chore: pin mcpp 0.0.109, hoist the compat index redirect, fix compat.openssl (#125)

* chore: pin mcpp 0.0.109, hoist the compat index redirect, fix compat.openssl

## mcpp 0.0.109 (MCPP_VERSION + index.toml floor)

0.0.109 makes a bare dependency take BOTH halves of its wire address from the
descriptor the identity gate accepted (mcpp#286). That is the client-side other
half of the SPEC-001 short-name migration (#120): mcpp used to take the name
from the descriptor and the namespace from the request, so a bare `gtest =
"1.15.2"` addressed `mcpplibs:gtest`, a key no index has. It survived only on a
hardcoded `compat.<short>` retry that the short names removed — leaving every
bare request against this index broken on 0.0.108. min_mcpp moves with the pin
so consumers get a client that can address the index they are handed.

## [indices]: hoisted to the workspace root

The 13 members that consume `compat` no longer repeat `[indices] compat =
{ path = "../../.." }`; the root declares it once and they inherit it, with the
relative path resolved against the workspace root (mcpp#224, 0.0.97).

Exactly one entry, and `compat` specifically, because the table is keyed by
NAMESPACE:

  * declared under a name no dependency asks for, the index is never
    registered and resolution silently falls through to the published remote
    index — the checkout under test is then not what is being tested;
  * declared under several namespaces it registers N separate project repos,
    and every lookup afterwards fails with an N-way ambiguity between what is
    physically one descriptor (mcpp#238 / xlings#374).

Members needing another namespace keep their own declaration, which REPLACES
the inherited table rather than merging — which is what holds each member to
one project index repo. mcpp.toml and index.toml also join the workflow's
paths filter; a change to either can break every member and neither gated a
run before.

## compat.openssl

`name`: `compat.openssl` -> `openssl`. It was the index's last legacy
fully-qualified spelling (SPEC-001 §3.2).

`./config` now passes `--libdir=lib`. Unset, OpenSSL derives the install libdir
as `lib$target{multilib}` and `linux-x86_64` declares `multilib => "64"`, so
the archives landed in $prefix/lib64 while `-Llib` and the post-build check
looked at $prefix/lib. linux-aarch64 and both darwin64 targets declare no
multilib and resolve to plain `lib` — which is how this validated on an arm64
Mac while being broken for every x86_64 Linux consumer. Reproduced against the
published descriptor before fixing: the install tree came out as bin/ include/
lib64/ and install() failed its own archive check.

Also: linux links `-l:libssl.a -l:libcrypto.a` (naming the archive rather than
letting the driver resolve a name a shared object would win — one stray -L
ahead of ours and the consumer picks up the host libssl.so.3) plus `-ldl
-lpthread` for musl and pre-2.34 glibc; the build log moved into the install
prefix, since the old spot was deleted mid-build by the very os.tryrm that
preceded install; `RANLIB=/usr/bin/ranlib` is confined to macOS, the platform
whose llvm-ranlib rejects `-c`; a redundant `os.cd` that would have broken the
relative-srcroot fallback is gone; and install() probes for `perl` up front,
since OpenSSL's ./config IS a Perl script and no xim:perl exists to declare.

## Two members for it

`tests/examples/openssl` — direct dependency, inherits the root `compat`
redirect, so the descriptor in this checkout is what gets built. Asserts both
archives really link (SSL_CTX_new + EVP sha256) and the binary carries no
dynamic ssl/crypto dependency.

`tests/examples/asio-ssl` — the asio `ssl` feature end-to-end, a real TLS
handshake over loopback. It declares no member-level [indices] on purpose:
inheriting `compat` means asio resolves from the published index while its
feature dep, compat.openssl, comes from this checkout — which is how an
unmerged compat descriptor can be exercised through a published consumer.

The test moved out of asio-module, where it had been guarded by
MCPP_FEATURE_SSL. A feature's `defines` apply to the package's own TUs, not to
consumers, so that file compiled to nothing and passed while asserting
nothing — the reason the libdir bug reached main green. It now keys off
HAVE_ASIO_SSL, which the member sets in its own cfg-gated cxxflags.

