feat(settly): config encryption-at-rest + hot-reload watcher (CFG-SOTA-001 + CFG-SOTA-002)

.grade-reports/build.log

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `cpufeatures v0.3.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cpufeatures-0.3.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/build.raw

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `cpufeatures v0.3.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cpufeatures-0.3.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/clippy.log

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `clap_lex v1.1.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/clap_lex-1.1.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/clippy.raw

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `clap_lex v1.1.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/clap_lex-1.1.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/doc.log

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `cpufeatures v0.3.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cpufeatures-0.3.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/doc.raw

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `cpufeatures v0.3.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cpufeatures-0.3.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/fmt.log

@@ -0,0 +1,80 @@
+Warning: can't set `indent_style = Block`, unstable features are only available in nightly channel.
+Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.
+Warning: can't set `indent_style = Block`, unstable features are only available in nightly channel.
+Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:128:
+     let plaintext =
+         serde_json::to_vec(payload).map_err(|e| ConfigCryptoError::Encrypt(e.to_string()))?;
+     let ciphertext = cipher
+-        .encrypt(
+(B-            nonce,
+(B-            Payload { msg: &plaintext, aad },
+(B-        )
+(B+        .encrypt(nonce, Payload { msg: &plaintext, aad })
+(B         .map_err(|e| ConfigCryptoError::Encrypt(e.to_string()))?;
+     Ok(EncryptedEnvelope { salt, nonce: nonce_bytes, ciphertext, aad: aad.to_vec() })
+ }
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:146:
+     let cipher = Aes256Gcm::new(key);
+     let nonce = Nonce::from_slice(&env.nonce);
+     let plaintext = cipher
+-        .decrypt(
+(B-            nonce,
+(B-            Payload { msg: &env.ciphertext, aad: &env.aad },
+(B-        )
+(B+        .decrypt(nonce, Payload { msg: &env.ciphertext, aad: &env.aad })
+(B         .map_err(|e| ConfigCryptoError::Decrypt(e.to_string()))?;
+     serde_json::from_slice(&plaintext).map_err(|e| ConfigCryptoError::Decrypt(e.to_string()))
+ }
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:264:
+                 let Some(_ev) = raw_rx.recv().await else { break };
+                 let mut latest: Option<notify::Event> = None;
+                 loop {
+-                    match tokio::time::timeout(std::time::Duration::from_millis(250), raw_rx.recv()).await {
+(B+                    match tokio::time::timeout(std::time::Duration::from_millis(250), raw_rx.recv())
+(B+                        .await
+(B+                    {
+(B                         Ok(Some(ev)) => latest = Some(ev),
+                         Ok(None) => return,
+                         Err(_) => break,
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:288:
+         });
+
+         Ok((
+-            Self {
+(B-                path,
+(B-                passphrase: passphrase.to_vec(),
+(B-                tx,
+(B-                _watcher: watcher,
+(B-                current,
+(B-            },
+(B+            Self { path, passphrase: passphrase.to_vec(), tx, _watcher: watcher, current },
+(B             initial,
+         ))
+     }
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:312:
+         let new_cfg: T = decrypt_from_file(&self.path, &self.passphrase)?;
+         let new_arc = Arc::new(new_cfg);
+         *self.current.write() = new_arc.clone();
+-        let _ = self.tx.send(ReloadEvent {
+(B-            config: new_arc,
+(B-            reloaded_at: chrono::Utc::now(),
+(B-        });
+(B+        let _ = self.tx.send(ReloadEvent { config: new_arc, reloaded_at: chrono::Utc::now() });
+(B         Ok(())
+     }
+
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:417:
+         // Cross-AAD: decrypting env_a with aad-B should fail. We test by
+         // trying to decrypt with a constructed envelope using env_a.ciphertext
+         // but env_b.aad — which AES-GCM rejects.
+-        let cross = EncryptedEnvelope { salt: env_a.salt, nonce: env_a.nonce, ciphertext: env_a.ciphertext, aad: env_b.aad.clone() };
+(B+        let cross = EncryptedEnvelope {
+(B+            salt: env_a.salt,
+(B+            nonce: env_a.nonce,
+(B+            ciphertext: env_a.ciphertext,
+(B+            aad: env_b.aad.clone(),
+(B+        };
+(B         let result: Result<SampleCfg, _> = decrypt(b"pw", &cross);
+         assert!(result.is_err());
+     }

