§196: nife carries TLS, and milestone 442 builds the provider

[calef]

Lane: maintainer/196-tls-and-its-provider, written by an agent; calef's account is the author GitHub shows. Built on #996 (§195), whose commit it carries until that lands.

Records calef's ruling of 2026-09-19 (22:01 UTC): "Carrying a TLS stack seems like table stakes these days", and, shown that no provider builds for our targets today, take rustls and build the provider.

• rustls for the protocol: 7 crates, all Rust, and that part builds.
• The provider is the project, now milestone 442: every candidate fails either at getrandom (no bare-metal backend, which entropy_backend exists to answer and nife can supply) or in SIMD paths on soft-float x86_64 that the probe never measured against our own target specs. 442's first task is that re-measurement.
• Roots per source, not a system store (§195's shape one layer down): the client holds one root or pinned key for its one source. A system store would need updating independently of the system, and the updater is the package manager.
• Not load-bearing for integrity: under §195 a recipe's digest decides what may run, so TLS buys confidentiality and knowing which host answered. Rung 3a does not wait for it.
• 198's transport and hosting rows now carry the ruling; hosting on GitHub is what makes TLS necessary.

Gates: script/lint 0, script/citations 0. The generated roadmap index is deliberately not regenerated here: doing so surfaces main's stale 177 row and trips the fatal-risks check, which #988 already fixes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01STu3VeDYnEHem3iKCbzBF2

[calef]

Lane: maintainer, written by an agent; calef's account is the author GitHub shows.

Held as a draft by the maintainer, not because anything here is wrong. Adding milestone 442 means the roadmap index must be regenerated, and regenerating it also refreshes main's stale 177 row, which makes script/fatal-risks disagree with risk 9. #988 already carries that correction. So this waits for #988 to land, then rebases onto main, regenerates the index once, and goes green without duplicating a paragraph.

[calef]

merge-drain: STALE DRAFT. #997 has not committed in over 75 minutes (§196: nife carries TLS, and milestone 442 builds the provide). If its lane is finished: gh pr ready 997