## Docs

docs/package-types.md still taught `name = "compat.<lib>"`. README, the
repository/schema doc (new "索引重定向" section, corrected `features` row) and
the openssl design spec are updated to match what the code does.

* fix(openssl): declare xim:make on macosx, and print the log tail on failure

The macOS workspace job failed on both new members ~43s after the tarball
landed — far too early for a compile, and with nothing to go on: install()
writes everything to an on-disk log (xim's interface mode swallows subprocess
stdout) and xlings surfaces the failure as a bare
`E_INTERNAL: [openssl] failed:`.

Two changes, one for the likely cause and one so the next failure says what it
was.

macosx now declares `deps = { "xim:make@latest" }`. The previous comment
claimed it was unnecessary because "macOS ships GNU Make at /usr/bin/make" —
it ships GNU Make **3.81**, the last GPLv2 release, frozen in 2006, and
OpenSSL 3.x's generated Makefile does not build with it. That matches the
timing exactly: ~30s of Perl Configure, then make failing on sight.
compat.openblas already declares this dep on macosx.

Each build step now runs through a helper that, on failure, names the step and
prints the last 40 lines of the log. The log also opens with `make --version`,
because 3.81-vs-4.x is precisely the distinction that is invisible after the
fact. The tail is passed as one pre-formatted argument rather than a format
string — build output contains `%` often enough that formatting it is its own
failure mode.

Verified on linux (cold): log opens with "GNU Make 4.3", openssl and asio-ssl
members both pass.

* fix(openssl): drop the macosx xim:make dep, pin Apple's cc, dump build logs in CI

`xim:make` has no macOS build — xim-pkgindex's pkgs/m/make.lua declares only an
`xpm.linux` block — so yesterday's macosx dep failed resolution outright with
`E_INVALID_INPUT: package 'xim:make@latest' not found`, before install() ran.
Reverted, with the finding written down. compat.openblas declares the same dep
on macosx and is broken identically; nobody has noticed because that package is
Windows-only in the test suite, so its macOS path is never taken.

That leaves the original macOS failure — 43s after download, no message —
still undiagnosed, so this stops guessing at it:

  * The workspace job gains an `if: failure()` step that finds every
    `mcpp_*_build.log` under the members and the registry and prints its tail.
    install()-driven packages build through their own Make/Configure system,
    xim's interface mode swallows that output, and xlings reports only
    `E_INTERNAL: [<pkg>] failed:` — so a platform-specific break otherwise
    costs one full CI round-trip per hypothesis.
  * The log now opens with make/cc/perl versions, not just make's.

And one likely cause addressed while here: OpenSSL is configured and built
outside mcpp's compile rules, so it inherits none of the resolved toolchain's
flags — it just runs `cc`. On macOS the `cc` in PATH is xim's llvm, which has
no macOS SDK wired up, so every compile would fail on <stdio.h>. macOS now
builds with `CC=/usr/bin/cc`, Apple's driver, which finds the SDK itself
(same spirit as the RANLIB pin, which is already macOS-only). resolve_make()
also prefers a Homebrew gmake when one exists, since /usr/bin/make is GNU Make
3.81.

If the SDK guess is wrong, the log tail now says what is.

Verified on linux (cold): log opens with GNU Make 4.3 / gcc 16.1.0, openssl
member passes.

* fix(openssl): pass RANLIB as a make command-line assignment, not an env var

The macOS build now gets all the way through configure and compile — the CC
pin was the missing piece there — and dies in `make install_sw`, one line after
copying libcrypto.a into place:

    install libcrypto.a -> .../3.5.1/lib/libcrypto.a
    llvm-ranlib: error: Invalid option: '-c'
    make: *** [install_dev] Error 1

which is precisely what the RANLIB override exists to prevent. OpenSSL's
`darwin-common` sets `ranlib => "ranlib -c"` (Configurations/10-main.conf:1844)
and PATH resolves `ranlib` to the toolchain's llvm-ranlib, which rejects `-c`.

