Bump cratestack to 0.6.7, and correct the aws-lc-rs claim in AGENTS.md

[stephane-segning]

Pull Request: Bump cratestack to 0.6.7, and correct the aws-lc-rs claim in AGENTS.md

1. Summary

This PR changes:

• Bumps the cratestack pin from =0.6.3 to =0.6.7, picking up cratestack/cratestack#341.
• Corrects a wrong claim I previously wrote into AGENTS.md about where aws-lc-rs enters this dependency tree, and replaces it with the verified mechanism plus the correct diagnostic command.
• Refreshes a stale status line — M1 is done (Service-account provisioning (provisionAppClient) #23/RBAC layers 1 and 2 #24/Gate: a persisted client_credentials client gets a token #25 merged, closing Epic: M1 — sms-auth: OIDC, service accounts, RBAC #18), not still open.

It solves:

• Picks up the resolution of cratestack#334 (filed from this repo): install_fips_crypto_provider() returned Ok(()) while installing nothing, because crypto-aws-lc-rs was declared = []. #341 makes enabling it a hard compile_error! instead of a false success.
• Removes a documentation landmine: the previous AGENTS.md text would have sent the next person chasing a non-existent upstream blocker.

2. Intent

The bump itself is small and behaviour-neutral here — we don't enable crypto-aws-lc-rs, so the new compile_error! never fires in this workspace. It's worth taking because it's the fix for an issue this repo reported, and because staying current is the pin discipline.

The AGENTS.md correction is the substantive part. A previous revision of that file — which I wrote — claimed aws-lc-rs reaches this tree from four independent paths including cratestack and sqlx, and concluded that getting off it was blocked on cratestack offering an opt-out. That was wrong, and it was wrong in the costly direction: it told the next reader that a thing they can do today is blocked upstream.

The error was reading cargo tree -i aws-lc-rs. That inverts on the shared rustls node and lists everything depending on it — not everything asking for aws-lc-rs. Because Cargo unifies features, one rustls in the graph carries both providers' feature flags regardless of who requested which, so cratestack crates appear in that output while actually having selected ring. cargo tree -e features -i rustls shows the real feature edges, and is now the command the docs point at.

3. Scope

In Scope

• The version bump and lockfile.
• The corrected aws-lc-rs section in AGENTS.md, including the diagnostic-command gotcha and the empirical result.
• The stale M1 status line.

Out of Scope

• Actually opting out of aws-lc-rs. Now known to be achievable with no upstream blocker (see Verification), but rustls-no-provider panics at reqwest::Client::new() unless the application installs a CryptoProvider in main first. That runtime path is unverified, so it deserves a deliberate change with a live TLS test — not a drive-by in a version-bump PR.
• Real FIPS support. Still requires the cross-crate backend-selection work #341 explicitly deferred; the feature is now honest about not existing rather than silently lying.
• Live sweep: cross-binary interference breaks #114's kill-9 gate (single-test binary, so not #102's within-binary cause) #116 (below) — pre-existing, unrelated to this bump.

4. Verification

I verified this change by:

• Running automated tests
• Running manual tests
• Checking logs
• Checking metrics
• Testing error cases
• Testing permissions/security behavior
• Testing rollback or failure behavior, if relevant

Commands run:

# confirm the fix is really in 0.6.7, and that 0.6.0's SQLSTATE fix didn't regress with it
grep -A8 'crypto-aws-lc-rs' cratestack-pg-0.6.7/src/lib.rs
grep -c 'cool_error_from_sqlx'                  cratestack-sqlx-0.6.7/src/query/write/*.rs
grep -c 'CoolError::Database(error.to_string())' cratestack-sqlx-0.6.7/src/query/write/*.rs

cargo build --workspace && cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

# live, against a real Postgres 16
DATABASE_URL=... cargo test --workspace -- --ignored

Results:

0.6.7 crypto-aws-lc-rs  → compile_error!(...) — #341's fix present, not inferred from the version
0.6.7 write paths       → 33 cool_error_from_sqlx, 0 raw CoolError::Database  (no regression of #87)

cargo build --workspace → clean, no source changes needed
fmt / clippy -D warnings→ clean / 0 errors
cargo test --workspace  → 198 passed, 0 failed
live sweep              → 62 passed, 1 failed  ← see below, not this bump

The aws-lc-rs claim, tested rather than argued. Setting default-features = false, features = ["rustls-no-provider"] on the four authkestra pins:

$ cargo tree -i aws-lc-rs
error: package ID specification `aws-lc-rs` did not match any packages

It leaves the graph entirely. Confirming the sources agree: cratestack-sqlx selects sqlx-core's _tls-rustls-ring-webpki; cratestack-client-rust selects reqwest's rustls-tls, which in reqwest 0.12 expands to rustls-tls-webpki-roots → __rustls-ring. Both ring. The aws-lc-rs edge was reqwest 0.13's defaults via authkestra-engine, exactly as marcjazz/authkestra#179 described. That experiment was reverted, not shipped — see Out of Scope.

The one live failure is not from this bump. #114's kill_9_mid_submit_reclaims_and_resubmits_without_losing_the_message fails under the full sweep and passes in isolation. It reproduces on main at =0.6.3, so it predates this change. Filed as #116, with what I think is a decisive detail: that binary contains exactly one test, so within-binary concurrency — the cause #102 was closed on — cannot explain it. It's cross-binary interference, made sharp by #114 spawning a real sms-worker subprocess whose claim loop selects by predicate and will claim other suites' rows.

5. Screenshots / Evidence

No UI. Evidence is the command output above.

6. Risk Assessment

Risk level:

• Low
• Medium
• High

Potential risks:

• Four patch versions in one jump (0.6.4 → 0.6.7), so more than just #341 comes along.
• The new compile_error! would break any build enabling crypto-aws-lc-rs.

Mitigation:

• Full offline suite (198) and live sweep (62, excluding the pre-existing Live sweep: cross-binary interference breaks #114's kill-9 gate (single-test binary, so not #102's within-binary cause) #116 failure) both green, including errors_live_postgres.rs — the map_database_error / is_illegal_transition do not fire live: SM001 and 23505 both surface as 500 (upstream cratestack-sqlx#267) #87 tripwire that was specifically built to fail if the SQLSTATE behaviour ever regresses. That's the check that matters most across a cratestack bump, and it passes.
• Nothing in this workspace enables that feature; verified by the clean build. And a compile_error! is the safe failure direction — it's strictly better than the Ok(()) it replaces, which is what #334 was about.

7. AI Usage Declaration

AI was used for:

• Understanding existing code
• Generating code
• Refactoring
• Generating tests
• Drafting documentation
• Reviewing the diff
• Not used

Human verification:

• I understand every meaningful change in this PR
• I checked generated code manually
• I checked generated tests manually
• I removed unsupported AI assumptions
• I accept responsibility for this PR

(Left unchecked by the assistant that opened this PR — these are human-accountability claims and can only be truthfully made by the reviewing human. Please check off what applies after your own review before merging.)

8. Reviewer Focus

Please focus your review on:

• Correctness
• Architecture
• Security
• Performance
• Tests
• Maintainability
• Edge cases

Specifically:

1. The corrected AGENTS.md section is the part worth actually reading. It now states the opposite of what it said yesterday, so it's worth confirming you agree with the reasoning rather than taking my word for the reversal — the cargo tree -e features -i rustls output is the evidence.
2. Is dropping aws-lc-rs something you want soon? It's now a small, self-contained change (authkestra feature flags + installing a ring provider in main), gated only on a live TLS test. Happy to open it as its own issue or PR.
3. Live sweep: cross-binary interference breaks #114's kill-9 gate (single-test binary, so not #102's within-binary cause) #116 is knowingly left failing in the full sweep rather than silenced. If you'd rather have a green sweep today, the cheap interim is a just live-test recipe that runs each --test target in turn — say the word and I'll add it.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 859d712

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR