stack-encrypt refactor: finalize crate ownership, naming and coordinated migration #1489

Background

Stack Encrypt (packages/stack-encrypt) is the Rust engine that every CipherStash language SDK runs on. It is published on crates.io. Vitamin C is our separate library of cryptographic primitives, formats, and encodings.

The Stack Encrypt API plan, merged in pull request #1365, ran a naming review on 8 November 2026. Every public name it covered is now decided. The packaging document proposes a crate for each trait and format. That proposal is not yet approved.

Problem

The names in code on next are still the old ones. The renames are breaking changes, so they should land together, once, before the stable release. The crate boundaries are still open, and moving a crate after release is harder.

Proposal

Part 1: apply the naming review

The plan's names table lists each decision. In short:

• StackCipher becomes Cipher, and KeysetCipher becomes Keyset.
• In Go, Client becomes Cipher, with NewCipher, and the keyset-bound Cipher becomes Keyset. Generated _stash.go files must be generated again once.
• OpSpec becomes Op.
• #[stash(context = "..")] becomes scope = "..", Plan::context(..) becomes Plan::scope(..), and Go's context= tag becomes scope=.
• The marker trait op::QueryTerm becomes Query, and LabelledTarget becomes Stored. The dynamic::QueryTerm struct keeps its name.
• The ZeroKMS unit of work Request becomes crate-private. A binding sends a serialised Plan or Planned instead.
• ContextExtension is removed. EncryptionPlan is never added.

CipherScope, dynamic::Scope, Label, and IntoLabel are removed as part of #1488.

None of these changes the stored format.

Part 2: decide the packaging

These questions are still open:

• Should stack-kms be renamed stack-zerokms?
• Which Vitamin C crate should contain Base64Text and Base85Text? The plan decided they move to Vitamin C.
• Should AsyncCipher be retired, as the packaging document proposes?
• How should the leaf cipher be split into sealing and opening? Today two types each implement half of Vitamin C's Cipher trait. Each returns an error from the other half.
• How does this fit the index crate split in stack-encrypt: every index is compiled into the core crate — move Equality, Match, Ore, Ope into their own crates #1063? Do not create a second, competing split.

Acceptance

• No old name remains in the public Rust or Go API.
• The examples in the plan's Target state compile under the new names.
• The packaging document's glossary matches the code.
• Each Part 2 question has a recorded decision.
• The dependency graph between Stack Encrypt, EQL, and Vitamin C has no cycle.
• Builds without HTTP and for WASM still work. SQL and engine interoperability are unchanged.
• Rust, EQL, and binding consumers are updated in a coordinated release, and conformance and artifact exchange pass again.

Relationship to other work

• Go SDK: methods on Cipher and Client take a *record.Plan and their docs and errors say "plan" — rename and hide them #1116 and Go: public plan-building API for types stashgen can't tag (reconcile with #1116) #1307 cover the Go plan names and a public Go plan builder.
• Pull request feat(stack-encrypt)!: derive owned record declarations with EncryptTarget and DecryptSource #1504 adds context = ".." and ContextExtension. This issue removes both. See stack-encrypt refactor: migrate record derives and plans to owned declarations #1483.
• Sequence after stack-encrypt refactor: remove transitional traits and redundant execution APIs #1488, unless a specific dependency needs a crate move first.

Plans: the Stack Encrypt API plan and the conformance roadmap.