Initial scaffold for kestrove-core

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-15 18:30:14 +09:00
commit 462fbbc523
34 changed files with 2063 additions and 0 deletions
@@ -0,0 +1,37 @@
+# kestrove-core
+
+Rust workspace that holds **all** Kestrove crypto and vault logic. Apple,
+Android and desktop apps call it through UniFFI. The server uses only `kv-proto`.
+
+| Crate | Status | Purpose |
+|---|---|---|
+| `kv-proto` | ✅ M0 | Wire types (Envelope, KDF params, API bodies). No secrets. |
+| `kv-crypto` | ✅ M0 | 2SKD (Argon2id + Secret Key), XChaCha20-Poly1305 envelopes, HPKE vault-key sealing, keyset, Ed25519, Secret Key format |
+| `kv-model` | ✅ M0 | Items, URL matching (PSL), TOTP (RFC 6238), password generator |
+| `kv-ffi` | ✅ M0 (in-memory) | The exported API (`VaultCore`, `totp_code`, `match_url`, `generate_password`) |
+| `kv-store` | 🔜 M1 | SQLite replica (ciphertext only) |
+| `kv-sync` | 🔜 M1 | OPAQUE login, RFC 9421 signing, pull/push/merge, signed manifest |
+
+Spec: `../kestrove-spec/docs/02-cryptography.md` and `03-sync-protocol.md`.
+
+## Setup
+
+```bash
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh   # once
+cargo test --workspace
+```
+
+## Bindings
+
+```bash
+./scripts/build-apple.sh     # → ../kestrove-apple/Packages/KestroveCore (XCFramework + Swift)
+./scripts/build-android.sh   # → ../kestrove-android/core-ffi (jniLibs + Kotlin); needs cargo-ndk
+```
+
+The desktop (Tauri) app depends on `kv-ffi` directly as a Rust crate.
+
+## Rules
+* No `unsafe` outside generated FFI glue.
+* Secrets live in `Zeroizing<_>`. Never log, `Debug`-print or `format!` a secret.
+* Any change to formats needs a spec change first and new vectors in `kestrove-spec/vectors`.
+* `cargo deny check` must pass. There are no GPL dependencies (App Store).