[dkruempe]

Summary

Implements the open, repo-local items from ROADMAP.md in small commits (one
concern per commit) and updates the roadmap checkboxes accordingly.

Performance

• Vectorized the RandomObfuscator XOR loop (64-byte keystream blocks,
  word-wise, alignment/endian-safe) with boundary tests for 0–200 bytes.
• Extended the benchmark to measure export + import round-trips and peak RSS,
  added --json, test/benchmark_baseline.json,
  tools/benchmark_compare.py and a CI regression gate.

Security

• Key-file parsing: 1 MiB cap, wipe-on-all-paths, in-memory
  Key::FromBytes/FromStream, fuzz_keyfile target.
• kpx --password-file/--password-stdin, conflicting-source rejection and a
  Windows console prompt; --password/env trade-off documented.
• OSV-Scanner workflow for the Conan graph + Dependabot for GitHub Actions.
• SaveAs/Save(..., key) now actually overrides a cached transformed key
  (fixes password changes on imported databases).

Usability / CLI

• New commands: create, groups, passwd, move, history, purge,
  otp, and merge/import (fresh UUIDs, optional target group).
• KeePass::Create caches the transformed key for the supplied password.
• KeePass::Open byte-range/vector overloads and typed attachment accessors.
• Stable exit codes (1/3/4/5), structured JSON errors, documented output
  schemas, and opt-in base64 attachments in print JSON.

Architecture / Modularity

• Centralized signatures, KDBX versions, cipher/KDF UUIDs, inner-stream IV and
  header cap in detail/constants.hh.

Testing / Quality / Infra

• fuzz_xml, fuzz_export, keyfile fuzzing and a matrix fuzz workflow.
• Unknown-header-field, HMAC-tamper and CBC-bit-flip robustness fixtures.
• Concurrency and secure-allocation tests.
• Weekly security-triage report workflow and SPDX SBOM in releases.
• Shared Conan setup composite action; fixed Conan cache keys to hash
  conanfile.py.
• New docs: support matrix, 0.2→0.3 migration, worked examples, CLI schemas,
  CONTRIBUTING TOC.

Validation

• ctest --test-dir build --output-on-failure: 19/19 passed
• clang-format 22 --dry-run --Werror on all tracked *.cc/*.hh: clean
• run-clang-tidy.py (LLVM 22) over src cli test: clean
• Fuzz targets built and smoke-run (fuzz_xml, fuzz_export,
  fuzz_keyfile; the export fuzzer also caught a bug in its own test harness
  which is fixed)

Remaining roadmap work (not in this PR)

Large design items and external work remain open, including: lazy attachment
loading, mmap reader, detail/lean public headers, FormatCodec/cipher-KDF
registries, ownership/ABI policies, decoupling the object model from codecs,
CMake components, language bindings, WASM demo, OSS-Fuzz submission,
vcpkg/Homebrew, Windows clang-tidy, and signing release artifacts.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 80.23256% with 204 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cli/edit.cc	74.77%	56 Missing ⚠️
test/benchmark.cc	0.00%	49 Missing ⚠️
cli/kpx.cc	68.10%	37 Missing ⚠️
cli/output.cc	86.66%	20 Missing ⚠️
src/entry.cc	74.57%	15 Missing ⚠️
cli/args.cc	69.69%	10 Missing ⚠️
src/key.cc	84.90%	8 Missing ⚠️
test/kpx.cc	96.22%	3 Missing and 3 partials ⚠️
test/concurrency.cc	94.59%	2 Missing ⚠️
src/keepass.cc	93.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!