Seal items AES-256-GCM under a random store key (item id as AAD).
Machine wrap: HKDF over a deterministic machined signature (domain
secrets-store-key, socket /run/souveraine/machined.sock; legacy
seed-id fallback, same framing) — private key never enters the daemon.
Argon2id passphrase wrap slot (64MiB/3, HKDF-mixed with the machine
signature) managed via org.souveraine.Secrets.Manage: SetPassphrase /
VerifyPassphrase / HasPassphrase; rotation re-wraps only.
Client-found spec fixes: DH prime was the 2048-bit group-14 constant,
not the 1024-bit Second Oakley group libsecret uses (pinned by test);
item ids now simple UUIDs (hyphens illegal in object paths); collection
also served at /aliases/default; interfaces registered before name
claim. Added spec signals, real timestamps, content types, atomic 0600
store writes.
packaging: systemd user unit, D-Bus activation shadow, idempotent
phone deploy script (masks gnome-keyring, verifies round-trip).
souveraine-secrets (feature 'secrets', own bin target) backs libsecret
clients — Chatty/libcmatrix and our keyring-core store — without
gnome-keyring or KWallet. Implements the dh-ietf1024-sha256-aes128-cbc-pkcs7
session transport (zbus/hkdf/aes-cbc, MODP-1024 via num-bigint) plus
collection/item/session objects and the store. SeedId::load() is the strict
no-generate counterpart to load_or_generate: the daemon treats identity as a
precondition and fails loudly if none exists.
