feat(crypto): add native Rust encryption and a minimal local CLI

.github/workflows/rust-crypto.yml

@@ -0,0 +1,49 @@
+name: Rust encryption
+on:
+  push:
+    paths: ['rust/Cargo.*', 'rust/crates/msg-core/**', 'rust/crates/msg-crypto/**', 'rust/tests/test_crypto_parity.py', '.github/workflows/rust-crypto.yml']
+  pull_request:
+    paths: ['rust/Cargo.*', 'rust/crates/msg-core/**', 'rust/crates/msg-crypto/**', 'rust/tests/test_crypto_parity.py', '.github/workflows/rust-crypto.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  crypto:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+          allow-prereleases: true
+      - name: Install test dependencies
+        run: |
+          rustup toolchain install 1.85.0 --profile minimal --component rustfmt,clippy
+          python -m pip install cryptography==46.0.3 ruff==0.16.9
+      - name: Format and reference harness style
+        run: |
+          cargo +1.85.0 fmt --manifest-path rust/Cargo.toml --all -- --check
+          python -m ruff check rust/tests/test_crypto_parity.py
+          python -m ruff format --check rust/tests/test_crypto_parity.py
+      - name: Native tests and lint
+        if: ${{ !cancelled() }}
+        working-directory: rust
+        run: |
+          cargo +1.85.0 test --locked -p msg-crypto
+          cargo +1.85.0 clippy --locked -p msg-crypto --all-targets -- -D warnings
+          cargo +1.85.0 build --locked -p msg-crypto
+      - name: Python and Rust interoperability
+        env:
+          PYTHONPATH: src
+        run: python rust/tests/test_crypto_parity.py --binary rust/target/debug/msg-crypto --report rust/artifacts/crypto.json
+      - uses: actions/upload-artifact@v7
+        if: ${{ always() }}
+        with:
+          name: crypto-${{ github.sha }}
+          path: |
+            rust/Cargo.lock
+            rust/artifacts/crypto.json
+          if-no-files-found: error

.github/workflows/rust-server.yml

@@ -0,0 +1,110 @@
+name: Rust daemon
+on:
+  push:
+    branches: [main]
+    paths: ['rust/**', '.github/workflows/rust-server.yml']
+  pull_request:
+    paths: ['rust/**', '.github/workflows/rust-server.yml']
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: rust-daemon-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  identity:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+    env:
+      CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: fallback
+      MSG_PG_TEST_ADMIN_DSN: postgresql://postgres:postgres@127.0.0.1:5432/postgres
+      PYTHONPATH: src
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+      - name: Install native and reference dependencies
+        run: |
+          rustup toolchain install 1.85.0 --profile minimal
+          sudo apt-get update -qq -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources -o Dir::Etc::sourceparts=-
+          sudo apt-get install -y age
+          python -m pip install 'cryptography==46.0.3' 'jsonschema>=4.25,<5' 'referencing>=0.36,<1' 'psycopg[binary]>=3.2,<4'
+      - name: Build native identity fixture
+        working-directory: rust
+        run: cargo +1.85.0 build -p msg-storage --example identity_lifecycle_check
+      - name: PostgreSQL issuance and browser interoperation
+        run: python rust/tests/test_identity_lifecycle.py --binary rust/target/debug/examples/identity_lifecycle_check --report rust/artifacts/identity-lifecycle.json
+      - name: Storage lifecycle and recovery tests
+        if: ${{ !cancelled() }}
+        working-directory: rust
+        run: cargo +1.85.0 test -p msg-storage --all-targets
+      - uses: actions/upload-artifact@v7
+        if: ${{ always() }}
+        with:
+          name: daemon-identity-${{ github.sha }}
+          path: rust/artifacts/identity-lifecycle.json
+          if-no-files-found: warn
+  native:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: fallback
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Install Rust
+        run: |
+          rustup toolchain install 1.85.0 --profile minimal --component rustfmt,clippy
+          sudo apt-get update -qq -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources -o Dir::Etc::sourceparts=-
+          sudo apt-get install -y age
+      - name: Native tests
+        working-directory: rust
+        run: cargo +1.85.0 test --workspace --all-targets
+      - name: Native lint
+        if: ${{ !cancelled() }}
+        working-directory: rust
+        run: |
+          cargo +1.85.0 fmt --all -- --check
+          cargo +1.85.0 clippy --workspace --all-targets -- -D warnings
+      - uses: actions/upload-artifact@v7
+        if: ${{ always() }}
+        with:
+          name: daemon-lock-${{ github.sha }}
+          path: rust/Cargo.lock
+          if-no-files-found: error
+  reference:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.15'
+      - name: Install reference dependencies
+        run: python -m pip install 'cryptography==46.0.3' 'httpx>=0.28,<1' 'jsonschema>=4.25,<5' 'referencing>=0.36,<1' 'starlette>=0.50,<2' 'aiohttp>=3.13,<4' 'graphql-core>=3.2.7,<3.3' 'dnspython>=2.8,<3' 'markdown-it-py>=4,<5' 'pygments>=2.19,<3'
+      - name: Export service contracts
+        env:
+          PYTHONPATH: src
+        run: python rust/tools/export_catalog.py --output rust/artifacts/catalog.json
+      - uses: actions/upload-artifact@v7
+        with:
+          name: daemon-reference-${{ github.sha }}
+          path: rust/artifacts/*.json
+          if-no-files-found: error

