nordisk/holger

Stinky lane 9 — the MVP line redrawn, and feature honesty

Written 2026-09-20 against holger main 542e296 (worktree /home/rickard/git/holger-wt-mvpline, branch stinky/mvpline). Tags: MEASURED = a command was run / a line was read and it is so today. READ = a document or an earlier lane says so, not re-proven here. DESIGNED = proposed here, no code beyond what this branch commits.

This REVISES .nornir/stinky/05-suite-monetize-mvp.md (branch stinky/suite, commit 5eccdaa). It does not replace it: sections A (the suite / reuse audit) and B (monetize) of that document stand unchanged. What is redrawn is its section C — the MVP line — because the premise it drew under was overturned.

0. THE RULING THAT MOVED THE LINE

Owner, 2026-09-20, verbatim:

"MVP behöver inte vara superslim storleksmässigt, men t.ex. inga egui-grejer och annat — funktionell, men inte science fiction. Kanske inte mimir/modgunn inbyggt t.ex."

Lane 5 drew its line under a different premise, and said so in as many words: "MVP's virtue is slimness" (05-suite-monetize-mvp.md, §C.2 preamble). That sentence is now false. Size is no longer the test. The tests are:

T1 and T4 pull in opposite directions and that is deliberate. T4 fixes the outer edge: nothing beyond A→B→C is MVP. T1 fixes the inner edge: nothing inside it may be a sketch. A row is MVP when it is inside T4 and passes T1 and T2. A row that is inside T4 but is a sketch is neither — it is work, not a tier. A row that works but is outside T4 is Pro.

The consequence for lane 5: every row it filed as Pro with size as the argument has to be re-argued on function, and most of them move. Every row it filed as MVP because it was small has to survive T1, and three do not.

1. T3 ANSWERED — mimir and modgunn, investigated not assumed

1.1 mimir — "not built in" is already true, at zero cost (MEASURED)

VERDICT — mimir: neither, and the cost of "not built in" is ZERO. There is no dep edge, no feature, no proto import, nothing to remove. The ruling's "kanske inte mimir inbyggt" is a description of holger as it already is. It is worth saying out loud what the alternative would have cost, so the question is closed rather than re-asked: linking mimir means linking nornir, and holger has no nornir edge at all (05-suite-monetize-mvp.md §A.1, READ) — the modgunn dep exists partly to break that cycle (server/lib/Cargo.toml:136, MEASURED). mimir is the one T3 candidate with no argument on either side.

⚠ One correction to lane 5, which called mimir "~11 000 lines": that is the top-level mimir*.rs files only. The glob is 23 116, and with the bench 29 223. The number does not change the verdict, it strengthens it — mimir is a large subsystem of another product, not a component holger could "include".

1.2 modgunn — "not built in" would cost the product's core verb (MEASURED)

modgunn is the opposite case: it is linked, and it is load-bearing.

So "not built in" has exactly three readings, and they cost three different things:

VERDICT — modgunn: MVP, linked, scan only. Recommend the owner rule (c) explicitly so the question stops being re-opened. One genuine stink survives from lane 5 §A.2 and is NOT a size argument: holger takes modgunn's scanner and compiles OUT its provenance-verify (on by modgunn's own default) while re-implementing DSSE verification in attest.rs over znippy-common. One house, two verifiers of one envelope. That is a T1 failure of attest.rs, not of modgunn — see row AttestationGate in §2.

2. ONE TABLE — every capability → MVP / Pro / neither

Read the columns like this. line is the verdict. why (FUNCTION) never argues from size — if a row's old reason was "too big", it has been replaced. moved? says what lane 5 (05-suite-monetize-mvp.md §C.2) filed it as and why it changed. ⚠ marks a row that is MVP and does not exist yet: inside T4, so it must be built, but a claim that MVP is done while it is absent is false.

