encryption: Argon2 KDF + envelope behind a default-on kdf feature

[AdaWorldAPI]

What

In crates/encryption:

• argon2 (0.5) is now optional.
• New feature kdf = ["dep:argon2"], on by default.
• wasm-bindings now implies kdf.
• Gated behind kdf: kdf, envelope, and the root seal / open / KdfParams / EnvelopeError re-exports.

Default builds are unchanged.

Why

The only in-tree consumer is OGAR's ogar-encryption (every repo under the workspace was checked). It carries its own KDF and envelope on argon2 0.6, from the AdaWorldAPI/password-hashes fork, and uses only aead, hash, sign and RngError from this crate. Once it depends with default-features = false, argon2 0.5 is no longer compiled into it. The OGAR side is a separate PR.

Verification

• cargo test -p encryption is green in three configurations:
  • default: 13 + 46;
  • --no-default-features: 12 + 28, and cargo tree shows no argon2;
  • --features wasm-bindings: 13 + 46.
• cargo clippy -p encryption --no-default-features --all-targets -- -D warnings is clean.
• cargo check -p encryption --no-default-features --target wasm32-unknown-unknown is green.
• .claude/blackboard.md has an entry for the change.

🤖 Generated with Claude Code

https://claude.ai/code/session_019HnekoM1EidTwQLS3oFVFm

---

Generated by Claude Code

Summary by CodeRabbit

• New Features
  • Encryption now includes Argon2-based key derivation by default, with an option to exclude it from builds that don’t need it.
  • Browser bindings now include key derivation and envelope encryption support.
• Changes
  • Key derivation and envelope APIs are available only when the key derivation feature is enabled.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: f67e8d83-0874-4c24-b12c-6b9e9836990a

📥 Commits

Reviewing files that changed from the base of the PR and between 5d5d71d and 4e898d5.

📒 Files selected for processing (3)

• .claude/blackboard.md
• crates/encryption/Cargo.toml
• crates/encryption/src/lib.rs

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Walkthrough

Walkthrough

The encryption crate now gates its Argon2 KDF and envelope APIs behind the kdf feature. The feature is enabled by default and by wasm-bindings. A documentation entry records the feature setup and reported checks.

Changes

Encryption KDF Feature Gating

Layer / File(s)	Summary
KDF feature and API availability crates/encryption/Cargo.toml, crates/encryption/src/lib.rs, .claude/blackboard.md	The manifest makes argon2 optional, enables kdf by default and through wasm-bindings, and the library gates KDF and envelope modules and re-exports on kdf. The documentation records the feature setup and reported checks.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Suggested reviewers: claude

Merge Risk: ⚪ Minimal · up to 4e898

The default build retains the KDF and envelope APIs, and wasm bindings enable them as well. No in-tree consumer breakage or other material merge risk is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: placing the Argon2 KDF and encryption envelope behind a default-on kdf feature.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

_{A rabbit checks the feature gate,
And finds the KDF set straight.
The envelope waits for kdf to run,
With wasm bindings joining in.
The rabbit hops through tidy rows,
Then nibbles clover as code grows.}

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_efd9e6c6-9f4f-467e-badc-cb7db89a6071)