[freshtonic]

Layer 3 of the CIP-5203 stack. Implements CIP-5306 (ADR-0013).

• New crate stack-kms-vendor, with the KeyVendorBackend trait (wrap, unwrap, sleep). Each vendor crate implements only this trait.
• KeysetRecord is a versioned record, written as stack-keyset: + base64url, with create and rewrap.
• Derived data keys: HKDF-SHA256 from the root key. The info binds the keyset id, the vendor and the key mode. The root key is cached for a TTL (default 5 minutes).
• KeyRouter holds ZeroKMS and at most one vendor, and routes by keyset.
• The static key backend.
• Also: retry (backoff on throttling), the VendorTransport trait, and a shared contract suite.
• The crate docs hold the capability matrix of every key backend.

stack-encrypt does not change. Decisions are in docs/plans/2026-11-05-key-vendor-backends-decisions.md (CIP-5306 section).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7d4722c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

[freshtonic]

Scope reduced (2026-11-12). This branch was rebuilt from one final tree by path, and the follow-up PRs #1555 to #1563 were folded in. The plan is docs/plans/2026-11-12-key-vendor-backends-scope-reduction.md; the decision log's "Scope reduction" section records each change. Decisions: no stack-encrypt change, no v2 leaf, and the wrapped data key mode deferred.

In this PR: the derived data key mode only, with the root key TTL in VendorKeySource. The index key stays in the cipher's cache until eviction, as for ZeroKMS; the capability matrix states that gap. The vendor and mode bytes are in the HKDF info of every derived key. KeyVendorBackend is vendor, wrap, unwrap and sleep; run_batch became retry. Folded in: the shared fixture harness (#1556), the shared credential cache (#1557) and the one-vendor router (#1562). The base is now #1522 (#1524 is closed).

[freshtonic]

Replaced by #1625, in the new stack #1633. The code is the same, rebased onto the latest next. The ADRs are now ADR-0013 and ADR-0014, and the text about the wrapped data key mode is removed.