Initial Commit

openspec/changes/archive/2026-05-03-crypto-trust-anchor-bootstrap/tasks.md

@@ -0,0 +1,35 @@
+## 1. Source
+
+- [ ] 1.1 Create `packages/crypto/crypto/src/trust-anchors/trust-anchor.types.ts` with `TrustAnchor`, `TrustAnchorReader`, `LoadTrustAnchorOptions`, `LoadTrustAnchorFromEnvOptions`
+- [ ] 1.2 Create `packages/crypto/crypto/src/trust-anchors/trust-anchor.ts` with `loadTrustAnchor(reader, path): Promise<TrustAnchor>` and `loadTrustAnchorFromEnv(reader, options?): Promise<TrustAnchor>`. Default env var: `SUAVEPLAN_TRUST_ANCHOR_PATH`. Self-verify via existing `verifyPublicBundle(bytes, null)` (root-mode).
+- [ ] 1.3 Add error codes to `packages/crypto/crypto/src/errors/codes/codes.ts`: `TRUST_ANCHOR.PATH_MISSING`, `TRUST_ANCHOR.READ_FAILED`, `TRUST_ANCHOR.SELF_VERIFY_FAILED`
+- [ ] 1.4 Create `packages/crypto/crypto/src/trust-anchors/index.ts` (barrel — explicit named exports per `openspec/AGENTS.md §6a`)
+- [ ] 1.5 Re-export the public surface from `packages/crypto/crypto/src/index.ts`
+
+## 2. Build wiring
+
+- [ ] 2.1 Add subpath export `./trust-anchors` to `packages/crypto/crypto/package.json`
+- [ ] 2.2 Add `trust-anchors/index` build entry to `packages/crypto/crypto/vite.config.ts`
+- [ ] 2.3 Whitelist `trust-anchors` in `packages/crypto/crypto/tests/no-duplicates.test.ts` (allowed top-level src dirs)
+
+## 3. Tests + docs
+
+- [ ] 3.1 Create `packages/crypto/crypto/src/trust-anchors/trust-anchor.test.ts` covering: round-trip self-verify; deterministic injectable `reader`; explicit-path and env-path entry points; verified bundle is byte-identical to the input.
+- [ ] 3.2 Create `packages/crypto/crypto/src/trust-anchors/trust-anchor.spec-conformance.test.ts` covering all 3 new error codes (`PATH_MISSING`, `READ_FAILED`, `SELF_VERIFY_FAILED`).
+- [ ] 3.3 Create `packages/crypto/crypto/src/trust-anchors/trust-anchor.md` (≥200 words, basic + advanced examples, full API reference).
+
+## 4. Spec delta
+
+- [ ] 4.1 Author `openspec/changes/crypto-trust-anchor-bootstrap/specs/crypto/spec.md` with the `## ADDED Requirements` block for `Trust-anchor bootstrap`.
+- [ ] 4.2 Run `openspec validate crypto-trust-anchor-bootstrap --strict` — green.
+
+## 5. Verification gate
+
+- [ ] 5.1 `bunx turbo lint typecheck test --filter=@suaveplan/crypto` — green.
+- [ ] 5.2 `bunx turbo test:coverage --filter=@suaveplan/crypto` — 100/100/100/100.
+- [ ] 5.3 `bunx turbo build --filter=...@suaveplan/crypto` — every dependent compiles green.
+
+## 6. Archive
+
+- [ ] 6.1 `openspec archive crypto-trust-anchor-bootstrap --yes` — fold the requirement into `openspec/specs/crypto/spec.md`.
+- [ ] 6.2 Confirm post-archive: `openspec validate --specs` shows `✓ spec/crypto`.