2n-quic Initial packet encryption, header protection, Retry tags, and jsonwebtoken ES256 signing/verification, including tampering checks, with no aws-lc-sys.
• cargo fmt --all --check
• cargo clippy --workspace --all-features -- --deny warnings, through quest gate, against crates.io's rind-aws-lc-rs 1.0.0 and rind 0.3.0.

Follow-ups

None.

Waiting

• Claude: quest review --base origin/main exited 3: usage limit; resets 2026-11-11T22:00:00Z. Run /quest-review after the reset.

Models

Size: S
Implementer: Codex, gpt-6.1-sol, xhigh effort

(Written by GPT-6.1 Sol with xhigh)