AD-008 — OpenSSL libssl as the only uprobe module

Decision: OpenSSL libssl is the only TLS-library uprobe module in the MVP; BoringSSL/GnuTLS/NSS/GoTLS are interface-only follow-ons. Primary hook is the pre-formatted keylog routine; fallback reads SSL_st/SSL_SESSION via BTF/CO-RE or a per-version offset table.
Reason: One well-understood module proves the model; the keylog-line hook avoids struct-offset fragility where available.
Trade-off: Statically linked/stripped non-OpenSSL builds are unsupported in the MVP.
Scope: Feature 02.
Date: 2026-09-09
Status: superseded by AD-010 — a live rootful run (AD-009) proved the fallback offset table is rejected outright by the kernel verifier against a real, unverified-offset libssl.so.3; the primary keylog-routine hook was also unreachable (symbol stripped). Both paths in this decision failed in practice.