suaveplan/openspec/changes/archive/2026-05-03-crypto-trust-anchor-bootstrap/tasks.md

1. Source

• 1.1 Create packages/crypto/crypto/src/trust-anchors/trust-anchor.types.ts with TrustAnchor, TrustAnchorReader, LoadTrustAnchorOptions, LoadTrustAnchorFromEnvOptions
• 1.2 Create packages/crypto/crypto/src/trust-anchors/trust-anchor.ts with loadTrustAnchor(reader, path): Promise<TrustAnchor> and loadTrustAnchorFromEnv(reader, options?): Promise<TrustAnchor>. Default env var: SUAVEPLAN_TRUST_ANCHOR_PATH. Self-verify via existing verifyPublicBundle(bytes, null) (root-mode).
• 1.3 Add error codes to packages/crypto/crypto/src/errors/codes/codes.ts: TRUST_ANCHOR.PATH_MISSING, TRUST_ANCHOR.READ_FAILED, TRUST_ANCHOR.SELF_VERIFY_FAILED
• 1.4 Create packages/crypto/crypto/src/trust-anchors/index.ts (barrel — explicit named exports per openspec/AGENTS.md §6a)
• 1.5 Re-export the public surface from packages/crypto/crypto/src/index.ts

2. Build wiring

• 2.1 Add subpath export ./trust-anchors to packages/crypto/crypto/package.json
• 2.2 Add trust-anchors/index build entry to packages/crypto/crypto/vite.config.ts
• 2.3 Whitelist trust-anchors in packages/crypto/crypto/tests/no-duplicates.test.ts (allowed top-level src dirs)

3. Tests + docs

• 3.1 Create packages/crypto/crypto/src/trust-anchors/trust-anchor.test.ts covering: round-trip self-verify; deterministic injectable reader; explicit-path and env-path entry points; verified bundle is byte-identical to the input.
• 3.2 Create packages/crypto/crypto/src/trust-anchors/trust-anchor.spec-conformance.test.ts covering all 3 new error codes (PATH_MISSING, READ_FAILED, SELF_VERIFY_FAILED).
• 3.3 Create packages/crypto/crypto/src/trust-anchors/trust-anchor.md (≥200 words, basic + advanced examples, full API reference).

4. Spec delta

• 4.1 Author openspec/changes/crypto-trust-anchor-bootstrap/specs/crypto/spec.md with the ## ADDED Requirements block for Trust-anchor bootstrap.
• 4.2 Run openspec validate crypto-trust-anchor-bootstrap --strict — green.

5. Verification gate

• 5.1 bunx turbo lint typecheck test --filter=@suaveplan/crypto — green.
• 5.2 bunx turbo test:coverage --filter=@suaveplan/crypto — 100/100/100/100.
• 5.3 bunx turbo build --filter=...@suaveplan/crypto — every dependent compiles green.

6. Archive

• 6.1 openspec archive crypto-trust-anchor-bootstrap --yes — fold the requirement into openspec/specs/crypto/spec.md.
• 6.2 Confirm post-archive: openspec validate --specs shows ✓ spec/crypto.