Changelog

Unreleased

Bug Fixes

• pin age to rage git rev for reproducible builds
• advance replay floor only after boot succeeds
• roll pods on enclave entrypoint/vsock-proxy ConfigMap changes
• reject out-of-range listen and egress ports at render
• validate signer id and reject CRLF in config bundle
• require pinned DynamoDB table pins to be full ARNs
• re-check replay floor on auto-init winner
• reject CRLF/BOM in sign-payload and bundle –add

CI/CD

• bake custody RON files into the enclave EIF when committed
• enable bun manager so website PRs refresh bun.lock

Documentation

• document signer manifest + private-fork CI custody build
• don’t assert an automated CI config-verify job (none is wired)
• clarify pinning scope and align Nitro examples with ARN schema
• add operator config-signing runbook
• pass config-signers in ceremony example build
• document signed-config EIF build + Helm deployment
• drop references to the uncommitted signed-config design doc
• explain why required signers must be role ci

Features

• update deps
• update deps
• verify operator-signed config against baked keys (Nitro)
• signed-config replay gate + operator-seed (phase 2)
• region-aware DynamoDB clients, drop tee.nitro.aws.region
• optional Nitro table pins; move RON files to custody/
• single-source signedConfig delivery for signed-Nitro
• require explicit ports, drop chart-side port defaults

Refactoring

• drop redundant remark-gfm integration
• apply code-quality review to phase-2 replay gate
• drop dead Split.marker_offset field
• extract StateRow::get_array helper
• always-enforce signed-config replay gate, drop operator-seed verb
• apply config-sig branch review — dedup + hardening
• share ARN parsing between runtime and build script
• dedup pinned-table validation and codegen

Tests

• cover signed-config replay-floor wire paths
• regression-test auto-init winner replay-floor re-check
• add auto-init winner success case for replay re-check

v1.0.0-rc.2 — 2026-06-22

Bug Fixes

• avoid hardcoded crypto false positives (#2)
• make token and policy administration management-token-only
• reject epochs and slots exceeding i64::MAX
• let emergency seal reach AwaitingRotation replicas
• clear stale rotation-share rows at quorum rotation entry
• defer mode-switch commit to atomic finalize
• preserve configured KMS threshold across mode switches
• refuse debug/trace logging on mainnet
• keep auth tokens out of curl argv
• correct DynamoDB IAM permissions for the signer role
• reject empty GVR carrying a stale HMAC
• verify master-key HMAC in kms_auto unseal
• pin kms_auto KMS ARNs to a config allow-list
• enforce kms_auto ARN allow-list on write paths + add CLI flag
• kms_auto allow-list — CLI precedence, harness pin, messages
• add master-key row-integrity HMAC to auth token/policy rows
• reject empty signer_state DynamoDb table
• make SQL interchange import raise-only (HC)
• apply seccomp filter to all threads, not one (HD)
• zeroize BIP-39 mnemonic on drop (M2)
• reject future-dated Nitro attestation documents (M3)
• bound signed/imported slots & epochs to a plausibility window (M8)
• wire plausibility-window knobs to CLI; tighten docs & tests (M8 review)
• validate CMS keyEncryptionAlgorithm is RSAES-OAEP (M4)
• make operator share writes create-only (M5)
• unify mlock/seccomp into HardeningMode with fail-closed required (M6)
• constant-time operator-name handling on share submission
• roll back master-key install on a failed auto-unseal
• defer credential-ID conflict check until after auth
• reject debug-mode (zero-PCR) Nitro attestation documents
• constant-time hash verification in find_token_by_hash
• reject trailing bytes after CMS ContentInfo and EnvelopedData
• hold per-validator advisory locks during PG interchange import
• map unexpected DynamoDB cancellation reasons to a retryable error
• resolve the real client IP from the trusted X-Forwarded-For chain
• bump postgres-protocol/tokio-postgres for RUSTSEC-2026-0178/0179/0180
• zero RLIMIT_CORE at boot as a second core-dump guard
• update website astro stack
• generalize the CmsError::UnsupportedAlgorithm message for key encryption
• address phase-1 review (ARN shape, pre-I/O validate, must_use)
• finish phase-1 review (key_count rename, doc notes)
• correct CODEOWNERS handle to @ArchiFleKs
• surface zero-length shares in reconstruct dedup
• address Phase 2 audit findings (H1, guards, trust-boundary)
• phase-3 audit follow-ups + drop redundant legacy-row check
• redact token secrets from Debug and zeroize config-digest YAML
• persist mock share_hmac and surface swallowed reconcile errors
• reject a ceremony block that cannot take effect
• assemble minted secrets without a transient un-zeroized copy
• fail closed when a Shamir share has no decrypt attempts
• update website (astro / starlight)

