[ElmanCod110]

Summary

This draft introduces an isolated single-file binary package format candidate for v1.0.0:

• fixed 253-byte header with an opaque, version-independent magic value;
• strict allowlisted cryptographic profile and bounded Argon2id parameters;
• independent password and pattern derivation, random root key, primary and optional recovery wrapping, and header HMAC;
• length-prefixed records, per-file secretstream chunks with authenticated file/sequence/size context, and a final encrypted binary manifest;
• strict manifest graph/path/order validation, bounded record parsing, no-overwrite creation, private staging, and conservative restore rollback;
• a normative byte-level specification, immutable compatibility fixture, and adversarial regression tests;
• CI coverage in PHP 8.2/8.3 plus a Windows job that exercises the format test.

Critical compatibility boundary

The existing V14 server writer/reader and browser V13 format are not modified or reinterpreted. This PR intentionally does not switch the production/default writer or route application endpoints to this format. Integration must be a separately reviewed change after this candidate passes CI and platform validation.

Validation status

The branch adds tests for round trips (empty, one-byte, exact-chunk and multi-chunk files), primary credentials and recovery, wrong credentials, existing-destination preservation, header/KDF/slot/chunk/file-start/manifest tampering, truncation, trailing bytes, unsafe paths and manifest graphs, source symlinks where supported, and cleanup of private staging after a tampered package. It also reads an immutable package fixture to guard against accidental format drift.

CI is running against the latest commit. Do not interpret this draft's existence as evidence of a completed independent audit, zero defects, or release readiness. Local XAMPP/shared-hosting filesystem behavior has not been independently validated here.

Release gate

Do not merge into the default branch, switch the default writer or tag v1.0.0 until every required check passes and the full writer/reader diff, parser boundaries, failure cleanup, Windows/shared-hosting filesystem behavior and release artifact have been reviewed.