Encrypt worker-shared dashboard snapshots at rest #1107

2026-08-19T01:58:37Z

timmy commented

2026-08-19 01:58:37 +00:00

Closes #1106

What changed

seal live and Find Work snapshot payloads in store-bound AES-256-GCM envelopes
lazily migrate legacy plaintext rows with optimistic compare-and-swap while preserving metadata
fail closed on missing, wrong, modified, or cross-store ciphertext
document the independent secret injection boundary

Verification

RED: the two persistence tests failed because stores did not accept an encryption key
focused: 73 passed
full suite: 2104 passed, 8 skipped
git diff --check clean

Closes #1106 ## What changed - seal live and Find Work snapshot payloads in store-bound AES-256-GCM envelopes - lazily migrate legacy plaintext rows with optimistic compare-and-swap while preserving metadata - fail closed on missing, wrong, modified, or cross-store ciphertext - document the independent secret injection boundary ## Verification - RED: the two persistence tests failed because stores did not accept an encryption key - focused: 73 passed - full suite: 2104 passed, 8 skipped - `git diff --check` clean

timmy added 1 commit 2026-08-19 01:58:38 +00:00

security: encrypt worker-shared snapshots (Closes #1106 )

CI / lint (pull_request) Successful in 2m48s

Details

CI / build-release (pull_request) Successful in 6s

Details

CI / browser-journey (pull_request) Successful in 2m55s

Details

CI / release-candidate (pull_request) Has been skipped

Details

9d9b28af8e

timmy merged commit fb08bc5ce5 into main

2026-08-19 02:04:53 +00:00

timmy referenced this issue from a commit

2026-08-19 02:04:53 +00:00

Merge pull request 'Encrypt worker-shared dashboard snapshots at rest' (#1107) from timmy/1106-encrypt-worker-snapshots into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1107