refactor(noq-proto)!: get ring and aws_lc_rs out of public API

[Frando]

Description

I ran cargo-check-external-types on the noq crates. It all looks reasonable. noq-proto has ring and aws-lc-rs in its public API though through a From<ring::error::Unspecified> for CryptoError impl (same for aws-lcs-rs, depending on feature flags). This means that from a strict POV that ring couldn't be updated without a semver breaking change.

This PR removes the From impl, instead using map_err at the few call sites.

Breaking Changes

• changed: noq_proto::crypto::CryptoError no longer implements From<ring::error::Unspecified> and From<aws_lcs_rs::error::Unspecified>

Notes & open questions

Remaining foreign types in public API are: bytes, futures_core, rustls, rustls_pki_types, tokio - all reasonable. Then we also have identity_hash (marker trait, but don't think there would be any need to update that crate during 1.0 so fine) and arbitrary (gated behind non-default arbitrary feature). I think we're good!

Change checklist

• Self-review.
• All breaking changes documented.

[github-actions]

Documentation for this PR has been generated and is available at: https://n0-computer.github.io/noq/pr/640/docs/noq/

Last updated: 2026-05-06T13:13:26Z

[github-actions]

Performance Comparison Report

cd2bf740bbd0281f8407e4fcec4398c48465338b - artifacts

Raw Benchmarks (localhost)

Scenario	noq	upstream	Delta	CPU (avg/max)
large-single	5376.7 Mbps	N/A	N/A	92.4% / 97.7%
medium-concurrent	5507.7 Mbps	N/A	N/A	92.2% / 98.0%
medium-single	3813.7 Mbps	N/A	N/A	93.7% / 100.0%
small-concurrent	3823.9 Mbps	N/A	N/A	98.8% / 152.0%
small-single	3481.8 Mbps	N/A	N/A	89.3% / 97.1%

Netsim Benchmarks (network simulation)

Condition	noq	upstream	Delta
ideal	3035.4 Mbps	4097.1 Mbps	-25.9%
lan	782.4 Mbps	810.3 Mbps	-3.4%
lossy	69.8 Mbps	69.8 Mbps	~0%
wan	83.8 Mbps	83.8 Mbps	~0%

Summary

noq is 21.5% slower on average

---

1604794b9ee9d59d911155876ab0bbe9594c7c71 - artifacts

Raw Benchmarks (localhost)

Scenario	noq	upstream	Delta	CPU (avg/max)
large-single	5271.7 Mbps	7893.1 Mbps	-33.2%	93.4% / 97.6%
medium-concurrent	5323.1 Mbps	7742.0 Mbps	-31.2%	94.1% / 100.0%
medium-single	3939.8 Mbps	4749.5 Mbps	-17.0%	98.1% / 151.0%
small-concurrent	3953.3 Mbps	5388.6 Mbps	-26.6%	90.9% / 99.3%
small-single	3589.8 Mbps	4674.8 Mbps	-23.2%	94.3% / 101.0%

Netsim Benchmarks (network simulation)

Condition	noq	upstream	Delta
ideal	N/A	3987.8 Mbps	N/A
lan	N/A	810.4 Mbps	N/A
lossy	N/A	55.9 Mbps	N/A
wan	N/A	83.8 Mbps	N/A

Summary

noq is 27.5% slower on average

[dignifiedquire]

nice

[flub]

Thanks!

How reasonable would it be to run the external crates check in CI next to the semver check? It seems like this kind of thing could easily sneak back in.