zeekay 9ba50e4128 pqsafe: decomplect — consume luxfi/zwing for X-Wing + hybrid identity ...

One and only one X-Wing implementation in the Lux stack: zwing.
Removed pqsafe/pkg/xwing and pqsafe/pkg/identity; replaced their
call sites in capsule + envelope with direct zwing imports
(zwing.XWingPublicKey / XWingPrivateKey / XWingEncapsulate /
XWingDecapsulate, zwing.Identity / IdentityPublic / Sign / Verify).

Same bytes that protect a Z-Wing session now protect a PQSAFE file:
one X-Wing, one hybrid-sig surface, vetted once.

All E2E tests still pass against the zwing-backed Seal/Open path:
  TestSealOpenRoundTrip          full round-trip
  TestWrongRecipientCannotOpen   wrong key fails closed
  TestCorruptChunkFails          chunk SHA mismatch detected
  TestTamperedManifestFails      zwing hybrid sig refuses
  TestSwapCapsulesFails          zwing X-Wing decap fails for wrong key
  TestExpiredEnvelopeRefused     TTL gate at Open time

Example program now uses zwing.GenerateIdentity() and the
PQSAFE-IL5-HYBRID-v1 envelope rides on top.

2026-05-12 20:34:23 -07:00

..

basic

pqsafe: decomplect — consume luxfi/zwing for X-Wing + hybrid identity

2026-05-12 20:34:23 -07:00