[AnthonyRonning]

The Agent dependency audit and SQLCipher source-verification gate fail on RUSTSEC-2026-0387: the in-tree SDK's P-256 dependency resolves vulnerable crypto-bigint 0.5.5.

Upgrade the Rust SDK to P-256 0.14 and require crypto-bigint >=0.7.6 explicitly, so downstream SDK builds cannot resolve an affected version without this repository's lockfile. Prepare SDK 4.1.2 and update the SDK, Proxy, Agent and Research lockfiles. Keep X25519 on its existing OS-RNG implementation and adapt P-256 key generation/SEC1 calls to the maintained API.

Three frozen compatibility tests were first passed against P-256 0.13.2, then passed unchanged after the upgrade. The independent Node-generated vector checks persisted PKCS#8/SPKI identity, existing encrypted-push preview decryption, and tampered authentication-tag rejection. They run in the ordinary SDK library-test gate.

Validation:

• All four client graphs passed RustSec and malicious-package checks for macOS, Linux and Windows (12 checks).
• Legacy compatibility vectors passed before and after migration.
• Full Agent just ci passed, including the complete lint feature matrix, workspace tests and headless tests.
• Normal commit hook passed Research Rust, SDK Rust, Proxy and Agent checks; SDK library tests: 123 passed, 1 ignored.
• Locked consumer identity verification passed: one in-tree SDK 4.1.2 and one local Proxy.
• cargo package --locked passed; the packaged manifest/lockfile retain the patched integer floor and include the compatibility fixture.
• Hosted platform and full-stack integration CI will run on this PR; no hosted runtime or registry publication is claimed.

The backend has a separate pre-existing affected graph through its independently pinned Tinfoil/HPKE/SEV dependencies; it is outside this client remediation and requires a separate dependency migration. Registry publication for external SDK users remains a separate action.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}