feat: extract Rust SDK as five workspace crates

.github/workflows/ci.yml

@@ -36,12 +36,15 @@ jobs:
               - 'apps/desktop/src-tauri/capabilities/**'
               - 'apps/desktop/src-tauri/resources/**'
               - 'apps/desktop/src-tauri/Cargo.toml'
-              - 'apps/desktop/src-tauri/Cargo.lock'
               - 'apps/desktop/src-tauri/build.rs'
               - 'apps/desktop/src-tauri/rust-toolchain.toml'
               - 'apps/desktop/index.html'
               - 'apps/desktop/vite.config.*'
               - 'apps/desktop/tsconfig*'
+              - 'crates/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'tests/vectors/**'
               - 'packages/crypto/src/**'
               - 'packages/crypto/tsconfig*'
               - '.github/workflows/ci.yml'
@@ -548,15 +551,15 @@ jobs:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            apps/desktop/src-tauri/target
-          key: windows-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+            target
+          key: windows-cargo-${{ hashFiles('Cargo.lock') }}
           restore-keys: windows-cargo-
 
-      - name: Cargo check
-        run: cargo check --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features --features winfsp
+      - name: Cargo check (workspace)
+        run: cargo check --workspace --no-default-features --features winfsp
 
-      - name: Cargo test
-        run: cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features --features winfsp
+      - name: Cargo test (workspace)
+        run: cargo test --workspace --no-default-features --features winfsp
 
   cargo-macos:
     name: Cargo Check & Test (macOS)
@@ -591,18 +594,17 @@ jobs:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            apps/desktop/src-tauri/target
-          key: macos-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+            target
+          key: macos-cargo-${{ hashFiles('Cargo.lock') }}
           restore-keys: macos-cargo-
 
-      - name: Cargo check
-        working-directory: apps/desktop/src-tauri
-        run: cargo check --no-default-features --features fuse
+      - name: Cargo check (workspace)
+        run: cargo check --workspace --no-default-features --features fuse
         env:
           PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
 
-      - name: Cargo test
-        run: cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features --features fuse
+      - name: Cargo test (workspace)
+        run: cargo test --workspace --no-default-features --features fuse
         env:
           PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
 
@@ -637,13 +639,12 @@ jobs:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            apps/desktop/src-tauri/target
-          key: linux-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+            target
+          key: linux-cargo-${{ hashFiles('Cargo.lock') }}
           restore-keys: linux-cargo-
 
-      - name: Cargo check
-        working-directory: apps/desktop/src-tauri
-        run: cargo check --no-default-features --features fuse
+      - name: Cargo check (workspace)
+        run: cargo check --workspace --no-default-features --features fuse
 
       - name: Install cargo-llvm-cov
         run: |
@@ -653,7 +654,7 @@ jobs:
       - name: Cargo test with coverage
         run: >-
           cargo llvm-cov
-          --manifest-path apps/desktop/src-tauri/Cargo.toml
+          --workspace
           --no-default-features --features fuse
           --lcov --output-path desktop-lcov.info
 
@@ -664,3 +665,48 @@ jobs:
           files: desktop-lcov.info
           flags: desktop
           fail_ci_if_error: false
+
+  vector-parity:
+    name: Cross-Language Vector Parity
+    needs: [changes, cargo-linux, test]
+    if: |
+      !failure() && !cancelled() &&
+      (needs.changes.outputs.desktop == 'true' || needs.changes.outputs.src == 'true')
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libfuse3-dev pkg-config build-essential \
+            libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev \
+            libssl-dev libxdo-dev
+
+      - name: Install Rust toolchain
+        run: rustup default stable
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Install Node dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build TypeScript packages
+        run: pnpm --filter @cipherbox/crypto build && pnpm --filter @cipherbox/core build
+
+      - name: Run Rust vector tests
+        run: cargo test -p cipherbox-crypto --test cross_language --no-default-features
+
+      - name: Run TypeScript vector tests
+        run: pnpm --filter @cipherbox/crypto test -- --reporter=verbose
+
+      - name: Check vector parity
+        run: bash scripts/check-vector-parity.sh

