[yujiyokoo]

Summary

The Python SDK now opens the EQL rows that the Go SDK stored, and seals the same values to the same search terms. EQL (Encrypt Query Language) is CipherStash's set of PostgreSQL types for encrypted values. A new test also checks that the extension wipes its own copies of the plaintext before it frees them.

These tests need no credentials. A test build of the extension takes its keys from a fixed seed, in the same way as the Go SDK's test build.

Changes

• Test build: the engine crate has a new deterministic-kms feature.
  • _engine._use_deterministic_keys(seed) switches the process to stack-kms's DeterministicSource. The Go SDK's test build uses the same key source.
  • After the switch, the live client refuses to build. So an operation that skips the switch fails its test, and sends no request to ZeroKMS.
  • client::run! runs each operation on whichever client is in place. encrypt, decrypt, and query each write their call once.
• Go rows: tests_deterministic/test_go_rows.py reads four Go fixtures in packages/eql/tests/encryption/fixtures/. For each one, Python does three things:
  • Python opens the rows, and each value matches exactly. A float's sign and a Decimal's scale count.
  • Python seals the same values. Each stored value matches Go's, except the ciphertext c.
  • Python makes an equality query term for each value. Each one matches the term Go stored.
• Frozen rows: one of the four fixtures is stored_v4_rows_v1.json. Nothing writes it again. The Go and Rust tests already check it, and now Python does too.
• Values Python cannot hold: Go can store a year outside 1 to 9999, and a timestamp with nanoseconds. Python's datetime supports neither.
  • decrypt now refuses both with decrypt_not_representable. The message names the one cause that applies.
  • Before this change, a timestamp with nanoseconds was rounded to microseconds. The value then changed, and sealed to another equality term.
• Wiping plaintext:
  • An opened value now wipes itself when dropped. The wipe covers text, bytes, and every number.
  • decrypt and encrypt now borrow each value, and no longer move it out of its row. A moved value left its bytes in the row's buffer, and the buffer was freed with them.
  • A decrypted row is now built in one buffer. Before, the code relied on an unspecified rustc optimisation to leave no copy behind.
  • A decimal's digits are wiped after each read. They are also wiped after each conversion to a Decimal.
• Heap hygiene test: crates/engine/src/heap_hygiene.rs installs a spy allocator.
  • The spy fails a test when a block freed during encrypt, query, or decrypt still contains the plaintext.
  • The spy looks for text by a marker, and for a decimal by its digits and its mantissa.
  • A fourth test checks that the spy does fail on a leak of each needle.
  • One free is excluded: vitaminc's aws-lc backend frees an unwiped buffer on every seal. That is vitaminc's to fix.
  • Python's own objects are out of scope. The caller owns them.
• Tasks and CI:
  • mise run test:deterministic builds the test extension, then runs tests_deterministic/ in its own pytest process.
  • tests-python.yml runs it in a new step, "Python against the Go SDK's rows". The workflow also runs when the Go fixtures change.
  • CI's clippy step now lints every feature.
• maturin features: a --features flag replaces the features in pyproject.toml. So the test task names pyo3/extension-module again. Without it, maturin 1.9 links the test build to libpython.

Verification

• mise run test:cargo: all core and extension tests pass, with the 4 hygiene tests.
• I removed each wipe in turn, and a hygiene test failed each time.
• mise run test:deterministic: 18 passed.
• pytest: 353 passed, 25 skipped. The skips are the 23 live tests and 2 gate-probe tests.
• clippy and cargo fmt --check: no findings, with and without all features.
• pnpm run test:scripts: 84 of 84 files pass.
• mypy and pyright: no new findings at the second commit. Later commits changed only two assert lines in Python.
• Python 3.9: the tests passed on 3.9 up to the third commit. The last two commits ran on 3.14 only. Those two commits changed no Python code.
• The hygiene test ran on macOS only. CI runs it on Linux, so this PR's job is its first run there.

Related

Refs #1393. Refs #1341.

This PR does not close #1393. These parts of the issue are not in it:

• A live parity binary: the deterministic test build replaces it. The keys come from a seed, so no credentials are needed. With the same seed, Python can open Go's rows.
• Fixtures with no Python in the path: a test that does not go through Python checks nothing about the Python SDK.
• Frozen rows written by Python: Python opens Go's frozen rows instead. Both SDKs now share one stored format.
• The shared conformance corpus: a later PR adds it, after this stack moves onto next.

Review notes

• Start with client.rs for the switch, then heap_hygiene.rs.
• The race between the switch and the first live build is closed in both directions. No test covers it, because it needs two threads at one exact moment.
• No test covers a Python error on a date or timestamp other than a range error. to_python passes such an error on unchanged.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9ea5ac8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_encrypt_live/test_a_sqlalchemy_class_is_built_without_its_ignored_relationship	View Logs
test_encrypt_live/ test_rows_read_back_with_dict_row_decrypt_into_the_models[SqlAlchemyUser]	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}