M1: persistent vault, local unlock key, sync client, test vectors

kv-store: SQLite (bundled) and in-memory Store holding only ciphertext
envelopes, with base copies for three-way merges and a 10-version history.

kv-ffi: VaultCore::open(path); persisted account record; local unlock key
(enable/unlock_with_local_key/disable); async sync API (configure_server,
set_device_signer, register_account, login, sync_now, logout, devices);
DeviceSigner foreign trait; IntegrityAlarm/PinMismatch/... error variants.

kv-sync: reqwest + rustls (TLS 1.3 only, ring) with SPKI pinning; OPAQUE
client on kv-proto's OpaqueSuite; RFC 9421 signing per kv_proto::httpsig;
pull/push with If-Match, field-level three-way merge, edit-beats-delete;
signed manifest (canonical CBOR, Merkle root, prev chain, Ed25519) with
rollback/fork/Merkle checks as hard integrity alarms. Tested against a
wiremock fake server, plus an #[ignore] test against kestrove-server.

kv-crypto: gen-vectors example and tests reproducing kestrove-spec/vectors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-crypto/src/aead.rs

@@ -30,8 +30,13 @@ impl SymKey {
     }
 
     pub fn seal(&self, plaintext: &[u8], aad: &[u8]) -> Result<Envelope> {
+        self.seal_with_nonce(random_bytes(), plaintext, aad)
+    }
+
+    /// Deterministic variant for test vectors. Never reuse a nonce with the same key.
+    #[doc(hidden)]
+    pub fn seal_with_nonce(&self, nonce: [u8; 24], plaintext: &[u8], aad: &[u8]) -> Result<Envelope> {
         let cipher = XChaCha20Poly1305::new(Key::from_slice(&self.bytes[..]));
-        let nonce: [u8; 24] = random_bytes();
         let ct = cipher
             .encrypt(XNonce::from_slice(&nonce), Payload { msg: plaintext, aad })
             .map_err(|_| CryptoError::Encrypt)?;

crates/kv-crypto/src/kdf.rs

@@ -12,6 +12,8 @@ use crate::{random_bytes, secret_key::SecretKey, CryptoError, Result};
 
 /// Keys derived from master password + Secret Key.
 pub struct DerivedKeys {
+    /// Root key both outputs are expanded from. Exposed for test vectors only.
+    pub root: Zeroizing<[u8; 32]>,
     /// Account Unlock Key: wraps the account keyset.
     pub auk: Zeroizing<[u8; 32]>,
     /// Fed to OPAQUE as the "password". Independent of `auk`.
@@ -90,7 +92,7 @@ pub(crate) fn derive_keys_unchecked(
     hk.expand(b"kestrove/v1/auk", auk.as_mut()).map_err(|_| CryptoError::Kdf)?;
     hk.expand(b"kestrove/v1/opaque-pwd", auth_input.as_mut()).map_err(|_| CryptoError::Kdf)?;
 
-    Ok(DerivedKeys { auk, auth_input })
+    Ok(DerivedKeys { root, auk, auth_input })
 }
 
 #[cfg(test)]

crates/kv-crypto/src/seal.rs

@@ -60,16 +60,23 @@ impl EncKeypair {
 
 /// Seals `plaintext` to a recipient public key (raw 32-byte X25519).
 pub fn seal_to(recipient_id: Uuid, recipient_pk: &[u8], plaintext: &[u8], aad: &[u8]) -> Result<Envelope> {
+    seal_to_with_rng(recipient_id, recipient_pk, plaintext, aad, &mut OsRng)
+}
+
+/// Same as [`seal_to`] with a caller-supplied RNG. The first 32 bytes it yields are the
+/// ephemeral `ikmE` of RFC 9180 `DeriveKeyPair`. Only for test vectors.
+#[doc(hidden)]
+pub fn seal_to_with_rng<R: rand_core::CryptoRng + rand_core::RngCore>(
+    recipient_id: Uuid,
+    recipient_pk: &[u8],
+    plaintext: &[u8],
+    aad: &[u8],
+    rng: &mut R,
+) -> Result<Envelope> {
     let pk = <Kem as KemTrait>::PublicKey::from_bytes(recipient_pk).map_err(|_| CryptoError::Malformed)?;
-    let (encapped, ct) = hpke::single_shot_seal::<ChaCha20Poly1305, HkdfSha256, Kem, _>(
-        &OpModeS::Base,
-        &pk,
-        INFO,
-        plaintext,
-        aad,
-        &mut OsRng,
-    )
-    .map_err(|_| CryptoError::Encrypt)?;
+    let (encapped, ct) =
+        hpke::single_shot_seal::<ChaCha20Poly1305, HkdfSha256, Kem, _>(&OpModeS::Base, &pk, INFO, plaintext, aad, rng)
+            .map_err(|_| CryptoError::Encrypt)?;
     Ok(Envelope {
         v: FORMAT_VERSION,
         alg: Alg::HpkeX25519ChaCha,