2.1 Repository backends — the biggest movement in the table

Lane 5 filed all 15 non-raw/non-rust backends as Pro, with the reason "zero of them are needed for A→B→C; each is attack surface on a zero-egress node". The first half is a T4 argument about the DEMO, not about the product — A, B and C are repositories of some format, and nothing says which. The second half is a size/surface argument, which the ruling retires. So all 15 get re-argued on T1, and MEASURED backend by backend (17 crates, server/repository/*, all non-optional in server/lib/Cargo.toml:42-77):

Three consequences of the backend sweep that are findings in their own right:

1. has_archive() lies on 11 archive-backed backends. Only znippy-rust (lib.rs:495) and znippy-build-thing (:420) override it; maven, python, npm, gem, deb, rpm, helm, conda, composer, docker, go, nuget and package all hold a znippy reader and inherit false from traits/src/lib.rs:352-354. Any caller asking "is this repository archive-backed" gets a wrong answer on 11 of 17 — including the archive_bytes meter lane 5 §B.4 called one of the two honest ones.
2. Serve-time quarantine cannot be switched on at all. Zero of the 17 backends implement coordinate_for_path/maps_paths_to_coordinates; the only implementations in the whole server are raw.rs:430,434 plus the two forwarding wrappers. The source says the consequence out loud — exposed/http.rs:1880-1886 "on every other backend the gate was decorative" — and lib.rs:2040-2060 makes the server refuse to boot when HOLGER_QUARANTINE_PROPERTY is set.
3. Four backends cannot enumerate (composer, docker, go, nuget) and it is the same four that overrode nothing optional at all. "Cannot enumerate" and "wrote the bare minimum" coincide exactly, which is a good smell test for the next backend somebody adds.

2.2 Everything else

2.3 The headline, and what it costs

MVP is now BIGGER than lane 5 drew it and SHORTER on promises.

• In, that was out: 14 repository backends (every one that a real client can install from), the group backend. Reason: they work, and size is not the test.
• Out, that was in: the egui ui-mini rung (T2, and it already left the repo), the trait Gate seam, the AttestationGate/Attach RPC, per-verdict DSSE + VSA, holger.repo-metadata/v1 — every one of them absent or unreachable (T1). And the quarantine predicate, which the server refuses to boot with.
• Neither, i.e. work that must not be called a tier: znippy-nuget, znippy-composer, holger-remote, PromoteSet.
• ⚠ MVP rows that do not exist: the audit query surface, and — the one that matters — promotion resolving to_repo to a repository something serves.

The measured consequence of the first bullet: mvp-server is 392 crates today with all 17 backends already compiled in (they are non-optional). So admitting them costs nothing — they were always there. What lane 5 proposed (slice 8: make 15 backends #[cfg]-optional and re-measure) is now withdrawn as a slimming exercise, and survives only in the narrow form RULE 1 demands: marketplace must become optional because no variant names it, not because it is big.

3. THE CLEANUP — a benchmark crate stops deciding what ships

3.1 The defect, stated once

bench is in holger's default feature set (server/cli/Cargo.toml:126, MEASURED), and bench = ["dep:bench-scenarios"] (:166) pulls holger-bench-scenarios as an optional NORMAL dependency (:99). A normal dependency's feature choices unify into the binary's graph. So a benchmark crate's manifest has written itself into the production binary three times:

⚠ Correction to the brief. The brief said bench-scenarios/Cargo.toml:76 "lacks default-features = false" on the server-lib edge. MEASURED: :62 (the server-lib edge) already carries it — that was fix 1, with a 16-line comment explaining exactly this hazard. The line that lacks it is :76, reqwest. The comment at :49-56 proves the author understood the mechanism and then missed the crate one screen below.

3.2 MEASURED — what each step removes

Resolved with cargo tree -p holger --edges normal --prefix none, deduplicated by crate name, in /home/rickard/git/holger-wt-mvpline.

