nbari / backup / 27091041831

80%

main: 80%

push

github

Add keyed content identifiers and sealed naming key

Harden the catalog for an untrusted-store threat model:

- Derive the X25519 content keypair from the mnemonic via HKDF-SHA256 over
  the full seed (centralized in content_keypair); wrap derived secrets in
  Zeroizing.
- Add a per-backup naming key that keys BLAKE3 content identifiers
  (blake3_keyed), so stored ids are opaque without the key.
- Seal the naming key to the public key in the catalog; cache the plaintext
  in an owner-only {name}.wkey so cron runs stay unattended. Missing cache
  prompts for the mnemonic, unseals, and rewrites it (also a recovery self-test).
- Wire create to generate+seal the naming key and write {name}.wkey; thread
  the naming key through the run scan; resolve/unlock it in the run action.
- Update README security model and tests (38 passing).

302 of 328 new or added lines in 7 files covered. (92.07%)

1654 of 2089 relevant lines covered (79.18%)

7.48 hits per line