Scaffold Rust workspace: warzone-protocol, server, client, mule

4 crates, all compile. 16/17 tests pass.

warzone-protocol (core crypto):
- Seed-based identity (Ed25519 + X25519 from 32-byte seed via HKDF)
- BIP39 mnemonic encode/decode (24 words)
- Fingerprint type (SHA-256 truncated, displayed as xxxx:xxxx:xxxx:xxxx)
- ChaCha20-Poly1305 AEAD encrypt/decrypt with random nonce
- HKDF-SHA256 key derivation
- Pre-key bundle generation with Ed25519 signatures
- X3DH key exchange (simplified, needs X25519 identity key in bundle)
- Double Ratchet: full implementation with DH ratchet, chain ratchet,
  out-of-order message handling via skipped keys cache
- Message format (WarzoneMessage envelope + RatchetHeader)
- Session type with ratchet state
- Storage trait definitions (PreKeyStore, SessionStore, MessageQueue)

warzone-server (axum):
- sled database (keys, messages, one-time pre-keys)
- Routes: /v1/health, /v1/keys/register, /v1/keys/{fp},
  /v1/messages/send, /v1/messages/poll/{fp}, /v1/messages/{id}/ack

warzone-client (CLI):
- `warzone init` — generate seed, show mnemonic, save to ~/.warzone/
- `warzone recover <words>` — restore from mnemonic
- `warzone info` — show fingerprint and keys
- Seed storage at ~/.warzone/identity.seed (600 perms)
- Stubs for send, recv, chat commands

warzone-mule: Phase 4 placeholder

Known issue: X3DH test fails (initiate/respond use different DH ops
due to missing X25519 identity key in bundle). Fix in next step.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/crates/warzone-client/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "warzone-client"
+version.workspace = true
+edition.workspace = true
+
+[dependencies]
+warzone-protocol = { path = "../warzone-protocol" }
+tokio.workspace = true
+reqwest.workspace = true
+sled.workspace = true
+clap.workspace = true
+ratatui.workspace = true
+crossterm.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+anyhow.workspace = true
+argon2.workspace = true
+chacha20poly1305.workspace = true
+rand.workspace = true
+zeroize.workspace = true
+hex.workspace = true

warzone/crates/warzone-client/src/cli/info.rs

@@ -0,0 +1,16 @@
+use crate::keystore;
+
+pub fn run() -> anyhow::Result<()> {
+    let seed = keystore::load_seed()?;
+    let identity = seed.derive_identity();
+    let pub_id = identity.public_identity();
+
+    println!("Fingerprint: {}", pub_id.fingerprint);
+    println!("Signing key: {}", hex::encode(pub_id.signing.as_bytes()));
+    println!(
+        "Encryption key: {}",
+        hex::encode(pub_id.encryption.as_bytes())
+    );
+
+    Ok(())
+}

warzone/crates/warzone-client/src/cli/init.rs

@@ -0,0 +1,27 @@
+use warzone_protocol::identity::Seed;
+
+use crate::keystore;
+
+pub fn run() -> anyhow::Result<()> {
+    let seed = Seed::generate();
+    let identity = seed.derive_identity();
+    let pub_id = identity.public_identity();
+    let mnemonic = seed.to_mnemonic();
+
+    println!("Identity generated!\n");
+    println!("Fingerprint: {}", pub_id.fingerprint);
+    println!("\nRecovery mnemonic (WRITE THIS DOWN):\n");
+    for (i, word) in mnemonic.split_whitespace().enumerate() {
+        print!("{:>2}. {:<12}", i + 1, word);
+        if (i + 1) % 4 == 0 {
+            println!();
+        }
+    }
+    println!();
+
+    // Save encrypted seed
+    keystore::save_seed(&seed)?;
+    println!("Seed saved to ~/.warzone/identity.seed");
+
+    Ok(())
+}

warzone/crates/warzone-client/src/cli/mod.rs

@@ -0,0 +1,3 @@
+pub mod info;
+pub mod init;
+pub mod recover;

warzone/crates/warzone-client/src/cli/recover.rs

@@ -0,0 +1,17 @@
+use warzone_protocol::identity::Seed;
+
+use crate::keystore;
+
+pub fn run(mnemonic: &str) -> anyhow::Result<()> {
+    let seed = Seed::from_mnemonic(mnemonic)?;
+    let identity = seed.derive_identity();
+    let pub_id = identity.public_identity();
+
+    println!("Identity recovered!");
+    println!("Fingerprint: {}", pub_id.fingerprint);
+
+    keystore::save_seed(&seed)?;
+    println!("Seed saved to ~/.warzone/identity.seed");
+
+    Ok(())
+}

