README.md

SunLitSecurityLibraries — dev guide

Engineer- and security-agent-facing documentation for adopting these libraries in your service. Every page lists what you get, the minimal dependency/config, a copy-paste example backed by a runnable example file, common pitfalls, and cross-references.

Framework adapter guides

• secure_boundary on Actix-web 4 — SecureJson<T>, SecurityHeadersTransform, FetchMetadataTransform.
• secure_authz on Actix-web 4 — AuthzTransform middleware (identity-agnostic).
• secure_device_trust — native-client bootstrap identity, client type/platform, attestation mode, and trust-tier decisions.
• Native device-trust release gate — release blocking via ZeroTrustAuth external conformance.
• secure_errors on Actix-web 4 — AppError → HTTP response via impl ResponseError.

The axum adapters are covered by the per-crate rustdoc and the workspace's ARCHITECTURE.md.

Topic guides

• SSRF prevention with SafeUrl — the full 12-CIDR blocked set, what it does and doesn't cover, integration patterns (serde, direct).
• secure_boundary prompt boundaries — render untrusted Markdown as literal fenced text before adding it to prompts, reviews, or issue comments.
• security_core variant analysis — typed variant-analysis reports for security review evidence and follow-up searches.
• Production deployment checklist — boot-time assertions, CI gates, SSRF, feature-flag hygiene for services shipping to prod.
• Branch protection — live baseline, public-release target, and required checks for GitHub.
• Release process — crates.io packaging order, Sigstore verification, and GitHub hardening checklist.
• Static analysis — Semgrep Rust scanning now and CodeQL code scanning once the repo is public.
• secure_network — TLS policy checks, cleartext URL detection, SPKI certificate pinning, and mTLS edge identity validation.
• secure_resilience — circuit breaker, RASP signal aggregation, app integrity checks, and the TLA+ verification trail.
• secure_privacy — PII classification, HMAC pseudonymization, consent decisions, and retention status checks.
• secure_data PQ guide — hybrid X25519 + ML-KEM-768 v2 envelope key wrap behind secure_data/pq.
• Formal verification — Kani harnesses, TLA+ specs, and the advisory verification lanes.
• ANSSI Rust mapping — 61-rule evidence map pinned to ANSSI 84e6ae18.

How the examples stay honest

Every code block in a dev-guide page that is meant to compile is backed by one of:

• a /// doctest on the public API being shown,
• a matching examples/*.rs file in the crate's examples/ directory,
• an integration or E2E test that constructs the same code.

cargo doc --workspace --no-deps --all-features must build with zero warnings, enforced by CI.

Reference material inside the crates

• Per-crate crate-level docs in crates/*/src/lib.rs (rendered as cargo doc).
• Per-type rustdoc with /// # Examples blocks that run as doctests.
• ARCHITECTURE.md and THREAT_MODEL.md at the repo root for the big picture.