feat(persistence): add crash-safe versioned conference persistence

Cargo.toml

@@ -42,6 +42,7 @@ getrandom = { version = "0.4", default-features = false }
 thiserror = { version = "2.0", default-features = false }
 arbitrary = { version = "1.4", features = ["derive"] }
 hex = { version = "0.4", default-features = false, features = ["alloc"] }
+fs2 = { version = "0.4.3", default-features = false }
 
 [workspace.lints.rust]
 missing_docs = "warn"

README.md

@@ -86,7 +86,7 @@ build rather than the call.
 
 | feature | effect |
 |---|---|
-| `std` *(default)* | standard library; without it the crates are `no_std` + `alloc` |
+| `std` *(default)* | standard library and `cfr::persistence`; without it the crates are `no_std` + `alloc` |
 | `hwaes` *(default)* | AEGIS-256 with hardware AES; needs a C compiler |
 | `portable` | AEGIS-256 in pure Rust, no C toolchain |
 | `pq` | X25519 + ML-KEM-768 hybrid |

crates/cfr-core/Cargo.toml

@@ -23,6 +23,7 @@ thiserror     = { workspace = true }
 default = ["std"]
 std     = ["thiserror/std", "cfr-crypto/std"]
 pq      = ["cfr-crypto/pq"]
+persistence = ["cfr-crypto/persistence"]
 
 [lints]
 workspace = true

crates/cfr-core/src/channel.rs

@@ -16,8 +16,8 @@ pub const MAX_BUFFERED: usize = 64;
 
 /// One direction of a pairwise channel.
 pub struct Chan {
-    chain: Secret<KEY_LEN>,
-    next: u64,
+    pub(crate) chain: Secret<KEY_LEN>,
+    pub(crate) next: u64,
 }
 
 impl Chan {
@@ -74,8 +74,8 @@ impl Chan {
 
 /// The receiving side: a ratchet plus a bounded reordering buffer.
 pub struct RecvChan {
-    chan: Chan,
-    buffer: BTreeMap<u64, Vec<u8>>,
+    pub(crate) chan: Chan,
+    pub(crate) buffer: BTreeMap<u64, Vec<u8>>,
 }
 
 impl RecvChan {

crates/cfr-core/src/dag.rs

@@ -19,11 +19,11 @@ pub const MAX_OPS: usize = 4096;
 #[derive(Default)]
 pub struct Dag {
     /// Increments on mutation to invalidate derived caches.
-    epoch: u64,
-    ops: BTreeMap<Oid, Op>,
-    parents: BTreeMap<Oid, BTreeSet<Oid>>,
+    pub(crate) epoch: u64,
+    pub(crate) ops: BTreeMap<Oid, Op>,
+    pub(crate) parents: BTreeMap<Oid, BTreeSet<Oid>>,
     /// Cached transitive ancestor sets, cleared on mutation.
-    cache: RefCell<BTreeMap<Oid, BTreeSet<Oid>>>,
+    pub(crate) cache: RefCell<BTreeMap<Oid, BTreeSet<Oid>>>,
 }
 
 impl Dag {

crates/cfr-core/src/keys.rs

@@ -53,9 +53,9 @@ pub fn version_of(nodes: &BTreeSet<Oid>, membership_root: &[u8; 32]) -> [u8; 8]
 ///
 /// Eviction erases the key material and ends local derivability of that version.
 pub struct NodeKeys {
-    keys: BTreeMap<Oid, Secret<KEY_LEN>>,
-    order: Vec<Oid>,
-    capacity: usize,
+    pub(crate) keys: BTreeMap<Oid, Secret<KEY_LEN>>,
+    pub(crate) order: Vec<Oid>,
+    pub(crate) capacity: usize,
 }
 
 impl Default for NodeKeys {

crates/cfr-core/src/lib.rs

@@ -35,6 +35,9 @@ pub mod op;
 pub mod prekey;
 pub mod wire;
 
+#[cfg(feature = "persistence")]
+mod state;
+
 pub use checkpoint::{
     media_context_id, Capabilities, CheckpointCertificate, CheckpointSignature, ProtocolProfile,
     ResumptionRecord, PROTOCOL_ID,

crates/cfr-core/src/member.rs

@@ -70,16 +70,16 @@ pub enum Beacon {
     Unknown,
 }
 
-struct SendState {
-    chan: Chan,
+pub(crate) struct SendState {
+    pub(crate) chan: Chan,
 }
 
