Cryptography

Every primitive and key-handling routine lives in capsule-core::crypto; all clients and the server’s no-key validation path run the same code.

Sub-doc	Owns
Primitives	Inventory of every hash, KDF, AEAD, signature, KEM, ciphersuite and version id
Keys	Key hierarchy, account types, device directory, write authorization, rotation
MLS	Group membership, history delivery, FS/PCS
Encryption	Asset and metadata AEAD, wire formats
Provenance	Signed manifests, append-only chains, derivative provenance
Failure Modes	Failure catalog, recovery paths, transport security

Invariants

• Audited libraries only (RustCrypto, dalek, OpenMLS over libcrux); Capsule is never the first serious user of an implementation.
• Memory hygiene: plaintext and key material are zeroed on drop; secure allocation where available.
• Server stores, never authorizes: it holds ciphertext and key-free index facts; every authorization is verified against MLS-distributed material.