The override was not taking effect, and that is a regression I introduced when
confining it to macOS: I moved it from `make RANLIB=… install_sw` to
`RANLIB=… make install_sw`. The first is a command-line assignment and beats
the Makefile's own definition; the second is only an environment variable,
which a Makefile assignment overrides absent `make -e` — so it silently did
nothing and the build failed exactly as if it were not there. Restored to the
command-line form, with a comment saying why the position matters.

Also confirmed from the same log that `--libdir=lib` does its job on macOS:
the archive installs to `3.5.1/lib/`, not `lib64/`.

Verified on linux (cold): openssl member passes.

Author: Sunrisepeak

.github/workflows/validate.yml

@@ -2,7 +2,10 @@ name: validate
 
 on:
   pull_request:
-    paths: ["pkgs/**/*.lua", "tests/**", "README.md", ".github/workflows/validate.yml"]
+    # mcpp.toml and index.toml carry the workspace member list, the inherited
+    # [indices] redirect and the client version floor — a change to any of them
+    # can break every member, so they gate the run like the descriptors do.
+    paths: ["pkgs/**/*.lua", "tests/**", "README.md", "mcpp.toml", "index.toml", ".github/workflows/validate.yml"]
   push:
     branches: [main]
   schedule:
@@ -11,6 +14,21 @@ on:
   workflow_dispatch:
 
 env:
+  # 0.0.109: a bare dependency's wire address takes BOTH halves from the
+  # descriptor the identity gate accepted (mcpp#286). This is the client-side
+  # other half of the SPEC-001 migration below: mcpp used to take the NAME from
+  # the descriptor and the NAMESPACE from the request, so a bare `gtest =
+  # "1.15.2"` addressed `mcpplibs:gtest` — a key no index has. It only ever
+  # worked because the pre-migration literal `package.name` read
+  # "compat.gtest", which the hardcoded `compat.<short>` retry then caught.
+  # Short names removed that coincidence and left every bare request against
+  # this index broken on 0.0.108, which is why min_mcpp moves to 0.0.109.
+  # Note this index cannot cover that spelling itself: the `[indices]` redirect
+  # is keyed by the REQUEST's namespace, so a bare dependency resolves from the
+  # published remote index rather than the checkout under test. Bare-name
+  # resolution against a short-name index is upstream's e2e 165; what moving
+  # the floor buys here is that consumers of THIS index get a client that can
+  # address it.
   # 0.0.106: SPEC-001 package identity (mcpp#280). `package.name` is a SINGLE
   # ATOMIC SEGMENT — all hierarchy lives in `package.namespace` — and mcpp
   # addresses a package by the LITERAL name it read, so descriptors no longer
@@ -57,7 +75,7 @@ env:
   # 0.0.94 fixed feature-gated `sources` under `mcpp test` (mcpp#218); 0.0.91
   # added standard = "c++fly" to the resolver grammar, so c++fly descriptors
   # get the lint WARN below, not a hard grammar-parse rejection.
-  MCPP_VERSION: "0.0.108"
+  MCPP_VERSION: "0.0.109"
 
 jobs:
   lint:
@@ -222,21 +240,21 @@ jobs:
             ext: tar.gz
             mcpp: bin/mcpp
             xlings: registry/bin/xlings
-            mcpp_version: "0.0.108"   # keep in sync with env.MCPP_VERSION
+            mcpp_version: "0.0.109"   # keep in sync with env.MCPP_VERSION
           - platform: macos
             os: macos-15
             suffix: macosx-arm64
             ext: tar.gz
             mcpp: bin/mcpp
             xlings: registry/bin/xlings
-            mcpp_version: "0.0.108"   # keep in sync with env.MCPP_VERSION
+            mcpp_version: "0.0.109"   # keep in sync with env.MCPP_VERSION
           - platform: windows
             os: windows-latest
             suffix: windows-x86_64
             ext: zip
             mcpp: bin/mcpp.exe
             xlings: registry/bin/xlings.exe
-            mcpp_version: "0.0.108"   # keep in sync with env.MCPP_VERSION
+            mcpp_version: "0.0.109"   # keep in sync with env.MCPP_VERSION
     env:
       MCPP_EFFECTIVE: ${{ matrix.mcpp_version }}
     steps:
@@ -375,3 +393,21 @@ jobs:
             exit $rc
           fi
 
