vta-backup

The VTA's backup/restore subsystem, extracted from vta-service.

• ops — encrypted full-state export/import (Argon2id KDF + AES-256-GCM), the vta_did compatibility check, and the two-phase descriptor flow for the backup/* trust tasks.
• backup_bundle_store — the sealed backup-bundle store (bundle records + on-disk blobs).
• backup_bundle_sweeper — TTL sweep of expired backup bundles.

The operations take narrow dependencies (keyspace handles, config, a vta_keyspaces::Keyspaces bundle) rather than a &AppState. Two vta-service-specific glue points are inverted and stay in vta-service:

• DescriptorDeps / apply_import are borrowed from AppState there via free constructors (operations::descriptor_deps_from_app_state).
• TEE KMS re-encryption during import is injected through the BootstrapReEncryptor trait, whose one implementation wraps vta-service's tee::kms_bootstrap::re_encrypt_bootstrap_secrets.

vta-service re-exports the crate as crate::operations::backup + crate::{backup_bundle_store,backup_bundle_sweeper}, so existing call sites are unchanged.

Part of the Verifiable Trust Infrastructure workspace. Apache-2.0.