⚠ auth-passkey must STAY on the bench edge, and it took a compile on loki to learn it. The first pass dropped it with online/auth-oidc/auth-oauth2. MEASURED, cargo check -p holger-bench-scenarios --features served,… on loki:

error[E0560]: struct `GatewaySettings` has no field named `passkeys`
error: could not compile `holger-bench-scenarios` (lib) due to 1 previous error

bench-scenarios/src/served.rs:153 sets passkeys: None, and that field is #[cfg(feature = "auth-passkey")] — which the manifest comment at :57-61 already said in as many words, and which the first pass removed anyway. Restored (commit cd5c1f0); the crate count is unchanged at 414, because auth-passkey is named by cli's default (:126) since 542e296 and by the two MVP rows, so it costs the shipped graph nothing.

This is the rule of §3.3 applied to the bench itself: a benchmark asks for what it needs IN ITS OWN MANIFEST, and nothing more. auth-passkey it needs; online, auth-oidc, auth-oauth2 it never touched.

GREEN, MEASURED on loki at 9d4bc1f, all seven bench features at once — cargo check -p holger-bench-scenarios --features served,nexus,artifactory,promote-ledger,retention-planner,audit-append,secure-update → Finished dev profile in 48.10s, 0 errors. The benches still compile, and the shipped binary is 17 crates lighter. That is the whole bargain of §3.3: the fix must not kill the benches, and the benches must not decide what ships.

21 crates arrive in the shipped server through that one edge, and the whole 21 is exactly the difference between the brief's claim and the measurement. For comparison, the rows that never enable bench: mvp-server = 392 crates, mini = 385, full = 421. Every one of those greps ^(reqwest|ureq|openssl) to 0 for mvp-server and mini — the airgap tiers were never touched. Binary size, MEASURED earlier and not re-measured here (READ): holger-server default 39 251 408 B, appliance holger-mvp 32 875 720 B.

3.3 THE OWNER'S FIX — holger-bench-scenarios is a DEV DEPENDENCY

Owner, 2026-09-20: "den skall vara dev-beroende, dvs aldrig in i slutbinären!!"

This is stronger than the feature fix and it is the right one, because it closes the class instead of the instance. A normal dependency can unify into a shipped graph no matter how carefully its features are spelled; a dev-dependency cannot — cargo never resolves dev-dependencies for a lib/bin build.

Where the move applies (MEASURED, every declaration in the repo):

LANDED — the baseline was captured on stinky/bench a5ef6e6 (merged into this branch), and the move is commit 7a618e0. What it did:

• server/cli's bench-scenarios moved to [dev-dependencies]; the bench feature is deleted from [features], from default and from full.
• ⚠ auth-oidc and auth-oauth2 had to be NAMED in the same commit. The bench crate's server-lib pin was the only declaration of either in the whole graph, so dropping bench would have deleted two authentication doors from holger-server silently, with nothing red to say so — the passkey accident again, the same edge pointing the other way. They are now passthrough features of server/cli and named in default. MEASURED correction to the warning as received: auth-bearer and auth-mtls were NOT at risk — they arrive through mini (server/lib/Cargo.toml mini = ["auth-bearer", "auth-mtls"]), not through the bench edge. Two doors, not three.
• The holger-ds verb moved verbatim to bench-scenarios/examples/holger_ds.rs ([[example]] required-features = ["served"]; clap added as a dev-dependency so the library half grows no argument parser).
• server/repository/znippy-rust/tests/bench_nexus_container.sh deleted — 237 lines of bash (curl per REST call, awk on /proc, sleep polling, trap cleanup EXIT), referenced by nothing, superseded by nexus.rs + artifactory.rs + served.rs. Pure Rust, no shelling.

MEASURED after the move, cargo tree -p holger --edges normal:

GREEN on loki at 7a618e0, four checks, all exit 0: cargo check -p holger (the default binary), cargo check -p holger-bench-scenarios --features served --example holger_ds (the rehomed verb), cargo check -p xtask --example nornir-bench (the bench driver, RULE 3), and cargo check -p holger --no-default-features --features mvp-server,appliance,auth-passkey (the appliance row). Zero errors.

