Function wrap_org_key 

pub fn wrap_org_key(
    k_org: &[u8; 32],
    org: &str,
    epoch: u64,
    recipient_user_id: &str,
    recipient_pub: &PublicKey,
    publisher_user_id: &str,
    signer: &SigningKey,
) -> Result<WrappedOrgKey, CryptoError>

Wrap the shared org master key k_org for recipient_pub in (org, epoch), SIGNED by publisher_user_id’s signer. A fresh ephemeral keypair per wrap; the full transcript is bound into the KDF; a low-order (degenerate) recipient key is rejected via the contributory check; the whole blob (incl. the AEAD envelope + publisher id) is signed so a recipient can reject wraps not authored by a trusted holder. org must be a canonical ASCII slug (see require_canonical_org).