[koabula]

Summary

The host could tell a 1:1 record's kind by its length. A rotation's announcement carries the whole signed bundle, about five times an ordinary message, and rebuild Welcomes and ContactAccepted each have a size of their own. The lane wrap now pads every frame so that nonce, ciphertext and tag fill the fewest whole blocks of WRAP_BLOCK = 4096 bytes.

• src/lane_wrap.rs:
  • wrap_frame pads as frame || 0x80 || 0x00*.
  • unwrap_frame refuses any length that is not a whole number of blocks before decrypting, and looks at the padding only after the AEAD has verified, so there is no padding oracle.
  • No client is deployed, so the labels stay at v1 and unpadded frames are refused.
  • Adds eight unit tests.
• WRAP_BLOCK equals the inbox's default MAX_INLINE_BYTES, so a one-block record is still stored inline.
• src/leakage_corpus.rs: only_a_payloads_size_reaches_the_host now asserts that:
  • every wrapped payload is a whole number of blocks;
  • every record the script wraps (the rotation's commit and announcement included) is exactly one block;
  • a one-block payload's length is constant across the matrix.
• contracts/leakage-ledger.json: the ciphertext_length, commit_frequency and envelope.bytes notes follow.

Known limits

• A sender whose bundle lists two or more devices still sends a multi-block announcement (estimated at more than 5 KB).
• Group records do not use lane_wrap and are not padded.
• A short message's stored record grows from about 0.9 KB to about 5.5 KB.

Test plan

• CI: cargo fmt --check, the whole test suite, and in particular the lane_wrap, leakage_ledger and leakage_corpus tests. Nothing was compiled locally; the record sizes above are estimates, and the corpus test measures them.

🤖 Generated with Claude Code