.grade-reports/fmt.raw

@@ -0,0 +1,80 @@
+Warning: can't set `indent_style = Block`, unstable features are only available in nightly channel.
+Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.
+Warning: can't set `indent_style = Block`, unstable features are only available in nightly channel.
+Warning: can't set `group_imports = StdExternalCrate`, unstable features are only available in nightly channel.
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:128:
+     let plaintext =
+         serde_json::to_vec(payload).map_err(|e| ConfigCryptoError::Encrypt(e.to_string()))?;
+     let ciphertext = cipher
+-        .encrypt(
+(B-            nonce,
+(B-            Payload { msg: &plaintext, aad },
+(B-        )
+(B+        .encrypt(nonce, Payload { msg: &plaintext, aad })
+(B         .map_err(|e| ConfigCryptoError::Encrypt(e.to_string()))?;
+     Ok(EncryptedEnvelope { salt, nonce: nonce_bytes, ciphertext, aad: aad.to_vec() })
+ }
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:146:
+     let cipher = Aes256Gcm::new(key);
+     let nonce = Nonce::from_slice(&env.nonce);
+     let plaintext = cipher
+-        .decrypt(
+(B-            nonce,
+(B-            Payload { msg: &env.ciphertext, aad: &env.aad },
+(B-        )
+(B+        .decrypt(nonce, Payload { msg: &env.ciphertext, aad: &env.aad })
+(B         .map_err(|e| ConfigCryptoError::Decrypt(e.to_string()))?;
+     serde_json::from_slice(&plaintext).map_err(|e| ConfigCryptoError::Decrypt(e.to_string()))
+ }
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:264:
+                 let Some(_ev) = raw_rx.recv().await else { break };
+                 let mut latest: Option<notify::Event> = None;
+                 loop {
+-                    match tokio::time::timeout(std::time::Duration::from_millis(250), raw_rx.recv()).await {
+(B+                    match tokio::time::timeout(std::time::Duration::from_millis(250), raw_rx.recv())
+(B+                        .await
+(B+                    {
+(B                         Ok(Some(ev)) => latest = Some(ev),
+                         Ok(None) => return,
+                         Err(_) => break,
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:288:
+         });
+
+         Ok((
+-            Self {
+(B-                path,
+(B-                passphrase: passphrase.to_vec(),
+(B-                tx,
+(B-                _watcher: watcher,
+(B-                current,
+(B-            },
+(B+            Self { path, passphrase: passphrase.to_vec(), tx, _watcher: watcher, current },
+(B             initial,
+         ))
+     }
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:312:
+         let new_cfg: T = decrypt_from_file(&self.path, &self.passphrase)?;
+         let new_arc = Arc::new(new_cfg);
+         *self.current.write() = new_arc.clone();
+-        let _ = self.tx.send(ReloadEvent {
+(B-            config: new_arc,
+(B-            reloaded_at: chrono::Utc::now(),
+(B-        });
+(B+        let _ = self.tx.send(ReloadEvent { config: new_arc, reloaded_at: chrono::Utc::now() });
+(B         Ok(())
+     }
+
+Diff in /mnt/c/Users/koosh/Dev/Configra/crates/settly/src/crypto.rs:417:
+         // Cross-AAD: decrypting env_a with aad-B should fail. We test by
+         // trying to decrypt with a constructed envelope using env_a.ciphertext
+         // but env_b.aad — which AES-GCM rejects.
+-        let cross = EncryptedEnvelope { salt: env_a.salt, nonce: env_a.nonce, ciphertext: env_a.ciphertext, aad: env_b.aad.clone() };
+(B+        let cross = EncryptedEnvelope {
+(B+            salt: env_a.salt,
+(B+            nonce: env_a.nonce,
+(B+            ciphertext: env_a.ciphertext,
+(B+            aad: env_b.aad.clone(),
+(B+        };
+(B         let result: Result<SampleCfg, _> = decrypt(b"pw", &cross);
+         assert!(result.is_err());
+     }

