samiandClaude Opus 5.5
20d465185d
Items record sign_in_with {provider, account}; the browser bridge reports it
with the site's identities and saves it after the usual app prompt. Items
now keep fields they don't know, so editing in an older app never drops what
a newer one added.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
kestrove-core
Rust workspace that holds all Kestrove crypto and vault logic. Apple,
Android and desktop apps call it through UniFFI. The server uses only kv-proto.
| Crate | Status | Purpose |
|---|---|---|
kv-proto |
✅ M0 | Wire types (Envelope, KDF params, API bodies). No secrets. |
kv-crypto |
✅ M0 | 2SKD (Argon2id + Secret Key), XChaCha20-Poly1305 envelopes, HPKE vault-key sealing, keyset, Ed25519, Secret Key format |
kv-model |
✅ M0 | Items, URL matching (PSL), TOTP (RFC 6238), password generator |
kv-ffi |
✅ M1 | The exported API (VaultCore with SQLite storage, local unlock key, sync; totp_code, match_url, generate_password) |
kv-store |
✅ M1 | SQLite replica (ciphertext only), base copies for merges, 10-version history |
kv-sync |
✅ M1 | TLS 1.3 + SPKI pins, OPAQUE login, RFC 9421 signing, pull/push/merge, signed manifest |
Spec: ../kestrove-spec/docs/02-cryptography.md and 03-sync-protocol.md.
Setup
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # once
cargo test --workspace
Bindings
./scripts/build-apple.sh # → ../kestrove-apple/Packages/KestroveCore (XCFramework + Swift)
./scripts/build-android.sh # → ../kestrove-android/core-ffi (jniLibs + Kotlin); needs cargo-ndk
The desktop (Tauri) app depends on kv-ffi directly as a Rust crate.
Test vectors and the live-server test
cargo run -p kv-crypto --example gen-vectors # writes crates/kv-crypto/tests/vectors and ../kestrove-spec/vectors
cargo test -p kv-ffi --test live_server -- --ignored # against a fresh local kestrove-server; see the test's docs
Rules
- No
unsafeoutside generated FFI glue. - Secrets live in
Zeroizing<_>. Never log,Debug-print orformat!a secret. - Any change to formats needs a spec change first and new vectors in
kestrove-spec/vectors. cargo deny checkmust pass. There are no GPL dependencies (App Store).