feat(key-source): land the vault-backed key sources (ADR-005 custody in code)
- Two injected-handle seams: KeySource (dial-config, decrypt-at-use ->
one PrivateKey) and HostKeySource (serve-config, decrypt-at-construction
-> the Config::keys set); async_trait object-safe, the HostKeyPolicy
handle shape
- Crate-provided ADR-005 implementations: VaultKeySource (injected
vault handle + Option<EncryptedData>, None -> Absent) and
VaultHostKeySource (record set, empty -> Absent) over the shared
decrypt_and_decode chain: vault.decrypt -> Zeroizing<String> seam
wrap -> one-time decode_secret_key(plain, None)
- EncryptedData opaque in src/ (no key_version interpretation); vault
error taxonomy reshaped into the five-variant KeySourceError matrix,
never collapsed; plaintext never persists
- 12 in-module tests on the real in-memory alkvault handle: round-trip
(fingerprint-identical ed25519 key that signs), full failure matrix,
locked host-bootstrap refusal, lock-mid-session lifecycle,
v2->v3 rotation identity; three committed throwaway PEM fixtures
Verified: cargo test (23 + 4 parity), cargo test --all-features,
clippy -D warnings (default + all-features), fmt --check, taskgraph
validate
glm-5.3-flash
4d529dbacf