chore(quest): plan CBC and rustls security checks

quest/m3/README.md

@@ -2,8 +2,8 @@
 
 ## Goal
 
-Work that waits on something besides priority: an outside party, an upstream
-release, or a consumer that does not exist yet.
+Work deferred by priority or waiting on an outside party, an upstream release,
+or a consumer that does not exist yet.
 
 ## Plan
 
@@ -13,6 +13,8 @@ quest names how to check it and is deleted once it holds.
 
 ## Required
 
+- [Check CBC consumers for padding-oracle exposure](/quest/m3/cbc-padding-oracle.md) - confirm current callers authenticate before exposing padding failures, and fix a reachable defect
+- [Check rustls provider panic reachability](/quest/m3/rustls-provider-panics.md) - trace malformed peer input to the adapter's key and IV conversions, and fix a reachable defect
 - [armv7 debug ctgrind, end of m2](/quest/m3/armv7-debug-ct.md) - recurring check that armv7 stays constant-time in debug builds
 - [cargo-llvm-cov builds with its tests again](/quest/m3/cargo-llvm-cov-check.md) - waiting on a nixpkgs rustc fix, then drop the doCheck override
 - [instant-acme 0.9 is released](/quest/m3/instant-acme-release.md) - waiting on the release with a pluggable `CryptoProvider`

quest/m3/cbc-padding-oracle.md

@@ -0,0 +1,15 @@
+# [XS] Check CBC consumers for padding-oracle exposure
+
+## Goal
+
+No current consumer of rind's AES-CBC exposes a distinguishable padding result for attacker-controlled ciphertext before authenticating it. Reproduce and fix any reachable defect; otherwise close this quest with the evidence.
+
+## Plan
+
+- Trace current production callers of `cipher::AesCbcDecryptingKey`, including adapters and their downstream use, to the point where a decryption failure can be observed.
+- [The AES-CBC PR](https://github.com/moq-dev/rind/pull/381) deliberately kept the generic unauthenticated primitive and documented its padding-oracle risk. That risk alone is not a defect to fix here.
+- Change a consumer only if its actual input and error path exposes the oracle. Reproduce that path before the fix and verify the result after it. Leave a broader rind API redesign for a separate decision if the evidence calls for one.
+
+## Related
+
+- [Test coverage](/TESTING.md) - maps primitive tests across backends, rather than consumer misuse

quest/m3/rustls-provider-panics.md

@@ -0,0 +1,15 @@
+# [S] Check rustls provider panic reachability
+
+## Goal
+
+Malformed peer input cannot reach the `rind-rustls` AEAD key or IV conversions that use `unwrap`. Reproduce and fix any reachable panic; otherwise close this quest with the input-provenance and trait-contract evidence.
+
+## Plan
+
+- Trace `rind-rustls/src/aead.rs`'s `aead_key` and TLS 1.2 IV conversions from rustls's key schedule and public provider traits. Check whether a peer, a caller using the provider normally, or only a direct trait caller can supply malformed lengths.
+- Compare the rustls 0.23 provider contract and its built-in providers. Exercise a malformed path only where the contract permits it; reproduce any reachable panic before fixing it.
+- If the only concern is direct misuse outside rustls's contract, record that boundary and close this quest. Plan broader rind-specific API hardening separately if the evidence warrants it.
+
+## Related
+
+- [Test coverage](/TESTING.md) - maps primitive tests rather than adapter input provenance