# OpenSpec Change: crypto-hash-spec-conformance

- **Change ID**: crypto-hash-spec-conformance
- **Package**: `@suaveplan/crypto-hash`
- **Status**: PROPOSED
- **Date**: 2026-04-26

## Summary

Add `**Verified by:**` lines to every requirement in `openspec/specs/crypto-hash/spec.md` and pin previously-unverified structural scenarios (package identity, per-primitive replaceability layout, generated `*.select.ts` banner) with `tests/spec-conformance.test.ts`. No public-API or behavioural changes.

## Current state

`@suaveplan/crypto-hash` ships SHA-256/384/512, HMAC, HKDF, PBKDF2, Argon2id with the per-primitive replaceability layout (`src/primitives/<id>/impl/<id>.{noble,native}.ts` plus a generated `<id>.select.ts`). `native-stubs.test.ts`, `tree-shake.test.ts`, and the per-feature unit tests cover behaviour, but the structural scenarios — package name, every primitive having both impl files, generated banner on selectors — were not pinned at runtime, and no requirement carried a `**Verified by:**` annotation.

## What changes

1. Annotate every requirement in the folded `openspec/specs/crypto-hash/spec.md` with a `**Verified by:**` line citing concrete tests.
2. Add `tests/spec-conformance.test.ts` covering the package-identity and per-primitive layout scenarios.
3. `bun scripts/openspec-conformance.ts @suaveplan/crypto-hash` exits 0.

## Impact

- Public API unchanged.
- One new test file (~85 lines).
- `openspec/specs/crypto-hash/spec.md` gains 5 `**Verified by:**` blocks.
- Coverage stays 100/100/100/100.