feat: replace private cas envelope

docs/architecture.md

@@ -478,6 +478,10 @@ The project is structured for future multi-user local-first authorization:
 ## Keyhive/BeeKEM Roadmap
 
 Resource secret epochs are the v0/v1 approximation for private payload access.
+Private CAS writes use an AES-256-GCM envelope keyed from the resource, local
+secret id, and epoch with resource-bound associated data and random nonces.
+Prototype BLAKE3-XOR private blob envelopes from earlier pre-deployment builds
+are rejected and should be recreated from plaintext.
 Later designs can add Keyhive-like convergent capabilities and BeeKEM/CGKA-style
 group key evolution. The bootstrap does not implement BeeKEM and does not claim
 strong forward secrecy or post-compromise security.

docs/command-stability.md

@@ -57,22 +57,17 @@ The following commands are tested but may still change while the subsystem
 settles:
 
 - `geth overlay status|plan|join|leave|interface-plan|up|down|peers|send|recv`
+- `geth cas add-private`
+- `geth cas get-private`
 
 Migration expectation: overlay membership records and authorization resources
 should remain readable, but packet runtime flags, platform activation details,
 and route metadata may change before the first deployment tag.
-
-## Prototype
-
-The following commands intentionally do not claim a stable security or storage
-contract yet:
-
-- `geth cas add-private`
-- `geth cas get-private`
-
-Migration expectation: prototype private CAS envelopes may be replaced by an
-audited AEAD/key-envelope design. Existing prototype blobs may need an explicit
-re-encryption or export/import workflow.
+Private CAS writes use an AES-256-GCM envelope, but the command family remains
+experimental while key envelopes, remote sharing, and forward-secrecy/PCS
+properties are explicitly out of scope. Prototype BLAKE3-XOR envelopes from
+earlier pre-deployment builds are rejected with a clear error and should be
+recreated from plaintext.
 
 ## Adding Commands
 

docs/production-readiness-roadmap.md

@@ -191,22 +191,22 @@ Goal: finish the authorization and remote-input audit before deployment.
 Goal: remove prototype cryptography from paths users may treat as real
 confidential storage.
 
-- `[ ]` Replace prototype private CAS envelope.
+- `[x]` Replace prototype private CAS envelope.
   Acceptance criteria:
-  - `[ ]` The BLAKE3-XOR prototype envelope is not used for new private CAS
+  - `[x]` The BLAKE3-XOR prototype envelope is not used for new private CAS
     writes.
-  - `[ ]` New private CAS writes use a reviewed AEAD construction or an
+  - `[x]` New private CAS writes use a reviewed AEAD construction or an
     established envelope format such as age.
-  - `[ ]` Key derivation, nonce generation, and envelope versioning are
+  - `[x]` Key derivation, nonce generation, and envelope versioning are
     documented.
-  - `[ ]` Tests cover tamper detection, wrong resource, wrong key, and nonce
+  - `[x]` Tests cover tamper detection, wrong resource, wrong key, and nonce
     uniqueness behavior.
 
-- `[ ]` Define pre-release encrypted blob migration behavior.
+- `[x]` Define pre-release encrypted blob migration behavior.
   Acceptance criteria:
-  - `[ ]` Existing prototype envelopes are either rejected with a clear error
+  - `[x]` Existing prototype envelopes are either rejected with a clear error
     or migrated through an explicit command.
-  - `[ ]` Docs state that prototype envelopes made before deployment are not a
+  - `[x]` Docs state that prototype envelopes made before deployment are not a
     durable security format.
 
 ## Phase 6: Sync Correctness And Fault Testing
@@ -343,7 +343,7 @@ Goal: prove the system works as an actual base layer before broader use.
 3. `[x]` Add stable contract and golden JSON tests.
 4. `[x]` Harden store migrations and backup.
 5. `[ ]` Complete security-boundary test coverage.
-6. `[ ]` Replace prototype private CAS cryptography.
+6. `[x]` Replace prototype private CAS cryptography.
 7. `[ ]` Add fault-injection sync tests.
 8. `[ ]` Improve automation commands and JSON errors.
 9. `[ ]` Add operational health, doctor, and release gates.

docs/roadmap.md

@@ -648,8 +648,12 @@ authorization and durable-state boundaries clear.
   - `[x]` `geth cas get-private <resource> <hash> --out <path>` decrypts with
     a matching local resource secret epoch.
   - `[x]` Access is gated by local resource secret epoch material.
-  - `[x]` Tests verify encrypted blob roundtrip and wrong resource/secret
-    rejection.
+  - `[x]` New writes use an AES-256-GCM envelope with resource-bound
+    associated data and random nonces.
+  - `[x]` Prototype BLAKE3-XOR envelopes from earlier pre-deployment builds are
+    rejected with a clear error.
+  - `[x]` Tests verify encrypted blob roundtrip, tamper detection, wrong
+    resource/secret rejection, old-envelope rejection, and nonce uniqueness.
   - `[x]` Docs explicitly avoid claiming forward secrecy or PCS.
 
 - `[x]` Iroh-docs KV integration.