Net −14, not the −21 of §3.2's ladder, because 7 of those crates (nornir-auth-oidc, nornir-auth-oauth2, oauth2, jsonwebtoken, simple_asn1, pem, serde_path_to_error) are now kept by declaration instead of by accident. That is the point: the binary barely changed, the declaration became true, and no benchmark crate can move it again. The benches stay runnable, and under this design they do: bench-scenarios keeps its own normal dependency on server-lib with its own explicit feature list, because bench-scenarios is not a shipped member. A bench that needs a feature the server does not ship asks for it in its own manifest, which is the whole point.

3.4 What bench was FOR, and where it goes (do not silently drop it)

bench is not a fixture switch. It gates a real, user-facing CLI verb:

• server/cli/src/main.rs:124-125 — #[cfg(feature = "bench")] HolgerDs(HolgerDsArgs), documented at :118-123 as "Artifact-delivery benchmark (holger-ds): build a synthetic crate corpus sized from --scale and the free disk on --data, serve it over Holger's native HTTP door, and bombard it with a parallel GET pool".
• Its knobs: --scale, --preset micro|small|large (:540-561), --data, --target <url> (bench an EXTERNAL Nexus/Artifactory over the real protocol), --eco crate|pip (:564-600).
• Dispatch at :1379, implementation :2204-2213, import :45-48.

So holger-server holger-ds … exists today and somebody may be typing it. It cannot survive as a subcommand of the shipped binary — that is exactly the thing the ruling forbids. Three places it could go:

Consequences to write down, because they are visible:

1. full's declared feature list loses bench (holger-recipe/src/variants.rs — the full row names &["full", "front"]; bench arrives through the full CLI feature at server/cli/Cargo.toml:171). holger-full shrinks by the same 21 crates.
2. cli default loses bench (:126).
3. The invocation changes from holger-server holger-ds --scale N to holger-ds --scale N. That is a release note, not a silent edit.
4. holger-recipe/src/rules.rs's doc comment for AIRGAP_TIERS (:95-102) says server-local is excluded because "its default feature set carries online + bench". After this move that sentence is half wrong — online still, bench no longer. §4.3 replaces the mechanism anyway.

4. THE RULES THAT PREVENT THE FOURTH OCCURRENCE

Three fixes so far, three commits, zero tests. The pattern that produced all three is the same: a feature reached a shipped artifact without any variant naming it. So the rule is the inverse, and it is mechanical.

4.1 RULE 1 — every feature in a shipped artifact must be NAMED by its variant

A feature is named when its enablement chain starts at something the variant declared: a feature in the row's features list, or the package default set when the row has no_default_features = false. A feature is a rider when its chain starts at a bare dependency edge — a features = [...] on some [dependencies] line that no row ever asked for.

cargo shows the distinction directly. MEASURED, mvp-server row:

$ cargo tree -p holger --no-default-features \
    --features mvp-server,appliance,auth-passkey -e features -i holger-server-lib

holger-server-lib v0.6.10 (…/server/lib)
├── holger-server-lib feature "auth-bearer"
│   └── holger-server-lib feature "mini"
│       └── holger feature "mini"
│           └── holger feature "mvp-server" (command-line)   ← NAMED
├── holger-server-lib feature "auth-mtls"
│   └── holger-server-lib feature "mini" (*)                            ← NAMED
├── holger-server-lib feature "auth-passkey"
│   └── holger feature "auth-passkey" (command-line)         ← NAMED
├── holger-server-lib feature "mini" (*)                                ← NAMED
├── holger-server-lib feature "sign"
│   └── holger v0.6.10 (…/server/cli)                        ← RIDER: the parent is a CRATE, not a feature
│       ├── … (command-line)
└── holger-server-lib feature "znippy-common"
    └── holger-server-lib feature "sign" (*)                            ← RIDER, transitively

sign is named by NO variant in any row — it rides in on server/cli/Cargo.toml:71 server-lib = { …, default-features = false, features = ["sign"] }, and the comment on :69-70 even says so out loud: "sign (CMS provenance verify) rides in on every tier." It pulls znippy-common with it. Every one of holger's four server rows ships CMS provenance verification and not one of them declares it. MEASURED, all four rows:

