feat(stack-encrypt): cascade the JSON tree's AEAD tags and store its entries in a random order

.changeset/eql-json-tree-cascade-and-random-order.md

@@ -0,0 +1,5 @@
+---
+"@cipherstash/eql": patch
+---
+
+EQL v4 `json_tree` (unreleased): a stored document's entries are now in a random order, root first, an object's members get a random permutation as their ordinals (the `o` the server probes a node's children at, which was a keyed rank), and its containment projection `q` is shuffled the same way, so the stored order no longer shows each row's tree, the size of every subtree or the byte order of sibling key names (#1357). A containment or equality needle is sent in a random order of its own too, so a query no longer shows sibling key order either. Every entry's ciphertext now also commits to its children's AEAD tags, so the client checks a subtree read's rows by the chain rather than by their positions, and a row swapped, dropped, added, reordered or moved beneath the node read is refused by the cipher. Nothing stored changes shape; `json_tree_children` returns a node's children in ordinal order (an array's elements by position), where it returned them by stored slot, and no other SQL function changes (three doc comments stop promising document order); documents sealed by the earlier build of this unreleased family no longer open. `->`, `->>` and an ordering on `eql_v4.ord_term(col -> sel)` at a wildcard path now return an unspecified element of the row (the same one every time), not element 0; read every element with `json_tree_path_query`. `->` on an object or array with members no longer opens on the client (the entry's ciphertext commits to its children, which `->` does not return): Stack Encrypt reports `JsonNotALeaf`, which is also what an altered entry looks like through `->`; read a container with a subtree read. `docs/reference/json-tree-leakage.md` says what the stored row still shows and what a read now proves.

docs/fuzzing.md

@@ -28,7 +28,7 @@ Current targets:
 | `fuzz:term-decode`   | `stack-encrypt` | `term_decode`       | the SEM term decoders (`EqualityTerm`, `MatchTerms`, `OreTerm`, `OpeTerm` `from_bytes`) |
 | `fuzz:check-record`  | `stack-encrypt` | `check_record`      | `dynamic::record::check_record` over an `Arbitrary`-derived plan and tree, against a model of the record rules (structure-aware) |
 | `fuzz:plan-build`    | `stack-encrypt` | `plan_build`        | `plan::FieldsBuilder::build` over `Arbitrary`-derived untrusted names (context, fields, identities); a built field's label must render and parse back, and passthrough names are never refused (structure-aware) |
-| `fuzz:json-wire`     | `stack-encrypt` | `json_wire_decode`  | the JSON index's wire decoders (`JsonDocument`, `JsonNode`, `JsonProjection`, `JsonLeafQuery` from JSON text; `JsonHeader::from_bytes`), over base64 tags and base85 ciphertexts; an accepted document or node must round-trip through its wire form |
+| `fuzz:json-wire`     | `stack-encrypt` | `json_wire_decode`  | the JSON index's wire decoders (`JsonDocument`, `JsonNode`, `JsonSelectorSet`, `JsonLeafQuery` from JSON text; `JsonHeader::from_bytes`), over base64 tags and base85 ciphertexts; an accepted document or node must round-trip through its wire form |
 
 Each target is a few lines — `libfuzzer-sys` hands a `&str` (or `&[u8]`
 for the byte decoders) to the parser via the `arbitrary` crate:

docs/plans/2026-10-25-json-tree-leakage-before-and-after.md

@@ -115,7 +115,7 @@ The "before" column is the profile at `9a7ca372c`; the "after" column is the por
 | `selector_precedence` | kept | which of two selectors comes first across rows: sibling key order |
 | `depth_recovery` | kept | an attack that reconstructs every row's depth sequence from the stored order alone |
 | `token_reach` | kept | per read, row and token: the node it finds and everything its walk links, with parents and depths |
-| `ordinal_patterns` | kept | elements' ordinals in position order; members ranked consistently under one token |
+| `ordinal_patterns` | replaced by `member_order_shared_across_rows` | whether one token's objects give their members one order of ordinals across rows, reported only below a `2⁻⁴⁰` chance bound: members' ordinals are now a random permutation per row |
 | `member_ordinals_follow_key_order` | kept | whether members' ordinals follow key order, reported only below a `2⁻⁴⁰` chance bound |
 | `token_derivability` | kept | which reads' tokens the database can derive from which others' (now by the member rule and by the element rule at an index below 4, from the tokens that find a node in some row) |
 | `transcripts` | kept | every query term with its tags named: determinism, shared selectors, needles; a read is now its token list and budget instead of a token and gates |

languages/golang/encrypt/guest/src/ops.rs

@@ -51,7 +51,7 @@ use stack_encrypt::sem::MatchOptions;
 use stack_encrypt::target::IndexSpec;
 use stack_encrypt::ErrorPayload;
 use stack_encrypt::{CipherText, KeysetCipher, Label, Node, SealedValue, StackCipherText};
-use stack_kms::DataKeySource;
+use stack_kms::{DataKeySource, IndexKeySource};
 use zeroize::Zeroizing;
 
