crypto(matryoshka): wasm32+simd128 backend — same ndarray::simd::U32x16 source, browser lane

Completes the matryoshka's browser half. The fork's `ndarray_simd` backend cfg
gates widen from x86_64+avx512f to
`any(all(x86_64, avx512f), all(wasm32, simd128))` (backends.rs module decl +
lib.rs::process_with_backend dispatch), and the target-scoped ndarray dep to
`cfg(any(target_arch="x86_64", target_arch="wasm32"))`.

The SAME src/backends/ndarray_simd.rs source now drives BOTH hardware lanes —
the AVX-512 `__m512i` lane on a server build and the native `[U32x4; 4]` lane on
a wasm32+simd128 browser build — because the backend only ever uses `U32x16`
ops, and ndarray's polyfill lowers `U32x16` to the right lane per target. aarch64
and other fork builds still never pull ndarray (they use RustCrypto's backends).

Verified:
  - `cargo build --manifest-path vendor/chacha20/Cargo.toml --target
    wasm32-unknown-unknown --lib` with `-Ctarget-feature=+simd128` compiles
    ndarray-for-wasm (std, minimal features) + the wasm backend clean;
  - x86 avx512 RustCrypto vectors still 9/9 green through ndarray_simd after the
    cfg widening.
Bit-exact by composition: the ndarray_simd source is RFC-8439-proven on x86, and
the wasm U32x16 [U32x4;4] lane is node-proven by the existing wasm_simd CI job.

CI: added a compile-guard step to the wasm_simd job (build the fork for
wasm32+simd128) so a future ndarray::simd change that broke the wasm backend
fails there.

A consumer building `encryption` as a wasm cdylib with +simd128 now gets the
accelerated XChaCha20-Poly1305 keystream transparently — the browser goal.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K6pT32kk6pnuAAqR3JiYqu

Author: claude

.claude/CHACHA20_MATRYOSHKA_PLAN.md

@@ -71,11 +71,18 @@ below **superseded it** — it is now **RETIRED** (2026-07-12, see below).
   build** (`.cargo/config-avx512.toml` / `-Ctarget-cpu=x86-64-v4`); the default v3
   build uses RustCrypto's own avx2 backend (fast, vetted). This is correct and
   safe — the matryoshka is the *server-avx512* accelerator.
-- **wasm browser backend (next):** add a sibling `#[cfg(all(target_arch="wasm32",
-  target_feature="simd128"))]` branch selecting an `ndarray_simd` backend (same
-  `U32x16` source; the wasm arm is native `[U32x4;4]`) + a `target.'cfg(wasm32)'`
-  ndarray dep. Gated on verifying `ndarray/std` builds inside the encryption
-  `cdylib` for `wasm32-unknown-unknown`.
+- ~~**wasm browser backend.**~~ **DONE 2026-07-12** — the fork's `ndarray_simd`
+  cfg gates were widened to `any(all(x86_64, avx512f), all(wasm32, simd128))` in
+  `backends.rs` + `lib.rs::process_with_backend`, and the ndarray dep to
+  `cfg(any(x86_64, wasm32))`. The SAME `ndarray_simd.rs` source now drives the
+  AVX-512 `__m512i` lane (server) and the native wasm `[U32x4;4]` lane (browser).
+  Verified: `cargo build --manifest-path vendor/chacha20/Cargo.toml --target
+  wasm32-unknown-unknown --lib` with `+simd128` compiles ndarray-for-wasm + the
+  wasm backend clean; x86 avx512 vectors still 9/9 green after the widening. Bit-
+  exact by composition (the `ndarray_simd` source is RFC-proven on x86; the wasm
+  `U32x16` lane is node-proven by the `wasm_simd` CI job). A CI compile-guard step
+  was added to the `wasm_simd` job. A consumer building `encryption` as a wasm
+  cdylib with `+simd128` now gets the accelerated keystream transparently.
 - **cross-repo `[patch]` (next):** `[patch]` does not transit, so MedCare-rs (and
   any other consumer building `encryption` for avx512) needs its own
   `[patch.crates-io] chacha20 = { path = "vendor/chacha20" }` pointing at a vendored