What the test would have said about the three past leaks

The test, sketched (DESIGNED)

Pure Rust, no shelling — the existing guard (build-space/src/lib.rs:660-666) runs Command::new(env!("CARGO")), which is the one place holger's own law is bent, and it skips silently when cargo is absent (auth_ship_small.rs:117), so a cargo-less CI passes it vacuously. This test reads the manifests with toml (a dev-dependency of holger-recipe) and computes the closure itself, so it is total, offline, and works in the wasm sandbox the build thing already targets.

// holger-recipe/tests/feature_honesty.rs
//
// RULE 1: every feature present in a shipped artifact must be NAMED by its variant.
//
// "Named" = the feature's enablement chain begins at something the ROW declared:
//   * a feature in `BuildVariant::features`, or
//   * the member package's `default` set, when `no_default_features == false`.
// "Rider" = the chain begins at a bare [dependencies] edge's `features = [...]`.
// A rider is a feature the BUILD DECLARATION does not know it is shipping, and
// every one of holger's three feature leaks was a rider.

use std::collections::{BTreeMap, BTreeSet};

/// A package's feature table + its dependency edges, parsed from Cargo.toml.
struct Manifest {
    /// feature name -> the `["dep:x", "other/feat", "sibling-feature"]` list
    features: BTreeMap<String, Vec<String>>,
    /// package name -> (default_features, explicit features, kind)
    deps: BTreeMap<String, DepEdge>,
}
struct DepEdge {
    default_features: bool,
    features: Vec<String>,
    optional: bool,
    kind: DepKind, // Normal | Dev | Build  <- RULE 2 reads this
}

/// The whole workspace, keyed by package name. Parsed ONCE, no cargo, no process.
fn workspace() -> BTreeMap<String, Manifest> { /* toml::from_str over members */ }

/// Features of `target_pkg` reachable from `roots` of `entry_pkg`, following
/// ONLY the feature table and `dep/feature` implications — i.e. what the ROW asked for.
fn declared_closure(
    ws: &BTreeMap<String, Manifest>,
    entry: &str,
    roots: &[String],
    target: &str,
) -> BTreeSet<String> { /* … */ }

/// Everything cargo will actually enable on `target_pkg`: the declared closure
/// UNION every non-optional (or feature-activated) dependency edge's own
/// `features = [...]` and `default` set, transitively. `kind == Dev` edges are
/// SKIPPED — that is precisely why the §3.3 move is the structural fix.
fn resolved_closure(
    ws: &BTreeMap<String, Manifest>,
    entry: &str,
    roots: &[String],
    target: &str,
) -> BTreeSet<String> { /* … */ }

/// Riders the owner has seen and accepted, each with a reason. EMPTY is the goal.
/// A row here is a decision on the record, not a silence.
const ACCEPTED_RIDERS: &[(&str, &str, &str)] = &[
    // (variant, feature, reason) — nothing is accepted today; `sign` is RED on purpose.
];

#[test]
fn every_shipped_feature_is_named_by_its_variant() {
    let ws = workspace();
    let set = holger_recipe::declared();
    let mut complaints = Vec::new();

    for v in set.variants.iter().filter(|v| v.ships()) {
        let entry = v.member_package();          // e.g. "holger"
        let mut roots = v.features.clone();
        if !v.no_default_features {
            roots.extend(ws[entry].features["default"].clone());
        }
        // Judge EVERY package in the closure, not just server-lib: `sign` lives in
        // server-lib, but the OpenSSL leak lived in `reqwest`'s feature table.
        for target in closure_packages(&ws, entry, &roots) {
            let named  = declared_closure(&ws, entry, &roots, &target);
            let actual = resolved_closure(&ws, entry, &roots, &target);
            for rider in actual.difference(&named) {
                if ACCEPTED_RIDERS.iter().any(|(rv, rf, _)| *rv == v.name && rf == rider) {
                    continue;
                }
                complaints.push(format!(
                    "variant '{}' ships {target} feature \"{rider}\", which NO variant \
                     declares. It is enabled by a dependency edge, not by the build \
                     declaration. Either name it on the row, or make the edge stop \
                     enabling it (`default-features = false`, or a dev-dependency).",
                    v.name
                ));
            }
        }
    }
    assert!(complaints.is_empty(), "feature riders:\n  {}", complaints.join("\n  "));
}

