CarterPerez-dev 4723716e08 feat(crypto): AEAD envelope encryption with AES-256-GCM, KEK loader, secure random ... - Random with constant-time-equal helper - KEK loader from env (Tier 1) with InvalidKekError on bad/missing var - AEAD via direct LibCrypto FFI bindings (Crystal 1.20 stdlib OpenSSL::Cipher doesn't expose GCM auth_data/auth_tag, so we extend LibCrypto with EVP_CIPHER_CTX_ctrl + EVP_aes_256_gcm and call them directly) - Envelope: per-row DEK wrapped by KEK, AAD-bound, algorithm_id reserved for crypto agility (0x01 = AES-256-GCM today, 0x02/0x03 reserved) - 17 unit specs including a 100-iteration random property test - Tag-tampered ciphertext / wrong-AAD / wrong-key all raise Aead::Error		2026-04-29 00:43:12 -04:00
..
fixtures	feat(cre): source tree skeleton with empty module dirs and CI workflow	2026-04-28 23:54:59 -04:00
integration	feat(persistence): PostgreSQL adapter with append-only audit trigger	2026-04-29 00:39:53 -04:00
unit	feat(crypto): AEAD envelope encryption with AES-256-GCM, KEK loader, secure random	2026-04-29 00:43:12 -04:00
spec_helper.cr	feat(cre): source tree skeleton with empty module dirs and CI workflow	2026-04-28 23:54:59 -04:00