carlos / contra Public

Depends on shared/1 (vectors). Independent of everything else.

Why this is native work that can start now, when the Mac app cannot. AGENTS.md decision 6 puts the Mac app after the web console, because a second client written against a moving contract produces two half-designs. That reasoning binds the UI, not the crypto: the crypto's contract is the golden vectors and DESIGN.md, both of which are fixed before either client exists. So this is the native work that is genuinely contract-independent, and doing it now de-risks slice 2 rather than front-running it.

Deliverable: a Swift implementation of the hierarchy that passes the same vector file the Go and JS suites pass —

• Argon2id m=64MiB, t=3, p=1 (note: no SharedArrayBuffer constraint applies here, but p=1 is fixed by the vectors and must not be "optimised" on native — that would break byte-identity, which is the entire point)
• Every HKDF label, the KCV, P-256 seed-to-keypair with rejection sampling, AES-256-GCM with the AAD binding
• Crockford Base32 with the O→0, I/L→1 mappings and the self-healing checksum

Done when: the Swift suite consumes the same JSON vector file — not a transcribed copy — and passes. A transcribed copy is a second source of truth and will drift.

Trap: CryptoKit's defaults are not always our parameters. Pin everything explicitly and let the vectors catch you.

Branch: native/crypto-core.