-struct RecvState {
-    eph: DhPublic,
-    chan: RecvChan,
+pub(crate) struct RecvState {
+    pub(crate) eph: DhPublic,
+    pub(crate) chan: RecvChan,
 }
 
-struct Derived {
+pub(crate) struct Derived {
     epoch: u64,
     guilty: usize,
     frontier: BTreeSet<Oid>,
@@ -91,7 +91,7 @@ struct Derived {
 /// Cache key for membership evaluated over one causal dependency set.
 type AuthorizationCacheKey = ([u8; 32], u64, usize);
 /// Memoized membership rosters keyed by causal past and derived-state epoch.
-type AuthorizationCache = BTreeMap<AuthorizationCacheKey, BTreeSet<SigPublic>>;
+pub(crate) type AuthorizationCache = BTreeMap<AuthorizationCacheKey, BTreeSet<SigPublic>>;
 
 /// A participant that has generated identity material but not yet joined.
 pub struct PendingJoin {
@@ -207,36 +207,36 @@ impl PendingJoin {
 
 /// A conference participant.
 pub struct Participant {
-    identity: SigSecret,
-    ipk: SigPublic,
-    sid: SessionId,
-    policy: Policy,
-    seed0: Secret<KEY_LEN>,
+    pub(crate) identity: SigSecret,
+    pub(crate) ipk: SigPublic,
+    pub(crate) sid: SessionId,
+    pub(crate) policy: Policy,
+    pub(crate) seed0: Secret<KEY_LEN>,
 
-    dag: Dag,
-    guilty: BTreeSet<SigPublic>,
+    pub(crate) dag: Dag,
+    pub(crate) guilty: BTreeSet<SigPublic>,
 
-    prekeys: PrekeyPool,
-    peer_prekeys: BTreeMap<SigPublic, (u32, DhPublic)>,
-    send: BTreeMap<SigPublic, SendState>,
-    recv: BTreeMap<SigPublic, RecvState>,
+    pub(crate) prekeys: PrekeyPool,
+    pub(crate) peer_prekeys: BTreeMap<SigPublic, (u32, DhPublic)>,
+    pub(crate) send: BTreeMap<SigPublic, SendState>,
+    pub(crate) recv: BTreeMap<SigPublic, RecvState>,
 
-    nodekeys: NodeKeys,
-    cparents: BTreeMap<Oid, BTreeSet<Oid>>,
-    absorbed: BTreeSet<Oid>,
-    missing: BTreeSet<Oid>,
+    pub(crate) nodekeys: NodeKeys,
+    pub(crate) cparents: BTreeMap<Oid, BTreeSet<Oid>>,
+    pub(crate) absorbed: BTreeSet<Oid>,
+    pub(crate) missing: BTreeSet<Oid>,
 
-    pending: Vec<Op>,
-    open_accusations: Vec<Op>,
+    pub(crate) pending: Vec<Op>,
+    pub(crate) open_accusations: Vec<Op>,
 
-    seen_versions: BTreeMap<[u8; 8], (BTreeSet<Oid>, [u8; 32])>,
-    last_version: [u8; 8],
+    pub(crate) seen_versions: BTreeMap<[u8; 8], (BTreeSet<Oid>, [u8; 32])>,
+    pub(crate) last_version: [u8; 8],
 
     /// Memoized membership rosters for equivalent causal dependency sets.
-    authz: RefCell<AuthorizationCache>,
+    pub(crate) authz: RefCell<AuthorizationCache>,
 
     /// Graph-derived values, invalidated when graph or accusation state changes.
-    derived: RefCell<Option<Derived>>,
+    pub(crate) derived: RefCell<Option<Derived>>,
 }
 
 impl Participant {
@@ -1158,7 +1158,7 @@ impl Participant {
         }
     }
 
-    fn check_accusation(&self, acc: &Op) -> bool {
+    pub(crate) fn check_accusation(&self, acc: &Op) -> bool {
         let Body::Accuse { who, coid, mk, seq } = &acc.body else {
             return false;
         };

crates/cfr-core/src/prekey.rs

@@ -15,11 +15,11 @@ pub const SEAL_AFTER: u32 = 64;
 
 /// A single prekey generation.
 pub struct PrekeyPool {
-    generation: u32,
-    secret: Option<DhSecret>,
-    public: DhPublic,
-    established: BTreeSet<SigPublic>,
-    age: u32,
+    pub(crate) generation: u32,
+    pub(crate) secret: Option<DhSecret>,
+    pub(crate) public: DhPublic,
+    pub(crate) established: BTreeSet<SigPublic>,
+    pub(crate) age: u32,
 }
 
 impl PrekeyPool {