[kixelated]

Implements quest/m1/quic-api/crypto.md: moq-quic's crypto is sealed to rustls. The crypto traits are crate-private, the configs take rustls configs directly, and a connection reports its handshake and peer as concrete types instead of Box<dyn Any>. Kept to the crypto surface, and rebuilt on main's plain configs from moq-dev/moq#7045.

Changes

• moq-quic: crypto::{Session, ClientConfig, ServerConfig, PacketKey, HeaderKey, HmacKey, HandshakeTokenKey, AeadKey}, Keys, KeyPair, and all of crypto::rustls are pub(crate). The plaintext crypto stays behind the hidden fuzz feature, now built through fuzz::Plaintext::{client, server}.
• Connection::handshake_data() -> Option<crypto::HandshakeData> (alpn, server_name) and peer_identity() -> Option<Vec<CertificateDer<'static>>> replace crypto_session() and its downcasts. export_keying_material and crypto::ExportKeyingMaterialError are crate-private and test-only, since nothing outside the tests uses them.
• client::Config::new(Arc<rustls::ClientConfig>) and server::Config::new(Arc<rustls::ServerConfig>) are infallible, and their crypto fields are crate-private. QuicClientConfig, QuicServerConfig, their TryFrom/with_initial, and NoInitialCipherSuite are gone. Initial packets are still keyed with the AES-128-GCM-SHA256 suite from the config's own provider.
• A rustls config that cannot do QUIC used to panic in start_session (no TLS 1.3) or fail try_from (no AES-128-GCM-SHA256). Now it fails each connection. The client's connect returns the new ConnectError::Tls. The server closes a connection without TLS 1.3 with INTERNAL_ERROR, and drops the Initial with a warning when its provider lacks the Initial suite, since it then has no key to protect a close.
• transport_parameters is private, and rustls is a required dependency (the ring/aws-lc-rs features pick the provider only). The rustls re-export is unconditional. The unused __rustls-post-quantum-test feature is deleted.
• moq-tokio: the !Send-scoped handshake_data().downcast().unwrap() in the backend, PeerIdentity::from_any with its test, quic::web::Session's OnceLock ALPN cache (resolved in raw() now, since a driver Connection exists only after its handshake), its two provider-gated negotiated_alpn copies, and the try_from calls in the backend and the web client/server all go. The driver's handshake_data/peer_identity return the concrete types. The blocked-handshake driver tests now block in a rustls cert resolver, since they can no longer wrap the sealed ServerConfig trait.
• moq-uring: Connection::peer_chain() -> Option<Vec<Vec<u8>>> becomes peer_identity() -> Option<Vec<CertificateDer<'static>>>, mirroring moq-tokio. moq-relay's uring.rs stops converting it back. The driver's try_from and its Error::Tls mapping go.
• moq-relay: cluster.rs and the integration tests drop their QuicServerConfig/QuicClientConfig::try_from.
• Migration notes: the MIGRATE.md files for moq-quic, moq-tokio, and moq-uring gain ## Unreleased entries with the Impact steps below. AGENTS.md now asks this of breaking PRs.
• Quests: rind transport loses its ## Required section, since this PR was its last blocker.

Impact

• moq-quic (breaking): build configs with client::Config::new(Arc::new(rustls_client)) / server::Config::new(Arc::new(rustls_server)) instead of wrapping in QuicClientConfig/QuicServerConfig. Replace conn.crypto_session().handshake_data()?.downcast::<crypto::rustls::HandshakeData>() with conn.handshake_data() (protocol is now alpn, and protocol_version/cipher_suite are dropped), crypto_session().peer_identity() plus its downcast with conn.peer_identity(). export_keying_material is no longer public. A custom crypto implementation and the public client::Config::crypto/server::Config::crypto fields are no longer supported. A provider without AES-128-GCM-SHA256 now fails each connection instead of try_from. transport_parameters is no longer reachable. ConnectError gains Tls and drops Eq.
• moq-tokio (breaking): quic::driver::Connecting::handshake_data returns crypto::HandshakeData, Connection::handshake_data returns Option<crypto::HandshakeData>, and Connection::peer_identity returns Option<Vec<CertificateDer<'static>>>, with no downcast. quic::Error::NoInitialCipherSuite is removed, and the test-only Connection::export_keying_material helper and its test are gone.
• moq-uring (breaking): quic::driver::Connection::peer_chain() is now peer_identity() and returns CertificateDers. Use cert.to_vec() for raw DER.
• Wire: none.

