Implement encrypted storage and migrations #57

Merged

lost-rob0t merged 48 commits from agent/issue-11-encrypted-storage into main

2026-07-18 23:13:03 +00:00

lost-rob0t commented

2026-07-18 21:17:13 +00:00

(Migrated from github.com)

What changed

Added a strict persistent codec for EncryptedRecordEnvelope values.
Added owner-only UUIDv4-sharded opaque blob files and a minimal SQLite catalog.
Catalog metadata is limited to opaque IDs, envelope/key versions, encrypted sizes, a coarse UTC day bucket, blob digest, and transaction state.
Added write-intent journaling, fsync plus atomic rename, restart recovery, interrupted deletion completion, integrity verification, orphan repair, and opaque quarantine.
Added quota enforcement and symlink/ownership checks.
Added forward-only catalog schema version 2 with a transactional version-1 migration fixture.
Added bounded coarse-day query and integrity-report storage contracts.
Added unit and security tests proving raw payload rejection and absence of seeded titles, OCR text, URLs, configuration revisions, and exact timestamps from catalog/filesystem metadata.

Validation

Workflow run #160 passed on Ubuntu 22.04 and Ubuntu 24.04:

Ruff formatting and lint
ShellCheck
strict Pyright
unit, contract, integration, and security tests
repository policy, Bandit, and detect-secrets
eight-mode failure propagation

Closes #11

## What changed - Added a strict persistent codec for `EncryptedRecordEnvelope` values. - Added owner-only UUIDv4-sharded opaque blob files and a minimal SQLite catalog. - Catalog metadata is limited to opaque IDs, envelope/key versions, encrypted sizes, a coarse UTC day bucket, blob digest, and transaction state. - Added write-intent journaling, fsync plus atomic rename, restart recovery, interrupted deletion completion, integrity verification, orphan repair, and opaque quarantine. - Added quota enforcement and symlink/ownership checks. - Added forward-only catalog schema version 2 with a transactional version-1 migration fixture. - Added bounded coarse-day query and integrity-report storage contracts. - Added unit and security tests proving raw payload rejection and absence of seeded titles, OCR text, URLs, configuration revisions, and exact timestamps from catalog/filesystem metadata. ## Validation Workflow run #160 passed on Ubuntu 22.04 and Ubuntu 24.04: - Ruff formatting and lint - ShellCheck - strict Pyright - unit, contract, integration, and security tests - repository policy, Bandit, and detect-secrets - eight-mode failure propagation Closes #11