.github/workflows/desktop-e2e.yml

@@ -33,12 +33,15 @@ jobs:
               - 'apps/desktop/src-tauri/capabilities/**'
               - 'apps/desktop/src-tauri/resources/**'
               - 'apps/desktop/src-tauri/Cargo.toml'
-              - 'apps/desktop/src-tauri/Cargo.lock'
               - 'apps/desktop/src-tauri/build.rs'
               - 'apps/desktop/src-tauri/rust-toolchain.toml'
               - 'apps/desktop/index.html'
               - 'apps/desktop/vite.config.*'
               - 'apps/desktop/tsconfig*'
+              - 'crates/**'
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'tests/vectors/**'
               - 'packages/crypto/src/**'
               - 'packages/crypto/tsconfig*'
               - '.github/workflows/desktop-e2e.yml'
@@ -172,8 +175,8 @@ jobs:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            apps/desktop/src-tauri/target
-          key: ${{ matrix.platform }}-cargo-${{ hashFiles('apps/desktop/src-tauri/Cargo.lock') }}
+            target
+          key: ${{ matrix.platform }}-cargo-${{ hashFiles('Cargo.lock') }}
           restore-keys: ${{ matrix.platform }}-cargo-
 
       - name: Create WinFsp MSI placeholder for resource glob (Windows)
@@ -182,13 +185,13 @@ jobs:
         run: New-Item -ItemType File -Force -Path "apps/desktop/src-tauri/resources/winfsp-placeholder.msi"
 
       - name: Build debug binary
-        run: cargo build --manifest-path apps/desktop/src-tauri/Cargo.toml --no-default-features --features ${{ matrix.fuse-feature }}
+        run: cargo build -p cipherbox-desktop --no-default-features --features ${{ matrix.fuse-feature }}
         env:
           PKG_CONFIG_PATH: /opt/homebrew/lib/pkgconfig:/usr/local/lib/pkgconfig
 
       - name: Fix rpath for FUSE-T (macOS)
         if: runner.os == 'macOS'
-        run: install_name_tool -add_rpath /usr/local/lib apps/desktop/src-tauri/target/debug/${{ matrix.binary-name }} || true
+        run: install_name_tool -add_rpath /usr/local/lib target/debug/${{ matrix.binary-name }} || true
 
       # --- Install backend services ---
 
@@ -447,7 +450,7 @@ jobs:
           export VITE_API_URL=http://localhost:3000
           export VITE_TEST_LOGIN_SECRET=e2e-test-secret-ci-only
           export RUST_LOG=info
-          BINARY=apps/desktop/src-tauri/target/debug/${{ matrix.binary-name }}
+          BINARY=target/debug/${{ matrix.binary-name }}
           chmod +x "$BINARY"
           DEV_KEY=$(openssl rand -hex 32)
           "$BINARY" --dev-key $DEV_KEY > /tmp/cipherbox-desktop.log 2>&1 &
@@ -476,7 +479,7 @@ jobs:
         run: |
           Xvfb :99 -screen 0 1024x768x24 &
           sleep 1
-          BINARY=apps/desktop/src-tauri/target/debug/${{ matrix.binary-name }}
+          BINARY=target/debug/${{ matrix.binary-name }}
           chmod +x "$BINARY"
           DEV_KEY=$(openssl rand -hex 32)
           "$BINARY" --dev-key $DEV_KEY > /tmp/cipherbox-desktop.log 2>&1 &
@@ -514,7 +517,7 @@ jobs:
         if: runner.os == 'Windows'
         shell: bash
         run: |
-          BINARY="apps/desktop/src-tauri/target/debug/${{ matrix.binary-name }}"
+          BINARY="target/debug/${{ matrix.binary-name }}"
           DEV_KEY=$(openssl rand -hex 32)
           LOGFILE="$RUNNER_TEMP/cipherbox-desktop.log"
           export DESKTOP_LOG="$LOGFILE"