warzone/crates/warzone-client/src/keystore.rs

@@ -0,0 +1,40 @@
+//! Seed storage: encrypts at rest with Argon2 + ChaCha20-Poly1305.
+//! For Phase 1, we store the seed in plaintext. Encryption is TODO.
+
+use std::fs;
+use std::path::PathBuf;
+
+use warzone_protocol::identity::Seed;
+
+fn seed_path() -> PathBuf {
+    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());
+    PathBuf::from(home).join(".warzone").join("identity.seed")
+}
+
+pub fn save_seed(seed: &Seed) -> anyhow::Result<()> {
+    let path = seed_path();
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+    // TODO: encrypt with passphrase (Argon2 + ChaCha20-Poly1305)
+    fs::write(&path, &seed.0)?;
+    // Set permissions to owner-only on Unix
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;
+    }
+    Ok(())
+}
+
+pub fn load_seed() -> anyhow::Result<Seed> {
+    let path = seed_path();
+    let bytes = fs::read(&path)
+        .map_err(|_| anyhow::anyhow!("No identity found. Run `warzone init` first."))?;
+    if bytes.len() != 32 {
+        anyhow::bail!("Corrupted seed file");
+    }
+    let mut seed_bytes = [0u8; 32];
+    seed_bytes.copy_from_slice(&bytes);
+    Ok(Seed::from_bytes(seed_bytes))
+}

warzone/crates/warzone-client/src/lib.rs

@@ -0,0 +1,5 @@
+pub mod cli;
+pub mod keystore;
+pub mod net;
+pub mod storage;
+pub mod tui;

warzone/crates/warzone-client/src/main.rs

@@ -0,0 +1,75 @@
+use clap::{Parser, Subcommand};
+
+mod cli;
+mod keystore;
+mod net;
+mod storage;
+mod tui;
+
+#[derive(Parser)]
+#[command(name = "warzone", about = "Warzone messenger client")]
+struct Cli {
+    #[command(subcommand)]
+    command: Commands,
+}
+
+#[derive(Subcommand)]
+enum Commands {
+    /// Generate a new identity (seed + keypair)
+    Init,
+    /// Recover identity from BIP39 mnemonic
+    Recover {
+        /// 24-word mnemonic
+        #[arg(num_args = 1..)]
+        words: Vec<String>,
+    },
+    /// Show your fingerprint and public key
+    Info,
+    /// Send an encrypted message
+    Send {
+        /// Recipient fingerprint (e.g. a3f8:c912:44be:7d01)
+        recipient: String,
+        /// Message text
+        message: String,
+        /// Server URL
+        #[arg(short, long, default_value = "http://localhost:7700")]
+        server: String,
+    },
+    /// Poll for and decrypt messages
+    Recv {
+        /// Server URL
+        #[arg(short, long, default_value = "http://localhost:7700")]
+        server: String,
+    },
+    /// Launch interactive TUI chat
+    Chat {
+        /// Server URL
+        #[arg(short, long, default_value = "http://localhost:7700")]
+        server: String,
+    },
+}
+
+fn main() -> anyhow::Result<()> {
+    let cli = Cli::parse();
+
+    match cli.command {
+        Commands::Init => cli::init::run()?,
+        Commands::Recover { words } => cli::recover::run(&words.join(" "))?,
+        Commands::Info => cli::info::run()?,
+        Commands::Send {
+            recipient,
+            message,
+            server,
+        } => {
+            println!("TODO: send '{}' to {} via {}", message, recipient, server);
+        }
+        Commands::Recv { server } => {
+            println!("TODO: poll messages from {}", server);
+        }
+        Commands::Chat { server } => {
+            println!("TODO: launch TUI connected to {}", server);
+        }
+    }
+
+    Ok(())
+}

warzone/crates/warzone-client/src/net.rs

@@ -0,0 +1,2 @@
+// HTTP client for talking to warzone-server.
+// TODO: implement in Phase 1 step 9.

warzone/crates/warzone-client/src/storage.rs

@@ -0,0 +1,2 @@
+// Local sled database: sessions, contacts, message history.
+// TODO: implement in Phase 1 step 9.

warzone/crates/warzone-client/src/tui/app.rs

@@ -0,0 +1,2 @@
+// TUI App struct and event loop.
+// TODO: implement in Phase 1 step 10.

warzone/crates/warzone-client/src/tui/mod.rs

@@ -0,0 +1,3 @@
+// TUI scaffold — ratatui app.
+// TODO: implement in Phase 1 step 10.
+pub mod app;