Module durable 

Concrete cryptographic backing for the durable execution layer.

zeph-durable defines the durable execution contract as a pure Layer-0 abstraction and deliberately carries no cryptographic dependency (INV-1). This module supplies the concrete XChaCha20Poly1305Cipher that satisfies zeph_durable::PayloadCipher. The binary constructs it from the vault-resolved ZEPH_DURABLE_KEY and injects it into a backend as Option<Arc<dyn PayloadCipher>>, exactly as a database pool is handed in.

XChaCha20-Poly1305 is chosen for its 192-bit extended nonce: a fresh random nonce per seal (INV-7) has a negligible collision probability even across the lifetime of a long-lived key, so no nonce-sequencing state has to be persisted.

Examples

use zeph_core::durable::XChaCha20Poly1305Cipher;
use zeph_durable::{ExecutionId, StepId, PayloadCipher};
use zeph_durable::cipher::{EntryKindTag, PayloadAad};

let cipher = XChaCha20Poly1305Cipher::new(0, [7u8; 32]);
let aad = PayloadAad::new(ExecutionId::new(), StepId::new(0), EntryKindTag::StepResult, None);

let sealed = cipher.seal(b"tool result", &aad).unwrap();
assert_eq!(cipher.open(&sealed, &aad).unwrap(), b"tool result");

Structs

XChaCha20Poly1305Cipher

A vault-keyed XChaCha20-Poly1305 PayloadCipher with a one-key rotation window.

Enums

CipherKeyError

Failure constructing an XChaCha20Poly1305Cipher from raw vault bytes.

Constants

DURABLE_KEY_ID

The key-id byte stamped on every payload sealed with the current ZEPH_DURABLE_KEY.

Functions

decode_vault_key_bytes

Decode a base64-encoded 32-byte vault key value into raw key bytes.

derive_control_hmac_key_b64

Derive the row-level control-entry HMAC key (INV-8) from the base64-encoded ZEPH_DURABLE_KEY vault value.

derive_hwm_key_b64

Derive the high-water-mark key (issue #6360) from the base64-encoded ZEPH_DURABLE_KEY vault value.

generate_durable_key_b64

Generate a fresh random 32-byte durable payload key, base64-encoded for vault storage.