feat(interop): interop/v2 compressed-values profile RFC (LAB-1135)

.github/workflows/verify.yml

@@ -28,13 +28,15 @@ jobs:
       - name: Python reference verify (stdlib only)
         run: |
           python3 tools/interop-reference.py verify
+          python3 tools/interop-v2-reference.py verify
           python3 tools/encryption-verify.py
           python3 tools/wire-format-reference.py verify
 
-      - name: Python reference verify (optional deps — AES-GCM seal + msgpack third-encoder conformance)
+      - name: Python reference verify (optional deps — AES-GCM seal + msgpack third-encoder + lz4 C-implementation conformance)
         run: |
-          pip install cryptography==49.0.0 msgpack==1.2.1
+          pip install cryptography==49.0.0 msgpack==1.2.1 lz4==4.4.5
           python3 tools/interop-reference.py verify
+          python3 tools/interop-v2-reference.py verify
           python3 tools/encryption-verify.py --require-seal
           python3 tools/wire-format-reference.py verify
 
@@ -44,6 +46,9 @@ jobs:
           npm install --no-audit --no-fund --ignore-scripts @noble/hashes@2.2.0
           node tools/interop-crosscheck.mjs
 
+      - name: Interop v2 JS cross-check (zero-dep independent container parser + LZ4 decoder + WebCrypto)
+        run: node tools/interop-v2-crosscheck.mjs
+
       - name: Python-frame verify (stdlib only)
         run: python3 tools/python-frame-reference.py verify
 

CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to the CacheKit Protocol Specification.
 
 ## [Unreleased]
 
+### Interop v2 — compressed-values profile (DRAFT)
+
+- New [`spec/interop-v2.md`](spec/interop-v2.md) (LAB-1135, protocol#52):
+  opt-in successor mode restoring the 2025-11-14 RFC's descoped
+  compressed+encrypted cross-SDK values. Values wrap in a `0xC1 0x02` +
+  msgpack `[method, original_size, payload:bin]` container (LZ4 block or
+  uncompressed), carried **inside** AES-256-GCM with a constant
+  four-component AAD reusing the frozen `"True"` token — deterministic
+  pre-AAD mode discrimination by configuration, no sniff-and-retry, and
+  cryptographic v1/v2 separation (cross-mode reads fail authentication).
+  Ships with a stdlib-only reference generator
+  ([`tools/interop-v2-reference.py`](tools/interop-v2-reference.py),
+  including a pure-Python LZ4 block codec), a zero-dependency independent
+  JS cross-check ([`tools/interop-v2-crosscheck.mjs`](tools/interop-v2-crosscheck.mjs)),
+  and [`test-vectors/interop-v2.json`](test-vectors/interop-v2.json)
+  (compressed, uncompressed, and non-canonical-widths round-trips,
+  compressed+encrypted round-trip, 16 structural + 2 cryptographic
+  must-reject vectors). Security limits
+  reuse the wire-format constants (512 MiB / 1000:1, enforced before
+  decompression); the CRIME/BREACH verdict is recorded in-spec (in threat
+  model, accepted with normative mitigations); the legacy array-of-ints
+  payload leniency is explicitly **not** inherited. Interop/v1 is
+  byte-for-byte untouched — its vectors and tools run unchanged beside the
+  new ones in CI. Status DRAFT until the vectors run in cachekit-py/ts/rs CI.
+
 ### SDK Feature Matrix
 
 - Consolidated ten conflicting open matrix PRs into one code-verified end-state

README.md

@@ -69,6 +69,7 @@ layer's own store/retrieve flows are specified in
 | [spec/encryption.md](spec/encryption.md) | AES-256-GCM encryption, HKDF-SHA256 key derivation, AAD v0x03, counter-based nonces, key rotation |
 | [spec/saas-api.md](spec/saas-api.md) | REST API endpoints, binary wire protocol, error codes, metrics headers |
 | [spec/interop-mode.md](spec/interop-mode.md) | Cross-SDK cache sharing — language-neutral key format, canonical argument normalization *(normative; shipped opt-in in all three SDKs — see the [feature matrix](sdk-feature-matrix.md#compliance-status) for per-SDK version floors)* |
+| [spec/interop-v2.md](spec/interop-v2.md) | Interop v2 compressed-values profile — opt-in LZ4-block + AES-256-GCM cross-SDK values *(DRAFT; no SDK implements it yet)* |
 | [spec/file-backend-format.md](spec/file-backend-format.md) | Shared local File backend filename, header, expiry, and fail-closed flag negotiation |
 | [sdk-feature-matrix.md](sdk-feature-matrix.md) | Feature parity tracking across Python, Rust, TypeScript, and PHP SDKs |
 | [decisions/key-rotation.md](decisions/key-rotation.md) | Decision records — master-key rotation via client-side keyring (rationale, rejected options, operator runbooks) |

spec/interop-mode.md

@@ -14,6 +14,10 @@
 > Design discussion: [Issue #1](https://github.com/cachekit-io/protocol/issues/1) ·
 > Test vectors: [`test-vectors/interop-mode.json`](../test-vectors/interop-mode.json) ·
 > Reference implementation: [`tools/interop-reference.py`](../tools/interop-reference.py)
+>
+> Compressed values: this mode deliberately has none. An opt-in successor
+> profile, **[interop/v2](interop-v2.md)** (DRAFT), adds an LZ4-compressed
+> value container as a distinct mode — nothing in v1 changes.
 
 </div>