[coderdan]

Stored record validation needs to distinguish errors visible before key retrieval from type mismatches concealed inside authenticated ciphertext. This adds the experimental record-reads-v1 profile with 26 cases shared by native Rust and Go WASI.

Cases cover malformed rows and output maps, missing ciphertext, plaintext under c, late batch failures, authenticated type mismatches, null read-policy changes, and context-field preflight. Reads also explicitly preserve the existing projection behavior: extra fields/outputs and missing equality terms do not prevent opening ciphertext.

Native tests assert the shape/pending stage, complete diagnostic payloads, and data-key retrieval counts. Go runs every case through an uninitialised guest and an active guest, proving malformed inputs fail before cipher lookup while concealed type mismatches pass preflight. Representable cases additionally exercise Cipher.Open. A test-only tree entry point reaches the existing guest export for shapes the record adapter cannot express; it uses the existing codec and buffer cleanup.

The contract records the existing diagnostic difference for a static-context plan given a call context: check_record reports a generic dynamic-record refusal, while the native pending opener names both context sources. The roadmap and coverage map identify overlap with current tests and the assertions they retain. No existing tests are removed. Repeated-key/raw-leaf framing, broader context composition, EQL/JSON profiles, and Python/TypeScript consumers remain follow-ups.

Stack: #1404 → #1460 → #1461 → this PR. Review against feat/stack-encrypt-runtime-conformance; merge the parents first and retarget as they land.

Validation: all four profiles (275 shared cases) and fresh scalar Go-to-Rust exchange pass locally; Rust clippy/formatting, Go lint, Biome and 34 CI wiring checks pass. The deterministic guest is reused from the unchanged parent engine. Native call counts are observed; Go logical provider-call counts are not claimed. No credentials or database required. Test/docs/tooling changes only; no release changeset.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9a48ac4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

No mutants were generated for the changed lines.