Complete ADR-0027 opaque indexed storage

.github/workflows/audit.yml

@@ -42,6 +42,18 @@ jobs:
       - name: tests
         run: cargo test --workspace --all-features
 
+  opaque-store-scale:
+    name: opaque storage scale budgets
+    runs-on: ubuntu-latest
+    env:
+      RUSTFLAGS: "-D warnings"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: 100k and 1m messages
+        run: scripts/store-scale-gate.sh
+
   # Informational only: a failing coverage run must never block the
   # advisory signal this workflow exists for.
   coverage:

.github/workflows/ci.yml

@@ -57,6 +57,25 @@ jobs:
       - name: cargo check
         run: cargo check --workspace --all-features --all-targets
 
+  storage-windows:
+    name: opaque storage on Windows
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: qualify storage host
+        shell: pwsh
+        run: |
+          $volume = Get-Volume -DriveLetter (Get-Location).Drive.Name
+          if ($volume.FileSystemType -ne "NTFS") {
+            throw "Storage tests require an explicitly identified NTFS volume"
+          }
+          Write-Output "OS: $([System.Runtime.InteropServices.RuntimeInformation]::OSDescription)"
+          Write-Output "Filesystem: $($volume.FileSystemType)"
+      - name: kult-store tests
+        run: cargo test -p kult-store --all-features -- --test-threads=1
+
   desktop:
     name: desktop app (fmt, clippy, tests)
     runs-on: ubuntu-latest

README.md

@@ -90,7 +90,7 @@ independent interoperability.
 
 | Area | Current state |
 |---|---|
-| **Core security and storage** | Hybrid PQXDH, Double Ratchet sessions, sealed envelopes, sealed local record bodies, backup/recovery, RPC/CLI, and UniFFI paths are implemented with automated tests. The current SQLite schema still exposes exact contact/group identifiers in plaintext indexes and lacks universal row binding; ADR-0027 is required before stronger locked-database metadata claims. The combined implementation has not yet passed independent security review or independent interoperability gates. |
+| **Core security and storage** | Hybrid PQXDH, Double Ratchet sessions, sealed envelopes, opaque keyed SQLite indexes, row-bound local records, released-schema migration, backup/recovery, RPC/CLI, and UniFFI paths are implemented with repeatable tests. SQLite still reveals approximate row counts/sizes, order, within-domain equality, access patterns, and change timing. Storage has Linux/ext4 test evidence, but independent review and physical macOS, Windows, Android, iOS, power-loss, backup-exclusion, and forensic qualification remain open. |
 | **Internet, LAN, and delayed delivery** | libp2p QUIC/TCP, Kademlia discovery, NAT traversal, mDNS, and volunteer mailbox roles are implemented. Fresh app installs do not yet have a qualified distinct-NAT golden path: bootstrap and mailbox defaults require deliberate configuration, and mailbox persistence/operator behavior remains a stabilization gate. [ADR-0034](docs/adr/0034-operator-minimized-reference-discovery.md) proposes an initial founder-operated Hetzner Standard-mode bootstrap/DHT/rendezvous default with RAM-backed mutable state; it is not implemented or a durable mailbox. |
 | **Off-grid delivery** | Sneakernet and the Meshtastic carrier, duty-cycle controls, retransmission, and internet↔mesh bridge paths are implemented with automated evidence. The physical two-radio bench is not yet field-qualified. |
 | **Applications and messaging** | Desktop, Android, and iOS shells expose pairwise/group text and a broad Alpha feature set, including attachments, local organization, linked devices, ephemeral content, polls, roles, and direct audio-call paths. CI and simulator evidence exist; hands-on device, background lifecycle, NAT, accessibility, and localization qualification remain. |

crates/kult-store/Cargo.toml

@@ -11,13 +11,16 @@ repository.workspace = true
 kult-crypto = { version = "0.3.0", path = "../kult-crypto" }
 kult-protocol = { version = "0.3.0", path = "../kult-protocol" }
 rusqlite = { version = "0.31", features = ["bundled"] }
-rand_core = "0.6"
+rand_core = { version = "0.6", features = ["getrandom"] }
 serde = { version = "1", features = ["derive"] }
 postcard = { version = "1", default-features = false, features = ["alloc"] }
 zeroize = "1"
 fs2 = "0.4"
 libc = "0.2"
 
+[target.'cfg(any(unix, windows))'.dependencies]
+atomicwrites = "0.4.4"
+
 [dev-dependencies]
 proptest = "1"
 rand = "0.8"