v1.7.4 — Native user-level CA trust stores Janus now makes browsers trust its local CA natively on every platform, strictly at the user level: no sudo, no UAC, no system CA bundles, no crawling through per-profile cert9.db databases. WHAT CHANGED - TrustStore trait with an idempotent ensure() built over the injected ProcessRunner (phase-3 micro-object architecture, scripted-fake testable). - Windows: CurrentUser\Root via native certutil — Chrome, Edge and Yandex pick the CA up instantly. - macOS: login Keychain via native security add-trusted-cert — Chrome, Edge and Safari. - Linux: Chromium NSS shared user DB via certutil -t "C,," — supports both the M146+ default (~/.local/share/pki/nssdb) and the legacy ~/.pki/nssdb, creates an empty database when none exists, and degrades quietly when certutil is absent. - Config.auto_trust (default true): trust is ensured fire-and- forget at startup, check-first, so native platform confirmations appear at most once per profile. - Firefox: security.enterprise_roots.enabled = true on Windows and macOS (the official Mozilla mechanism); manual import stays the documented path on Linux, where the flag is not supported. - docs/dev-rules/CA-TRUST.md codifies the storage and trust boundaries; the Firefox guide is split per operating system. QUALITY - 9 angry unit tests for the NSS backend plus cfg-gated suites for Windows and macOS: one assertion per test, scripted process fakes, no OS calls; full suite green (99 lib tests), cargo check --tests clean. - Built on the yegor256-test-campaign baseline (phases 1-3, 70.67% line coverage).