[coderdan]

Summary

Stack Encrypt is the Rust engine behind the Go SDK and the EQL types. It can now store order terms for dates, timestamps and decimals. An order term is an index value that lets the database answer <, >, BETWEEN and ORDER BY without decrypting. Until now the engine refused an order index on these three kinds. That was the last open part of #1236.

What this means for users:

• Go SDK: an encrypt.Decimal, encrypt.Date or time.Time field can now take index=ore or index=ope. The generated code then gives the field Lt, Lte, Gt, Gte and Between.
• EQL v4: nine types are now produced: DateOrd, DateOrdOpe, DateOrdOre, and the Timestamp and Numeric versions of each. Before, they were refused by name.

How values order:

• A date orders by its day.
• A timestamp orders by the microsecond, so two instants within one microsecond tie. This matches how its equality term already compares.
• A decimal orders by value whatever its scale, so 1.5 ties 1.50.

Stacked on #1328, which is stacked on #1327 (the vitaminc 0.8 and ORE crate upgrade this depends on). It needs nothing from #1328 itself. It is stacked there only to avoid conflicts, since both PRs edit the same files.

Changes

Stack Encrypt

• New public module stack_encrypt::value with Date, Timestamp, Decimal and RangeError, moved here from eql-bindings.
  • These are the Rust types for values with no standard Rust type. They wipe their memory when dropped, and they can be cloned.
  • chrono's and rust_decimal's types can't be wiped, and the engine's Orderable trait is sealed, so the engine has to own these types to order them.
  • New chrono and rust_decimal features add conversions to and from those crates' types.
• All three types are sem::Orderable and op::Ordered, so the ORE, OPE and block ORE indexes all take them.
• Data-plan path: order_of used to drop a value's logical type when choosing how to order it, so a date would have been ordered as a bare day count. It now reads a date, timestamp or decimal into its value type first. IndexSpec::takes admits one exactly when that read succeeds.
• Reason::OrderTermPending is removed. Nothing can produce it any more, and it was never released.
• Block ORE: a date goes through ore-rs's 6-bit fixed-width engine. A timestamp or decimal goes through the chained engine.

eql-bindings and eql-codegen

• The nine ordered date, timestamp and numeric types are listed as producible, and the generated bindings and target table are regenerated.
• v4::plaintext re-exports the stack_encrypt::value types, so callers' code is unchanged.
• The crate's chrono and rust_decimal features now turn on Stack Encrypt's features of the same name.
• The crate no longer depends on vitaminc-aead directly. Its one remaining use now goes through stack_encrypt::dynamic::frame.

Go SDK

• stashgen's built-in test engine (enginetest) and the notices stashgen prints now admit order indexes on decimals, dates and timestamps.
• The encrypt/eql table is regenerated.
• The ValueKinds test model takes the order indexes the value-kinds fixture now declares, and probe_stash.go and valuekinds_stash.go are regenerated.
• Docs: encrypt package docs, stashgen README.

Docs and release notes

• CHANGELOGs for stack-encrypt, eql-bindings and the Go module.
• A new @cipherstash/eql changeset (eql-bindings ships at the npm package's version).
• The pending date/timestamp/numeric changeset no longer says the ordered types stay unproducible.

Verification

• Root workspace: cargo nextest run --workspace --all-features passes (1278 tests, 1 skipped). clippy with -D warnings is clean with all features and with none. rustdoc with -D warnings and mise run test:doc pass.
  • New tests:
    • the data-plan path derives the same ORE and OPE bytes as the typed path for a date, a timestamp and a decimal;
    • OPE terms order by value, tie 1.5 with 1.50, tie instants within one microsecond, and floor one nanosecond before 1970 to the microsecond before it;
    • block ORE uses the expected engine and block count for each kind (6 blocks for a date, 16 for a timestamp, 19 for a decimal), orders, and ties the same way;
    • the typed op bounds.
  • value_kinds.json is regenerated: it only gains the three fields' order terms, and a folded query (-1234.56, …03.123456Z) now also lands on the stored order term.
  • Three trybuild snapshots were updated:
    • two because the Ordered diagnostic now names the new types;
    • one because --all-features turns on chrono, which adds chrono's types to the compiler's list of implementors.
• Mutation testing: cargo mutants --in-diff for stack-encrypt ran 51 mutants: 40 caught, 11 unviable, none missed.
• EQL workspace: cargo test -p eql-codegen, -p eql-bindings --all-features and -p eql-encryption-tests pass, as do mise run types:check and check:encryption:wasi.
• PostgreSQL 17 (disposable container), mise run test:encryption:postgres:
  • a new test compares date, timestamp and decimal block ORE terms in EQL's comparator against ore-rs's comparator and the plaintext order, both ways round, two writes per value;
  • the eql_v4.between smoke test now covers every ordered family, 29 overloads (up from 20).
• Go: all four guests were rebuilt. mise run go:test, mise run go:lint and mise run wasm:guest:test pass, and go generate ./... changes no committed file.
  • Go's Lt on the new fields derives the bytes Rust stored, including for the folded queries.
• pnpm run test:scripts passes (78 files).