.github/workflows/ci.yaml

@@ -134,6 +134,12 @@ jobs:
           node-version: "22"
       - name: wasm SIMD parity (build + node run)
         run: ./scripts/wasm-parity.sh
+      # Guard the wasm matryoshka: the chacha20 fork's ndarray_simd backend must
+      # keep compiling for wasm32+simd128 (it rides the same U32x16 lane the node
+      # parity step above proves bit-exact). A future ndarray::simd change that
+      # broke the wasm backend build would fail here.
+      - name: wasm matryoshka backend (chacha20 fork) compiles for wasm32+simd128
+        run: RUSTFLAGS="-C target-feature=+simd128" cargo build --manifest-path vendor/chacha20/Cargo.toml --target wasm32-unknown-unknown --lib
 
   neon_simd:
     # The x86 `cargo test` suite never touches `simd_neon.rs` (it is cfg'd to

vendor/chacha20/Cargo.toml

@@ -50,11 +50,12 @@ zeroize = ["cipher/zeroize"]
 [target."cfg(any(target_arch = \"x86_64\", target_arch = \"x86\"))".dependencies.cpufeatures]
 version = "0.2"
 
-# The matryoshka's one non-upstream dependency: the AVX-512 backend rides
-# `ndarray::simd::U32x16`. Scoped to x86_64 so wasm / aarch64 / other builds of
-# this crate never pull ndarray (they fall through to the upstream backends);
-# `simd` needs only ndarray's `std` feature, not the full HPC default set.
-[target."cfg(target_arch = \"x86_64\")".dependencies.ndarray]
+# The matryoshka's one non-upstream dependency: the ndarray_simd backend rides
+# `ndarray::simd::U32x16` (AVX-512 lane on x86_64, native [U32x4;4] on wasm32).
+# Scoped to x86_64 + wasm32 so aarch64 / other builds of this crate never pull
+# ndarray (they fall through to the upstream backends); `simd` needs only
+# ndarray's `std` feature, not the full HPC default set.
+[target."cfg(any(target_arch = \"x86_64\", target_arch = \"wasm32\"))".dependencies.ndarray]
 path = "../.."
 default-features = false
 features = ["std"]

vendor/chacha20/src/backends.rs

@@ -3,9 +3,14 @@ use cfg_if::cfg_if;
 cfg_if! {
     if #[cfg(chacha20_force_soft)] {
         pub(crate) mod soft;
-    } else if #[cfg(all(target_arch = "x86_64", target_feature = "avx512f"))] {
-        // AdaWorldAPI matryoshka: on an AVX-512 build the keystream double-round
-        // rides `ndarray::simd::U32x16` (the polyfill lowers it to `__m512i`).
+    } else if #[cfg(any(
+        all(target_arch = "x86_64", target_feature = "avx512f"),
+        all(target_arch = "wasm32", target_feature = "simd128"),
+    ))] {
+        // AdaWorldAPI matryoshka: the keystream double-round rides
+        // `ndarray::simd::U32x16` — the polyfill lowers it to `__m512i` on an
+        // AVX-512 build (server) and to the native `[U32x4; 4]` lane on a
+        // wasm32+simd128 build (browser). Same source, two hardware lanes.
         // Takes precedence over the runtime-detected AVX2/SSE2 path below.
         pub(crate) mod ndarray_simd;
     } else if #[cfg(any(target_arch = "x86", target_arch = "x86_64"))] {

vendor/chacha20/src/lib.rs

@@ -263,8 +263,12 @@ impl<R: Unsigned> StreamCipherCore for ChaChaCore<R> {
         cfg_if! {
             if #[cfg(chacha20_force_soft)] {
                 f.call(&mut backends::soft::Backend(self));
-            } else if #[cfg(all(target_arch = "x86_64", target_feature = "avx512f"))] {
-                // AdaWorldAPI matryoshka: keystream via ndarray::simd::U32x16.
+            } else if #[cfg(any(
+                all(target_arch = "x86_64", target_feature = "avx512f"),
+                all(target_arch = "wasm32", target_feature = "simd128"),
+            ))] {
+                // AdaWorldAPI matryoshka: keystream via ndarray::simd::U32x16
+                // (AVX-512 lane on x86_64, native [U32x4; 4] lane on wasm32).
                 f.call(&mut backends::ndarray_simd::Backend(self));
             } else if #[cfg(any(target_arch = "x86", target_arch = "x86_64"))] {
                 cfg_if! {