feat(stack-encrypt)!: add OpaqueBlob whole-value encryption

.github/workflows/bench-eql.yml

@@ -64,6 +64,7 @@ on:
       - "packages/eql/docker/**"
       - "packages/eql/README.md"
       - "packages/eql/SUPABASE.md"
+      - "conformance/stack-encrypt/**"
       - "packages/stack-encrypt/**"
       - "packages/stack-encrypt-derive/**"
       - "packages/stack-kms/**"

.github/workflows/crap-crates.yml

@@ -56,10 +56,12 @@ env:
   CARGO_NET_GIT_FETCH_WITH_CLI: true
   NEXTEST_PROFILE: ci
 
+# cargo-crap 0.6.1's prebuilt GNU/Linux binary needs GLIBC 2.39 (Ubuntu 24.04).
+# Keep the runner and its mise cache on that image. The gate itself is unchanged.
 jobs:
   crap-stack-auth:
     name: CRAP (stack-auth)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -74,16 +76,19 @@ jobs:
           working_directory: .
           cache: true
           # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
-          cache_key_prefix: mise-v1-ubuntu-2204
+          cache_key_prefix: mise-v1-ubuntu-2404
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
+      - name: Check the CRAP executable before collecting coverage
+        run: cargo crap --version
+
       - name: Run the CRAP gate
         run: mise run crap:stack-auth -- --format github
 
   crap-stack-encrypt:
     name: CRAP (stack-encrypt)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: blacksmith-16vcpu-ubuntu-2404
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -97,9 +102,12 @@ jobs:
           working_directory: .
           cache: true
           # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
-          cache_key_prefix: mise-v1-ubuntu-2204
+          cache_key_prefix: mise-v1-ubuntu-2404
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
+      - name: Check the CRAP executable before collecting coverage
+        run: cargo crap --version
+
       - name: Run the CRAP gate
         run: mise run crap:stack-encrypt -- --format github

.github/workflows/test-eql.yml

@@ -109,6 +109,7 @@ on:
       # cannot see them (a task body names a cargo package, not a path); the
       # manifest walk in eql-suite-ci.test.mjs does, and fails when one of them
       # is missing from this list.
+      - "conformance/stack-encrypt/**"
       - "packages/stack-encrypt/**"
       - "packages/stack-encrypt-derive/**"
       - "packages/stack-kms/**"
@@ -208,6 +209,7 @@ jobs:
               - "packages/eql/docker/**"
               - "packages/eql/README.md"
               - "packages/eql/SUPABASE.md"
+              - "conformance/stack-encrypt/**"
               - "packages/stack-encrypt/**"
               - "packages/stack-encrypt-derive/**"
               - "packages/stack-kms/**"

.github/workflows/tests-golang.yml

@@ -60,6 +60,9 @@ on:
       - scripts/go-binding-test.sh
       - scripts/stack-conformance.sh
       - scripts/stack-conformance-selection.mjs
+      - scripts/stack-eql-conformance.mjs
+      - scripts/stack-conformance-evidence.mjs
+      - scripts/stack-lifecycle-conformance.mjs
       - Cargo.toml
       - Cargo.lock
       - .cargo/**
@@ -99,6 +102,9 @@ on:
       - scripts/go-binding-test.sh
       - scripts/stack-conformance.sh
       - scripts/stack-conformance-selection.mjs
+      - scripts/stack-eql-conformance.mjs
+      - scripts/stack-conformance-evidence.mjs
+      - scripts/stack-lifecycle-conformance.mjs
       - Cargo.toml
       - Cargo.lock
       - .cargo/**
@@ -144,6 +150,18 @@ jobs:
         with:
           persist-credentials: false
 
+      # Native EQL conformance uses the EQL workspace's toolchain. Install it
+      # before root setup, so ordinary guest commands retain the root pin.
+      # Its local DATABASE_URL must not enable database tests in this job.
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        with:
+          version: 2026.4.0
+          install: true
+          working_directory: packages/eql
+          env: false
+          cache: true
+          cache_key_prefix: mise-v1-ubuntu-2204
+
       - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
         with:
           version: 2026.4.0
@@ -258,6 +276,28 @@ jobs:
           echo "RLIMIT_MEMLOCK: $(ulimit -l) KiB"
           mise run go:test
 
+      - name: Required lifecycle and key-I/O conformance
+        env:
+          STACK_CONFORMANCE_REPORT_DIR: ${{ runner.temp }}/lifecycle-conformance
+        run: mise run test:conformance:lifecycle
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: lifecycle-conformance
+          path: ${{ runner.temp }}/lifecycle-conformance/*.json
+          if-no-files-found: error
+
+      - name: Required EQL and JSON conformance
+        env:
+          STACK_CONFORMANCE_REPORT_DIR: ${{ runner.temp }}/eql-conformance-fast
+        run: mise run test:conformance:eql
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: eql-conformance-fast
+          path: ${{ runner.temp }}/eql-conformance-fast/*.json
+          if-no-files-found: error
+
       - name: Fresh Go scalar artifacts open in Rust
         env:
           STACK_CONFORMANCE_INPUT: ${{ runner.temp }}/stack-conformance-go.json
@@ -392,6 +432,8 @@ jobs:
   # v4 bundle under packages/eql's mise config, which pins its own Rust; the
   # guests are the ones wasi-check built and checked.
   eql-postgres:
+    env:
+      MISE_ENV: test
     name: Go rows and queries in PostgreSQL with EQL v4
     needs: wasi-check
     runs-on: blacksmith-16vcpu-ubuntu-2204
@@ -434,6 +476,16 @@ jobs:
           # Must name runs-on's image; see scripts/__tests__/workflow-mise-cache-image.test.mjs
           cache_key_prefix: mise-v1-ubuntu-2204
 
+      # mise caches Rust symlinks, not ~/.rustup. A cache hit can leave a
+      # toolchain directory without cargo and still report "all tools installed".
+      # Reconcile both workspaces' configured toolchains before cargo is used.
+      - name: Restore Rust toolchains behind the cached mise links
+        run: |
+          mise install --force rust
+          mise -C packages/eql install --force rust
+          mise x -- cargo --version
+          mise -C packages/eql x -- cargo --version
+
       # `mise run build` compiles eql-codegen to write the bundle.
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -459,11 +511,18 @@ jobs:
 
       # Builds the bundle from the tree, installs it, and runs the tests; a
       # skip fails the task, so a missing guest or database cannot pass.
-      - name: Go rows and queries through EQL v4
+      - name: Go rows, queries and required JSON conformance through EQL v4
         env:
           EQL_TEST_DATABASE_URL: "host=localhost port=${{ job.services.postgres.ports['5432'] }} user=postgres password=postgres dbname=postgres sslmode=disable"
+          STACK_CONFORMANCE_REPORT_DIR: ${{ runner.temp }}/eql-conformance-postgres
         run: mise run go:test:postgres
 
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: eql-conformance-postgres
+          path: ${{ runner.temp }}/eql-conformance-postgres/*.json
+          if-no-files-found: error
+
   # Round trips through real ZeroKMS. The Go live tests skip without their
   # STACK_ENCRYPT_TEST_* variables, so the secrets pre-flight runs first and
   # turns a missing credential into a failure rather than a silent skip. The