Related

Closes #1236.
Stacked on #1328 and #1327. Uses clww-ore 0.6.0 and ore-rs 0.10.0 (cipherstash/ore.rs#130, cipherstash/ore.rs#131, cipherstash/ore.rs#132, cipherstash/ore.rs#135).

Review notes

• Start with packages/stack-encrypt/src/dynamic/term.rs (ordered and order_of), then packages/stack-encrypt/src/value.rs.
  • value.rs is eql-bindings' v4/plaintext.rs with its docs rewritten for the engine. Its tests moved with it.
• The one unsafe: stack-encrypt denies unsafe code. The moved test that proves Drop wipes a value in place needs one, so it is allowed on that test only, with the reason written down. Without that test, a Drop that wiped nothing would pass.
• Three expects: the conversions to chrono and rust_decimal types use expect, each allowed with its reason, following descriptor.rs. A value type is only ever built inside the target crate's range, and chrono has no unchecked constructor.
• Typed EQL queries still lag: the typed EQL query chain (ANSWERS) still answers no ordered type of any family, as before. These nine join that existing gap in typed_queries.rs; this PR doesn't close it.
• Frozen fixture unchanged: stored_rows_v1.json is not touched. Its rows keep the plans they were written with, so its date, timestamp and decimal fields have no order term. Nothing regenerates the file.

https://claude.ai/code/session_01XQN1QpaWVDGjHEg39KEJF3

Summary by CodeRabbit

• New Features
  • Added ordering queries for dates, timestamps, and decimals, including comparison operators and range searches.
  • Ordering follows day-level precision for dates, microsecond precision for timestamps, and numeric value for decimals. Equivalent decimal values with different scales compare equally.
  • Added reusable date, timestamp, and decimal value types, with optional conversions to common date and decimal formats.
• Documentation
  • Updated Go and EQL guides to describe supported ordering indexes, operators, and comparison behavior.

[changeset-bot]

🦋 Changeset detected

Latest commit: f8fc092

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 12 packages

Name	Type
@cipherstash/eql	Minor
stash	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/prisma-example	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/stack	Patch
@cipherstash/wizard	Patch
@cipherstash/bench	Patch
@cipherstash/test-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1e3449b5-466a-4c13-a6b9-1e2c0faae1b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: fc5ebd35-84c6-48bb-b199-cc8a38e88932

📥 Commits

Reviewing files that changed from the base of the PR and between 5a3e878 and c753de7.

⛔ Files ignored due to path filters: 3

• Cargo.lock is excluded by !**/*.lock
• languages/golang/encrypt/guest/Cargo.lock is excluded by !**/*.lock
• packages/eql/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing: 55

