# Release v0.1.0 - 2026-05-18

## Summary

Initial scaffold for `key-vault`. Repository created on GitHub, standards in place, CI configured, **9-layer security architecture fully documented**, ready for Phase 0.2.0 implementation work.

This crate provides enterprise-grade in-memory key management for the Hive DB stack and the wider Rust ecosystem. It implements defense-in-depth across 9 distinct layers (plus a bonus 10th) to make cryptographic key material hard to extract via memory analysis, scraping, or forensic recovery.

## Added

### Repository structure
- `src/` with subdirectories for each layer: `fetcher/`, `fragment/`, `decoy/`, `codex/`, `monitor/`
- `tests/`, `benches/`, `examples/`, `fuzz/`, `docs/`, `.github/`
- `Cargo.toml` with MSRV 1.75, edition 2024, Apache-2.0 OR MIT
  - 5 keywords: vault, keys, encryption, secure, keychain
  - 5 categories: cryptography, authentication, memory-management, os, api-bindings
  - Feature flags for every layer (`fetcher-*`, `fragment-*`, `decoy-*`, codex, monitor, audit, mlock, zeroize, tee-detect, post-quantum)
  - Convenience presets: `preset-balanced`, `preset-paranoid`, `preset-fast`

### Naming conventions (locked in)
- **Trait: `KeyFetch`** — handles acquisition
- **Operation: `defrag`** — defragmentation/reassembly
- **Filler bytes: `Decoy`** — `DecoyStrategy` trait, `KeyDecoy` type
- **Strategy splitting key: `Fragment`** — `FragmentStrategy` trait, `StandardFragmenter` etc.
- **Memory lock: `mlock`** — short, matches POSIX
- **Byte swap layer: `Codex`** — `Codex` trait with involution-based implementations
- **Failure detection: `SecurityMonitor`** trait

### Source scaffolding
- `src/lib.rs` with full REPS lint configuration and 9-layer documentation
- `tests/smoke.rs`
- `benches/vault_bench.rs` (placeholder)
- Canonical `REPS.md` at repo root
- Dual licensing: `LICENSE-APACHE` + `LICENSE-MIT`

### Documentation (premium quality)
- `README.md` (9.8 KB) — full 9-layer overview, badges, threat model, doc links
- `docs/SECURITY.md` (24 KB) — comprehensive 9-layer architecture with per-layer:
  - Defense provided + NOT provided
  - Implementation details
  - Performance impact
  - Trade-offs
  - Composition rules
- `docs/TRANSFORMATION.md` (12 KB) — visual step-by-step walkthrough of a key passing through all layers, with concrete byte examples
- `CHANGELOG.md`

### CI
- `.github/workflows/ci.yml` — cross-platform CI (Linux/macOS/Windows × stable + MSRV 1.75)

## Repository setup

- GitHub: https://github.com/jamesgober/key-vault
- Topics: rust, reps, vault, encryption, keys, keychain, secure, cryptography, security, key-management
- Default branch: main
- License: Apache-2.0 OR MIT
- Visibility: PUBLIC

## Design decisions locked in

- 9-layer architecture (plus bonus Layer 10) documented in `docs/SECURITY.md`
- Codex layer uses involutions for symmetric encode/decode
- Decoy strategy defaults to `SelfReferenceDecoy` for indistinguishability
- TEE detection in 1.0; full TEE acquirers deferred to 1.x
- Key normalization via BLAKE3 neutralizes format pattern leaks
- Master key recovery, atomic key rotation, multi-key vaults in 1.0
- Hive DB will ship a private `HiveCodex` for proprietary byte-swap tables

## Next

Phase 0.2.0 — Foundation types + `KeyHandle` + TEE detection.

**Estimated time to 1.0: 4-5 focused weeks.**

**Priority: MAXIMUM. Premium quality.**

---

## Documentation

- [`README.md`](../../README.md) — overview, badges, threat model
- [`docs/SECURITY.md`](../SECURITY.md) — 9-layer architecture
- [`docs/TRANSFORMATION.md`](../TRANSFORMATION.md) — visual walkthrough
- [`CHANGELOG.md`](../../CHANGELOG.md) — full change log

---

<sub>key-vault v0.1.0 — Copyright (c) 2026 James Gober. Apache-2.0 OR MIT.</sub>
