docs: describe the current format restrictions

.github/workflows/ci.yml

@@ -63,6 +63,8 @@ jobs:
       - run: flutter pub get
       - name: Assemble the publish payload
         run: dart run tool/publication.dart --out "$RUNNER_TEMP/payload"
+      # --min-tests is the number of cases containment_test.dart declares, so it
+      # has to move with that file. It is a floor, not an assertion of equality.
       - name: Run the containment subset from a clean consumer
         run: >
           xvfb-run -a dart run tool/packaged_consumer.dart

CHANGELOG.md

@@ -13,6 +13,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+## [v0.3.6](https://github.com/MicroClub-USTHB/M-Security/releases/tag/v0.3.6) - 2026-07-31
+
+### Added
+
+- `UnsafeLegacyEvfsPolicy` on `VaultService.create()` and `open()`, defaulting to `deny`. Both now fail with `unsafeLegacyFormatDenied` before touching the path; `allowUnauthenticatedV1V2` restores the previous behaviour and changes no stored bytes.
+- Argon2id verification limits. The password may be at most 1024 UTF-8 bytes and the hash must sit within published parameter bounds, both checked before any memory is reserved. One verification runs at a time.
+- `Argon2PolicyViolation`, `Argon2VerificationBusy`, `DisabledFormat` and `UnsafeLegacyFormatDenied` variants in `CryptoError`.
+- `example/integration_test/containment_test.dart`, executed in CI by a consumer built outside the repository against the assembled publish payload.
+
+### Removed
+
+- `.mvex` export and import, and encrypted or compressed `MSSE` stream files, from the Rust source, the generated bindings and the built library's exported symbols. The six Dart methods remain as stubs so existing code compiles, each emitting one `disabledFormat` error before touching input or output. Existing files in either format are unreadable by this release and unchanged on disk.
+- `createNoopEncryption()`, which aborted the host process when the testing feature was absent.
+
+### Changed
+
+- Flutter Rust Bridge pinned to exact 2.12.0 across the manifest, the crate, the CI generators and the committed bindings. A range let a fresh install resolve a runtime the bindings refuse.
+- Flutter floor raised to `>=3.38.9`, which carries Dart 3.10.8. The previous `>=3.3.0` could not coexist with the `^3.10.8` Dart constraint.
+
+### Fixed
+
+- Apple pod builds no longer dump the process environment into build logs.
+- The publish payload no longer carries local build output or example `Podfile.lock` files, and `rust/.gitignore` no longer hides the tracked `src/frb_generated.rs`.
+- README, CONTRIBUTING and RELEASE_GUIDE describe the current surface.
+
+### Security
+
+- The v1/v2 vault format derives its keys with no per-vault salt, so two vaults under one master key repeat their nonces. Segment nonces come from the segment index and generation rather than the CSPRNG, structural metadata is unauthenticated, and log replay can restore an index pointing at ciphertext a delete already erased. Opting in accepts all of it.
+
 ## [v0.3.5](https://github.com/MicroClub-USTHB/M-Security/releases/tag/v0.3.5) - 2026-04-10
 
 ### Added

CONTRIBUTING.md

@@ -269,38 +269,44 @@ Keep commits atomic, with one logical change per commit.
 
 ```bash
 cd rust && cargo test
+cd rust && cargo test --release
 ```
 
-There are 79 unit tests covering all algorithms, including NIST and RFC test vectors (RFC 8439 for ChaCha20, RFC 5869 for HKDF).
+There are 466 unit tests covering all algorithms, including NIST and RFC test vectors (RFC 8439 for ChaCha20, RFC 5869 for HKDF). Both profiles run the same set.
 
-### Dart Integration Tests
+### Host Dart tests
 
-Integration tests require a running device or simulator. From the **project root**:
+```bash
+flutter test test/ tool/
+```
+
+Twenty cases, no device needed.
+
+### Integration tests
+
+One file executes, against the native library built from the assembled publish payload.
 
 ```bash
 cd example
-flutter test integration_test/aes_gcm_test.dart
-flutter test integration_test/chacha20_test.dart
-flutter test integration_test/hashing_test.dart
-flutter test integration_test/argon2_test.dart
-flutter test integration_test/hkdf_test.dart
+flutter test integration_test/containment_test.dart -d macos
 ```
 
-There are 44 integration tests across 5 files covering all features.
+The broader suites under `integration_test/` and `example/integration_test/` hold 98 and 120 declarations and are not wired into any runner. Adding a case to one of them does not make it run. Canonicalizing those trees is open work.
 
 ### CI Pipeline
 
 All pull requests must pass the CI pipeline (`.github/workflows/ci.yml`), which runs:
 
-| Job         | Runner          | What it does                                  |
-| ----------- | --------------- | --------------------------------------------- |
-| **Rust**    | `ubuntu-latest` | `cargo clippy -- -D warnings` + `cargo test`  |
-| **Dart**    | `ubuntu-latest` | FRB codegen + `build_runner` + `dart analyze` |
-| **Android** | `ubuntu-latest` | Full APK build (ARM64 + ARMv7, NDK r27c)      |
-| **iOS**     | `macos-latest`  | Simulator debug build (ARM64 + ARM64-sim)     |
-| **Linux**   | `ubuntu-latest` | Release build with GTK-3                      |
+| Job                   | Runner          | What it does                                             |
+| --------------------- | --------------- | -------------------------------------------------------- |
+| **Rust**              | `ubuntu-latest` | `cargo clippy -- -D warnings` + `cargo test`             |
+| **Dart**              | `ubuntu-latest` | FRB codegen + `build_runner` + `dart analyze` + host tests |
+| **Packaged consumer** | `ubuntu-latest` | Assembles the publish payload, builds a consumer outside the repository against it and runs the integration file |
+| **Android**           | `ubuntu-latest` | Release APK (ARM64 + ARMv7, NDK r27c)                    |
+| **Apple**             | `macos-latest`  | iOS simulator debug build and a macOS debug build         |
+| **Linux**             | `ubuntu-latest` | Release build with GTK-3                                 |
 
-The CI is triggered on pushes and PRs to `main` and `dev` branches.
+CI triggers on pushes to `main` and `dev`, and on pull requests to those and to `staging/**`. The last three jobs are skipped when the base is a `staging/` branch, so they first run at the promotion into `dev`. Adding a case to `containment_test.dart` means raising `--min-tests` in the workflow to match.
 
 ## Submitting a Pull Request