+      # install()-driven packages (openssl, openblas) build through their own
+      # Make/Configure system, whose output xim's interface mode swallows; a
+      # failed hook surfaces only as `E_INTERNAL: [<pkg>] failed:`. Each writes
+      # a log into its install prefix, so on failure surface those — otherwise
+      # diagnosing a platform-specific build break costs a full CI round-trip
+      # per guess.
+      - name: Dump install() build logs on failure
+        if: failure()
+        shell: bash
+        run: |
+          found=0
+          while IFS= read -r log; do
+            found=1
+            echo "::group::$log"
+            tail -80 "$log"
+            echo "::endgroup::"
+          done < <(find tests/examples "$HOME/.mcpp/registry" -name 'mcpp_*_build.log' 2>/dev/null)
+          [ "$found" = 1 ] || echo "no install() build logs found"

README.md

@@ -35,7 +35,7 @@ mcpp self config --mirror CN   # 切换至国内镜像,默认使用 GLOBAL 上
 | 原生模块库(Form A) | [`mcpplibs.xpkg`](pkgs/x/xpkg.lua) · [`mcpplibs.tinyhttps`](pkgs/t/tinyhttps.lua) · [`tensorvia-cpu`](pkgs/t/tensorvia-cpu.lua) · [`ffmpeg`](pkgs/f/ffmpeg.lua)(模块层,源码经 `compat.ffmpeg` 直编) · [`opencv`](pkgs/o/opencv.lua)(单仓库:模块层与 OpenCV 5 全源码构建同在包内,索引侧只留本描述符) |
 | C 源码 compat(含 `features`) | [`compat.cjson`](pkgs/c/compat.cjson.lua) · [`compat.zlib`](pkgs/c/compat.zlib.lua) |
 | header-only(含 `features`) | [`compat.eigen`](pkgs/c/compat.eigen.lua) |
-| 外部构建系统(`install()` 从源码构建) | [`compat.openblas`](pkgs/c/compat.openblas.lua)(Make) |
+| 外部构建系统(`install()` 从源码构建) | [`compat.openblas`](pkgs/c/compat.openblas.lua)(Make) · [`compat.openssl`](pkgs/c/compat.openssl.lua)(Perl Configure + Make,静态 libssl/libcrypto) |
 | 全源码直编(config 快照 + 源列表,零外部构建系统) | [`compat.ffmpeg`](pkgs/c/compat.ffmpeg.lua)(2281 TU 含 NASM 汇编,28 个目录 glob 声明) |
 | C++23 module wrapper | [`nlohmann.json`](pkgs/n/nlohmann.json.lua) · [`marzer.tomlplusplus`](pkgs/m/marzer.tomlplusplus.lua) |
 
@@ -59,8 +59,9 @@ mcpp self config --mirror CN   # 切换至国内镜像,默认使用 GLOBAL 上
 - 字段规范见 [mcpp 扩展字段文档](https://github.com/mcpp-community/mcpp/blob/main/docs/04-schema-xpkg-extension.md)。
 
 > 提交 PR 后,`validate` 自动执行 lint 并按改动库选跑对应 workspace 成员(整个测试面是一个 mcpp
-> workspace,公开模块包 `imgui`/`ffmpeg`/`opencv`/`tinyhttps` 也是普通成员——各成员经 `[indices]`
-> 把所消费命名空间重定向到 checkout,零 shell 驱动);合并后,`deploy-site` 将其发布至在线浏览站。
+> workspace,公开模块包 `imgui`/`ffmpeg`/`opencv`/`tinyhttps` 也是普通成员——`compat` 的重定向声明在
+> workspace 根并由成员继承,消费其他命名空间的成员各自覆盖,零 shell 驱动);合并后,`deploy-site`
+> 将其发布至在线浏览站。
 
