Crate lys_core 

lys-core — domain-agnostic cryptographic trust primitives.

A focused library of trust primitives: certificate-authority operations, Merkle transparency-log operations, signed attestations, sealed payload transport, and Ed25519 key management. Consumers (an agent runtime, a workflow engine, an anchoring service) compose domain meaning on top — this crate knows nothing about agents, sessions, workspaces, or any higher-level concept.

Status

This crate is being extracted, unchanged in behaviour, from the hardened meridian-trust crate. See docs/ROADMAP.md in the repository root for the extraction plan and the module inventory that will land here:

• keys — Ed25519Identity: file/env-backed keypair with strict verification, Debug redaction, and Ed25519→X25519 derivation.
• ca — certificate authority: Ed25519-rooted X.509 issuance, custom extensions, and validity-window-enforcing chain verification.
• merkle — AppendOnlyTree: RFC 6962 transparency log with inclusion and consistency proofs verifiable by external parties from published roots.
• attestation — domain-separated, timestamp-authenticated signed statements over arbitrary payloads.
• seal — X25519 + AES-256-GCM sealed envelopes, standalone and sender-authenticated.