Module ops 

VTA backup export and import operations.

Export (export_backup) writes every keyspace in vta_keyspaces::BACKED_UP, row for row, plus the master seed and the JWT signing key, into a vta-backup-v2 payload, encrypted with Argon2id + AES-256-GCM. Nothing is collected per keyspace: the export walks the list, so a keyspace added to it is backed up with no further code.

Import decrypts and validates a backup, optionally previews it, and on commit stages the restore (stage_import): the payload is sealed into the bootstrap keyspace under a key derived from the restored seed, the target adopts that seed, and the VTA reboots. The restore is applied at boot by crate::restore, under the storage key the restored seed yields. That is what lets a backup move between a plain VTA, a hardened one and an enclave in any direction — see vta_support::restore_stage.

A vta-backup-v1 backup (typed collections for six keyspaces) still restores; [write_legacy_payload] writes it at boot.

Sub-modules

• descriptors — the 3-phase descriptor-pattern op layer for the trust-task slice. Wraps export_backup / preview_import / stage_import, decoupling bulk byte transport from the JSON envelope. See docs/05-design-notes/backup-descriptor-pattern.md.

Modules

blob

Op-layer for the backup-blob byte transport (GET/POST /backup/blob/{id}).

chunked

The chunkedTrustTask backup transfer, for the agent.

descriptors

Op-layer for the backup-descriptor pattern (spec/vta/backup/*).

Structs

PayloadCounts

Row counts a preview or an import reports. Counts, not an inventory.

StageRequest

What a caller needs to stage a restore.

Constants

IMPORT_IN_PROGRESS_KEY

Key under which the pre-staging import recorded that a destructive import was in flight. Imports no longer write it — a staged restore is its own crash marker — but boot still refuses a store an older build left half-imported (see vta-service’s server::run).

Functions

decrypt_backup

Decrypt a backup envelope and return the payload.

export_backup

Assemble and encrypt a backup of the entire VTA state.

payload_counts

Count what a payload restores, whichever format it is.

preview_import

Decrypt and validate a backup, returning a preview without modifying state.

preview_import_for

preview_import, plus the identity check a commit would make — so an operator who previews a backup of another agent is told then, with the flag that allows it, rather than after confirming.

stage_import

Commit an import: stage the restore, have the target adopt the restored seed, and return. The caller must then reboot the VTA — the restore is applied by the next boot, not by this call (see vta_support::restore_stage for why it cannot be applied in place).

validate_payload

Refuse a payload this build cannot restore faithfully, before anything is staged. Everything here is checked again at boot; checking it first means a bad backup is refused to the operator rather than discovered by a boot.