 ## 相关链接
 

docs/package-types.md

@@ -17,8 +17,8 @@ A、B、C 三类共用的骨架(`package` 头与 `xpm`)如下:
 ```lua
 package = {
     spec        = "1",
-    namespace   = "compat",          -- compat / nlohmann / mcpplibs 等,决定 import 前缀与依赖 key
-    name        = "compat.<lib>",    -- 完整包名,决定 pkgs/<首字母>/ 的落点
+    namespace   = "compat",          -- 点分层级路径;compat / nlohmann / mcpplibs 等,决定 import 前缀与依赖 key
+    name        = "<lib>",           -- 单一原子段,不重复 namespace(SPEC-001 §3.2)
     description = "…",
     licenses    = {"MIT"},           -- SPDX
     repo        = "https://…",
@@ -36,6 +36,10 @@ package = {
 }
 ```
 
+身份是 `(namespace, name)` 二元组:层级一律放 `namespace`,`name` 只写一段。文件名不参与解析,推荐
+`pkgs/<首字母>/<namespace>.<name>.lua`(命中 mcpp 的快路径)。详见
+[仓库结构与 schema](repository-and-schema.md#包身份namespace-name)。
+
 ---
 
 ## A. C 源码 compat(`compat.cjson` / `compat.zlib`)
@@ -132,8 +136,9 @@ name = "<short>-example"
 version = "0.1.0"
 [toolchain]
 default = "gcc@16.1.0"
-[indices]
-compat = { path = "../../.." }            # 指回仓根,以使用本地描述符
+# `compat` 由 workspace 根的 [indices] 继承,成员无需再写;
+# 消费其他命名空间时才在此声明,例如 `[indices] fmtlib = { path = "../../.." }`
+# —— 成员级声明会**替换**根级表而非与之合并(这正是保持单个项目索引 repo 的方式)。
 [dependencies.compat]
 <short> = "1.2.3"                          # 或:<short> = { version = "1.2.3", features = ["…"] }
 [targets.<short>-example]

