Sharpen security-first crate positioning

[copyleftdev]

What changed

• Repositions totp-rfc as a security-hardened, allocation-free no_std HOTP/TOTP primitive layer.
• Makes constant-address truncation and constant-time first-match selection visible in the README.
• Adds a clear scope boundary between the verification core and provisioning, QR, clock, database, and secret-generation concerns.
• Aligns Cargo search metadata and the canonical GitHub About/topics documentation with that positioning.

Why

The crate should compete on a compact, auditable security boundary rather than duplicate convenience-heavy enrollment toolkits. This wording makes that distinction immediately clear to Rust, embedded, 2FA, and MFA users.

Impact

No API, behavior, dependency, or version changes. The Cargo description and keywords will become visible on crates.io with the next crate release.

Validation

• cargo fmt --all -- --check
• cargo check --all-targets --all-features --locked
• cargo test --all-features --locked (33 unit, integration, and doc tests)
• RUSTDOCFLAGS='-D warnings' cargo doc --no-deps --all-features --locked
• cargo package --allow-dirty --locked
• git diff --check

Summary by CodeRabbit

• Documentation
  • Updated project descriptions to highlight allocation-free, no_std support and strict RFC 4226/6238 behavior.
  • Expanded README guidance on constant-time verification, RFC-compliant processing, and the library’s focused primitive scope.
  • Clarified that provisioning, secret management, clock policy, replay protection, and throttling are handled by surrounding applications.
  • Refined repository topics and metadata to better reflect security and constant-time capabilities.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 53cd605d-6540-4570-9cb8-96bf3ed80ccd

📥 Commits

Reviewing files that changed from the base of the PR and between 7d3e6df and b01a715.

📒 Files selected for processing (3)

• Cargo.toml
• README.md
• docs/repository-metadata.md

---

📝 Walkthrough

Walkthrough

Updated crate and repository metadata plus README documentation to describe security-hardened, allocation-free no_std HOTP/TOTP primitives, strict RFC behavior, constant-time verification details, and the intentionally limited primitive-layer scope.

Changes

Crate positioning

Layer / File(s)	Summary
Metadata and documentation updates Cargo.toml, README.md, docs/repository-metadata.md	Package descriptions and keywords now emphasize allocation-free no_std, strict RFC 4226/6238 behavior, and constant-time verification. The README adds detailed verification guarantees and documents provisioning, replay, throttling, and clock-policy boundaries.

Estimated code review effort: 1 (Trivial) | ~5 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/hardened-positioning

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}