[freshtonic]

Layer 7 of the CIP-5203 stack. Implements CIP-5309.

• New crate stack-kms-azure: Azure Key Vault Managed HSM only. It uses the Key Vault REST API 7.4 (wrapkey/unwrapkey), with A256KW under an oct-HSM (AES-256) key.
• Azure Key Vault (vault.azure.net) is not supported. A vault holds only RSA and EC keys. With RSA, anyone who has the public key can wrap a root key that they know, so a vault cannot prove who made a keyset record. The client refuses Key Vault hosts and any key that is not oct-HSM.
• wrapkey has no associated data, so it is bound with stack_kms_vendor::bound. This is sound only because the wrap needs the HSM's AES key. The wrapped key is padded to 72 bytes.
• The stored form carries the versioned kid, so an unwrap needs no extra lookup.
• Credentials: client secret, workload identity, managed identity (IMDS and App Service), and a static token. Client-certificate auth is deferred.
• Not tested against a live Managed HSM. We have no instance, so the tests use hand-written fixtures and an in-process emulator only. The live workflow integration-azure-managed-hsm.yml stays off: leave the variable STACK_KMS_AZURE_LIVE_KEY unset until an instance is available. It also needs the secrets STACK_KMS_AZURE_TENANT_ID, STACK_KMS_AZURE_CLIENT_ID and STACK_KMS_AZURE_CLIENT_SECRET.
• The vendor name is azure-managed-hsm, and the static token variable is AZURE_MANAGED_HSM_ACCESS_TOKEN.

Decisions are in docs/plans/2026-11-05-key-vendor-backends-decisions.md (the CIP-5309 section, and "Azure: Managed HSM only (2026-11-13)").

Replaces #1629, which was closed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

[changeset-bot]

⚠️ No Changeset found

Latest commit: bcd6147

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.