docs/repository-and-schema.md

@@ -4,12 +4,13 @@
 
 ```
 pkgs/<x>/<name>.lua          描述符。<x> 取完整包名首字母(compat.* → c,nlohmann.json → n,imgui → i)
-mcpp.toml                    workspace 清单(members 列表)
+mcpp.toml                    workspace 清单(members 列表)+ 根级 [indices] compat = { path = "." },
+                             由成员继承(相对路径按 workspace 根解析,mcpp ≥ 0.0.97)
 tests/examples/<member>/     每库测试工程(workspace 成员;<member> 为包名去前缀,模块包为
-  mcpp.toml                  <name>-module)。恰好一条 [indices] <ns> = { path = "../../.." }
-                             把所消费命名空间重定向到本 checkout(模块包用 default,
-                             mcpp ≥ 0.0.97;单条是硬约束——xlings 多项目级 repo 静默失败,
-                             mcpp#238,修复后再做根级集中化)。依赖按平台自门控
+  mcpp.toml                  <name>-module)。消费 compat 的成员不写 [indices];消费其他
+                             命名空间的成员写恰好一条(模块包用 default),该声明**替换**
+                             根级表而非合并 —— 每个成员最多一个项目级索引 repo 是硬约束,
+                             详见下文「索引重定向」。依赖按平台自门控
                              ([target.'cfg(...)'])
   tests/*.cpp                行为断言(独立 main,退出码非 0 即失败)
 tests/check_mirror_urls.lua  lint:GLOBAL+CN 表完整性,以及 CN 指向 mcpp-res
@@ -75,8 +76,27 @@ namespace = "mcpplibs",      name = "capi.lua"  -- ❌ 短名仍带点
 | `sources` | glob 列表,编入 lib 的源码 |
 | `cflags` / `cxxflags` / `ldflags` | 追加至对应规则 |
 | `targets` | `{ ["name"]={ kind="lib"/"bin", main=…, soname=… } }` |
-| `features` | `{ ["f"]={ sources={…} } }`,仅识别 sources |
-| `deps` | `{ ["ns.name"]="ver" }`,扁平或点号式 |
+| `features` | `{ ["f"]={ sources={…}, defines={…}, deps={…}, implies={…}, requires={…} } }`;`defines` 只作用于**包自身**的 TU,消费端若要按 feature 分支须自行声明(见 `tests/examples/openssl`、`openblas` 的 `[target.'cfg(…)'.build] cxxflags`) |
+| `deps` | `{ ["ns.name"]="ver" }`,扁平或点号式;feature 内同形 |
+
+## 索引重定向(`[indices]`)
+
+测试面要验证的是 **checkout 里的描述符**,而不是已发布的远程索引,这靠 `[indices]` 把命名空间重定向到本仓完成。
+
+**根级继承**:workspace 根的 `mcpp.toml` 声明 `[indices] compat = { path = "." }`,相对路径按 **workspace 根**解析(mcpp ≥ 0.0.97,[mcpp#224](https://github.com/mcpp-community/mcpp/issues/224)),成员直接继承,不必各写一份 `path = "../../.."`。
+
+**为什么只有一条,而且是 `compat`**:
+
+- 索引表**按命名空间取键**。声明在一个没有任何依赖会请求的名字下,该索引根本不会被注册,解析会静默回落到已发布的远程索引 —— 此时被测的根本不是这个 checkout。
+- 同一路径声明成多个命名空间确实都会注册,但会变成 N 个各自独立的项目 repo,之后任何查找都以 N 路歧义失败(物理上是同一个描述符;[mcpp#238](https://github.com/mcpp-community/mcpp/issues/238) / [xlings#374](https://github.com/openxlings/xlings/issues/374),在 xlings 0.4.69 后由静默 exit 1 变为响亮报错)。
+
+所以根级只能承载一个命名空间,`compat` 是收益最大的那个(13 个成员 vs 其余合计 10 个)。
+
+**成员级覆盖**:消费其他命名空间的成员自己声明 `[indices]`,该表**替换**继承来的根级表而非与之合并 —— 这正是每个成员只保留一个项目索引 repo 的机制。
+
+**跨命名空间的取舍**:一个成员无法同时从本 checkout 解析两个命名空间。`tests/examples/asio-ssl` 有意利用了这一点:它不写成员级声明、继承根级 `compat`,于是 asio 本身走已发布的远程索引,而它的 `ssl` feature 依赖 `compat.openssl` 从本 checkout 解析 —— 这样**未合并的 compat 描述符可以通过一个已发布的消费者去验证**。反过来,本地 asio 描述符由 `tests/examples/asio-module` 覆盖。
+
+**裸名依赖不适用**:重定向按**请求侧**的命名空间取键,而裸写的 `eigen = "5.0.1"` 是以默认命名空间发出的请求,即使最终落到 `compat` 描述符上,也会从远程索引解析。因此各成员一律使用限定写法;裸名解析本身由 mcpp 上游的 e2e 165 覆盖。
 
 ## index 版本契约(index.toml)
 
@@ -101,7 +121,8 @@ mcpp 跑 `xpkg parse`(strict:未知键即失败),所以需要更新文法/键的
 - `mirror-cn-reachable`(始终运行):逐个 `curl` CN url,均须返回 200。
 - `workspace (linux|macos|windows)`:整个测试面就是一个 mcpp workspace,**唯一的构建/运行通道**——
   没有任何 shell 驱动的例外(公开模块包 imgui/ffmpeg/opencv/tinyhttps 也是普通成员,经成员级
-  `[indices] default = { path = "../../.." }` 从 checkout 解析,mcpp ≥ 0.0.97)。