This test is RED on main today (sign, znippy-common, five rows). That is the correct starting state: the first commit that makes it green is the commit that decides whether sign belongs on the rows or on nobody's. Owner decision needed — see §5.

4.2 RULE 2 — no shipped binary may normal-depend on a bench/test/fixture crate

RULE 1 catches a leak once it exists. RULE 2 forbids the edge that makes the class possible, which is the owner's ruling generalised.

/// Crates whose reason to exist is a test, a benchmark or a fixture. A SHIPPED
/// member may depend on these only as [dev-dependencies]: cargo never resolves
/// a dev-dependency for a lib/bin build, so such an edge cannot unify a single
/// feature into a shipped graph. This is the rule the owner set on 2026-09-20,
/// in as many words: "den skall vara dev-beroende, dvs aldrig in i slutbinären".
const NOT_IN_A_SHIPPED_BINARY: &[&str] = &[
    "holger-bench-scenarios",
    "nornir-testmatrix",
    "testcontainers",
    "criterion",
    "holger-marketplace-mock",
    "holger-mannequin",
];

#[test]
fn no_shipped_binary_normal_depends_on_a_bench_or_test_crate() {
    let ws = workspace();
    let set = holger_recipe::declared();
    // Every package a shipped row can reach through NORMAL edges only.
    let shipped: BTreeSet<String> = set.variants.iter()
        .filter(|v| v.ships())
        .flat_map(|v| normal_closure_packages(&ws, v.member_package()))
        .collect();

    let mut complaints = Vec::new();
    for pkg in &shipped {
        for (dep, edge) in &ws[pkg].deps {
            if edge.kind == DepKind::Normal && NOT_IN_A_SHIPPED_BINARY.contains(&dep.as_str()) {
                complaints.push(format!(
                    "'{pkg}' is reachable from a shipped variant and declares '{dep}' as a \
                     NORMAL dependency{}. A bench/test crate's manifest must never be able \
                     to unify features into a shipped graph — move it to [dev-dependencies].",
                    if edge.optional { " (optional — which does NOT help: a default feature turns it on)" } else { "" }
                ));
            }
        }
    }
    assert!(complaints.is_empty(), "{}", complaints.join("\n"));
}

RED on main today, and it finds MORE than the owner named (MEASURED):

The nornir-testmatrix rows are the fourth occurrence waiting to happen: an optional normal dep of a shipped binary, whose feature list can unify at any time. That is the whole value of writing the rule instead of the fix.

4.3 RULE 3 — the bench drivers must BUILD, or the numbers are unreproducible

Cheap, and it would have caught a failure nobody saw for weeks. MEASURED by the baseline lane: cargo build --release -p xtask --example nornir-bench failed at HEAD with 10× E0063 — nornir-bench 0.1.8 added a field and holger builds that struct by literal at ten sites. Nobody had built it, because an --example of a publish = false xtask is built by nothing in the normal flow.

The reason nothing caught it is worth writing down on its own: holger's only CI workflow is cargo audit. MEASURED — .forgejo/workflows/security.yml is the single workflow in the repo, and its own comment says "no cargo build, no cargo test, and no cargo deny" (:12-13). .github/ contains one Markdown file. So the house has no gate that compiles anything, which is the same reason the three feature leaks of §3.1 each had to be found by hand, after the fact, on a deployed binary.

