feat(encryption): sidecar crash-durable read/write (Stage 1)#722

Open

bootjp wants to merge 7 commits intofeat/encryption-foundationfrom

feat/encryption-sidecar

Commits on May 5, 2026

feat(encryption): add sidecar crash-durable read/write (Stage 1)
bootjp
committed
fix(encryption): address PR722 round-1 (P2 security + medium x4)
bootjp
committed
test(encryption): cover Active.Raft direction in ReadSidecar test (PR722 r2)
bootjp
committed
fix(encryption): validate Active.{Storage,Raft} purpose match (PR722 codex P2)
bootjp
committed
test(encryption): skip chmod-based failure test as root (PR722 codex P2)
bootjp
committed
test(encryption): skip TmpFileMode on Windows (PR722 codex P2)
bootjp
committed
test(encryption): skip StaleTmpDoesNotLeak on Windows (PR722 codex P2)
bootjp
committed