+  `[indices] default = { path = "../../.." }` 从 checkout 解析,mcpp ≥ 0.0.97;消费 `compat` 的
+  成员则继承根级声明,见上文「索引重定向」)。
   - 选择性成员测试:PR 时由 `git diff` 将改动文件映射到受影响成员
     (`pkgs/<x>/<lib>.lua` → mcpp.toml 引用 `<lib>` 的成员;`tests/examples/<m>/**` → 成员 `<m>`),
     仅 `mcpp test -p <member>` 这些成员;workflow 本身、workspace 清单非成员部分、`tools/` 等
@@ -135,3 +156,5 @@ done
 | C++23 module(generated wrapper) | `pkgs/n/nlohmann.json.lua` | `tests/examples/nlohmann.json/` | 同上 / #48 |
 | header-only + source-gated feature | `pkgs/c/compat.eigen.lua` | `tests/examples/eigen/` | `.agents/docs/2026-06-28-add-eigen-plan.md` / #50 |
 | header-only(纯头) | `pkgs/c/compat.opengl.lua`、`compat.khrplatform.lua` | — | `.agents/docs/2026-06-03-gl-runtime-packages-plan.md` |
+| 外部构建系统(`install()` 驱动) | `pkgs/c/compat.openblas.lua`(Make)、`compat.openssl.lua`(Perl Configure + Make) | `tests/examples/openblas/`、`openssl/` | `docs/superpowers/specs/2026-07-26-openssl-asio-tls-design.md` / #124 |
+| feature 拉起依赖(跨包) | `pkgs/c/chriskohlhoff.asio.lua` 的 `ssl` feature → `compat.openssl` | `tests/examples/asio-ssl/` | 同上 |

docs/superpowers/specs/2026-07-26-openssl-asio-tls-design.md

@@ -1,8 +1,38 @@
 # Add OpenSSL package + Asio SSL support
 
-> Created: 2026-07-26 · Status: design
+> Created: 2026-07-26 · Status: design (superseded in part — see §0)
 > Repo: `mcpplibs/mcpp-index` · Branch: `feat/add-openssl-asio-tls`
 
+## 0. Corrections after landing
+
+The design below is kept as written; three of its claims did not survive
+contact with the implementation, and the descriptor now differs accordingly.
+
+1. **`name = "compat.openssl"` → `name = "openssl"`.** SPEC-001 (mcpp 0.0.106)
+   makes `name` a single atomic segment with all hierarchy in `namespace`; the
+   fully-qualified spelling is only a compatible legacy form.
+
+2. **`MCPP_FEATURE_SSL` is NOT propagated to consumer TUs.** A feature's
+   `defines` apply to the package's own translation units. The original
+   `tests/ssl.cpp` keyed its whole body off that macro and therefore compiled
+   to nothing — it passed while asserting nothing. A consumer that branches on
+   a feature declares its own macro (`tests/examples/asio-ssl` sets
+   `HAVE_ASIO_SSL` in its `[target.'cfg(…)'.build] cxxflags`), which is the
+   same shape the openblas member already used.
+
+3. **`./config` needs an explicit `--libdir=lib`.** Unset, OpenSSL derives it
+   as `lib$target{multilib}`, and `linux-x86_64` declares `multilib => "64"` —
+   so the archives install to `$prefix/lib64` while `-Llib` and the post-build
+   check look at `$prefix/lib`. linux-aarch64 and both darwin64 targets declare
+   no multilib, which is why the build validated on an arm64 Mac and was still
+   broken for every x86_64 Linux consumer.
+
+Also changed while landing: linux links `-l:libssl.a -l:libcrypto.a` (naming
+the archive rather than letting the driver resolve a name that a shared object
+would win) plus `-ldl -lpthread`; the build log moved into the install prefix
+so it survives a failed build; `RANLIB` is pinned only on macOS, which is the
+platform that needs it; and `install()` probes for `perl` up front.
+
 ## 1. Motivation
 
 The mcpp ecosystem needs TLS support. `chriskohlhoff.asio@1.38.1` (C++23

index.toml

@@ -7,5 +7,5 @@
 # "floor first, new grammar after" rollout rule mechanically.
 [index]
 spec        = "1"
-min_mcpp    = "0.0.108"
-latest_mcpp = "0.0.108"
+min_mcpp    = "0.0.109"
+latest_mcpp = "0.0.109"