[freshtonic]

Fixes a build failure on next: packages/stack-encrypt/tests/heap_hygiene.rs does not compile with the dynamic feature.

error[E0433]: failed to resolve: use of undeclared type `Scope`
    --> packages/stack-encrypt/tests/heap_hygiene.rs:1245:33

Cause

Two PRs that each built alone:

• refactor(stack-encrypt)!: replace CipherScope and dynamic::Scope with one CipherRef #1610 replaced dynamic::Scope with CipherRef. record::decrypt now takes impl Into<CipherRef>, which &StackCipher converts into. It merged first (aedd55e04).
• fix(stack-encrypt): wipe the plaintext copies that were freed unwiped #1643 added a cancellation test that calls record::decrypt(Scope::Client(&cipher), …). It was written before refactor(stack-encrypt)!: replace CipherScope and dynamic::Scope with one CipherRef #1610 merged, and it merged after it (9f6b08095).

Commit	cargo check -p stack-encrypt --tests --features dynamic
5811ac412 (#1643 before merge)	compiles
aedd55e04 (after #1610)	compiles
9f6b08095 (after #1643, current next)	fails

Nobody saw it because the test file is #![cfg(all(feature = "dynamic", unix))], so a default-features build skips it, and no checks ran on the merge commit.

Fix

Pass &cipher, as the file's other record::decrypt calls do (lines 451 and 485). Test-only; no changeset.

Checks

• cargo clippy --workspace --all-targets --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: clean.
• cargo nextest run -p stack-encrypt --all-features: 1415 passed, 1 skipped.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7bad7ae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: cd60938e-957a-42f4-87d3-011c4489be8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.

[cipherstash-agent]

Review attestation

Reviewed 7bad7ae · posted from Claude Code · claude-opus-5-5 · effort medium
Sources: code-review · claude-opus-5-5
Skills: code-review, rust-security, review-cross-check

Findings (1): 1 minor — 0 inline, 1 below.

• .github/workflows/tests-crates.yml:42 (outside diff) minor No workflow in .github/workflows/ runs on a push to next: every push.branches here is [main], and next has no ruleset that requires branches to be up to date and no merge queue. So two PRs that each pass alone, like #1610 and #1643, can land a compile break on next without CI ever building it. Adding next to push.branches would only catch a break after it lands; to prevent one, require up-to-date branches or a merge queue on next. This is a repo-settings follow-up, and it does not block this PR.

The fix itself checks out. At next (9f6b080), cargo check -p stack-encrypt --tests --features dynamic fails with E0433 on Scope. At 7bad7ae it passes, and cargo test -p stack-encrypt --features dynamic --test heap_hygiene passes 33/33. &cipher builds an unscoped CipherRef (pending.rs:181), and each leaf's key is fetched under the keyset that leaf records. That matches the file's other record::decrypt calls at lines 451 and 485. No Scope::Client call sites remain in any .rs file.

---

Generated by Claude Code