/// Every driver that produces a number the house PUBLISHES must compile. An
/// `--example` on a `publish = false` crate is built by nothing in the normal
/// flow, so its rot is silent until someone tries to reproduce a benchmark.
const BENCH_DRIVERS: &[(&str, &str, &[&str])] = &[
    ("xtask",                  "nornir-bench", &[]),
    ("holger-bench-scenarios", "holger_ds",    &["served"]),
    ("holger-bench-scenarios", "secure_update_bench", &["secure-update"]),
];

One line per row in whatever gate exists:

cargo build -p xtask --example nornir-bench
cargo build -p holger-bench-scenarios --example holger_ds --features served

4.4 The egress judge — no row may be exempted SILENTLY

holger_recipe::rules::judge_artifact ends like this (rules.rs:399-413, MEASURED):

    if links_no_http_client(variant) { /* airgap: refuse any forbidden client */ }
    if variant == FEDERATING_TIER    { /* full: refuse the ABSENCE of a client */ }
    Verdict::ok()          // ← every other row. No statement. No record. No reason.

AIRGAP_TIERS is ["embedded", "mini", "mvp-server"] (:102) and FEDERATING_TIER is "full" (:106). server-local — holger-server, the binary the systemd unit stages — matches neither, so it falls to the bare Verdict::ok(). That is the row OpenSSL got into. The judge did not fail to notice; it was never asked. The doc comment at :95-102 explains the exemption in prose ("server-local is deliberately NOT here … its VERBS are local while its LINK is not") — prose is not a verdict, and prose does not appear in a build log.

DESIGNED — make the posture a TOTAL function of the declared variant set.

/// What a variant is ALLOWED to reach. Every declared variant must map to exactly
/// one of these — the mapping is TOTAL and a test proves it, so a new row cannot
/// be born unjudged.
pub enum EgressPosture {
    /// Provably unable to phone home: no outbound HTTP client in the closure.
    NoEgress,
    /// Federates by design: the ABSENCE of a client is itself a refusal.
    Federates,
    /// Reaches the network, on the record. `reason` is printed in every verdict,
    /// and `allowed` is the exhaustive list of clients this row may link — so a
    /// row that gains a NEW client (the OpenSSL path: `native-tls`) is refused
    /// even though the row was already allowed to have `reqwest`.
    Egress { reason: &'static str, allowed: &'static [&'static str] },
}

pub fn posture(variant: &str) -> Option<EgressPosture> { /* declared per row */ }

#[test]
fn every_declared_variant_has_a_posture() {
    for v in crate::declared().variants {
        assert!(posture(&v.name).is_some(),
            "variant '{}' declares no egress posture. A row that has never been \
             judged is not a row that passed.", v.name);
    }
}

and judge_artifact loses its fallthrough:

    match posture(variant) {
        None => Verdict::refuse(format!(
            "'{variant}' has no declared egress posture — an UNJUDGED artifact is \
             not an approved artifact")),
        Some(NoEgress)  => { /* as today */ }
        Some(Federates) => { /* as today */ }
        Some(Egress { reason, allowed }) => {
            let unexpected: Vec<_> = facts.linked_crates.iter()
                .filter(|c| FORBIDDEN_OUTBOUND_CLIENTS.contains(&c.as_str()))
                .filter(|c| !allowed.contains(&c.as_str()))
                .collect();
            if unexpected.is_empty() {
                Verdict::ok_with(format!("'{variant}' reaches the network: {reason}"))
            } else {
                Verdict::refuse(format!(
                    "'{variant}' may reach the network ({reason}) but links \
                     UNDECLARED client(s): {unexpected:?}"))
            }
        }
    }

Two more things the judge should learn, both measured by this lane:

1. FORBIDDEN_OUTBOUND_CLIENTS (rules.rs:90-91) does not contain a TLS backend. The OpenSSL leak brought native-tls, tokio-native-tls, hyper-tls, openssl-sys — and the judge would have said ok to all four, because none of them is an HTTP client. Add a second list, FORBIDDEN_TLS_BACKENDS = ["native-tls", "openssl-sys", "openssl", "hyper-tls", "tokio-native-tls", "schannel", "security-framework"], applied to every row including full: holger's declared TLS story is rustls everywhere (server/lib/Cargo.toml:121, agent/lib/Cargo.toml:35), and a native backend in any row is a drift, not a tier difference.
2. judge_artifact refuses an empty closure by name already (:371-375, "an UNMEASURED zero-egress claim is not a zero-egress claim") — which is the right instinct, applied to one field. posture() extends the same instinct to the whole row set.