.github/workflows/rust-wire.yml

@@ -67,7 +67,8 @@ jobs:
         env:
           PYTHONPATH: src
         run: |
-          cargo +1.85.0 build --locked --manifest-path rust/Cargo.toml --workspace --examples
+          cargo +1.85.0 build --locked --manifest-path rust/Cargo.toml --workspace --examples --bins
+          python rust/tests/test_crypto_parity.py --binary rust/target/debug/msg-crypto --report rust/artifacts/crypto-debug.json
           python rust/tests/test_python_parity.py --binary rust/target/debug/examples/wire_check --report rust/artifacts/parity.json
           python rust/tests/test_identity_parity.py --binary rust/target/debug/examples/authority_check --report rust/artifacts/identity-parity.json
           python rust/tests/test_storage_parity.py --binary rust/target/debug/examples/writer_check --report rust/artifacts/storage-parity.json
@@ -81,7 +82,8 @@ jobs:
         env:
           PYTHONPATH: src
         run: |
-          cargo +1.85.0 build --release --locked --manifest-path rust/Cargo.toml --workspace --examples
+          cargo +1.85.0 build --release --locked --manifest-path rust/Cargo.toml --workspace --examples --bins
+          python rust/tests/test_crypto_parity.py --binary rust/target/release/msg-crypto --report rust/artifacts/crypto-release.json
           python rust/tests/test_python_parity.py --binary rust/target/release/examples/wire_check --report rust/artifacts/parity-release.json
           python rust/tests/test_identity_parity.py --binary rust/target/release/examples/authority_check --report rust/artifacts/identity-parity-release.json
           python rust/tests/test_storage_parity.py --binary rust/target/release/examples/writer_check --report rust/artifacts/storage-parity-release.json

README.md

@@ -17,6 +17,11 @@ English · [简体中文](README.zh-CN.md)
 
 The repository is [**msg**](https://github.com/TokenNotIncluded/msg). **`msg`** is the client command and **`msgd`** is the server command; the PyPI distribution remains **`msgctl`**. See the [documentation guide](docs/README.md) for current manuals and historical evidence.
 
+The [Rust rewrite](rust/README.md) includes `msg-crypto`, an offline tool for
+key generation, encryption and decryption compatible with Python's
+`msg-x25519-v1` files. The production `msg` and `msgd` entry points remain Python
+until their native replacements pass the [migration gates](rust/MIGRATION.md).
+
 ![MSG terminal walkthrough: connect, read, post, reply and create a Git repository](docs/media/msg-terminal-demo.gif)
 
 *Illustrated command walkthrough with sample content, not a recording of live messages. [Commands and demo source](docs/TERMINAL_DEMO.md) · [Watch the video on X](https://x.com/LIghtJUNction_x/status/2105389700534137061).*

README.zh-CN.md

@@ -19,6 +19,10 @@
 
 现行手册和历史依据见[文档导航](docs/README.md)。
 
+[Rust 重写](rust/README.md)已提供独立的 `msg-crypto`：本地生成密钥、加密和解密，
+与 Python 的 `msg-x25519-v1` 加密文件互通。生产入口 `msg`、`msgd` 仍使用 Python，
+逐项通过[迁移验收](rust/MIGRATION.md)后再切换。
+
 ![MSG 终端演示：连接、读帖、发帖、回复和创建 Git 仓库](docs/media/msg-terminal-demo.gif)
 
 *动图为命令流程示意，使用演示内容，没有向线上发消息。[命令和动图生成方式](docs/TERMINAL_DEMO.md) · [在 X 看视频](https://x.com/LIghtJUNction_x/status/2105389700534137061)。*