FlatHash: status in the 1.0.0 release candidate

Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.

This page replaces the 3.0.0-era “FlatHash Security-Focused API Documentation”, which documented a security-hardened API at version 3.0.0 that no package of the 1.0.0-rc.7 line carries.

What the release records

• Not a catalog profile. The release catalog lists 49 profiles in 16 families; FlatHash (MetaMUI’s structured-data hashing) is not among them, so no validation, packaging or interoperability claim is made for it on any target.
• In the Rust release line. The crate metamui-flathash is part of the Rust slice of the export manifest, with the vector directory its gate reads; it is a per-algorithm crate outside the facade and the public API contract makes no stability promise for it.
• Implementations in the source tree: Rust (metamui-flathash), C (metamui-flathash), Go (flathash), Python (metamui_crypto.flathash), TypeScript (@metamui/flathash, over the flathash WebAssembly crate), Swift (MetaMUIFlatHash), Kotlin (id.metamui.crypto.flathash), Java (metamui-flathash), C# (MetaMUI.Crypto.FlatHash). Each ships with its tree and its own tests; none is recorded in the catalog.

What is not claimed

No constant-time or side-channel property (A48, unmeasured), no independent audit, no certification, no performance figure. The former page’s API listings, hardening features and usage examples are withdrawn: none was executed against the candidate, and this page carries no code.

Related

• FlatHash threat model
• Public API Reference — what the catalog and the contract cover