Encrypt completed Filed review history at rest #1253

2026-08-22T06:09:29Z

timmy commented

2026-08-22 06:09:29 +00:00

Closes #1252

What changed

seal each account's bounded completed-Filed receipt collection with authenticated private-state encryption
transactionally migrate and securely remove legacy plaintext rows while preserving ordering and update semantics
include the store in shared private-state key rotation with content-free reporting
document the key requirement and migration behavior

Verification

RED observed for encrypted/account-bound storage before implementation
RED observed for legacy multi-account migration before implementation
RED observed for rotation coverage before implementation
python3 -m pytest tests/test_completed_filed_review_store.py tests/test_rotate_private_state.py -q → 11 passed
python3 -m pytest tests/ -q → 2369 passed, 12 skipped
git diff --check and py_compile pass

Closes #1252 ## What changed - seal each account's bounded completed-Filed receipt collection with authenticated private-state encryption - transactionally migrate and securely remove legacy plaintext rows while preserving ordering and update semantics - include the store in shared private-state key rotation with content-free reporting - document the key requirement and migration behavior ## Verification - RED observed for encrypted/account-bound storage before implementation - RED observed for legacy multi-account migration before implementation - RED observed for rotation coverage before implementation - `python3 -m pytest tests/test_completed_filed_review_store.py tests/test_rotate_private_state.py -q` → 11 passed - `python3 -m pytest tests/ -q` → 2369 passed, 12 skipped - `git diff --check` and `py_compile` pass

timmy added 1 commit 2026-08-22 06:09:30 +00:00