2 Commits

Author	SHA1	Message	Date
Kyle Isom	3b961b5d8a	Step 17: Encryption core — passphrase-only, selective per-file. ... Manifest schema: Entry gains Encrypted, PlaintextHash fields. Manifest gains Encryption section with KekSlots map (passphrase slot with Argon2id params, salt, and wrapped DEK as base64). garden/encrypt.go: EncryptInit (generate DEK, wrap with passphrase KEK), UnlockDEK (derive KEK, unwrap), encryptBlob/decryptBlob using XChaCha20-Poly1305 with random 24-byte nonces. Modified operations: - Add: optional encrypt flag, stores encrypted blob + plaintext_hash - Checkpoint: detects changes via plaintext_hash, re-encrypts - Restore: decrypts encrypted blobs before writing - Diff: decrypts stored blob before comparing - Status: compares against plaintext_hash for encrypted entries 10 tests covering init, persistence, unlock, add-encrypted, restore round-trip, checkpoint, status, diff, requires-DEK guard. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-24 08:50:53 -07:00
Kyle Isom	b4bfce1291	Add directory recursion for Add and mirror up/down commands. ... Add now recursively walks directories instead of creating a single "directory" type entry. Extract addEntry helper for reuse. Implement MirrorUp (sync filesystem state into manifest) and MirrorDown (sync manifest state to filesystem with untracked file cleanup). Add CLI mirror command with up/down subcommands. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-23 23:42:58 -07:00