Initial Commit

openspec/archive/2026-05-02-crypto-cipher-spec-conformance/proposal.md

@@ -0,0 +1,27 @@
+# OpenSpec Change: crypto-cipher-spec-conformance
+
+- **Change ID**: crypto-cipher-spec-conformance
+- **Package**: `@suaveplan/crypto-cipher`
+- **Status**: PROPOSED
+- **Date**: 2026-04-26
+
+## Summary
+
+Add `**Verified by:**` lines to every requirement in `openspec/specs/crypto-cipher/spec.md` and pin previously-unverified structural scenarios with `tests/spec-conformance.test.ts`. No public-API or behavioural changes.
+
+## Current state
+
+`@suaveplan/crypto-cipher` ships AES-256-GCM, ChaCha20-Poly1305, and XChaCha20-Poly1305 with the per-primitive replaceability layout. Per-feature unit tests cover RFC vectors, AAD authentication, tampered-ciphertext rejection, key/nonce length validation, and native-stub `PrimitiveNotImplemented` behaviour. The structural scenarios (impl-file presence, GENERATED banner, Phase-0.5 vendoring gate, dangerous-tier flip-gate runtime reflection, no-internal-CSPRNG invariant) were not pinned, and no requirement carried a `**Verified by:**` annotation.
+
+## What changes
+
+1. Annotate every requirement in the folded `openspec/specs/crypto-cipher/spec.md` with a `**Verified by:**` line.
+2. Add `tests/spec-conformance.test.ts` covering layout, banner, Phase-0.5 consistency, dangerous-tier runtime reflection, native-stub state, and the no-internal-CSPRNG invariant.
+3. `bun scripts/openspec-conformance.ts @suaveplan/crypto-cipher` exits 0.
+
+## Impact
+
+- Public API unchanged.
+- One new test file (~120 lines).
+- `openspec/specs/crypto-cipher/spec.md` gains 6 `**Verified by:**` blocks.
+- Coverage stays 100/100/100/100.

openspec/archive/2026-05-02-crypto-cipher-spec-conformance/specs/crypto-cipher/spec.md

@@ -0,0 +1,21 @@
+# Capability Spec Delta: crypto-cipher (spec-conformance)
+
+**Package**: `@suaveplan/crypto-cipher`
+**Status**: PROPOSED
+
+This delta annotates each existing requirement in `openspec/specs/crypto-cipher/spec.md` with a `**Verified by:**` line. No requirement semantics change.
+
+## MODIFIED Requirements
+
+| Requirement | Verified by |
+|---|---|
+| Universal AEAD primitive surface | `tests/spec-conformance.test.ts` AND `src/primitives/{aes-256-gcm,chacha20-poly1305,xchacha20-poly1305}/*.test.ts` |
+| Per-primitive replaceability | `tests/spec-conformance.test.ts` (impl files + banner) AND per-primitive `throws PrimitiveNotImplemented` |
+| Vendored noble source (Phase 0.5) | `tests/spec-conformance.test.ts::"is a Phase-0.5 forward gate; current state is pre-0.5 (noble dep + no vendored/)"` |
+| Dangerous-tier CI gate | `tests/spec-conformance.test.ts::"every native is a stub today, so no AEAD has been flipped without an audit"` |
+| Constant-time block-cipher and MAC implementation | `tests/spec-conformance.test.ts` (every native still a `PrimitiveNotImplemented` stub) |
+| Nonce handling is the caller's responsibility | `tests/spec-conformance.test.ts::"no primitive source file consumes a CSPRNG (no Math.random / crypto.getRandomValues / randomBytes)"` AND per-primitive `rejects wrong nonce length` |
+
+## Newly added tests in this change
+
+- `tests/spec-conformance.test.ts` — pins layout, GENERATED banner, Phase-0.5 consistency, dangerous-tier runtime reflection, native-stub state, and the no-internal-CSPRNG invariant.

openspec/archive/2026-05-02-crypto-cipher-spec-conformance/tasks.md

@@ -0,0 +1,7 @@
+# Tasks — crypto-cipher-spec-conformance
+
+- [x] Add `**Verified by:**` line to every `### Requirement:` block in `openspec/specs/crypto-cipher/spec.md`.
+- [x] Add `tests/spec-conformance.test.ts` pinning structural scenarios.
+- [x] Confirm `bun scripts/openspec-conformance.ts @suaveplan/crypto-cipher` exits 0.
+- [x] Confirm `bunx turbo lint typecheck test --filter=@suaveplan/crypto-cipher` is green.
+- [x] Confirm `bunx turbo test:coverage --filter=@suaveplan/crypto-cipher` reports 100/100/100/100.