chore(rust): upgrade ed25519-dalek and rand

[Floze (floze-the-genius)]

Summary

Upgrade the Rust workspace from ed25519-dalek 2.2.0 to 3.0.0 and from
rand 0.8.6 to 0.10.2, including the required source-level API migration.

Changes

• migrate rand::distributions to rand::distr and use SampleString
• replace deprecated thread_rng() calls with rng()
• replace the removed RngCore import with Rng
• preserve OS-backed Ed25519 key generation with SysRng wrapped by
  rand_core::UnwrapErr, matching the new fallible system-RNG API
• update the lockfile to ed25519-dalek 3.0.0, curve25519-dalek 5.0.0,
  and the rand 0.10 dependency stack
• add a regression test that verifies production nonces remain exactly
  32 ASCII-alphanumeric characters

The migration does not change serialized identity formats, public-key sizes,
signature sizes, nonce length, or credential-vault encryption behavior.

Security invariants

• Ed25519 signing keys continue to come directly from the operating system RNG.
  UnwrapErr(SysRng) preserves the previous fail-closed behavior if system
  entropy is unavailable.
• Vault keys, AES-GCM nonces, and MCP nonces continue to use the thread-local
  generator seeded and periodically reseeded from the system RNG.
• Existing tests cover valid signing, wrong-message rejection, malformed and
  oversized signatures, cross-identity rejection, distinct generated keypairs,
  key rotation, and encrypted vault persistence.
• The added regression test proves that the nonce migration preserves the
  existing 32-character ASCII-alphanumeric contract.

Validation

• rustup run 1.89.0 cargo test --release --workspace
  • 515 tests passed, including unit, integration, and doc tests
• cargo check --workspace --all-targets
• full workspace Clippy passed with -D warnings after allowing only existing,
  unrelated repository warnings (deprecated, single_element_loop,
  format_in_format_args, io_other_error, and manual_is_multiple_of)
• targeted rustfmt checks passed for the changed identity and nonce files
• dependency inspection confirms that rand 0.8 / rand_core 0.6 and
  ed25519-dalek 2.x are no longer present
• cargo audit --file Cargo.lock
  • no advisory affects the upgraded rand / Ed25519 dependency stack
  • reports two pre-existing transitive warnings from unchanged
    regorus 0.10.1: anyhow 1.0.102 (RUSTSEC-2026-0190) and yanked
    spin 0.10.0

AI Assistance

OpenAI Codex assisted with the API migration, regression test, and validation.
The implementation was checked against the exact crate sources, compiler
diagnostics, the repository's declared Rust 1.89 MSRV, and the complete release
test suite before submission.

Fixes #3355

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for your first pull request.
Please ensure tests pass, code follows style (ruff check), and you have signed the CLA.
See our Contributing Guide.

[github-actions]

🤖 AI Agent: test-generator — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Test coverage looks good. No gaps identified.

[github-actions]

🤖 AI Agent: contributor-guide — Welcome, and thank you for contributing! Great job on the detailed summary and thorough validation steps.

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Welcome, and thank you for contributing! Great job on the detailed summary and thorough validation steps.

Before merging, please address the following:

1. Update Cargo.toml to ensure all dependencies have exact version constraints (=) for consistency.
2. Verify that the rand::distr import aligns with the new API usage in clock.rs.

For guidance, refer to CONTRIBUTING.md. Let us know if you need help!

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

Severity	Change	Impact
High	Upgrade ed25519-dalek from 2.2.0 to 3.0.0	Major version upgrade introduces breaking changes, including API changes and dependency updates.
High	Upgrade rand from 0.8.6 to 0.10.2	Major version upgrade introduces breaking changes, including changes to module structure and APIs.
High	Migration from rand::distributions to rand::distr	Code relying on the old module structure will break.
High	Replacement of thread_rng() with rng()	Code using thread_rng() will need to be updated.
High	Removal of RngCore import in favor of Rng	Code explicitly importing RngCore will fail.
High	Changes to system RNG API (SysRng with rand_core::UnwrapErr)	Code relying on the previous system RNG behavior will need adjustments.
Medium	Dependency updates in Cargo.lock and Cargo.toml	May cause compatibility issues with other dependencies relying on older versions.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

• README.md -- no updates found for the changes in dependencies or API migration.
• CHANGELOG.md -- missing entry for the upgrade of ed25519-dalek to 3.0.0 and rand to 0.10.2, along with the associated API changes.

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

🤖 AI Agent: code-reviewer — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. [Upgrade appears secure but requires follow-up validation for cryptographic changes.]

#	Sev	Issue	Where
1	Warn	Cryptographic library upgrades (ed25519-dalek, rand) require thorough validation to ensure no regressions in security-sensitive operations.	agent-governance-rust/Cargo.toml, Cargo.lock

Action items:

• Conduct a detailed security review of the upgraded cryptographic libraries (ed25519-dalek 3.0.0 and rand 0.10.2`) to confirm no regressions or vulnerabilities.

Warnings:

#	Issue	Where	Follow-up PR
1	Ensure cryptographic changes preserve security guarantees (e.g., key generation, signature validation).	agent-governance-rust/agentmesh-mcp/src/mcp/clock.rs	fine as follow-up PRs.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.

[Floze (floze-the-genius)]

@microsoft-github-policy-service agree

[Copilot]

Pull request overview

TL;DR: 0 blockers, 0 warnings. No issues found. Clean change.

Upgrades the Rust workspace dependencies in agent-governance-rust/ to ed25519-dalek 3.0.0 and rand 0.10.2, including the required source-level API migrations in identity, vault crypto, and nonce generation.

Changes:

• Bump ed25519-dalek to 3.0.0 and rand to 0.10.2 (workspace + lockfile refresh).
• Migrate OS-backed Ed25519 key generation to SysRng via rand_core::UnwrapErr where required by the new fallible RNG API.
• Update nonce generation to rand::distr + SampleString and add a regression test for the 32-char ASCII-alphanumeric nonce format.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
agent-governance-rust/Cargo.toml	Pins workspace dependencies to ed25519-dalek 3.0.0 and rand 0.10.2.
agent-governance-rust/Cargo.lock	Updates the resolved dependency graph to match the new major versions.
agent-governance-rust/agentmesh/src/identity.rs	Migrates Ed25519 key generation to SysRng with UnwrapErr for the updated RNG API.
agent-governance-rust/agentmesh/src/identity_support.rs	Aligns credential issuance / key rotation keygen with the updated RNG + dalek API expectations.
agent-governance-rust/agentmesh/src/credential_vault.rs	Replaces thread_rng() with rng() for key/nonce generation under rand 0.10.
agent-governance-rust/agentmesh-mcp/src/mcp/clock.rs	Migrates alphanumeric nonce generation to rand::distr + SampleString and adds a format regression test.

[Imran Siddique (imran-siddique)]

Thanks Floze (@floze-the-genius). This targets the same six files and the same ed25519-dalek 2.x to 3.x / rand upgrade as #3420, which is already mergeable and linked to the tracking issue #3355. To keep the review in one place we are consolidating on #3420. Closing this as a duplicate, with no reflection on the work here. Please feel free to review #3420 or pick up another open issue.