.gitignore

@@ -3,6 +3,7 @@ node_modules/
 
 # Build output
 dist/
+target/
 
 # Environment files
 **/.env

.learnings/2026-03-25-windows-build-debug-on-platform.md

@@ -0,0 +1,31 @@
+# Windows Build Errors Must Be Debugged on Windows
+
+**Date:** 2026-03-25
+
+## Original Prompt
+
+> In the phase 23 planning docs there is a markdown file related to the debug of the Windows build of the Tauri app. Continue debugging this issue locally until you have both working cargo scripts.
+
+## What I Learned
+
+- CI and build issues in the desktop app should **always be debugged on the target platform**. The Windows `winfsp` feature gate means the entire `platform/windows/` module tree and the desktop app's `fuse/windows/` module are never compiled on macOS or Linux. Errors are invisible until you run `cargo check` on an actual Windows machine.
+- Rust's `super::` in nested modules is a common gotcha: if you wrap code in `mod implementation { }` inside a file, `super::` from inside that inner module resolves to the **file-level module**, not the file's parent. Reaching sibling modules requires `super::super::`.
+- `pub(crate)` visibility on inner modules breaks cross-crate access. When a library crate exposes types consumed by a separate binary crate (like `cipherbox-fuse` -> `cipherbox-desktop`), those modules must be `pub`, not `pub(crate)`.
+- The macOS and Windows mount code in the desktop app are structurally similar but were written at different times. The macOS version had `.map_err(|e| format!("{}", e))` on API calls; the Windows version used bare `.await?`. Always check parity when porting patterns across platform modules.
+
+## What Would Have Helped
+
+- Running `cargo check --workspace --no-default-features --features winfsp` on Windows before merging the Phase 23 extraction work
+- A CI matrix that catches these errors before they accumulate (already exists but was failing)
+- The debug doc in `.planning/phases/23-rust-sdk-extraction/WINDOWS-BUILD-DEBUG.md` was accurate about the symptoms but the hypothesis about feature resolution was a red herring — the real issue was `super::` path depth
+
+## Key Files
+
+- `crates/fuse/src/platform/windows/mod.rs` — module declarations
+- `crates/fuse/src/platform/windows/operations.rs` — WinFsp FileSystemContext impl, delegates to sibling modules
+- `crates/fuse/src/platform/windows/read_ops.rs` — read operation handlers
+- `crates/fuse/src/platform/windows/write_ops.rs` — write operation handlers
+- `crates/fuse/src/platform/windows/dir_ops.rs` — directory operation handlers
+- `apps/desktop/src-tauri/src/fuse/windows/mod.rs` — desktop WinFsp mount/unmount
+- `apps/desktop/src-tauri/src/fuse/mod.rs` — FUSE bridge re-exports
+- `.github/workflows/ci.yml` — CI cargo-windows job definition

.planning/REQUIREMENTS.md

@@ -59,6 +59,19 @@ Requirements for IPFS infrastructure milestone. Each maps to roadmap phases.
 - [x] **SDK-10**: All transitional re-exports removed from @cipherbox/crypto; domain type imports enforced at compile time
 - [x] **SDK-11**: Release Please configured for independent per-package versioning
 
