[kixelated]

Plans the fixes from a security and performance misuse audit of rind's public API, as a new m2 epic, quest/m2/api.

Audit

Four reviewers each read one module group of rind (symmetric ciphers and AEADs; hashes, MACs, KDFs and CPU; signatures and RSA; agreement, KEM, encodings and errors) against AGENTS.md's rules. They were told the 0.2.0 audit's decisions (moq-dev/rind#383) were settled. I checked the top findings against the source. Nothing was high-severity, and no panic is reachable from public input.

Quests

• [S] HKDF output keys the next expand: Prk from an Okm, so chained key schedules aren't hand-written. rind-ring and rind-aws-lc-rs drop their copies of Expand.
• [S] Agreement keys keep their public key and algorithm: public_key() and to_pkcs8() stop redoing a base-point multiplication on every call, and agreement keys get algorithm() and an algorithm in their Debug.
• [S] AES-CBC encryption takes a typed IV (breaking, rind 0.4): the IV is random or explicitly asserted unpredictable.
• [S] The audit's hazards are documented or linted: tags' Debug stops printing their bytes, #[must_use] is added where results are lazy, and eight hazards get documented.
• [S] rind needs no runtime CPU check (breaking, rind 0.4 and adapter patch releases): cpu::check() can no longer fail on any target rind builds for, so the requirement moves to compile time, and the check and every adapter's MissingFeature are deleted.

Decisions

Made with the maintainer on 2026-11-08 and recorded in each quest's Plan:

• Scope: the epic's goal ✅ (rejected: non-breaking only, docs only).
• Additive quests: HKDF chaining, cached agreement keys, hygiene and docs ✅, all three.
• Breaking: typed CBC IV ✅ and deleting the CPU check ✅ (rejected: a named SharedSecret accessor, GCM short tags moved to a legacy name, one constant_time::verify error).
• CPU check: delete it and require only compile-time features ✅ (rejected: keep it documented, leave it). This authorizes the AGENTS.md rule edit.
• Adapters break in patch releases ✅ (rejected: wait for each upstream's next major, change the version scheme). Maintainer: nobody uses them yet.
• Milestone: m2 ✅ (rejected: m1, m3).
• Dropped: RSA-sized fixed buffers, RandomizedNonceKey's syscall per seal, rind-str0m's SRTP copy, agree(&PublicKey), and a streaming HMAC verify. The epic README gives each reason. ML-KEM key storage is already in ML-KEM-512 and ML-KEM-1024.

It also updates the 32-bit x86 target quest, whose runtime-error line the CPU quest replaces.

Impact

Quest files only. No public API or wire changes.

Models

Size: S
Implementer: Claude Code, claude-opus-5-5, high effort

🤖 Generated with Claude Code

(Written by Claude Opus 5.5 with high)

Review

Rewritten by quest review after each round.

• Reviewer: Codex, gpt-6.1-sol, medium effort
• Session: 01a1bd16-d4c1-7ac1-bbb0-9eb90d8ca79e, round 1
• Head: 8688001
• Base: origin/main at 48c0908
• Score: 10/10, The documentation-only change adds planning documents without changing executable code, and no actionable defects were identified.
• Findings: none

[pullfrog]

This run was cancelled before it finished.

  ^{｜ View workflow run ｜ via Pullfrog}