security: independently review the v1 envelope and define post-preview promotion

[forkwright]

Finding

The v1 Sphragis envelope remains deliberately unaudited and default-inert. Exact main@0b9381ac still declares preview-pq, with default features empty, and both Cargo.toml and DECISION.md say independent cryptographic review is required before promotion.

Closed #23 correctly narrowed the normal API to the versioned envelope profile and put raw primitive access behind hazmat; it did not perform the independent review or decide the post-preview packaging boundary. Closed Akroasis #172 explicitly required this work to be re-filed as a discrete issue.

RustCrypto now publishes stable x-wing 0.1.0, but its own README states that it has never been independently audited. Stability alone does not satisfy the historical stable-and-audited provider gate.

Why this matters

Known-answer vectors and provenance locks establish conformance to claimed inputs; they do not establish implementation security, API misuse resistance, or a safe default boundary. Removing the preview warning without an immutable, independent review would turn an explicitly qualified primitive into an implied production claim.

Done when

1. The review target is immutable: exact Sphragis commit/release, resolved dependency versions, primitive provider, feature set, and v1 wire profile.
2. A qualified independent cryptographic review covers the X-Wing provider, KDF/AEAD composition, recipient/AAD/domain/version binding, CBOR boundary, entropy failures, zeroization, rotation contract, and safe-versus-hazmat API boundary.
3. A durable review artifact names the reviewer, date, exact SHA, scope, exclusions, method, and findings.
4. Every finding is fixed with regression coverage or explicitly accepted by the operator with durable rationale.
5. The review records a provider disposition for RustCrypto x-wing 0.1.0: retain the reviewed local provider, or migrate only with independent coverage and byte-identical v1 key/ciphertext/shared-secret vectors. Any incompatibility requires a new wire version, never a silent v1 swap.
6. Only after a favorable disposition, publish an exact reviewed release and deliberately define post-preview packaging. Dropping preview-pq does not automatically mean enabling cryptography by default; a stable opt-in feature is valid if that is the reviewed boundary.
7. If promotion is rejected, retain the preview gate and warnings and record the rejection rather than implying completion.
8. Publish an exact consumer handoff tag/revision for Akroasis to adopt.

Relationships

• Refs design-input: hybrid PQ content-key wrapping (ECDH P-256 + ML-KEM-768) for multi-device vault akroasis#131 and decision: fleet post-quantum hybrid sealing (sphragis = X-Wing + ChaCha20-Poly1305 envelope) akroasis#172 as closed decision history.
• Builds on Define revocation as key rotation, not re-wrapping a key the revoked device already knows #14, Make the cryptographic acceptance gate execute every claimed KAT and bind its provenance #18, and Make Sphragis a versioned envelope profile over upstream cryptographic primitives #23.
• First consumer: feat(pinax): persist Sphragis-wrapped content-key epochs in the reference store akroasis#395.