S51 · Encryption & Secret Protection

Declared state: absent — no encryption at rest anywhere in the system.

This is the repository plan and evidence, not a live health reading. A task marked done may still depend on credentials, devices, deployment or a newer acceptance test.

Dependencies

S36, S37, S50

Tasks and gates

51.F1 · No credential sits in plaintext on disk: an age/sops-managed secret file is decrypted into memory at boot and never written back.

Tier F · open · Verification: planned-test

Gate: new `test_secrets_at_rest.py` — the on-disk store carries no readable secret

    51.F2 · The state root is encrypted at rest with an envelope key that never leaves the laptop.

    Tier F · open · Verification: planned-test

    Gate: new `test_state_encryption.py` — a store on disk is unreadable without the key

      51.R1 · Backups are encrypted with a key that never leaves the laptop, and the restore drill still proves a real restore.

      Tier R · open · Verification: planned-test

      Gate: extend `test_backup_restore.py` with a new `test_encrypted_restore` case — an archive restores with the key, not without

        51.R2 · A plaintext store is caught by a GATE, not discovered in an incident.

        Tier R · open · Verification: planned-test

        Gate: extend `test_data_classification.py` with a new `test_unencrypted_store` case — an unencrypted sensitive store fails

          HUD screen contracts

          All subsystems · Source: docs/systems-plan.json.