Function encryption_gate 

pub fn encryption_gate(
    cfg: &DurableConfig,
    shared_db: bool,
) -> Result<EncryptionGate, DurableError>

Evaluate whether the configured encrypt_payload setting is permitted for this deployment (INV-8).

AEAD is default-on. Disabling it is a development-only override that is permitted only for a single-user local backend on a non-shared database. shared_db MUST be true whenever the journal lives on a multi-client database (Postgres, or any file shared across processes), where the DB-file trust boundary does not hold.

Errors

Returns DurableError::EncryptionRequired when encrypt_payload = false is combined with a non-local backend or a shared database.

Examples

use zeph_durable::{DurableBackend, DurableConfig, EncryptionGate, encryption_gate};

// Default config keeps AEAD on regardless of deployment.
let cfg = DurableConfig::default();
assert_eq!(encryption_gate(&cfg, true).unwrap(), EncryptionGate::Enabled);

// Disabling AEAD is tolerated only on a single-user local backend.
let dev = DurableConfig { encrypt_payload: false, ..DurableConfig::default() };
assert_eq!(encryption_gate(&dev, false).unwrap(), EncryptionGate::DisabledLocalWarn);
assert!(encryption_gate(&dev, true).is_err(), "forbidden on a shared database");