- Implement memory-based caching for package cache to avoid redundant computations.
- Add test reflecting standard library behavior, addressing issue #966.
- Refactor and organize transformer logic for modularity and better readability.
- Update `.gitignore` to exclude IDE-specific files.
- Improve error handling and logging in transformer process.

…e.go

- Introduced `GARBLE_BUILD_NONCE` to enhance reproducibility and randomness.
- Combined seed and nonce for more robust obfuscation.
- Updated tests and documentation to reflect build nonce support.
- Improved error handling during seed and nonce generation.

…ethod

- Introduced ASCON-128 obfuscation as the primary strategy for better security (NIST-compliant).
- Enhanced the simple XOR obfuscator with nonce, position-mixing, and chaining for improved resistance to analysis.
- Updated obfuscator probability weights for balanced performance and security.
- Added tests for improved XOR and ASCON obfuscation integration.
- Included inline ASCON decryption code generation and validation.
- Refactored obfuscators for improved modularity and compatibility.

- Added `-reversible` flag for reversible obfuscation with debugging and `garble reverse` support.
- Default irreversibility now uses stronger security measures, eliminating name mapping leakage.
- Updated XOR-based obfuscation to handle both reversible and irreversible modes.
- Improved reflection logic to respect `-reversible` flag and prevent original name leakage in default mode.
- Added detailed tests for reversible/irreversible obfuscation and reflection compatibility.

…ation

- Introduced a 4-round balanced Feistel cipher with hashing-based round function.
- Added support for encryption/decryption of 64-bit values and 32-bit pairs.
- Implemented deterministic key derivation from seeds with test coverage.
- Included test cases to validate avalanche effect, seed-based differentiation, and deterministic behavior.
- Added benchmark tests for performance measurement.
- Extended runtime metadata testing to cover obfuscation with Feistel-based strategies.

Phase1

- Add Feistel encryption with table generation in linker patch
- Linker creates runtime.feistelDecryptTable symbol with:
  * 32-byte seed for runtime decryption
  * Entry count and flags (reversible mode)
  * Mappings: encrypted offset → original offset
- Add feistelSeed() to hash.go for deterministic seed generation
- Update linker environment variables (FeistelSeedEnv, ReversibleEnv)
- Update main.go to pass Feistel parameters to linker
- Uses existing -reversible flag (no new CLI arguments)

Architecture:
  BUILD TIME: Linker encrypts and generates table
  STARTUP TIME: Runtime init() will decrypt table (next step)
  HOT PATH: entry() will use map lookup (zero crypto overhead)

Status: Linker side complete, runtime side pending
Tests: All Feistel unit tests passing (8/8)
Next: Create runtime patch for decryption table loading

- Create runtime patch system (internal/runtime/)
- Add Feistel decryption patch for runtime/symtab.go:
  * Inject Feistel cipher functions (round, decrypt, derive keys)
  * Add global lookup maps for O(1) decryption
  * Inject init() to read linker-generated table
  * Modify entry() to use map lookup (zero crypto overhead)
- Update transformer.go to apply runtime patches in reversible mode
- Add runtime patch loader similar to linker patch system
- Create integration test (feistel_phase2.txtar)

Architecture complete:
  ✅ BUILD: Linker encrypts + generates table
  ✅ INIT: Runtime reads table and populates maps
  ✅ HOT PATH: entry() does simple map[offset] lookup

Status: Implementation complete, ready for testing
Tests: Feistel unit tests passing (8/8)
Next: Run integration test to verify end-to-end functionality

…s documentation for cleanup and preparation of updated implementation.

- Removed legacy runtime lazy decryption table and updated related documentation.
- Added 4-round Feistel obfuscation for `entryOff` to enhance runtime metadata encryption.
- Updated SECURITY.md to reflect Feistel cipher adoption and status changes.
- Fixed runtime patch to inject cryptographic functions with `//go:nosplit` for compatibility with `runtime.Caller`.
- Refactored key derivation and encryption helpers for maintainability.
- Removed outdated references, ensuring code aligns with Phase 2 architecture.

- Added `cache_ascon.go` for ASCON-128 authenticated encryption of the build cache.
- Introduced `encryptCacheWithASCON` and `decryptCacheWithASCON` functions with seed-based key derivation and domain separation.
- Updated `cache_shared.go` and `cache_pkg.go` to use encryption by default when a seed is provided.
- Added extensive unit tests for encryption, tampering detection, and key derivation in `cache_encryption_test.go`.

… handling:

- Obfuscate all non-empty literals by eliminating the `MinSize` constraint.
- Introduce conditional chain logic based on literal length to optimize obfuscation.
- Add tests (`TestShortStringObfuscation` and `TestLongStringChainDependency`) to ensure proper handling of short and long literals.
- Refactor `obfuscateReversible` and deobfuscation loop for improved readability and logic alignment.

- Added `-controlflow` flag and `GARBLE_CONTROLFLOW` environment variable to manage control-flow obfuscation scope.
- Implemented support for `auto` mode, obfuscating all functions with bodies unless explicitly skipped via `//garble:nocontrolflow`.
- Added `Mode` type to handle obfuscation levels (`off`, `directives`, `auto`, `all`) and corresponding logic.
- Updated transformer and hashing logic to respect control-flow modes.
- Extended tests (`mode_test.go` and `ctrlflow_auto.txtar`) to verify mode behavior and function skip directives.

…ty architecture

- Introduced `FEATURE_TOGGLES.md`, providing a detailed reference of CLI flags and environment variables, their defaults, and interactions.
- Expanded `SECURITY.md` to include a complete technical overview of Garble's architecture, detailing threat models, encryption mechanisms (Feistel, ASCON-128), and design improvements.
- Updated sections on metadata encryption, cache hardening, and runtime obfuscation for improved clarity and completeness.

- Introduced `ARCHITECTURE.md`, a detailed reference of Garble’s architecture.
- Included high-level system diagrams and explicit separation of responsibilities for architecture layers.
- Documented obfuscation mechanisms: name hashing, control-flow transformation, and runtime metadata encryption.
- Provided in-depth implementation details for caching, cryptographic primitives, and obfuscation modules.
- Detailed build and reverse execution flows, improving clarity for maintainers and contributors.

- Introduced `literals.Builder` for better separation of obfuscation logic.
- Added support for obfuscating linker-injected strings (`-ldflags -X`), securing them against static extraction.
- Rewrote eligible constant strings to variables for enhanced obfuscation while preserving compile-time dependent constants.
- Enhanced tests to verify proper obfuscation of linker-injected strings and rewritten constants in various scenarios.