suaveplan/openspec/archive/2026-05-02-crypto-cipher-spec-conformance/proposal.md

OpenSpec Change: crypto-cipher-spec-conformance

• Change ID: crypto-cipher-spec-conformance
• Package: @suaveplan/crypto-cipher
• Status: PROPOSED
• Date: 2026-04-26

Summary

Add **Verified by:** lines to every requirement in openspec/specs/crypto-cipher/spec.md and pin previously-unverified structural scenarios with tests/spec-conformance.test.ts. No public-API or behavioural changes.

Current state

@suaveplan/crypto-cipher ships AES-256-GCM, ChaCha20-Poly1305, and XChaCha20-Poly1305 with the per-primitive replaceability layout. Per-feature unit tests cover RFC vectors, AAD authentication, tampered-ciphertext rejection, key/nonce length validation, and native-stub PrimitiveNotImplemented behaviour. The structural scenarios (impl-file presence, GENERATED banner, Phase-0.5 vendoring gate, dangerous-tier flip-gate runtime reflection, no-internal-CSPRNG invariant) were not pinned, and no requirement carried a **Verified by:** annotation.

What changes

1. Annotate every requirement in the folded openspec/specs/crypto-cipher/spec.md with a **Verified by:** line.
2. Add tests/spec-conformance.test.ts covering layout, banner, Phase-0.5 consistency, dangerous-tier runtime reflection, native-stub state, and the no-internal-CSPRNG invariant.
3. bun scripts/openspec-conformance.ts @suaveplan/crypto-cipher exits 0.

Impact

• Public API unchanged.
• One new test file (~120 lines).
• openspec/specs/crypto-cipher/spec.md gains 6 **Verified by:** blocks.
• Coverage stays 100/100/100/100.