• .changeset/eql-v4-date-timestamp-numeric.md
• .changeset/eql-v4-ordered-date-timestamp-numeric.md
• languages/golang/CHANGELOG.md
• languages/golang/cmd/stashgen/README.md
• languages/golang/cmd/stashgen/main_test.go
• languages/golang/encrypt/doc.go
• languages/golang/encrypt/eql/eql_gen.go
• languages/golang/encrypt/eql/eql_test.go
• languages/golang/encrypt/eql_test.go
• languages/golang/encrypt/guest/src/ops.rs
• languages/golang/encrypt/guest/src/targets.rs
• languages/golang/encrypt/guest/tests/native_ops.rs
• languages/golang/encrypt/internal/testusers/kinds.go
• languages/golang/encrypt/internal/testusers/probe_stash.go
• languages/golang/encrypt/internal/testusers/valuekinds_stash.go
• languages/golang/encrypt/query_test.go
• languages/golang/encrypt/value_kinds_test.go
• languages/golang/stashgen/emit.go
• languages/golang/stashgen/enginetest/enginetest.go
• languages/golang/stashgen/refusal_test.go
• packages/eql/crates/eql-bindings/CHANGELOG.md
• packages/eql/crates/eql-bindings/Cargo.toml
• packages/eql/crates/eql-bindings/src/encryption/targets.rs
• packages/eql/crates/eql-bindings/src/v4/date.rs
• packages/eql/crates/eql-bindings/src/v4/numeric.rs
• packages/eql/crates/eql-bindings/src/v4/plaintext.rs
• packages/eql/crates/eql-bindings/src/v4/targets.rs
• packages/eql/crates/eql-bindings/src/v4/timestamp.rs
• packages/eql/crates/eql-codegen/src/bindings.rs
• packages/eql/crates/eql-codegen/src/go_eql.rs
• packages/eql/crates/eql-codegen/src/targets.rs
• packages/eql/tests/encryption/tests/targets.rs
• packages/eql/tests/encryption/tests/typed_queries.rs
• packages/eql/tests/encryption/tests/v4_date_time_numeric.rs
• packages/eql/tests/encryption/tests/v4_order.rs
• packages/eql/tests/encryption/tests/v4_ore_block.rs
• packages/eql/tests/encryption/tests/v4_range.rs
• packages/stack-encrypt/CHANGELOG.md
• packages/stack-encrypt/Cargo.toml
• packages/stack-encrypt/src/dynamic/kind.rs
• packages/stack-encrypt/src/dynamic/mod.rs
• packages/stack-encrypt/src/dynamic/query.rs
• packages/stack-encrypt/src/dynamic/record.rs
• packages/stack-encrypt/src/dynamic/term.rs
• packages/stack-encrypt/src/lib.rs
• packages/stack-encrypt/src/op/mod.rs
• packages/stack-encrypt/src/sem/mod.rs
• packages/stack-encrypt/src/value.rs
• packages/stack-encrypt/tests/fixtures/README.md
• packages/stack-encrypt/tests/fixtures/value_kinds.json
• packages/stack-encrypt/tests/ore_block.rs
• packages/stack-encrypt/tests/ui/op_between_takes_a_pair.stderr
• packages/stack-encrypt/tests/ui/op_order_on_bytes.stderr
• packages/stack-encrypt/tests/ui/struct_field_must_open.stderr
• packages/stack-encrypt/tests/value_kinds.rs

💤 Files with no reviewable changes: 1

• packages/stack-encrypt/src/dynamic/mod.rs

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Stack Encrypt adds date, timestamp, and decimal plaintext types and order-term support. EQL v4 and the Go SDK expose ordered targets and query methods for these values, with tests covering their comparison and range behavior.

Changes: Ordered value support

Layer / File(s)	Summary
Plaintext types and typed ordering packages/stack-encrypt/src/value.rs, packages/stack-encrypt/src/op/mod.rs, packages/stack-encrypt/src/sem/mod.rs, packages/stack-encrypt/Cargo.toml, packages/stack-encrypt/tests/*	Stack Encrypt adds Date, Timestamp, Decimal, and RangeError, plus optional chrono and rust_decimal conversions. Typed ordering and ORE support use day, floored-microsecond, and decimal-value semantics.
Dynamic order-term derivation packages/stack-encrypt/src/dynamic/*, packages/stack-encrypt/tests/value_kinds.rs, packages/stack-encrypt/tests/fixtures/*	The dynamic path accepts date, timestamp, and decimal order indexes and derives terms through their logical value types. Tests and fixtures include ORE or OPE outputs for those kinds.
EQL v4 ordered targets and dispatch packages/eql/crates/eql-bindings/src/v4/*, packages/eql/crates/eql-bindings/src/encryption/targets.rs, packages/eql/crates/eql-codegen/src/*	EQL v4 marks nine date, timestamp, and numeric ordered targets producible and adds encryption, decryption, and query dispatch. The plaintext types are re-exported from Stack Encrypt.
EQL v4 ordering and range coverage packages/eql/tests/encryption/tests/*	Tests cover date, timestamp, and numeric ordering, ORE schemes, and range overloads. The range smoke test exercises 29 overloads and expects no ordered families to be skipped.
Go SDK indexing and query support languages/golang/encrypt/*, languages/golang/stashgen/*, languages/golang/cmd/stashgen/*	The Go SDK marks the ordered EQL types producible and adds date, timestamp, and decimal index support, order terms, and generated comparison and range methods.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Feature · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant EQLv4Targets
  participant StackEncrypt
  Caller->>EQLv4Targets: Select an ordered target and pass plaintext
  EQLv4Targets->>StackEncrypt: Encrypt value or derive query terms
  StackEncrypt-->>EQLv4Targets: Return encrypted value or order terms
  EQLv4Targets-->>Caller: Return result

Loading

Possibly related issues

• Issue 1236: This change adds date, timestamp, and decimal order terms across Stack Encrypt, EQL v4, and the Go SDK. The issue also describes float ordering and integer order-key work, which this change summary does not cover.

