Module org_key_resolver 

resolve_org_root — the out-of-band resolver that turns a member’s published wraps into their org master key K_org, for feeding crate::org_key_provider::OrgAwareKeyProvider. This runs OFF the hot path (at subsystem open), never inside cipher_for.

What it does — and the trust it holds (audit item D)

It fetches the candidate set addressed to the member (OrgKeyDirectory::fetch_wrapped_for, newest-epoch-first) and returns the first wrap that crate::crypto::unwrap_org_key accepts under the caller’s trusted granter keys. The primitive carries all the security: it verify_stricts the publisher signature against trusted BEFORE any decrypt and binds the CALLER’s my_user_id (not the blob’s advisory recipient), so the resolver stays dumb and lets the primitive judge.

Its safety therefore reduces ENTIRELY to two things it cannot itself check, and which the cryptographer audit still owns:

1. the correctness of the trusted slice (admin-designated granters — keep it small; a compromised granter can sign a wrap of a bogus K_org'), and
2. backend publish-authz — in particular pubkey-table poisoning (an active publisher who overwrote a victim’s published pubkey can recover the REAL K_org; see the crate::org_key_directory module threat model). verify_strict does not close #2 — do not read this resolver as doing so.

Fail-closed return shape (NOT a bare Option)

• Err(..) — the directory was UNREACHABLE (fetch failed). The caller MUST fail closed (org scope → DenyCipher), never silently drop org scope.
• Ok(None) — the directory was reachable but holds no trusted grant for this member (not yet granted). Also DenyCipher, but a distinct, benign state.
• Ok(Some(ResolvedOrgRoot)) — the root plus the epoch it came from.

Collapsing the first two into one None would let a transient fetch blip silently disable org encryption — a fail-open. They are kept distinct.

Structs

ResolvedOrgRoot

A resolved org master key and the epoch it was granted at. The epoch is surfaced so a future rotation-aware caller (or audit log) can see WHICH generation was selected without retrofitting the API.

Functions

resolve_org_root

Resolve org’s K_org for a member from their published wraps. See the module docs for the fail-closed return contract and the trust this holds.