Documentation

• explain frozen commitment label and shared error variant
• document row-HMAC encoding determinism invariant
• fix widen/narrow wording in policy tamper test comment
• drop audit-finding identifiers from code comments
• document the deterministic-challenge replay model
• correct security threat model
• update Nitro entropy-ordering comment
• correct the apply_seccomp_filter contract doc
• rewrite for the kms_auto-static custody model
• sync CONTEXT.md + AGENTS.md to the kms_auto-static model
• align rustdoc, OpenAPI, and CLI text with the kms_auto-static model
• fix broken intra-doc links and purge stale custody-model references
• fix stale “seal/unseal ceremonies” on docs homepage
• say “chamber” not “vault” in operator seal/status help
• drop stale keygen::cpu_phase references in deposit_data comments
• fix SEAL_OVERRIDE recovery pk casing + stale unseal/RA-TLS prose

Features

• log denied management-only auth-admin attempts
• fix deps
• update website
• split keygen API into generate / generate-keys / deposit-data routes
• static ceremony parameters with build-time injection
• grouped KMS shares + ceremony transact primitives
• in-enclave auto-init for kms_auto-static (Phase 3)
• reconcile transact carries optional root re-mint
• post-unseal reconcile converges the row to the static (§A6)
• kms_auto-static seal/unseal; drop operator-quorum and TEE auto-unseal
• bind MASTER_KEY shares with a row HMAC; drop dead operator-quorum crypto
• MRK replica failover for master-key KMS custody
• require a baked-in ceremony on Nitro builds
• enclave-image config pins; derive backup on/off from recipients
• require a ceremony for stateful boot; retire the Uninitialized state
• update deps
• update ron to latest stable
• bump chart version

Refactoring

• centralize the row-HMAC envelope in one decision module
• rename master-key HMAC fns to commitment
• derive Default for SignerStateConfig
• complete HMAC->commitment terminology in prose
• split MasterKeyHmacMismatch into commitment + HMAC variants
• hand-roll canonical_policy encoding, drop serde_json
• import ZeroizeOnDrop instead of inline path
• route OS randomness through a SysRng helper
• make 32-byte + keygen entropy generation fallible
• make token and passphrase randomness fallible
• finish the commitment-vs-HMAC rename
• anchor the kms_auto ARN gate to the ceremony static
• drop dead passphrase-entropy validation (zxcvbn)
• dead-code cleanup, config deny_unknown_fields, test consolidation
• simplify chamber routing, extract_region, and master-key helpers
• collision-free hex framing for mock encryption context
• clarify key-generation and deposit-data API naming
• resolve SigningRequest and SignerStateBackend name collisions
• fix symbol names that misrepresented behavior
• align DynamoDb casing in error type and KeySource variant
• align auth-token vocabulary on “create”, drop “mint”
• drop get_ prefix on TEE/TLS attestation + entropy methods
• regroup keystore DELETE under write profile, rename routes
• de-stutter error variants, interchange, scope, log + cidr fields
• rename interchange containers + minor stutter tail
• rename token_bound_cidrs to bound_cidrs (wire + CLI + config)
• rename aTLS to RA-TLS (Remote Attestation TLS)
• spell out att/blk abbreviations to full words
• rename seal response StateChangeResponse -> SealResponse
• clean up naming nits
• tidy MasterKeyPurpose/CryptoError naming, drop dead metric bucket
• merge adjacent tee.is_active() validation blocks
• naming cleanups across signer core + eth keygen
• rename block() constructor, fix Merged doc
• naming cleanups in the DynamoDB key store
• de-ceremony auto-init naming + 3 chamber type renames
• naming cleanups in the signer state machine
• naming cleanups in the HTTP core + signing layer
• drop test-only DynamoDbKeySourceConfig::default_for_cli
• naming cleanups in the HTTP auth layer
• naming cleanups in chamber API, TLS, and TEE layers
• align ServerCommand fields with Figment paths + proxy fn naming
• finish config-layer naming review (findings #3-#5, #8)
• move compute_config_digest onto Config::digest
• move ResolvedKmsKey constructors onto TryFrom impls
• move PROXY v2 parsers onto V2HeaderInfo
• move client-IP resolution onto ClientIp
• move BLS cipher encrypt/decrypt onto EncryptedBlsSecretKey
• move interchange empty/validate onto Document
• derive FromStr for KeyStatus, delegate parse_key_status
• move derive_keypair_cpu onto DerivedKeypair::derive
• move reason_label onto ConfigBootstrapError via strum
• de-storage-verb seal-override write + document signing gate

Tests

• assert HMAC-mismatch root cause in kms_auto tamper test
• tighten kms_auto rejection asserts + add config merge test
• cover policy row-HMAC tamper drop on rebuild
• sync enclave CMS fixture to RSAES-OAEP key-encryption OID
• mirror the attestation-floor raise-only regression on Postgres
• refresh stale fixtures for the GVR-HMAC and kms_auto ARN guards
• de-flake concurrent weak-rejection test by dropping wall-clock budget
• add dev-localstack harness + rework compliance/load suites
• cover anti-slashing race, GVR, seal gate, auth propagation; fix load stats
• cover openapi/tls/health easy wins + clean stale coverage profdata

Style

• add #[must_use] to pure value-returning builders
• hoist base64 import out of attestation_handler to module scope

v1.0.0-rc.1 — 2026-06-04