deps: rustls 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)

[aien-spark]

Bumps rustls from 0.23.45 to 0.23.46 to pick up four RustSec fixes. Cargo.lock only: no Cargo.toml or source changes (crumb metadata recompiled where the repo checks crumbs).

Advisories fixed (all affect 0.23.45, patched in >= 0.23.46)

• RUSTSEC-2026-0346: the Debug output of some rustls types could print TLS secrets into logs.
• RUSTSEC-2026-0347: after an ECH (Encrypted Client Hello) rejection, buffered application data could be sent to the outer (public) server.
• RUSTSEC-2026-0348: Brotli certificate decompression could allocate up to 1 GiB before the peer was authenticated.
• RUSTSEC-2026-0349: an unauthenticated ServerHello could downgrade later connections to classical (non post-quantum) key exchange.

rustls-webpki stays at 0.103.15, which satisfies 0.23.46's ^0.103.14 and is clean.

Evidence

• Crate drift: Cargo.lock package list vs main: 1 change, rustls 0.23.45 -> 0.23.46; cargo tree --workspace -e normal,build diff: only rustls lines changed
• Build: cargo build --workspace --locked PASS
• Tests: cargo test --workspace --locked -- --test-threads=1 (the AEGIS-TEST gate command): 158 passed, 0 failed, 0 ignored across 14 test binaries
• Crumbs: recompiled with tools/crumb from aien-architecture @ 94fffbcf88492c5a1c54211b5126c8a6c370a98d (pin in aien-verification.yml); crumb verify . OK (13 crumbs) on unchanged main and on this branch; crumb commit is last
• Note: built against a fresh sibling clone of aien-protocols main (4b76f7f), as the hosted job does.

🤖 Generated with Claude Code

[github-actions]

⚖️ Sovereign Code Review & Alignment Gate

Greetings @aien-spark. I am AIEN, the automated review gate for the AIENOS project.

Your pull request #66 ("deps: rustls 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)") has undergone automated auditing against the project standards.

✅ Doctrine Diff Audit: PASS

• Telemetry Check: Clean (zero tracking or surveillance hooks detected).
• Sovereign Voice & Formatting Check: Clean (zero em/en dashes, zero banned buzzwords).
• Secrets & Credentials Check: Clean (zero plaintext secrets, hardware vault only).
• Status: Project standards verified.

---

🌿 Sovereign Steward: Contributor Alignment Interview

Greetings @aien-spark. I am AIEN, the automated steward for the AIENOS project.

We welcome all contributors who share our commitment to open collaboration, global humanity, and disciplined systems craftsmanship. We build to expand computing capability, advance open-source intelligence, and share technology freely with the world.

Your pull request #66 ("deps: rustls 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)") is ready for stewardship alignment.

Please respond directly to these four alignment inquiries:

1. Long-Term Mission Alignment:
   This initiative is an enduring engineering commitment to open-source technology for humanity, not a vehicle for short-term hype, social media monetization, or get-rich-quick ventures. How does your contribution support global progress and the resilience of local communities?

2. Telemetry & Integrity:
   Do you certify that this change introduces zero telemetry, zero surveillance, and zero artificial paywalls?

   "I certify that my contribution is submitted in service of human sovereignty and open collaboration. I affirm that this work maintains zero telemetry, contains no surveillance backdoors, and introduces no artificial barriers, and that I offer it under AGPL-3.0-or-later, the license that governs this project. I build so that intelligence is owned by the person who runs it, not rented."

3. Downstream Heritage Preservation:
   Do you acknowledge and agree that any downstream branch, fork, or copy of this work remains under AGPL-3.0-or-later and retains the project's license and attribution notices, as the LICENSE file requires?

4. Craftsmanship & Native Discipline:
   What architectural trade-offs did you make, and how did you verify that this code introduces zero regressions, zero unneeded dependencies, and complies with our pure native compiled standards?

---

Reply to this comment with your affirmation. Once verified against the project standards, I will grant the sovereign-interview-passed clearance. For direct sovereign coordination: Drake Stapleton ([email protected]) and AIEN ([email protected])

[github-actions]

⚖️ Sovereign Code Review & Alignment Gate

Greetings @aien-spark. I am AIEN, the automated review gate for the AIENOS project.

Your pull request #66 ("deps: rustls 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)") has undergone automated auditing against the project standards.

✅ Doctrine Diff Audit: PASS

• Telemetry Check: Clean (zero tracking or surveillance hooks detected).
• Sovereign Voice & Formatting Check: Clean (zero em/en dashes, zero banned buzzwords).
• Secrets & Credentials Check: Clean (zero plaintext secrets, hardware vault only).
• Status: Project standards verified.

---

🌿 Sovereign Steward: Contributor Alignment Interview

Greetings @aien-spark. I am AIEN, the automated steward for the AIENOS project.

We welcome all contributors who share our commitment to open collaboration, global humanity, and disciplined systems craftsmanship. We build to expand computing capability, advance open-source intelligence, and share technology freely with the world.

Your pull request #66 ("deps: rustls 0.23.46 (RUSTSEC-2026-0346/0347/0348/0349)") is ready for stewardship alignment.

Please respond directly to these four alignment inquiries:

1. Long-Term Mission Alignment:
   This initiative is an enduring engineering commitment to open-source technology for humanity, not a vehicle for short-term hype, social media monetization, or get-rich-quick ventures. How does your contribution support global progress and the resilience of local communities?

2. Telemetry & Integrity:
   Do you certify that this change introduces zero telemetry, zero surveillance, and zero artificial paywalls?

   "I certify that my contribution is submitted in service of human sovereignty and open collaboration. I affirm that this work maintains zero telemetry, contains no surveillance backdoors, and introduces no artificial barriers, and that I offer it under AGPL-3.0-or-later, the license that governs this project. I build so that intelligence is owned by the person who runs it, not rented."

3. Downstream Heritage Preservation:
   Do you acknowledge and agree that any downstream branch, fork, or copy of this work remains under AGPL-3.0-or-later and retains the project's license and attribution notices, as the LICENSE file requires?

4. Craftsmanship & Native Discipline:
   What architectural trade-offs did you make, and how did you verify that this code introduces zero regressions, zero unneeded dependencies, and complies with our pure native compiled standards?

---

Reply to this comment with your affirmation. Once verified against the project standards, I will grant the sovereign-interview-passed clearance. For direct sovereign coordination: Drake Stapleton ([email protected]) and AIEN ([email protected])