Possibly related PRs

• cipherstash/stack#1328: Adds nullable support to EQL v4 domain derives and target dispatch, which is related to the EQL bindings changed here.
• cipherstash/stack#1327: Changes ORE and OPE dependencies and term formats used by this PR’s date, timestamp, and decimal ordering support.

Suggested reviewers: auxesis

Merge Risk: ⚪ Minimal · up to c753d

This change adds order-term support for dates, timestamps and decimals across Stack Encrypt, EQL v4 and the Go SDK. No actionable merge-blocking risk remains. The only known issue is stale wording in one changeset.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Linked Issues check		#1236 remains active and directly covers more than the date, timestamp, and decimal work. Its coding requirements include float ordering and ADR-0002 integer order-key encoding, with matching typed an…	Implement the remaining #1236 requirements for float ordering and ADR-0002 integer encoding. Add matching typed/data-plan term tests and ordering coverage, or split and directly link the remaining work so the active linked issue no longer r…

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding ordering support for dates, timestamps, and decimals across the named components.
Out of Scope Changes check		The changes stay within the linked issue's coding scope. The new Stack Encrypt value types, order-term derivation, ORE/OPE and block-ORE support, EQL targets, Go generation, fixtures, tests, and docum…
Docstring Coverage		Docstring coverage is 82.08% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 106 functions across 41 files. (13 skipped:…

Full details: Out of Scope Changes check

Explanation

The changes stay within the linked issue's coding scope. The new Stack Encrypt value types, order-term derivation, ORE/OPE and block-ORE support, EQL targets, Go generation, fixtures, tests, and documentation all support date, timestamp, and decimal ordering requested by #1236. The re-export and dependency changes support that implementation. No unrelated change is demonstrated.

Full details: Docstring Coverage

Explanation

Docstring coverage is 82.08% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 106 functions across 41 files. (13 skipped: 13 unsupported.)

Full details: Linked Issues check

Explanation

#1236 remains active and directly covers more than the date, timestamp, and decimal work. Its coding requirements include float ordering and ADR-0002 integer order-key encoding, with matching typed and data-plan terms and ordering tests. This PR implements the date, timestamp, and decimal portion, but the PR description explicitly excludes float and integer-encoding work. The reported tests support the implemented portion and do not establish the missing requirements.

Resolution

Implement the remaining #1236 requirements for float ordering and ADR-0002 integer encoding. Add matching typed/data-plan term tests and ordering coverage, or split and directly link the remaining work so the active linked issue no longer requires it from this PR.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Mutation testing (cargo-mutants, --in-diff, stack-auth + stack-encrypt)

caught	missed	unviable	timeout
40	0	11	0

Every mutant in the changed lines was caught by a test.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T10:54:43.700342Z	c753de7	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-23T10:54:51.907277Z	c753de7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cipherstash-agent]

Review attestation: /code-review medium + cross-check-review-findings

Reviewed head: c753de7. No critical or blocking issues.

• 1 minor finding, posted inline: the changeset eql-v4-date-timestamp-numeric.md still names v4::plaintext as the owner of the moved types.
• 6 other candidate findings were dropped:
  • Cosmetic line wrapping.
  • A possible double parse in order_of.
  • Missing tests for the Some(_) arms in ordered() and order_of(). The mutation job reports 0 missed mutants.
  • The Reason::OrderTermPending removal. The PR says it was never released, and I could not show a downstream use.
  • Fixture ciphertext churn.
  • A Postgres test gap for OPE.
• Existing feedback was bots only (changeset-bot, CodeRabbit, Codex, mutants). CodeRabbit and Codex were still running when I checked, so overlap with their later findings is not ruled out.
• I read the diff and checked the cited code at head. I did not build the crates or run the tests.

---

Generated by Claude Code