.grade-reports/test-unit.log

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `clap_lex v1.1.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/clap_lex-1.1.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

.grade-reports/test-unit.raw

@@ -0,0 +1,18 @@
+ Downloading crates ...
+error: failed to download `clap_lex v1.1.0`
+
+Caused by:
+  unable to get packages from source
+
+Caused by:
+  failed to download replaced source registry `crates-io`
+
+Caused by:
+  failed to parse manifest at `/home/kooshapari/.cargo/registry/src/index.crates.io-6f17d22bba15001f/clap_lex-1.1.0/Cargo.toml`
+
+Caused by:
+  feature `edition2024` is required
+
+  The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.75.0).
+  Consider trying a more recent nightly release.
+  See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#edition-2024 for more information about the status of this feature.

crates/pheno-config/examples/cascade.rs

@@ -105,10 +105,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Show which layer won for each field.
     println!("\nField provenance:");
-    println!(
-        "  port = {} (env overrides > file > default)",
-        config.port
-    );
+    println!("  port = {} (env overrides > file > default)", config.port);
 
     Ok(())
 }

crates/pheno-config/examples/validation.rs

@@ -20,10 +20,7 @@ fn validate(cfg: &pheno_config::Config) -> Result<(), ConfigError> {
     if cfg.port < 1024 {
         return Err(ConfigError::ParseError {
             field: "PORT".to_owned(),
-            message: format!(
-                "port must be >= 1024 (non-privileged), got {}",
-                cfg.port
-            ),
+            message: format!("port must be >= 1024 (non-privileged), got {}", cfg.port),
         });
     }
     if cfg.log_level.is_empty() {

crates/pheno-config/tests/toml_merge_test.rs

@@ -68,9 +68,16 @@ impl EnvGuard {
 /// use a single global env var namespace, so two tests that
 /// use the same prefix will race. Per-test unique prefixes
 /// make the tests trivially parallel-safe.
+// All four are declared up front even when not every test consumes
+// each one — adding a future test in this file should pick from this
+// pool rather than invent a new prefix that might race with neighbours.
+#[allow(dead_code)]
 const PREFIX_CFP: &str = "PHENO_CONFIG_V020_CFP";
+#[allow(dead_code)]
 const PREFIX_CEO: &str = "PHENO_CONFIG_V020_CEO";
+#[allow(dead_code)]
 const PREFIX_CNE: &str = "PHENO_CONFIG_V020_CNE";
+#[allow(dead_code)]
 const PREFIX_CRE: &str = "PHENO_CONFIG_V020_CRE";
 
 /// All env var names any test in this file might set. Listed

crates/settly/src/adapters/formats.rs

@@ -1,8 +1,9 @@
 //! Format adapters for parsing configuration files.
 
-use crate::domain::{errors::ConfigError, Config, ConfigValue};
 use std::collections::HashMap;
 
+use crate::domain::{errors::ConfigError, Config, ConfigValue};
+
 /// TOML format parser.
 pub struct TomlFormat;
 

crates/settly/src/adapters/sources.rs

@@ -1,10 +1,12 @@
 //! Configuration source adapters.
 
-use crate::domain::{errors::ConfigError, sources::Source, Config, ConfigValue};
-use async_trait::async_trait;
 use std::collections::HashMap;
 use std::path::Path;
 
+use async_trait::async_trait;
+
+use crate::domain::{errors::ConfigError, sources::Source, Config, ConfigValue};
+
 /// File-based configuration source.
 pub struct FileSource {
     path: String,

crates/settly/src/application/builder.rs

@@ -1,10 +1,11 @@
 //! Configuration builder.
 
+use std::collections::HashMap;
+
 use crate::domain::{
     sources::Source, validation::Validator, Config, ConfigError, ConfigValue, LayerPriority,
     LayerStack, MergeStrategy,
 };
-use std::collections::HashMap;
 
 /// Builder for constructing configurations.
 pub struct ConfigBuilder {