Release Notes — Cryptography IHmacAlgorithm primitive

Sprint: SPRINT_20260430_000_Cryptography_hmac_primitive Module: Cryptography (src/Cryptography/)

20260430-017 follow-up — assembly unified, collision retired

The primitive originally shipped in a parallel project at src/Cryptography/StellaOps.Cryptography/. That project’s default AssemblyName collided with the legacy src/__Libraries/StellaOps.Cryptography/ (both produced StellaOps.Cryptography.dll), so any service whose dependency graph reached both projects ended up with one DLL on disk and the legacy StellaOps.Cryptography.Audit.IAuthEventSink type silently dropped — breaking Auth.ServerIntegration at runtime. SPRINT_20260430_005 papered over the collision with <AssemblyName>StellaOps.Cryptography.Primitives</AssemblyName> as a stop-gap.

SPRINT_20260430_017 retires the collision. All types from src/Cryptography/StellaOps.Cryptography/ (HMAC primitives, plus pre-existing IContentSigner, IContentVerifier, MultiProfileSigner, SignatureProfile, Models/*, KeyEscrow/*) plus DefaultHmacAlgorithm and FipsHmacAlgorithm moved into the canonical legacy assembly at src/__Libraries/StellaOps.Cryptography/. The duplicate-name csproj was deleted. Public namespaces are unchanged (StellaOps.Cryptography, StellaOps.Cryptography.Plugin, StellaOps.Cryptography.Plugin.Fips); consumer source code did not change. The SPRINT_005 Primitives rename was reverted (the renamed csproj is gone). Single StellaOps.Cryptography.dll is produced from the canonical project again. The conformance test allowlist was updated to reflect the new file locations and (unrelated to this sprint’s scope) absorbed 9 pre-existing legacy callsites with explicit follow-up task IDs (HMAC-CLEANUP-CLI-01, HMAC-CLEANUP-EXPORT-01…02, HMAC-CLEANUP-NOTIFY-01…04).

Summary

Introduces a top-level HMAC primitive — StellaOps.Cryptography.IHmacAlgorithm — in the core cryptography library. The primitive is required so that all HMAC operations across the StellaOps repository route through the regional crypto-plugin substitution pipeline (FIPS / GOST / SM / eIDAS), instead of calling System.Security.Cryptography.HMAC* directly.

Without this primitive, the downstream sprints SPRINT_20260430_001_Policy_registry_webhook_signature_validation and SPRINT_20260430_005_Notify_external_webhook_signature_validation would have to call BCL HMAC types directly, bypassing the regional plugin substitution that FIPS / GOST / SM installs depend on.

New public surface

Behaviour

Backwards-compatibility

Architecture-conformance enforcement

A new conformance test (CRYPTO-HMAC-05) — see src/Cryptography/__Tests/StellaOps.Cryptography.Tests/HmacBclCallSiteConformanceTests.cs — scans src/** for \bHMACSHA(256|384|512)\b references and fails the build if any file outside the crypto-plugin allow-list contains a direct BCL HMAC call.

The allow-list currently contains:

Existing call sites that pre-date the conformance test are tracked in the allow-list as legacy entries; the conformance test treats them as already known and a follow-up cleanup sprint will migrate them to IHmacAlgorithm.

Test evidence