[coderdan]

Stack Encrypt's prototype exposes overlapping value-encryption traits, unclear ciphertext and JSON roles, and inconsistent context handling. This documentation-only PR captures the API review and turns its decisions into a coordinated Rust, dynamic/Go, EQL, and provider implementation plan.

The proposed surface distinguishes single opaque ciphertext encryption from target-directed structural encryption, shares validated definitions between static and dynamic callers, and separates ciphertext binding, search scope, key selection, and provider policy.

Review guide

• Start with the API implementation plan for accepted decisions, proposals, outstanding questions, and acceptance criteria.
• Read the public workflow examples and context scenarios for encryption/decryption, opaque blobs, record layouts, searchable targets, and directional context selection.
• Review the JSON operation contract for the comprehensive first-release inventory and Rust/dynamic/SQL examples.
• Review provider capabilities and packaging/names for plaintext-derived keysets, ZeroKMS lock context, optional backend capabilities, the Stack/Vitamin C boundary, and AsyncCipher retirement.
• The review log records the issues and decision history.

The documents distinguish accepted direction from recommendations and current implementation. The detailed JSON contract remains under review; packaging and naming are proposals. Examples describe the intended API and are not claimed to compile against the prototype. Implementation timing remains a follow-up discussion.

Stable, versioned blob storage is prioritized before format-preserving zeroization/timing improvements. Related work: cipherstash/vitaminc#519 and #1353.

Validation

• Checked local Markdown link targets, balanced fenced blocks, and all fenced JSON examples.
• Passed git diff --check and the staged equivalent.
• No runtime code changed; no Rust/Go integration tests or proposed-API typechecking were run.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c5efc48

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2147f7fa-af3a-48e5-b574-b3a2333c0a9e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T11:43:34.708643Z	356ba45	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-25T11:44:08.161739Z	356ba45	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cipherstash-agent]

Attestation of review — /code-review medium plus cross-check-review-findings (cipherstash/skills company-skills), run on head 356ba45.

• Critical/blocking: none.
• Findings: 1 minor (inline). It was checked against Vitamin C 0.8.0 sources and the PR's existing feedback. No prior review threads exist, so nothing was dropped as already covered.
• Checked: all relative links and anchors in the seven new docs resolve. Dynamic/Rust operation names and the J01–J20 inventory are consistent across the JSON, plan and examples documents. The packaging claim that Stack does not use AsyncCipher holds (it appears only in a doc comment in stack-encrypt/src/cipher.rs).
• Limits: docs-only PR, so this is a consistency and fact check against the codebase. The ~5k lines of proposed design were not exhaustively read, and the design decisions themselves were not evaluated. The changeset-bot warning does not apply to a docs-only change.
• Not run: gh auth failed, so pr_feedback.py was replaced by the GitHub MCP reads, and findings were verified inline rather than by delegates.

---

Generated by Claude Code

[cipherstash-agent]

minor The AsyncCipher retirement inventory is incomplete against Vitamin C 0.8.0: it omits aead/src/lib.rs:39 (public re-export), aead/src/encrypt_sink.rs:42,152 (AsyncCipher bound and seal_all_async import), and the AsyncCipher impls in normalize/tests/known_answers.rs:1397,1446. Add them so the deletion and test-migration steps cover every site.

---

Generated by Claude Code