Trusty: provenance library workspace (initial import)

crates/core/trusty-core/Cargo.toml

@@ -0,0 +1,39 @@
+[package]
+name = "trusty-core"
+version.workspace = true
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+description = "Tamper-evident data provenance chain primitives. Dual hash (SipHash-2-4 + SHA-256), chain-break-as-event. Framework neutral, no storage dependency."
+
+[features]
+# On by default, so every existing consumer is unaffected and `rand` resolves
+# exactly as before. Verified across MITCH-stack, AI-Playbooks, kirbo and
+# good-ol-googz: nothing sets `default-features = false` on trusty-core, so
+# this gate is invisible to all of them.
+default = ["keygen"]
+
+# Generating a fresh Ed25519 key pair. This is the ONLY item in trusty-core
+# that needs an operating-system RNG, and therefore the only thing standing
+# between this crate and a `wasm32-unknown-unknown` build -- the rest of the
+# crate uses no filesystem, clock, thread, socket, or process API at all.
+#
+# Verification needs no RNG, which is exactly what a browser peer wants. Build
+# with `default-features = false` to get hashing, canonicalisation, chain
+# construction, signature verification, `from_secret_bytes`, and ProofBundle,
+# leaving key generation to the host (Web Crypto, a hardware token, or a key
+# supplied from elsewhere).
+keygen = ["dep:rand"]
+
+[dependencies]
+serde = { workspace = true }
+serde_json = { workspace = true }
+sha2 = { workspace = true }
+siphasher = { workspace = true }
+zeroize = { workspace = true }
+hex = { workspace = true }
+thiserror = { workspace = true }
+ed25519-dalek = { workspace = true }
+rand = { workspace = true, optional = true }