Revert #256 — the sealed-channel primitives went in on the wrong crates

[AdaWorldAPI]

Reverts the #256 merge (0e5ebc02, git revert -m 1). Removes kx.rs, hkdf_sha384.rs, bundle.rs, their wasm.rs bindings, and the x25519-dalek / hkdf crates.io dependencies. sha384 and the envelope wasm bindings stay.

Two reasons, and the second is the real one:

1. encryption: X25519, HKDF-SHA384 and Ed25519-signed bundles #256 added the registry dependencies x25519-dalek and hkdf from crates.io, which breaks the fork rule.

2. dalek is the wrong substrate for this stack. Its AVX2 backend is not cleanly separable — field.rs reaches around packed_simd.rs to raw intrinsics at 35 sites, so the ndarray-simd matryoshka cannot swap one backend module the way it can for RustCrypto's crates. In chacha20 / sha2 / poly1305 the AVX2 path is a separate module (backends/avx2.rs, x86_avx2.rs), which is exactly the shape the polyfill swaps cleanly, and those crates are mutually version-compatible across the suite. The primitives will be rebuilt on that basis.

30 encryption tests green after the revert.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mwq1QKpw4zRd6oaGRoJhF2

---

Generated by Claude Code

Summary by CodeRabbit

• Removed Features
  • Removed support for signed content bundles and their verification APIs.
  • Removed browser-based bundle verification exports.
  • Removed key-agreement and session-key derivation capabilities from the encryption package.
• API Changes
  • Existing bundle, key-agreement, and key-derivation interfaces are no longer available.
  • The encryption package now exposes its remaining envelope, hashing, and key-derivation functionality.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_bcfbf45e-ebd6-4b28-b521-adb9deefbb50)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2fe1be84-a8cd-4b49-9bb0-82f918177ed9

📥 Commits

Reviewing files that changed from the base of the PR and between 0e5ebc0 and aa0e343.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• .claude/blackboard.md
• crates/encryption/Cargo.toml
• crates/encryption/src/bundle.rs
• crates/encryption/src/hkdf_sha384.rs
• crates/encryption/src/kx.rs
• crates/encryption/src/lib.rs
• crates/encryption/src/wasm.rs

💤 Files with no reviewable changes (7)

• crates/encryption/src/lib.rs
• crates/encryption/Cargo.toml
• crates/encryption/src/kx.rs
• crates/encryption/src/hkdf_sha384.rs
• crates/encryption/src/bundle.rs
• crates/encryption/src/wasm.rs
• .claude/blackboard.md

---

📝 Walkthrough

Walkthrough

The encryption crate removes bundle, X25519, and HKDF-SHA-384 implementations, dependencies, Rust exports, and WASM bindings. A dated operational note is also removed from .claude/blackboard.md.

Changes

Encryption API retirement

Layer / File(s)	Summary
Encryption implementation removal crates/encryption/src/bundle.rs, crates/encryption/src/hkdf_sha384.rs, crates/encryption/src/kx.rs	Removes content-bundle signing and verification, HKDF key derivation, and X25519 key-exchange implementations and tests.
Encryption surface and build cleanup crates/encryption/src/lib.rs, crates/encryption/src/wasm.rs, crates/encryption/Cargo.toml	Removes the corresponding Rust modules, WASM verify_bundle bindings, and x25519-dalek/hkdf dependencies.

Blackboard cleanup

Layer / File(s)	Summary
Operational note removal .claude/blackboard.md	Deletes the dated shared-checkout guidance entry and its associated finding, rule, and corollary.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

A bunny found old crypto code,
And cleared a path where exports flowed.
Bundles, keys, and schedules rest,
While WASM sheds its former quest.
The blackboard note hops away—
Clean burrows greet the review day!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the revert of PR #256 and the removal of sealed-channel primitives from the encryption crate.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}