zeekayandHanzo Dev cdca774661 One derived key, no wrapping ...

tasks generated a DEK per shard, wrapped it under a KEK derived from the
master, and stored the wrapped blob beside the database — so it also needed an
upgrade path to rewrap, a principal vocabulary to derive against, and tests
for all of it. hanzoai/cek derives the key from the master and the namespace
instead. Nothing is stored, so there is nothing to wrap, rewrap, or upgrade.

dek.go, principal.go and upgrade.go are gone with the tests that pinned them:
they proved properties of a scheme that no longer exists, not properties the
store still has to hold.

That also unpins hanzoai/sqlite, which deleted the DEK API in v0.5.0. tasks
now builds against it, which is what proves the migration is complete rather
than merely compiling.

Databases written under the old scheme will not open under the new
derivation. There are no customers and no data to preserve.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-02 09:45:33 -07:00

..

main.go

One derived key, no wrapping

2026-08-02 09:45:33 -07:00