+### Rust SDK Extraction (Phase 23)
+
+- [x] **RSDK-01**: Cargo workspace at repo root with centralized `[workspace.dependencies]` and all five Rust crates as members
+- [x] **RSDK-02**: `cipherbox-crypto` crate contains pure crypto primitives (AES-GCM/CTR, ECIES, Ed25519, HKDF, IPNS name derivation) with no domain knowledge
+- [x] **RSDK-03**: Shared JSON test vectors in `tests/vectors/` loaded by both Rust and TypeScript test suites for cross-language parity verification
+- [x] **RSDK-04**: `cipherbox-core` crate contains domain types (FolderMetadata, FileMetadata, RecycleBinMetadata, DeviceRegistry), metadata encrypt/decrypt, vault blob v2, IPNS record creation
+- [x] **RSDK-05**: `cipherbox-api-client` crate provides typed HTTP client for all CipherBox API endpoints used by desktop
+- [x] **RSDK-06**: `cipherbox-fuse` crate contains platform-agnostic FUSE abstractions (InodeTable, caches, file handles) and platform-specific modules behind feature flags (fuse for macOS/Linux, winfsp for Windows)
+- [x] **RSDK-07**: `cipherbox-sdk` crate contains stateful orchestration (SyncDaemon, WriteQueue, KeyState, device registry ops) with no Tauri dependency
+- [x] **RSDK-08**: Desktop app is a thin Tauri shell (commands/, tray/, main.rs) with all logic delegated to workspace crates
+- [x] **RSDK-09**: CI workflows use workspace-level cargo commands, cache root Cargo.lock, and include cross-language vector parity gate
+- [x] **RSDK-10**: Release Please configured for independent versioning of all five Rust crates
+
 ## v1.2 Requirements
 
 Deferred to future release. Tracked but not in current roadmap.
@@ -134,14 +147,24 @@ Which phases cover which requirements. Updated during roadmap creation.
 | SDK-09      | Phase 19.1 | Pending  |
 | SDK-10      | Phase 19.1 | Complete |
 | SDK-11      | Phase 19.1 | Complete |
+| RSDK-01     | Phase 23   | Complete |
+| RSDK-02     | Phase 23   | Complete |
+| RSDK-03     | Phase 23   | Complete |
+| RSDK-04     | Phase 23   | Complete |
+| RSDK-05     | Phase 23   | Complete |
+| RSDK-06     | Phase 23   | Complete |
+| RSDK-07     | Phase 23   | Complete |
+| RSDK-08     | Phase 23   | Complete |
+| RSDK-09     | Phase 23   | Complete |
+| RSDK-10     | Phase 23   | Complete |
 
 **Coverage:**
 
-- v1.1 requirements: 37 total
-- Mapped to phases: 37
+- v1.1 requirements: 47 total
+- Mapped to phases: 47
 - Unmapped: 0
 
 ---
 
 _Requirements defined: 2026-03-07_
-_Last updated: 2026-03-23 after Phase 19.2 gap closure (PERF-09 registration)_
+_Last updated: 2026-03-24 after Phase 23 planning (RSDK-01 through RSDK-10 registered)_

.planning/ROADMAP.md

@@ -25,7 +25,7 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [x] **Phase 20: Vault Migration** - Move rootFolderKey to IPFS vault blob v2 format, making the server store zero crypto material (gap closure in progress) (completed 2026-03-24)
 - [ ] **Phase 21: BYO-IPFS Node Support** - User-configurable IPFS pinning endpoint with dual-pin strategy, Settings UI, and connection testing
 - [ ] **Phase 22: Performance Baselines Completion** - Client-side timing instrumentation, end-to-end journey timing, k6 load testing, and capacity documentation
-- [ ] **Phase 23: Rust SDK Extraction** - Extract shared cipherbox-core Rust crate mirroring @cipherbox/core and @cipherbox/sdk-core, replace duplicated crypto/IPNS/metadata logic in desktop FUSE code, enable unit testing at same granularity as TypeScript
+- [x] **Phase 23: Rust SDK Extraction** - Extract five Rust crates (crypto, core, api-client, fuse, sdk) mirroring the TypeScript SDK hierarchy, replace duplicated logic in desktop FUSE code, enable unit testing at same granularity as TypeScript (completed 2026-03-24)
 
 ## Phase Details
 
@@ -154,6 +154,32 @@ Plans:
 4. Capacity thresholds are documented with scaling recommendations (max concurrent users, storage growth projections, IPNS publish throughput limits)
    **Plans**: TBD
 
