[kixelated]

Finishes quest/m1/adapter-cpu-check.md.

Summary

rind-jsonwebtoken and rind-instant-acme now refuse a CPU missing a feature rind requires the same way rind-rustls, rind-dimpl, and rind-object-store have since moq-dev/rind#420: default_provider() returns the adapter's own MissingFeature. A user of either adapter no longer needs rind as a direct dependency just to call rind::cpu::check().

• Each crate gains pub fn default_provider() -> Result<&'static CryptoProvider, MissingFeature> and its own MissingFeature, identical to the other adapters'. The CryptoProvider static is now private, so there is one way to get it.
• Both upstream APIs take &'static CryptoProvider (jsonwebtoken's install_default(&'static self), instant-acme's Account::builder(.., &'static CryptoProvider)), so the &'static return fits both; nothing needed another shape.
• READMEs, crate docs, MIGRATING.md (adapter section and table), and MIGRATE.md's startup-check step are updated. Tests, ctgrind tests, and the jsonwebtoken bench take the provider from default_provider().

Public API

Breaking, for both crates:

Before	After
rind::cpu::check()?; then rind_jsonwebtoken::DEFAULT_PROVIDER.install_default()	rind_jsonwebtoken::default_provider()?.install_default()
rind::cpu::check()?; then Account::builder(http, &rind_instant_acme::DEFAULT_PROVIDER)	Account::builder(http, rind_instant_acme::default_provider()?)
field access such as DEFAULT_PROVIDER.hmac	default_provider()?.hmac

Added: rind_jsonwebtoken::MissingFeature, rind_instant_acme::MissingFeature. No wire impact.

Release

This must merge before the release PR moq-dev/rind#424, so the break rides rind-jsonwebtoken 11.0.0, the major bump the adapter-version change (moq-dev/rind#440) already takes. release-plz refreshes #424 from this commit once it lands; the release PR itself is left alone here. rind-instant-acme is unpublished.

Choices made without asking

• MIGRATE.md's startup step now names the three ways to refuse an unsupported CPU (an adapter's default_provider(), rind-ring's cpu::check(), or rind::cpu::check()) rather than telling every binary to depend on rind.
• In MIGRATING.md, rind-rcgen's KeyPair remains the one adapter surface that still needs rind::cpu::check(), since its errors are rcgen's.

Follow-ups

• rind-rcgen still points callers at rind::cpu::check(). Recommend drop: its README example already depends on rind directly for rind::rand::fill to make the serial number, and KeyPair::generate's error type is rcgen's, so a rind-rcgen check would not save the dependency.

Validation

• nix develop --command just check origin/main: passes (rs, msrv, bench, quest, shell, nix), including both crates' doctests, the interop/differential/install/ctgrind tests, and the pebble issuance test.

(Written by Claude Opus 5.5 with high)

🤖 Generated with Claude Code

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, low effort
• Session: 01a1b484-eac1-7bc2-a80e-6fab97a8f9c7, round 1
• Head: 306184f
• Base: origin/main at 1dce2e7
• Score: 10/10, Both adapters check CPU support before returning their private providers, all repository consumers and examples use the new API, and no actionable defects were found; tests were not run in the read-only environment.
• Findings: none

[pullfrog]

Your OpenCode Go account is out of credit. Top it up, then re-trigger Pullfrog.

OpenCode Go's response

provider error: Insufficient account funds

Top up OpenCode Go →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using glm-5.3}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 23f4d742-9df8-4306-9394-fe543e9d2010

Commits

Reviewing files that changed from the base of the PR and between 1dce2e7 and 306184f.

Files selected for processing: 15

• MIGRATE.md
• MIGRATING.md
• quest/m1/README.md
• quest/m1/adapter-cpu-check.md
• rind-bench/benches/jsonwebtoken.rs
• rind-instant-acme/README.md
• rind-instant-acme/src/lib.rs
• rind-instant-acme/tests/ctgrind.rs
• rind-instant-acme/tests/differential.rs
• rind-instant-acme/tests/pebble.rs
• rind-jsonwebtoken/README.md
• rind-jsonwebtoken/src/lib.rs
• rind-jsonwebtoken/tests/ctgrind.rs
• rind-jsonwebtoken/tests/install.rs
• rind-jsonwebtoken/tests/interop.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[kixelated]

Automated review by review (OpenAI)

Reviewed head 306184f against base 1dce2e7.

No actionable findings. Both adapters call rind::cpu::check before returning their private provider, wrap the error in the adapter's public MissingFeature with Display/Error implementations, and preserve the static reference needed by the upstream APIs. The changed tests, benchmark and examples consistently use default_provider; the jsonwebtoken function explicitly uses std::result::Result rather than its imported upstream error alias. Crypto callbacks and provider contents are unchanged.

Direction: land this before the 11.0.0 release as documented. Add a fresh-process required-feature-denied regression and an external consumer test without a direct rind dependency to pin the new failure path and intended dependency benefit; these are coverage suggestions, not identified implementation defects. The documentation correctly retains rind-rcgen's separate startup-check requirement.

Limits: GitHub-only static review of the full 15-file diff and the adapter/upstream interfaces inspected during the preceding plan review. No builds, doctests, CPU-denial probes, crypto tests, CI or quest context executed; reported validation was not independently reproduced. This COMMENT is not merge approval.