5. WHAT NEEDS THE OWNER

6. SEQUENCE (DESIGNED — the order that keeps every step landable)

1. ⏸ Wait for the benchmark-baseline lane on loki to confirm capture. Nothing below changes main until then. (The reqwest fix is fa78200, on this branch only.)
2. bench-scenarios → [dev-dependencies] in server/cli and xtask; delete the bench feature from server/cli (:166, :126, full at :171); move the holger-ds verb to a [[bin]] in bench-scenarios. Re-run the benches, compare to the baseline. MEASURED expectation: holger-server 431 → 410 crates.
3. RULE 2 as a test (§4.2). It goes green on step 1 for bench-scenarios and stays RED on the three nornir-testmatrix edges — land it with those three named in a PENDING list that has a date, not an exemption that has none.
4. RULE 1 as a test (§4.1). RED on sign until owner question 1 is answered.
5. posture() + the total-mapping test + FORBIDDEN_TLS_BACKENDS (§4.4). Plus RULE 3 (§4.3), two lines. judge_artifact loses its fallthrough.
6. marketplace becomes #[cfg(feature = "marketplace")], off on every row that does not name it — demanded by RULE 1, not by size.
7. seal(&Repository, …): a promotion into a repository that does not exist becomes NOT_FOUND; flip the expectation of promote/mod.rs:812-826. Then Holger::fetch serves the promoted store. This is the ⚠ that makes A→B real.
8. AuditService.Query(ident?, repo?, action?, since) over ArrowIpcAuditLog::read_dir, ADMIN-gated. This is the ⚠ that makes "what does C have" answerable.
9. Owner question 4; only then the holger-remote work or the courier work.
10. Pro slice 0: merge ONE of the two metering branches (lane 5 §B.5).

7. THE FIVE WORST FINDINGS OF THIS LANE

1. A benchmark crate has decided the production binary's contents three times, and the third time it was native OpenSSL in a binary whose declared TLS story is rustls everywhere. The recipe's egress judge could not have caught it twice over: server-local falls through judge_artifact to a bare Verdict::ok() (rules.rs:413), and FORBIDDEN_OUTBOUND_CLIENTS (:90-91) lists no TLS backend. MEASURED.
2. sign is shipped by every holger server row and declared by none — the oldest rider, server/cli/Cargo.toml:71, whose own comment says "rides in on every tier". The build declaration has never been true. MEASURED.
3. Serve-time quarantine cannot be turned on at all: zero of 17 backends implement coordinate_for_path, the source calls the gate "decorative" (exposed/http.rs:1880-1886), and the server refuses to boot if you configure it (lib.rs:2040-2060). It was scored MVP. MEASURED.
4. znippy-composer is a sketch with no marker: a 2-line hand-written packages.json (lib.rs:81-88) and no metadata builder anywhere in the crate, compiled non-optionally into every binary. There is no todo!() under server/repository/ at all, so grep would never have found it — and znippy-nuget says in its own comments that dotnet restore does not resolve (lib.rs:119-128). MEASURED.
5. The line moved a long way and the previous line was drawn on the wrong axis. 14 backends were filed Pro for being surface; they are complete, tested protocol implementations that were already in the binary. Meanwhile five rows were filed MVP for being small and do not run. Both errors come from the same habit: scoring a capability by what it costs instead of by whether it works.

Written on branch stinky/mvpline. Nothing in /home/rickard/git/holger was checked out, branched or committed; all work is in the worktree /home/rickard/git/holger-wt-mvpline. No git stash, no git add -A, no repo-wide cargo fmt; explicit pathspecs only.