Choices made without asking

• rustls became a required moq-quic dependency so HandshakeData, peer_identity, and ConnectError::Tls exist in every build. A build with no provider (qmux's mux-only use) can no longer construct a QUIC config, so it allows dead code crate-wide. rind transport removes the provider features, and that allowance with them.
• client::Config::new/server::Config::new take the rustls config, and from_crypto stays crate-private for the plaintext crypto behind fuzz (fuzz::Plaintext::{client, server}).
• The crate-private exporter stays compiled in every build, with expect(dead_code) outside tests, rather than gating every impl on cfg(test), so it cannot rot.
• HandshakeData keeps only what a consumer reads (ALPN, SNI) and lives in moq_quic::crypto. The unused HmacKey::verify is deleted.
• HmacKey/HandshakeTokenKey setters with no caller (reset_key, token_key) are deleted rather than kept private.
• moq-uring keeps server_name() plus the trait's protocol() rather than gaining a handshake_data() with no consumer; the epic README's side-by-side pass mirrors the drivers.

Not done here

The quest expected about 18 #[cfg(any(feature = "aws-lc-rs", feature = "ring"))] gates in quic::web to go. Only the gates on the ALPN helper depended on moq-quic's surface. Config has since deleted the builders the rest guarded, and rind transport removes the provider features.

The Retry tag, reset key, and token key still use moq-quic's own ring/aws-lc, as on main, so a FIPS-only provider does not cover them.

Decisions

Settled by the maintainer, 2026-10-29:

1. Where an unusable rustls config fails.
   • ✅ (a) The constructors stay infallible, and a config without TLS 1.3 fails each connection: ConnectError::Tls on the client, an INTERNAL_ERROR close on the server. A provider without AES-128-GCM-SHA256 fails the same way (see the review below).
   • (b) The constructors return Result after probing the config with a throwaway rustls session.
2. TLS exporter. "I don't know if we need export_keying_material for now."
   • (a) Keep Connection::export_keying_material and crypto::ExportKeyingMaterialError public.
   • ✅ (c) Remove them from the public API, making them crate-private or test-only. No non-test consumer exists: Connection::export_keying_material is #[cfg(test)] pub(crate), the error and trait method are crate-private, and moq-tokio's test-only helper and its duplicate test are deleted. moq-quic's export_keying_material test still covers the exporter.
   • (b) Delete it, its trait method, and both tests.

Checks

quest gate nix develop -c just ci origin/main on 630662f (main 41f60ec merged) passed every module except two, neither from this diff:

• test rs: tenant_matrix::uring_keeps_tenants_apart could not set up its io_uring worker (RLIMIT_MEMLOCK of 8192 KiB, which every process of this user shares). A full rerun with just rs test --workspace --no-fail-fast then passed 11049 of 11049 tests, that test included.
• check flake: this host's Nix builder cannot create user namespaces (unshare: write failed /proc/self/uid_map) when it builds the github-runner VM image. This diff does not touch that image.

These also passed on the merge: cargo clippy --locked -p moq-quic -p moq-tokio -p moq-relay -p moq-uring --features moq-relay/io-uring,moq-quic/fuzz,moq-quic/sim --all-targets -- -D warnings, just rs quic-features --all, and quest check --base origin/main.

Review

Codex gpt-6.1-sol at medium effort (quest review --base origin/main), session 01a19f9f-37c2-7601-acd4-ff13e733fde3, round 1 on 630662f against main f685126: no findings.

quest started a new session because main's AGENTS.md files changed since the old session 01a19808-0309-7e51-8dbd-e59691d84b61. The new round still got the response to that session's one finding (rs/moq-quic/src/endpoint.rs:460, reject a provider without TLS13_AES_128_GCM_SHA256 at server setup). That finding stays refuted with no change, per the maintainer's decision 1(a).

Declined: the OpenAI review's nonblocking suggestion to add endpoint tests for a config without TLS 1.3. moq-quic builds rustls without its tls12 feature, so its tests cannot build such a config. That path is a single map_err over rustls's own "TLS 1.3 support is required for QUIC" check (rs/moq-quic/src/crypto/rustls.rs:257, :309). The missing-suite path is the one moq-quic decides itself, and provider_without_initial_suite_fails_connections covers it.

Why it kept failing

This PR removes public moq-quic APIs (QuicClientConfig/QuicServerConfig::try_from). Main keeps adding new callers of them in files this PR does not touch. The merge then has no textual conflict but still fails to compile:

• rs/moq-tokio/tests/integration/receive_ts.rs (moq-dev/moq#7334) broke the land fixer's d0e5960. 2086670 fixed it, but it was pushed during the land fixer's attempt, and that push ejected the PR with head_moved.
• rs/moq-relay/tests/integration/tenant_matrix.rs (moq-dev/moq#7366) and rs/moq-tokio/tests/integration/sim.rs (the new sim driver) broke the same way on 5bb33e2's merge, and bitrate_caps.rs and receive_credit.rs on 630662f's. All of them now pass the rustls config straight to Config::new.

