[freshtonic]

Layer 3 of the CIP-5203 stack. Implements CIP-5306 (ADR-0013).

• New crate stack-kms-vendor, with the KeyVendorBackend trait (wrap, unwrap, sleep). Each vendor crate implements only this trait.
• KeysetRecord is a versioned record, written as stack-keyset: + base64url, with create and rewrap.
• Derived data keys: HKDF-SHA256 from the root key. The info binds the keyset id, the vendor and the key mode. The root key is cached for a TTL (default 5 minutes).
• KeyRouter holds ZeroKMS and at most one vendor, and routes by keyset.
• The static key backend.
• Also: retry (backoff on throttling), the VendorTransport trait, and a shared contract suite.
• The crate docs hold the capability matrix of every key backend.

stack-encrypt does not change. Decisions are in docs/plans/2026-11-05-key-vendor-backends-decisions.md (CIP-5306 section).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7d4722c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

cargo-mutants did not complete (exit ) before producing results. Check the workflow run logs. The gate below will fail.