 use stack_guest_abi::last_error;
@@ -101,7 +101,7 @@ pub async fn term<K>(
     kind: u32,
 ) -> Result<Vec<u8>, u32>
 where
-    K: DataKeySource + Sync + 'static,
+    K: DataKeySource + IndexKeySource + Sync + 'static,
 {
     // The same proof every stack-encrypt leaf demands: an empty context is
     // `STATUS_ENCODING` here, before any derivation.
@@ -178,7 +178,7 @@ pub async fn encrypt_record<K>(
     plan: &[u8],
 ) -> Result<Vec<u8>, u32>
 where
-    K: DataKeySource + Sync + 'static,
+    K: DataKeySource + IndexKeySource + Sync + 'static,
 {
     let plan = parse_plan(plan)?;
     let tree =
@@ -213,7 +213,7 @@ pub async fn decrypt_record<K>(
     expected: Option<Label>,
 ) -> Result<Vec<u8>, u32>
 where
-    K: DataKeySource + Sync + 'static,
+    K: DataKeySource + IndexKeySource + Sync + 'static,
 {
     let plan = parse_plan(plan)?;
     let value =
@@ -255,7 +255,7 @@ pub async fn query_term<K>(
     operator: &[u8],
 ) -> Result<Vec<u8>, u32>
 where
-    K: DataKeySource + Sync + 'static,
+    K: DataKeySource + IndexKeySource + Sync + 'static,
 {
     let (plan, field, operator) = parse_query(plan, field, operator)?;
     let term = dynamic::query_term(

languages/golang/encrypt/guest/src/status.rs

@@ -129,6 +129,9 @@ pub fn status_for_error(error: &stack_encrypt::Error) -> u32 {
         // retrieved, like a foreign keyset and unlike a wrong-context open.
         stack_encrypt::Error::ContextMismatch { .. } => STATUS_CONTEXT_MISMATCH,
         stack_encrypt::Error::Kms(kms) => status_for_kms(kms),
+        // A keyset a JSON document needed could not be loaded: the load's
+        // own error says what the host can act on.
+        stack_encrypt::Error::KeysetLoad { source, .. } => status_for_error(source),
         // A context that renders past ZeroKMS's descriptor limit is the
         // caller's input, refused before any request is sent.
         stack_encrypt::Error::DescriptorTooLong { .. } => STATUS_ENCODING,
@@ -141,6 +144,10 @@ pub fn status_for_error(error: &stack_encrypt::Error) -> u32 {
         // one it was opened as: sealed as that type, not tampered with, so
         // the caller's input and not STATUS_AUTH.
         stack_encrypt::Error::OpenedType { .. } => STATUS_ENCODING,
+        // The entry `->` returned did not open alone: a container with
+        // children asked for as a scalar, or an altered entry. The client
+        // cannot tell which, so neither STATUS_AUTH nor a claim of either.
+        stack_encrypt::Error::JsonNotALeaf => STATUS_ENCODING,
         _ => STATUS_INTERNAL,
     }
 }
@@ -283,13 +290,30 @@ mod tests {
         ViturRequestError::new(kind, "stubbed", std::io::Error::other("boom"))
     }
 
+    #[test]
+    fn a_failed_keyset_load_maps_as_its_cause() {
+        let load = stack_encrypt::Error::KeysetLoad {
+            keyset_id: uuid::Uuid::from_u128(1),
+            source: std::sync::Arc::new(stack_encrypt::Error::Kms(stack_kms::Error::LoadKeyset(
+                stack_kms::LoadKeysetError::Unauthorized(vitur(
+                    ViturRequestErrorKind::Unauthorized,
+                )),
+            ))),
+        };
+        assert_eq!(status_for_error(&load), STATUS_KMS_UNAUTHORIZED);
+    }
+
     #[test]
     fn aead_and_composition_errors_map_to_the_vitaminc_codes() {
         assert_eq!(status_for_error(&stack_encrypt::Error::Aead), STATUS_AUTH);
         assert_eq!(
             status_for_error(&stack_encrypt::Error::OpenedType { expected: "i32" }),
             STATUS_ENCODING
         );
+        assert_eq!(
+            status_for_error(&stack_encrypt::Error::JsonNotALeaf),
+            STATUS_ENCODING
+        );
         assert_eq!(
             status_for_error(&stack_encrypt::Error::DescriptorTooLong { len: 513 }),
             STATUS_ENCODING

packages/eql/crates/eql-bindings/src/v4/json_tree.rs

@@ -77,7 +77,8 @@ pub struct JsonTreeKeyHeader(pub Base64Text);
 /// `public.eql_v4_json_tree`: a JSON tree document, `{v, i, h, sv:
 /// [entry], q: group}`. Strict. `h` is the document's key header, stored
 /// once (every entry is sealed under the document's one data key); `sv`
-/// holds one entry per node in depth-first order, the root first; `q` is
+/// holds one entry per node, the root first and the rest in a random order
+/// drawn when the document was sealed; `q` is
 /// the document's containment projection, one `{s, vs}` pair per node
 /// nested by array element, which the client writes beside the entries
 /// and which is the only place the value selectors live: the server's