docs(intent-presets): Rust from_env() no longer activates encryption (LAB-4669)

changelog.d/20261023_lab-4669.md

@@ -0,0 +1,33 @@
+### Conformance — Rust meets Encryption Activation rule 2 from cachekit-rs 0.12.0
+
+- [`spec/intent-presets.md`](spec/intent-presets.md#sdk-conformance): the Rust cell of
+  "`CACHEKIT_MASTER_KEY` does not activate encryption on `minimal` / `production` / `io`" flips
+  ❌ → ✅ `cachekit-rs` 0.12.0+
+  ([cachekit-rs#173](https://github.com/cachekit-io/cachekit-rs/pull/173)).
+  `CacheKit::from_env()` still reads and validates `CACHEKIT_MASTER_KEY` and
+  `CACHEKIT_PREVIOUS_MASTER_KEYS` but no longer encrypts because the key is set. The new builder
+  call `.encryption_from_env()` encrypts with those keys, tenant `"default"`, and is a
+  `CachekitError::Config` when the key is unset or empty; the new `.no_encryption()` is the
+  explicit opt-out (rule 3). From 0.12.0 (still in 0.13.0) a `from_env()` builder that saw the
+  key and states no encryption intent (any encryption call, or `.no_encryption()`) fails at
+  `build()`, a transitional gate like `cachekit` 0.21.0's one-release gate; design decision (B)
+  records it. The default-tenant row adds that `.encryption_from_env()` derives under
+  `"default"` (0.12.0+), read against `default_tenant_interop` from 0.13.0. The rule 1 row lists
+  `.encryption_from_env()` (0.12.0+) and `.encryption_with_previous()` (0.11.0+) among the
+  builder encryption methods. Design decision (C) no longer says Rust carves out `from_env()`.
+  The verification paragraph records the 0.11.0, 0.12.0 and 0.13.0 `.crate` inspections.
+- [`sdk-feature-matrix.md`](sdk-feature-matrix.md):
+  - the Rust key-rotation cell and note ⁵: previous keys are applied by `::secure_from_env`
+    (0.9.0+) and `.encryption_from_env()` (0.12.0+), and by `from_env()` only through 0.11.x;
+  - the Workers feature note: without `encryption`, `.encryption_from_env()` returns `Config`,
+    and from 0.12.0 `from_env()` activates encryption in neither build, its `build()` gate
+    applying with the feature on or off;
+  - the backend-selection paragraph: from 0.12.0 `from_env()` validates the two key variables
+    and applies neither;
+  - the "`CACHEKIT_MASTER_KEY` auto-enables encryption" row and the preset-traps note: the key
+    activates only `::secure_from_env` from 0.12.0 (`from_env()` too through 0.11.x), and they
+    describe the transitional gate.
+- [`spec/encryption.md`](spec/encryption.md#key-rotation-keyring) and
+  [`decisions/key-rotation.md`](decisions/key-rotation.md) name `secure_from_env` and
+  `.encryption_from_env()` as the Rust calls that apply `CACHEKIT_PREVIOUS_MASTER_KEYS`. No
+  normative text changed.

conformance/coverage.md

@@ -150,8 +150,8 @@ Marked not-a-requirement in `spec/intent-presets.md`:
 - line 53: The key words **MUST**, MUST NOT, SHOULD, SHOULD NOT and MAY are used as in RFC 2119.
 - line 53: The key words MUST, **MUST NOT**, SHOULD, SHOULD NOT and MAY are used as in RFC 2119.
 - line 143: … storage container, which is SDK-internal (protocol#11). This specification therefore fixes no **MUST** on integrity:
-- line 499: No **MUST** on integrity. The checksum lives in the storage container, which protocol#11 makes SDK-internal; a MUST here would …
-- line 500: … on integrity. The checksum lives in the storage container, which protocol#11 makes SDK-internal; a **MUST** here would legislate the container by the back door.
+- line 502: No **MUST** on integrity. The checksum lives in the storage container, which protocol#11 makes SDK-internal; a MUST here would …
+- line 503: … on integrity. The checksum lives in the storage container, which protocol#11 makes SDK-internal; a **MUST** here would legislate the container by the back door.
 
