feat(encryption): storage envelope wiring (Stage 2)#742

Open

bootjp wants to merge 14 commits intofeat/encryption-sidecarfrom

feat/encryption-storage

Commits on May 6, 2026

Commits on May 7, 2026

perf(store): pre-size AAD buffer in encrypt/decrypt hot path (PR742 gemini medium)
bootjp
committed
fix(store): bind value-header into storage AAD (PR742 codex P1)
bootjp
committed
fix(store): reject rebadged-as-cleartext envelope reads (PR742 codex P1)
bootjp
committed
fix(store): empty-value semantics + tighten rebadge guard (PR742 codex P1 round-4)
bootjp
committed
fix(store): authenticate value-header on DeletePrefix path (PR742 claude[bot] round-5)
bootjp
committed
fix(store): replace shape-only rebadge guard with AEAD trial decrypt (PR742 codex P1 round-6)
bootjp
committed
fix(store): authenticate value-header on rebadge trial (PR742 codex P1 round-7)
bootjp
committed
fix(store): allow envelope overhead in snapshot restore cap (PR742 codex P1 round-8)
bootjp
committed
fix(store): bypass DecodeEnvelope on rebadge guard (PR742 codex P1 round-9)
bootjp
committed
docs(store): expand rebadge-guard residual-gap rationale (PR742 codex P1 round-10)
bootjp
committed
docs(store): strip review-provenance from rebadge-guard comments
bootjp
committed
ci: empty commit to retrigger Jepsen workflow
bootjp
committed