plan: PR-5.0 inner-loop review cycle 1 ACCEPTED (rustls TLS change)

Signed-off-by: "Connor Tsui" <connor@spiraldb.com>

Author: connortsui20

.big-plans/ct__bench-v4.md

@@ -540,7 +540,7 @@ _Step 2 — snapshot acquisition + rebuild (2026-06-10):_
 - **2e safety net** ✓: re-ran `verify` after the cross-check — `0 presence diffs, 0 value mismatches` (the cross-check's 11 UPDATEs were genuine no-ops; the seed is intact). **Step 2 (load + verify + cross-check) is COMPLETE.**
 - **1e Vercel env CONFIRMED wired** (via `https://benchmarks-web.vercel.app/api/health`): `db_path: vortex-bench-prod.c4f8qygk4xdp.us-east-1.rds.amazonaws.com`, `schema_version: 1`, and `row_counts` show the seeded data live (`query_measurements: 4849218`, `commits: 4545`, …). The Vercel project (`BENCHMARKS_WEB_PROD_URL=https://benchmarks-web.vercel.app`, `VERCEL_ORG_ID`/`VERCEL_PROJECT_ID`/`VERCEL_TOKEN` set) deployed successfully today at 17:21 (build_sha `8b85a3d3f`) — but against the then-empty DB and at a stale commit.
 - **Step 3 deploy** — needs a fresh deploy at HEAD: `/api/groups` (the chart-family registry) **timed out (40s)** on the stale `8b85a3d3f` deploy against the 4.85M-row seed; HEAD carries the PR-4.x read-path + cycle-4 web fixes the old deploy lacks. Deploy = push `ct/bench-v4` (37 commits unpushed) → `web-deploy.yml` Vercel prod (uses the GitHub `VERCEL_TOKEN`). **`VERCEL_TOKEN` rotation still owed** (leaked into a transcript) — security follow-up; the deploy functions with the current secret.
-- **Inner-loop review (Step 2.3)**: the rustls TLS change is PR-5.0's only production code → 2-vote gauntlet before close.
+- **Inner-loop review (Step 2.3)** ✓ cycle 1 **ACCEPTED** (2026-06-10): reconstructed 2-vote (fresh + correctness, both claude) on the rustls diff — `Skill(spiral:gauntlet)` was unavailable ("Unknown skill"), so prompts were composed faithfully via gauntlet/0.4.0 `compose_prompts.py` + run as Agent reviewers + synthesized inline (per the task ORCH recipe / big-plans [Z] round-5 pattern). Both lenses ACCEPT, high confidence, 0 must-fix. Correctness skeptic adversarially confirmed: hostname/SAN verification IS enforced, `sslmode=require` does NOT downgrade (libpq footgun N/A to tokio-postgres), empty/bad CA bundle is fail-closed (no MITM exposure of the master password). 1 should-fix (empty-CA-bundle → opaque error, both lenses) applied in `d0175d70c` (loud `bail!`); 1 nit (crypto-provider error-swallow) dismissed. Synthesizer JSON in the `5e049db89` commit body.
 - **Step 4 data checks**: after the fresh deploy. Promoted to the Implementation status PR-5.0 entry at Step 2.5.
 
 ## Implementation status