The other ejections were not this PR's fault:

• check gh and a pyright error on main (2026-10-31)
• a moq-net compile error from another PR in the batch
• repeated conflicts in rs/moq-tokio/src/quic/driver/tests.rs, where main kept changing imports

The next PR to add a try_from caller on main will break this PR the same way, so it should land soon after this merge.

History:

• 630662f merges main (41f60ec) after two days of conflicts. The conflicts were the three MIGRATE.md files, which keep both sides' entries with this PR's first, and rs/moq-tokio/tests/integration/receive_credit.rs, which takes main's new dial helper. The commit also updates two new try_from callers: that dial helper and rs/moq-relay/tests/integration/bitrate_caps.rs (moq-dev/moq#7535). main through f685126 merges cleanly and adds no more callers.
• 5bb33e2 merges main (bf4e726). Its one conflict was rs/moq-quic/Cargo.toml: main added the sim feature next to the __rustls-post-quantum-test feature this PR deletes. The resolution keeps sim and still deletes the old feature. The same commit updates tenant_matrix.rs and sim.rs.
• bac8d28 adds the migration notes, and 05dcd16 removes the empty ## Required heading.
• 664b65f merged main (70821da) and fixed receive_ts.rs. 2086670 merged the land fixer's d0e5960 into it with no change to the tree.
• Earlier rounds (Codex gpt-6-astra/gpt-6.1-sol, through 9e20541): the Initial-key provider fix (7899c21) and the no-fallback fix (01c3523). The setup-time validation finding was refuted each round, per decision 1(a).

Follow-ups

• The remaining provider gates belong to rind transport, which this PR unblocks.
• Possible: reject a provider without the Initial suite at setup. AGENTS.md's "decide a path at setup" rule suggests it, and three review rounds have asked for it. It would reopen decision 1(a), since the constructors would become fallible, so it is the maintainer's call.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[zshenker]

Initial keys now come from a static suite picked by cfg(feature = "ring") / cfg(all(feature = "aws-lc-rs", not(feature = "ring"))) (crypto/rustls.rs initial_suite), instead of from the caller's provider as on main. The doc comment's point stands for confidentiality, since Initial keys derive from public values. The cost is the module boundary: a caller that hands in a FIPS-only aws-lc provider gets Initial packet protection from ring whenever anything in the graph enables moq-quic/ring (its default, moq-tokio's ring, or fuzz), with no error. A deployment that must keep every cipher inside a validated module can't then use moq-quic. Could the Initial suite keep coming from tls.crypto_provider() (AES-128-GCM-SHA256 in every real provider), with the crate's own as the fallback? Or, if unifying both features is unsupported, a compile_error! would make it loud.

(Written by Claude Opus 5.5)

[kixelated]

Fixed: Initial keys come from the config's own provider again (7899c21), and a provider without TLS13_AES_128_GCM_SHA256 now fails each connection instead of borrowing moq-quic's suite (01c3523). The client's connect returns ConnectError::Tls, and the server drops the Initial with a warning. The Retry tag, reset key, and token key still use moq-quic's own ring/aws-lc, as on main.

(Written by Claude Opus 5.5)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1723884b-c8fa-4fb5-95ae-b08b5ea2e153

Commits

Reviewing files that changed from the base of the PR and between 41f60ec and 630662f.

Files selected for processing: 42

• quest/m1/quic-api/README.md
• quest/m1/quic-api/crypto.md
• quest/m2/rind/transport.md
• rs/moq-quic/Cargo.toml
• rs/moq-quic/MIGRATE.md
• rs/moq-quic/benches/common/mod.rs
• rs/moq-quic/src/config/client.rs
• rs/moq-quic/src/config/server/mod.rs
• rs/moq-quic/src/connection/mod.rs
• rs/moq-quic/src/crypto.rs
• rs/moq-quic/src/crypto/ring_like.rs
• rs/moq-quic/src/crypto/rustls.rs
• rs/moq-quic/src/endpoint.rs
• rs/moq-quic/src/fuzz/connection.rs
• rs/moq-quic/src/fuzz/plaintext.rs
• rs/moq-quic/src/lib.rs
• rs/moq-quic/src/packet.rs
• rs/moq-quic/src/tests/characterize/paths.rs
• rs/moq-quic/src/tests/mod.rs
• rs/moq-quic/src/tests/util.rs
• rs/moq-relay/src/cluster.rs
• rs/moq-relay/src/uring.rs
• rs/moq-relay/tests/integration/bitrate_caps.rs
• rs/moq-relay/tests/integration/peer_limits.rs
• rs/moq-relay/tests/integration/refusals.rs
• rs/moq-relay/tests/integration/runtime_uring.rs
• rs/moq-relay/tests/integration/tenant_matrix.rs
• rs/moq-tokio/MIGRATE.md
• rs/moq-tokio/src/quic/backend.rs
• rs/moq-tokio/src/quic/driver/connection.rs
• rs/moq-tokio/src/quic/driver/tests.rs
• rs/moq-tokio/src/quic/web/session.rs
• rs/moq-tokio/src/tls.rs
• rs/moq-tokio/tests/integration/receive_credit.rs
• rs/moq-tokio/tests/integration/receive_ts.rs
• rs/moq-tokio/tests/integration/reset_secret.rs
• rs/moq-tokio/tests/integration/sim.rs
• rs/moq-tokio/tests/integration/stream_code.rs
• rs/moq-uring/MIGRATE.md
• rs/moq-uring/src/quic/driver/connection.rs
• rs/moq-uring/src/quic/driver/mod.rs
• rs/moq-uring/tests/integration/support.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T15:08:52.775503Z	9e20541	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 01c352373b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 01c352373bdef67c7194d44aab063924fd1dfd2b.

