feat(phylake): add root key file and at-rest sealing primitives

.github/codeql/codeql-config.yml

@@ -0,0 +1,13 @@
+name: dioptron CodeQL config
+
+# WHY: security queries target production code. Test code holds known-answer
+# vectors (fixed keys, fixed nonces) and redaction assertions that format key
+# types with Debug on purpose; the queries flag them as hard-coded
+# cryptographic values and cleartext logging. Dismissing those alerts one at
+# a time would repeat in every crypto slice, so test modules and test-only
+# helpers live in files matched below (see CLAUDE.md, Standards) and stay out
+# of the scan.
+paths-ignore:
+  - "**/tests.rs"
+  - "**/tests/**"
+  - "**/test_support.rs"

.github/workflows/codeql.yml

@@ -63,12 +63,15 @@ jobs:
           cache: false
       # WHY build-mode none: CodeQL extracts Rust from source without a
       # traced build, so there is no autobuild step to run.
+      # WHY config-file: it excludes test files (tests.rs, tests/,
+      # test_support.rs) from the scan; the reason is in the config file.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
         with:
           languages: rust
           build-mode: none
           queries: +security-extended
+          config-file: ./.github/codeql/codeql-config.yml
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
         with:

CLAUDE.md

@@ -38,6 +38,8 @@ dioptron/
 
 Follow kanon standards (canonical source: `kanon/crates/basanos/standards/`). Key docs: `RUST.md`, `TESTING.md`, `SECURITY.md`, `ARCHITECTURE.md`, `WRITING.md`.
 
+Test layout: test modules live in `tests.rs` files (`#[cfg(test)] mod tests;`) or `tests/` directories, never inline, and test-only helpers live in `test_support.rs`; CodeQL skips those paths (`.github/codeql/codeql-config.yml`).
+
 ## Key decisions (locked)
 
 - **Peer tenancy**: operator, agents, sub-agents are all tenant classes with the same capability surface. Differences are grants, not capabilities.

Cargo.toml

@@ -78,8 +78,9 @@ inefficient_to_string = "warn"
 # precomputed tables are not needed for one signature per connection;
 # `zeroize` clears signing keys on drop.
 ed25519-dalek = { version = "3.0", default-features = false, features = ["zeroize"] }
-# WHY direct: the one OS random source for handshake nonces and the
-# daemon's dummy verifying key. 0.4 is the version crypto-common 0.2 and
+# WHY direct: the one OS random source for handshake nonces, the
+# daemon's dummy verifying key, and phylake keys, salts and sealing
+# nonces. 0.4 is the version crypto-common 0.2 and
 # ed25519-dalek 3 use; called directly so a failure is a visible error.
 getrandom = { version = "0.4", default-features = false }
 # WHY rkyv: docs/design/topology.md fixes rkyv as the wire format; 0.8 with
@@ -97,8 +98,10 @@ rkyv = { version = "0.8.18", default-features = false, features = [
 # WHY syntheke: the contract crate; epitrope decides over its types.
 # Publishable crates pin internal dependencies by version, declared once here.
 syntheke = { path = "crates/syntheke", version = "0.1.6" }
-# WHY rustix (dev only): safe POSIX calls in tests (sending a signal to the
-# test process). Already in the tree under tempfile, so no new version.
+# WHY rustix: safe wrappers where std has none. phylake opens the root key
+# file with O_NOFOLLOW | O_NONBLOCK and reads the effective uid; dioptron's
+# tests send a signal to the test process. Already in the tree under
+# tempfile, so no new version. Crates enable only the features they use.
 rustix = { version = "1.1.5", default-features = false }
 # WHY snafu: the fleet error library (kanon RUST.md); thiserror is banned.
 snafu = "0.9.2"
@@ -120,6 +123,20 @@ proptest = { version = "1.11.0", default-features = false, features = ["alloc",
 # for diagnostics).
 tracing = { version = "0.1.44", default-features = false, features = ["std"] }
 
+# WHY one RustCrypto generation: chacha20poly1305 0.11 (aead 0.6), hkdf
+# 0.13, hmac 0.13, and sha2 0.11 all sit on digest 0.11, crypto-common
+# 0.2, and hybrid-array 0.4, so the tree holds one copy of each trait
+# crate (deny.toml bans duplicate versions). ed25519-dalek 3.0 depends on
+# sha2 0.11 and rand_core 0.10, the same generation.
+# WHY `zeroize` features: the cipher, HMAC, and hash states copy key
+# material into their own structs; these features zero that copy on drop.
+chacha20poly1305 = { version = "0.11", default-features = false, features = ["alloc", "zeroize"] }
+hkdf = { version = "0.13", default-features = false }
+hmac = { version = "0.13", features = ["zeroize"] }
+secrecy = "0.10"
+sha2 = { version = "0.11", default-features = false, features = ["zeroize"] }
+zeroize = "1.8"
+
 [profile.dev.package."*"]
 opt-level = 2
 

crates/phylake/Cargo.toml

@@ -7,5 +7,19 @@ rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 
+[dependencies]
+chacha20poly1305.workspace = true
+getrandom.workspace = true
+hkdf.workspace = true
+hmac.workspace = true
+rustix = { workspace = true, features = ["std", "fs", "process"] }
+secrecy.workspace = true
+sha2.workspace = true
+snafu.workspace = true
+zeroize.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
 [lints]
 workspace = true