3 Commits

Author	SHA1	Message	Date
steve	76ada04442	refactor(cli): wire commandRole into dispatch; doc + comment cleanup ... Resolve final-review findings: commandRole is now the single source of truth (Run resolves role once and threads it to handlers, replacing hardcoded openStore roles). Tighten crypto/SKILL/SPEC/USER-MANUAL wording and document init's agent-key-on-first-init-only semantics. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 07:18:27 +01:00
steve	c52f30898b	feat(crypto): named-var key loaders (admin/agent) + NewDEK ... Replace KeyFromEnv with AgentKeyFromEnv/AdminKeyFromEnv reading EMCLI_KEY and EMCLI_ADMIN_KEY; add NewDEK for envelope encryption. Seal/Open double as DEK wrap/unwrap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-22 22:47:05 +01:00
steve	8d04b0fde9	feat(crypto): AES-256-GCM field encryption keyed from EMCLI_KEY ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-21 23:32:23 +01:00