Review 001 (consumer input from alkssh): VaultServiceHandle::decrypt
returned a bare heap String — decrypted secret material crossed the API
boundary with no zeroization guarantee, a window consumers could not
close from the consumer seat. Resolution paths 1+2 of the review.
- decrypt -> Result<Zeroizing<String>, VaultServiceError> (breaking;
the unlock_new precedent for the same class of secret)
- encryption::decrypt (module-internal) -> Zeroizing<String>, zeroizes
the decrypted buffer on all paths including the UTF-8 failure path,
which previously leaked unzeroized bytes inside the error value
- rotate transits through the zeroizing decrypt output; no bare String
during re-encryption
- test assertions use .as_str() for the explicit PartialEq
- docs: README example, service.md decrypt section, encryption.md
internal signatures, review 001 closed as resolved
- CHANGELOG.md established (house format); version 0.1.0 -> 0.2.0
Verification: cargo test --all-features (108) and cargo test (101) pass,
clippy --all-features --all-targets clean, cargo doc clean,
cargo publish --dry-run clean at 0.2.0.
glm-5.3-flash
bcfb368b7b