 ## spec/interop-mode.md
 

decisions/key-rotation.md

@@ -8,7 +8,7 @@
 | **Date** | 2026-07-23 |
 | **Ticket** | LAB-516 (filed by the LAB-275 cross-SDK feature-gap audit) |
 | **Normative spec** | [`spec/encryption.md` → Key Rotation (Keyring)](../spec/encryption.md#key-rotation-keyring) — the spec section owns the rules; this record owns the rationale and runbooks. |
-| **Implementation** | Implemented and released in all three SDKs: Python (`cachekit` 0.18.0+, PyPI), Rust (`cachekit-rs` 0.8.0+, crates.io; `CACHEKIT_PREVIOUS_MASTER_KEYS` is read by its `from_env()` and, from 0.9.0, by the `secure` preset's `secure_from_env` — see the matrix note), and TypeScript (`@cachekit-io/cachekit` 0.2.1+, npm; 0.2.0 does not install) (artifacts inspected 2026-09-22, the Rust `.crate`s 2026-09-30 (0.8.0) and 2026-10-03 (0.9.0), the npm `.tgz` 2026-10-24). Shared decrypt helper `Keyring` in cachekit-core 0.5.0 ([cachekit-core#67](https://github.com/cachekit-io/cachekit-core/pull/67), LAB-683 — also deleted the `rotate_key()` stub, `KeyRotationState` and `RotationAwareHeader`); SDK surfaces in [cachekit-py#261](https://github.com/cachekit-io/cachekit-py/pull/261) (LAB-684), [cachekit-rs#63](https://github.com/cachekit-io/cachekit-rs/pull/63) (LAB-686) and [cachekit-ts#103](https://github.com/cachekit-io/cachekit-ts/pull/103) (LAB-685). The [feature matrix](../sdk-feature-matrix.md#encryption) rotation row reads ✅ for all three; conformance is enforced by [`tools/encryption-verify.py`](../tools/encryption-verify.py) against the keyring vectors in [`test-vectors/encryption.json`](../test-vectors/encryption.json) (LAB-687). |
+| **Implementation** | Implemented and released in all three SDKs: Python (`cachekit` 0.18.0+, PyPI), Rust (`cachekit-rs` 0.8.0+, crates.io; `CACHEKIT_PREVIOUS_MASTER_KEYS` is applied by the `secure` preset's `secure_from_env` from 0.9.0 and by the builder call `.encryption_from_env()` from 0.12.0, and was applied by `from_env()` through 0.11.x — see the matrix note), and TypeScript (`@cachekit-io/cachekit` 0.2.1+, npm; 0.2.0 does not install) (artifacts inspected 2026-09-22, the Rust `.crate`s 2026-09-30 (0.8.0), 2026-10-03 (0.9.0) and 2026-10-26 (0.12.0), the npm `.tgz` 2026-10-24). Shared decrypt helper `Keyring` in cachekit-core 0.5.0 ([cachekit-core#67](https://github.com/cachekit-io/cachekit-core/pull/67), LAB-683 — also deleted the `rotate_key()` stub, `KeyRotationState` and `RotationAwareHeader`); SDK surfaces in [cachekit-py#261](https://github.com/cachekit-io/cachekit-py/pull/261) (LAB-684), [cachekit-rs#63](https://github.com/cachekit-io/cachekit-rs/pull/63) (LAB-686) and [cachekit-ts#103](https://github.com/cachekit-io/cachekit-ts/pull/103) (LAB-685). The [feature matrix](../sdk-feature-matrix.md#encryption) rotation row reads ✅ for all three; conformance is enforced by [`tools/encryption-verify.py`](../tools/encryption-verify.py) against the keyring vectors in [`test-vectors/encryption.json`](../test-vectors/encryption.json) (LAB-687). |
 
 ---