Fix the findings of the pre-release review

[yi-here]

Fixes everything found by an internal, AI-assisted pre-release review. Three separate AI reviewers each worked from a frozen snapshot, covering the cryptographic construction, the implementation and the public claims. A fourth re-tested the fixes. This is not an independent audit by human cryptographers, and CHANGELOG.md says so.

Every code fix comes with a test that failed before it.

Findings fixed

Severity	Finding	Fix
High	The documented AuthKey cutover chose the envelope per row from schema_version, a column the forger writes, so following the docs re-opened forgery	New Reseal; cutover is now: re-seal once, then read authenticated only. The forgery window (until the migration finishes) is documented. A test pins the old advice as unsafe.
Medium	Open allocated 16–90 MiB before refusing a row under any cap. Many small zstd frames cost 2 GB for a 22 KB row.	Decoding bounded per cap into a buffer that cannot grow (≤ ~2.8× cap in every tested attack). Over-long blobs refused before decrypting. Tests measure allocation.
Medium	CI fuzz jobs never ran (-fuzz over ./..., two packages)	Target .; a test checks the command form
Medium	Compression is a length oracle within one field (CRIME)	Documented, plus Envelope.DisableCompression (a stored zstd frame, readable by any reader)
Medium	README usage didn't compile and ignored errors (copied as written, it started a reader on a random key)	Snippets handle errors and are compiled by a test
Medium	Metadata integrity and the per-request binding were undocumented	README, SPEC and ATTACK updated
Low	All-zero keys; NewLocalKeyring(nil) silently ephemeral; inconsistent ErrInvalidConfig; unusable public keys accepted; unbounded hostile-row inputs; process-wide serialisation; test gaps	All fixed (see CHANGELOG)

Other changes

• HKDF comes from the standard library, so golang.org/x/crypto is dropped; the known-answer vectors are unchanged.
• klauspost/compress is bumped to 1.20.0.
• New vectors cover negative and non-ASCII bindings, unstamped rows and uncompressed rows.
• CI runs on both the go.mod minimum and the latest 1.26 patch. Dependabot is enabled, and issue forms route security reports to SECURITY.md.
• SECURITY.md gains supported versions and a response timeline. NOTICE and CODE_OF_CONDUCT are added.
• All 6 translations are updated.

Verification

• go vet, gofmt, go test -race ./... and staticcheck are all clean.
• All 9 fuzz targets ran 30s each, run exactly as CI runs them.
• The verifier's own attack suite passes against the final code, including 113 caps × compressed/uncompressed Seal/Open and stored frames checked against reference libzstd.
• govulncheck could not run locally (vuln.go.dev is blocked in the sandbox); CI runs it.

Please check before merging

• Legal entity in NOTICE ("Continuum AI Corp.") and the conduct contact in CODE_OF_CONDUCT (security@orcarouter.ai).
• SECURITY.md response targets (3 / 10 / 90 days) are suggested defaults.
• Compression default: it stays on, with an opt-out.

Note: CI may not run until the organization's Actions billing issue is resolved.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VwpTwdibuwvYAqEb4hETUu

---

Generated by Claude Code