+### Phase 23: Rust SDK Extraction
+
+**Goal:** Extract five Rust crates (`cipherbox-crypto`, `cipherbox-core`, `cipherbox-api-client`, `cipherbox-fuse`, `cipherbox-sdk`) mirroring the TypeScript SDK package hierarchy. Replace duplicated crypto/IPNS/metadata logic in desktop FUSE code with crate imports. Enable unit testing at the same granularity as TypeScript. Desktop app becomes a thin Tauri shell.
+**Requirements**: RSDK-01, RSDK-02, RSDK-03, RSDK-04, RSDK-05, RSDK-06, RSDK-07, RSDK-08, RSDK-09, RSDK-10
+**Depends on:** None (can run independently alongside other phases)
+**Success Criteria** (what must be TRUE):
+
+1. Five Rust crates compile independently under a Cargo workspace with centralized dependency versions
+2. Desktop app is a thin Tauri shell (~1,500 LOC) with all logic delegated to workspace crates
+3. Cross-language test vectors in `tests/vectors/` produce identical output in both Rust and TypeScript
+4. CI runs workspace-level builds on macOS, Linux, and Windows with cross-language parity gate
+5. No duplicated crypto, domain, or API logic remains in the desktop app
+
+**Plans:** 8/8 plans complete
+
+Plans:
+
+- [x] 23-01-PLAN.md -- Cargo workspace scaffold + cipherbox-crypto crate extraction
+- [x] 23-02-PLAN.md -- cipherbox-core crate extraction (domain types, metadata, IPNS records)
+- [x] 23-03-PLAN.md -- cipherbox-api-client crate + shared test vectors extraction
+- [x] 23-04-PLAN.md -- cipherbox-fuse crate extraction (platform-agnostic + platform modules)
+- [x] 23-05-PLAN.md -- cipherbox-sdk crate extraction (sync, queue, state, registry)
+- [x] 23-06-PLAN.md -- Desktop app thin shell cleanup + full workspace verification
+- [x] 23-07-PLAN.md -- CI workspace builds + Release Please + cross-language parity gate
+- [x] 23-08-PLAN.md -- Gap closure: Move Windows WinFsp operations to crates/fuse/src/platform/windows/
+
 ## Progress
 
 **Execution Order:**
@@ -165,21 +191,10 @@ Phases execute in numeric order: 18 -> 19 -> 19.1 -> 19.2 -> 20 -> 21 -> 22
 | 19. IPNS Resolution Improvement           | v1.1      | 2/2            | Complete    | 2026-03-07 |
 | 19.1 Extract Core Crypto SDK              | v1.1      | 6/6            | Complete    | 2026-03-20 |
 | 19.2 IPFS Upload Performance Optimization | v1.1      | 4/4            | Complete    | 2026-03-23 |
-| 20. Vault Migration                       | 6/6       | Complete       | 2026-03-24  | -          |
+| 20. Vault Migration                       | v1.1      | 6/6            | Complete    | 2026-03-24 |
 | 21. BYO-IPFS Node Support                 | v1.1      | 0/?            | Not started | -          |
 | 22. Performance Baselines Complete        | v1.1      | 0/?            | Not started | -          |
-| 23. Rust SDK Extraction                   | v1.1      | 0/?            | Not started | -          |
-
-### Phase 23: Rust SDK Extraction
-
-**Goal:** Extract shared `cipherbox-core` Rust crate mirroring `@cipherbox/core` and `@cipherbox/sdk-core` TypeScript packages. Replace duplicated crypto/IPNS/metadata logic in desktop FUSE code with crate imports. Enable unit testing at the same granularity as TypeScript. Platform-specific plans for macOS (FUSE-T SMB), Linux (kernel FUSE), Windows (WinFSP).
-**Requirements**: TBD
-**Depends on:** None (can run independently alongside other phases)
-**Plans:** 0 plans
-
-Plans:
-
-- [ ] TBD (run /gsd:plan-phase 23 to break down)
+| 23. Rust SDK Extraction                   | v1.1      | 8/8            | Complete    | 2026-03-24 |
 
 ---