[LIghtJUNction]

Why

Python currently owns recipient encryption. The Rust rewrite needs a small usable encryption path that can read existing files before native clients or the daemon can replace Python.

Changes

• Extend the existing msg-crypto crate with msg-x25519-v1 envelopes: X25519, HKDF-SHA256 and AES-256-GCM, using the same canonical header and authenticated data as Python.
• Add three Unix CLI commands: keygen, encrypt and decrypt. Keep private keys local, require safe key-file ownership/permissions, create outputs with mode 0600, reject symlinks and existing outputs, and authenticate before writing plaintext.
• Bound inputs, reject low-order keys and malformed envelopes, and clear owned secret buffers.
• Add direct Python/Rust interoperability checks and scoped CI. Commit the Cargo-generated lockfile and require --locked for builds, tests and Clippy.
• Document the native tool in both root READMEs. Retain MIT licensing and the existing workspace structure.

Validation

Locked Rust encryption CI passed on Rust 1.85 and Python 3.15:

• 7 Rust tests; 64 actual Python/Rust checks, including both encryption directions, binary/empty/bounded inputs, historical larger envelopes, tampering, low-order keys, permissions, symlinks, FIFOs and closed stdout.
• Rustfmt, Ruff check/format, Clippy with warnings denied, and the native build.

The preceding issue-recovery regression run also passed. The PR workflows recheck the final review tree.

Migration boundary

This delivers the local encryption slice. Production msg and msgd remain Python; issuance, password-wrapped signing keys, remote keystore operations and the native daemon are still outstanding. The fixed migration checklist remains 5 completed / 6 remaining. No production entry point or deployment is changed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	⚠️ Failed 2026-10-21T23:50:51.230211Z We couldn’t complete this review. Comment @codex security review to try again.	071a0ac	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.