v0.2.0

0.2.0 (2026-08-16)

⚠ BREAKING CHANGES

• sphragis: make deterministic encapsulation private (#31)

Features

• sphragis: define revocation as key rotation, not re-wrapping (#34) (37ba8e3)
• sphragis: narrow the public API to the envelope profile, define the adapter seam (#32) (d0a0bb8)

Bug Fixes

• sphragis: bind the KAT gate to a machine-readable crypto provenance lock (#27) (65e3433)
• sphragis: bound and fully consume untrusted CBOR before accepting a wrapped key (#24) (d165e5b)
• sphragis: make deterministic encapsulation private (#31) (cf48668)
• sphragis: redact SharedSecret's Debug and retrofit SealError location (#33) (11216eb)
• sphragis: return typed entropy failures instead of panicking (#28) (2ff3a08)