keys: one resolved key set per rip, proven on first read

ResolvedKeySet resolves keys up front, forensic keys included, and every
read surface decrypts through it. A keyless session never muxes
ciphertext; a single declared key keys only the pieces it opens; held
keys are tried before side reads. Resolve reports whether the disc's
VID would help, returns its trace on refusal, and never codes an
unreachable key service as Missing.
This commit is contained in:
Matthew Jackson
2026-09-28 07:18:11 -07:00
parent 1baf9ba061
commit 9000c83c1b
26 changed files with 5392 additions and 27 deletions
+10
View File
@@ -26,3 +26,13 @@ src/drive/allow.rs is_eject SS-6
src/drive/mod.rs eject SS-6
src/drive/mod.rs start_unit SS-6
src/drive/mod.rs note_ledger SS-7
src/keys/resolve.rs resolve KS-14
src/keys/resolve.rs borrow_samples KS-10
src/keys/resolve.rs apply_single_unit_rule KS-14
src/keys/arrival.rs decrypt_proven KS-5
src/keys/arrival.rs side_partners KS-1
src/keys/arrival.rs side_partners KS-2
src/keys/arrival.rs side_partners KS-7
src/keys/fmts.rs anchor KS-26
src/keys/fmts.rs phases KS-25
src/keys/fmts.rs phases KS-26