[P0] Implement encryption and key-provider strategies #10

New issue

Closed

opened 2026-07-17 23:59:16 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-17 23:59:16 +00:00

(Migrated from github.com)

Goal

Encrypt every persisted capture record with pluggable, fail-closed key management.

Requirements

Authenticated encryption with versioned envelopes and associated metadata.
Key-provider strategy supporting an OS keyring or dedicated local key store.
Configurable GPG fallback provider.
Encryption occurs directly from redacted in-memory data.
Missing, locked, or invalid keys prevent storage and stop/fault capture according to policy.
Key IDs are stored; key material is never written to application logs or config.
Define key rotation, recovery, and revocation behavior.

Acceptance criteria

Storage APIs accept encrypted envelopes only.
Tampering and wrong-key tests fail authentication cleanly.
GPG fallback is never selected silently; it must be configured and health checked.
Key rotation can rewrap or migrate existing records without plaintext files.

Depends on

## Goal Encrypt every persisted capture record with pluggable, fail-closed key management. ## Requirements - Authenticated encryption with versioned envelopes and associated metadata. - Key-provider strategy supporting an OS keyring or dedicated local key store. - Configurable GPG fallback provider. - Encryption occurs directly from redacted in-memory data. - Missing, locked, or invalid keys prevent storage and stop/fault capture according to policy. - Key IDs are stored; key material is never written to application logs or config. - Define key rotation, recovery, and revocation behavior. ## Acceptance criteria - Storage APIs accept encrypted envelopes only. - Tampering and wrong-key tests fail authentication cleanly. - GPG fallback is never selected silently; it must be configured and health checked. - Key rotation can rewrap or migrate existing records without plaintext files. ## Depends on - #5 - #9