Module manager 

Multi-backend manager + per-key routing (design §2.2, §17.7).

The BackendManager is the layer between the gRPC service adapters and the Backend implementations. Given a dotted catalog name (the wire key_id), it resolves the key’s KeyEntry in the catalog routing table, picks the named Backend instance, and dispatches the op against the key’s backend-native path.

A down backend fails only the ops routed to it. Each key’s resolution is independent, and a backend error is surfaced as ManagerError::Backend without affecting any other key.

Op surface

The manager routes new_key, sign, verify, get_public_key (with real algorithm + version metadata), import (BYOK), encrypt/decrypt, rotate, get/set (KV-v2 value read/write), and list (value-free key metadata), after checking the op is valid for the key’s Class (e.g. sign only on asymmetric, get only on value/public, set only on value).

Structs

BackendManager

Routes catalog keys to their declared backend instances.

KeyProviderDescriptor

Admin-observable provider metadata for one catalog key (basil-wuj.10).

MlKemEnvelopeParts

The wire byte fields of an ML-KEM envelope to unwrap.

ProviderDispatch

What a provider-dispatched operation selected, surfaced so the service layer can record a ProviderAuditEvent carrying the provider and algorithm.

ProviderGate

Caller-scoped policy inputs the provider-dispatch (ML-DSA) path needs beyond the catalog labels.

Routed

A resolved route: the Backend instance plus the key’s catalog metadata.

Enums

ManagerError

An error from resolving or routing a catalog key. Fails closed; never panics.

SealingFailure

Why a sealing operation failed.

SigningFailure

Why a value-store Ed25519 materialize-to-sign op failed.