asklera-PDF — Roadmap to becoming the world reference for PDF

PAUSED (founder, 2026-09-14 evening): no implementation until the brainstorm and this roadmap are complete and every question in 06-decisions.md is answered. The state of the interrupted work is recorded in 05-battle-order.md ("State at the pause"). Lanes restart only from the founder's answers.

Written 2026-09-14 at HEAD 782f231 on the founder's decision. Supersedes the French ROADMAP.md of 2026-09-14 (archived under docs/archive/), whose scope was too narrow: it centred on the French health market. The target is now universal coverage — every ISO/ETSI/ITU/IETF/W3C standard touching PDF, every PDF Association and vendor extension, every national profile (e-invoicing, e-signature law, archival, accessibility, identity) and every industry de-facto convention (pharma eCTD, defence labelling, mortgage SMART Docs, enterprise MIP encryption, Chinese e-seals, Russian GOST signatures…), across all verticals — health, education, legal, commercial, government, industrial, defence, personal, SMB, large enterprise, Fortune-500 — and all platforms and languages.

Thesis

A library becomes the reference when three things are simultaneously true:

1. It is provably right where others are merely usable. Every claim in this roadmap is tied to an oracle that shares no code with us (a reference implementation, an official validator, a conformance suite, a national test file set) and to a negative control that proves the oracle can see the defect. cargo xtask prove <id> remains the gate; docs/COUVERTURE-ISO32000.toml remains the ledger.
2. It covers what nobody else bothers to cover — the "esoteric" national and industry profiles that force enterprises to keep three vendors on payroll. Each of those is small; together they are the moat.
3. It is reachable from anywhere — a stable C ABI, first-class Node/Bun/WASM, Python, JVM, .NET, Swift, Go and the rest, with drop-in shims for the APIs and CLIs people already use (pdfium FPDF_*, poppler-utils, qpdf, pdftk, cpdf).

How this directory is organised

Doctrine (unchanged program rules, restated for new readers)

• Never implement cryptography here. Every primitive, mode, KDF, signature scheme and certificate path routine comes from RUSSL (russl-* on Kellnr). A missing RUSSL capability is named in the report and becomes an upstream lane; it is never substituted locally, never worked around with a third-party crate.
• Every external crate needs a founder-approved ADR. Binding generators (cbindgen, napi-rs, wasm-bindgen, PyO3, UniFFI…) are build tools, grouped under one ADR; runtime dependencies are individually justified.
• Backbone libraries live outside ASKLERA/, are published to Kellnr, and carry zero path dependencies. Same version number ⇒ same bytes: diff the .crate, never republish a number.
• A feature is implemented only after cargo xtask prove <id> runs every cited test against an external oracle with a negative control; SKIPPED is fatal.
• References live outside the repository (~/Projects/ref/<id>/, ledger docs/REFERENCES.toml with SHA-256/commit and licence). Sponsored ISO texts are for internal use: never copied, never quoted beyond one sentence. Third-party test corpora are internal test material only: fetched by script at a pinned commit, never copied into the repository, never shipped in an artefact.
• Shared machine discipline (big-1): isolated worktree per lane under ~/ (/tmp is over quota), commits through a temporary index with blobs built from HEAD for shared files, HEAD verified to compile from a clean worktree, no git stash, no git add -A/-u, no concurrent cargo test --workspace, no broad pkill.
• User-facing text in French (CLI messages, errors, reports for the founder); code, comments, identifiers and this roadmap in English.
• Performance is measured at small scale at every layer (criterion + ~50 representative files) because we control every layer from codec to rasteriser; the full-corpus benchmark comes only once the small-scale harness is stable.

Status legend

✅ done · 🔧 in progress (lane X) · ⏸ interrupted, resume · 📋 planned · 🧭 founder decision required · 🚫 out of scope, reason given · 🔬 oracle.

Maintenance

Each lane takes its identifier from 05-battle-order.md, reads its objective, oracle and exit criterion there, and when it reports it updates: its status line in 05, the measured numbers in 04 for the features it touched, and any decision it had to leave to the founder in 06. The baseline in 01 is regenerated after every green cargo xtask prove all. Nothing in these files says "done" without a proof cited from docs/COUVERTURE-ISO32000.toml.