Implement encrypted backup export and restore #91

Merged

lost-rob0t merged 4 commits from agent/issue-32-backup-export into main

2026-08-30 03:54:40 +00:00

lost-rob0t commented

2026-08-30 03:52:41 +00:00

(Migrated from github.com)

Closes #32.

RAGE transaction for encrypted backup export and restore. Starting main: 233f310.

Completed and verified slices:

bounded LRBACKUP1 archive container: magic+version header, canonical-JSON manifest (format/schema versions, record count, SHA-256 body digest), length-prefixed canonical encrypted envelopes; no decryption anywhere in the pipeline and no active key material exported;
BackupEngine.export: full and explicit time-range windows over the paged content-free catalog, sanitized export_decision audit;
BackupEngine.restore: empty-target enforcement with explicit override, schema-version compatibility check, body-digest verification, envelope authentication, identical-duplicate skip, conflicting-duplicate fail-safe, sanitized restore_decision audit;
optional GPG recipient encryption: GpgRecipientCrypter via create_subprocess_exec (no shell), strict args, bounded timeout, private homedir support; wrong-recipient/timeout/missing-binary failures are sanitized and never produce partial restores;
documentation: docs/backup.md.

Acceptance evidence (exact head 7c877c5):

archive inspection reveals no captured text/titles/prompts/credentials (byte-level scans of raw archives and manifest JSON);
restore reproduces searchable records after key material is available (canonical get assertions on restored profiles);
corrupted, truncated, and wrong-recipient archives fail safely with zero restored records (byte-flip, truncation, and wrong-keyring tests);
export and restore audited with counts only (event assertions; audit reprs free of content).

Canonical ./scripts/check on exact head: 916 tests passed (unit 795, security 61, integration 49, contract 6 — plus 5 GPG round-trip tests), 8 failure modes verified, Bandit clean, detect-secrets clean, ruff clean, strict Pyright clean. RAGE log: rage/issue-32-backup-export.org.

Closes #32. RAGE transaction for encrypted backup export and restore. Starting main: `233f310`. Completed and verified slices: - bounded `LRBACKUP1` archive container: magic+version header, canonical-JSON manifest (format/schema versions, record count, SHA-256 body digest), length-prefixed canonical encrypted envelopes; no decryption anywhere in the pipeline and no active key material exported; - `BackupEngine.export`: full and explicit time-range windows over the paged content-free catalog, sanitized `export_decision` audit; - `BackupEngine.restore`: empty-target enforcement with explicit override, schema-version compatibility check, body-digest verification, envelope authentication, identical-duplicate skip, conflicting-duplicate fail-safe, sanitized `restore_decision` audit; - optional GPG recipient encryption: `GpgRecipientCrypter` via `create_subprocess_exec` (no shell), strict args, bounded timeout, private homedir support; wrong-recipient/timeout/missing-binary failures are sanitized and never produce partial restores; - documentation: `docs/backup.md`. Acceptance evidence (exact head `7c877c5`): - archive inspection reveals no captured text/titles/prompts/credentials (byte-level scans of raw archives and manifest JSON); - restore reproduces searchable records after key material is available (canonical `get` assertions on restored profiles); - corrupted, truncated, and wrong-recipient archives fail safely with zero restored records (byte-flip, truncation, and wrong-keyring tests); - export and restore audited with counts only (event assertions; audit reprs free of content). Canonical `./scripts/check` on exact head: 916 tests passed (unit 795, security 61, integration 49, contract 6 — plus 5 GPG round-trip tests), 8 failure modes verified, Bandit clean, detect-secrets clean, ruff clean, strict Pyright clean. RAGE log: `rage/issue-32-backup-export.org`.