feat(encryption): keyring rotation — previous_master_keys + sequential decrypt (LAB-686) - #63

Merged

27Bslash6 merged 6 commits into

mainfrom

lab-686-keyring-rotation

Aug 8, 2026

Commits on Aug 7, 2026

feat(encryption): keyring rotation surface — previous_master_keys + sequential decrypt (LAB-686)
27Bslash6
committed
737d77f
fix(encryption): keep config-class errors out of the decrypt-failure class (LAB-686 panel)
27Bslash6
committed
97537b1
fix(config): review round — zeroized key decode, blank env retirement, boundary tests (LAB-686)
27Bslash6
committed
7efc8e6
test(config): panel round — finish EnvGuard conversion, isolate defaults test (LAB-686)
27Bslash6
committed
7e2a98f
fix(config): zeroise hex secret copies from env and EnvGuard (LAB-686)
Mark S
committed
7a7d3f0
docs(config): scope the zeroise claim to the heap copy (LAB-686)
Mark S
committed
79bee95