[kixelated]

Problem

Renaming a direct dependency to rind-aws-lc-rs cannot move transitive aws-lc-rs users onto rind.

Approach

Exercise the unpublished aws-lc-rs shim from moq-dev/rind-patch#1 through s2n-quic-crypto and jsonwebtoken, alongside the existing ring QUIC handshake. Patch both rind adapters to this checkout and reject metadata containing registry copies or aws-lc-sys. Run the fixture when either adapter changes. Document binary workspace patches, version constraints, key wiping, and API gaps. Remove the completed quest and its epic.

Impact

• No public Rust API or wire changes in rind. The separate shim exposes the existing adapter under aws-lc-rs's name.
• rustls, rustls-webpki, and rcgen's aws-lc-rs features remain excluded: rind lacks ML-DSA and ML-KEM-1024. Their ring features and dedicated adapters remain the documented routes.
• The s2n-quic row covers packet crypto; its TLS backend needs a separate choice. libp2p's TLS graph remains unsupported.

Alternatives

Reuse the published adapter rather than duplicate crypto. Per-crate renames do not reach transitive dependencies.

Decisions

• Pin the fixture's aws-lc-rs shim to commit b785c6994465b59d2176d2593aa5e3395c61864d so it runs before the companion PR merges. The migration instructions use the default branch and require that PR to land first.
• rind-aws-lc-rs 1.0.0 and rind 0.3.0 are published and were successfully built by the shim, so no release blocker remains.
• This checkout has no rind-patch submodule. Its changes live on remote branch feat/aws-lc-rs-shim in the companion PR; no submodule pointer was changed.

Validation

• quest gate sh/patch.sh: passed formatting, clippy with denied warnings, metadata checks, and all three executable fixtures.
• s2n-quic Initial encryption/decryption, header protection, and Retry authentication; ES256 JWT signing/verification; both reject tampering.
• cargo tree -i aws-lc-sys: no matching package, exit 101 as expected.
• quest gate just ci: passed the full gate, including 725 workspace tests (10 skipped by the existing configuration), 18 wipe tests, doc tests, MSRV and cross-backend checks, dependency policy, Python and Dart checks, fixtures, quest validation, shell and Nix lint.
• quest check --base origin/main: 150 documents valid.
• After merging origin/main at ea5e690 (conflict-free): quest gate just check origin/main passed, running every check including the patch fixture.

Follow-ups

None.

Waiting

• moq-dev/rind-patch: merge moq-dev/rind-patch#1, whose shim MIGRATE.md and MIGRATING.md tell binaries to patch from the default branch. Then drop the rev pin in patch/fixture/Cargo.toml and the (\?rev=[0-9a-f]{40})? allowance in sh/patch.sh, so the fixture tests the shim's main branch, rerun just check, and run /quest-review. Check with gh pr view 1 -R moq-dev/rind-patch.

Models

Size: S
Implementer: Codex, gpt-6.1-sol, xhigh effort

(Written by GPT-6.1 Sol with xhigh)

Review

Rewritten by quest review after each round.

• Reviewer: Claude Code, claude-opus-5-5, low effort
• Session: e0da6286-e864-4933-946c-b4dbf1d2e2ec, round 1
• Head: 90663a1, named in full once a round reports no findings
• Base: origin/main at ea5e690
• Score: 7/10, The docs and fixture match the recorded plan, but the pinned shim revision means CI doesn't test the shim main branch that users are told to patch from.
• Findings, open until the next round settles them:
  • Low, patch/fixture/Cargo.toml:28: aws-lc-rs shim pinned to a fixed rev with nothing forcing its removal
  • Low, sh/patch.sh:19: Comment claims generate-lockfile takes shim revisions afresh, but the pinned aws-lc-rs can't
  • Low, MIGRATE.md:71: Stop condition omits hard-wired aws-lc-rs older than 1.x

Head 90663a1, round 1 dispositions (all low, so no further round):

1. patch/fixture/Cargo.toml:28 pin with nothing forcing its removal: fixed by gating. The ## Waiting item now requires dropping the pin before this PR leaves draft; it cannot be dropped earlier, since the shim is not on rind-patch's main yet.
2. sh/patch.sh:19 comment vs. pinned aws-lc-rs: same cause, resolved with item 1 when the pin and the ?rev= allowance go. The comment is accurate meanwhile: generate-lockfile re-resolves each revision the fixture names.
3. MIGRATE.md:71 aws-lc-rs older than 1.x: refuted. The only pre-1.0 release on crates.io is 0.0.1, a 931-byte placeholder whose description reads "Please use aws-lc-sys", and 1.0.0-rc1 is matched by the patch's 1.999.0, so no hard-wirable older aws-lc-rs exists.

(Written by Claude Opus 5.5)