fix(linux): qualify private Classic QUIC TLS toolchain

.github/workflows/validate.yml

@@ -53,7 +53,7 @@ jobs:
                 classic-vulkan-toolchain.json | \
                 classic-vulkan-toolchain.spdx.json | \
                 classic-vulkan-packages.lock | \
-                toolchains.json | tools/audio/* | \
+                toolchains.json | tools/tests/test_classic_tls.py | tools/audio/* | \
                 tools/build-sdl3-mixer.sh | \
                 tools/install_classic_vulkan_toolchain.py | \
                 tools/require-image-checks.sh | \
@@ -82,6 +82,7 @@ jobs:
                 tools/validate-classic-image.sh | \
                 tools/install_classic_shader_toolchain.py | \
                 tools/tests/test_install_classic_shader_toolchain.py | \
+                tools/tests/test_classic_tls.py | \
                 tools/install_classic_vulkan_toolchain.py | \
                 tools/validate-vulkan-toolchain.sh | \
                 tools/tests/test_install_classic_vulkan_toolchain.py)
@@ -127,6 +128,9 @@ jobs:
       - name: Test Classic shader toolchain installer
         run: python3 -m unittest tools/tests/test_install_classic_shader_toolchain.py
 
+      - name: Test Classic TLS toolchain installer
+        run: python3 -m unittest tools/tests/test_classic_tls.py
+
       - name: Test Classic Vulkan toolchain installer
         run: python3 -m unittest tools/tests/test_install_classic_vulkan_toolchain.py
 

AGENTS.md

@@ -31,6 +31,13 @@
   client. Keep the Linux tool manifests, Classic package lock, non-root version
   checks, and isolated worktree/payload smoke synchronized when changing this
   prerequisite.
+- `linux/tls/manifest.json` owns Classic's private OpenSSL/libcurl cohort at
+  `/opt/atrinik/tls`, shared by broad and slim Linux images. Keep source pins,
+  notices, providers, explicit consumer discovery and runtime search paths
+  coherent; never replace distro TLS packages or globally override their
+  provider/loader configuration. Run its archive tests, upstream QUIC API suite
+  and non-root trusted/untrusted HTTPS/provider smoke. The separately sealed
+  portable producer and Windows MXE contracts remain independent.
 - The public Classic image's shader contract is defined by
   `classic-shader-toolchain.json`: retain the exact DXC/SPIRV-Cross archive and
   source checksums, upstream licenses, and `/usr/local/bin` tool paths. Its

README.md

@@ -467,3 +467,27 @@ Redistributors must retain the pinned source archives, notices, build recipes,
 and Debian source coordinates and satisfy the corresponding-source and LGPL
 replacement/relinking obligations in the contract. Authored game media remain
 `content@main`, resources and sound inputs owned by their respective repositories.
+
+### Classic application TLS
+
+The Linux Classic and broad Linux images carry an application-only TLS prefix at
+`/opt/atrinik/tls`, declared by `ATRINIK_CLASSIC_TLS_PREFIX`. Its
+[`linux/tls/manifest.json`](linux/tls/manifest.json) pins OpenSSL 4.0.3 and libcurl
+8.22.0 source archives. Classic consumers must select this prefix explicitly for
+both OpenSSL and libcurl, and retain its `lib` directory in their runtime search
+path. Copy the complete prefix, including providers and upstream notices, when
+packaging a consumer. The prefix uses the public `SSL_get_peer_addr` API; a build
+against the system OpenSSL 3 package does not provide that capability.
+
+The application libcurl supports HTTP/HTTPS, IDN and zlib. Optional SSH, LDAP,
+GSSAPI, PSL, HTTP/2 and HTTP/3 integrations are disabled in this bounded cohort.
+System tools and Python retain their distribution TLS packages: there is no
+global `LD_LIBRARY_PATH`, `OPENSSL_MODULES` or command-path override. The sealed
+Debian portable producer and Windows MXE toolchain retain their separate pinned
+consumer contracts.
+
+`classic-tls-build` runs the upstream OpenSSL QUIC API tests. Both Linux consumer
+images additionally compile a public API/provider probe and exercise trusted and
+untrusted loopback HTTPS against Python's system TLS stack, without external
+network access. This qualifies the dependency closure; Classic's own tests must
+still prove actual per-connection peer identity and authorization behavior.

classic-toolchain.json

@@ -37,5 +37,12 @@
   "consumer_validation": {
     "repository": "atrinik/classic",
     "commit": "8fec1db157bcfdd050c1ba360e77365bce701bba"
+  },
+  "classic_tls": {
+    "prefix": "/opt/atrinik/tls",
+    "manifest": "/opt/atrinik/tls/share/atrinik/classic-tls.json",
+    "openssl": "4.0.3",
+    "libcurl": "8.22.0",
+    "required_api": "SSL_get_peer_addr"
   }
 }