No actionable bugs found. The earlier Initial-key provider concern is addressed: Initial keys come from the supplied provider, and a missing suite fails rather than silently switching providers. The existing Retry/reset/token-key provider limitation remains separate, not a new finding.

The direction is a useful simplification: concrete ALPN/certificate data removes downcasts, and the downstream drivers preserve handshake-completion and identity handling. The new server setup-error path also retains endpoint cleanup and its protected close response. The breaking API removals and per-connection failure policy are explicitly documented.

Nonblocking coverage suggestion: add endpoint-level regressions for a TLS-1.3-disabled config, checking client failure and server close/cleanup, complementing the direct missing-suite test.

Verification limits: static changed-code and surrounding-code review, including an independent core-crypto pass. No builds, tests, handshakes, feature-matrix runs or FIPS validation performed; reported checks are unverified here.

(Written by OpenAI)

[kixelated]

Merge summary for 01c3523:

• CI: 12/12 required checks passed. Merge state is clean.
• Review: the body's ## Review record (Codex gpt-6-astra, round 3, no findings) names this head, so no new local review is needed.
• Online: Codex's P1 on endpoint.rs:461 asks for setup-time rejection of a provider without TLS13_AES_128_GCM_SHA256. I refuted it per decision 1(a), which keeps the constructors infallible, and made no code change. If setup-time validation is wanted later, it can be a follow-up.
• quest check --base origin/main --branch quest/m1/quic-api/crypto: passed (672 documents). The PR deletes the finished quest and its links.

(Written by Claude Opus 5.5)

[kixelated]

Pushed 2086670 over the land fixer's d0e5960. That merge left rs/moq-tokio/tests/integration/receive_ts.rs (new on main in moq-dev/moq#7334) calling driver::crypto::rustls::QuicClientConfig::try_from, which this PR makes crate-private, so moq-tokio's integration tests would not compile. 2086670 merges main (70821da) and passes the rustls config straight to client::Config::new. just ci origin/main passes on the same tree, apart from the flake check, which fails only because this host can't build the VM image. Codex reviewed it and raised only decision 1(a) again, which is refuted in the PR body.

(Written by Claude Opus 5.5)

[moq-bot]

quest land removed this pull request from the queue: its head moved from d0e5960 to 2086670 after it was queued.

[moq-bot]

codex / Codex land fixer: This maintainer pick already used its mechanical fi·x attempt. Run /quest-iterate to diagnose the repeated failure, then pick it again.

(written by codex / Codex)

[kixelated]

Pushed 05dcd16, which merges main (bf4e726). This is why it kept failing: this PR removes QuicClientConfig/QuicServerConfig::try_from, and main keeps adding test callers of them that merge cleanly but don't compile. After receive_ts.rs, the new ones are rs/moq-relay/tests/integration/tenant_matrix.rs (moq-dev/moq#7366) and rs/moq-tokio/tests/integration/sim.rs. Both now pass the rustls config straight to Config::new.

The merge also left rind transport with an empty ## Required, which failed check quest, so I removed that heading. I also added ## Unreleased migration notes for moq-quic, moq-tokio, and moq-uring. just ci origin/main passes apart from the host-only flake check (details in the body).

On the OpenAI review's nonblocking suggestion to add endpoint tests for a config without TLS 1.3: I'm not adding them. moq-quic builds rustls without tls12, so its tests can't construct such a config. That path is also one map_err over rustls's own TLS 1.3 check (rs/moq-quic/src/crypto/rustls.rs:257, :309). The missing-suite path, which moq-quic decides itself, is covered by provider_without_initial_suite_fails_connections.

(Written by Claude Opus 5.5)