[samgbafa]

TC-887 harness follow-ups from the #335 approval (review a7e06ef6), on main after #335 merged. No product code changes.

What changed (tests/at_rest_harness.rs, scripts/at-rest-harness/README.md, docs/at-rest/INTERFACES.md)

1. Escrow and record contents:
   • In an escrow-none run (read from state.json), any escrow bundle or record object is RED.
   • In every run, mirrors are scanned for each secret the harness derives or unwraps: root, W, each ARK, KEK, chain, canary and record-MAC key, NK, the DEK-mirror tag key, and every DEK. The scan covers exempt fields too: shares[].commitment, holder names (singly, in pairs and all together) and the armored share text and payload.
   • Each secret is matched as hex, base64 or base64url text at any alignment, and inside hex, base64, base64url and base32 decodings.
2. No false RED on holder names: shares[].holder no longer counts toward the 16+16 split check; the 32-byte and derived-secret checks still apply.
3. Bounded generations: a generation above MAX_ARK_GENERATION = 9 is one finding. A gap is found by comparing counts, not by looping, and ARKs above 9 are never opened. ark-4294967295-… fails RED in under 2 s.
4. Mirrors required in encrypt and strict modes:
   • an ARK mirror must exist;
   • every block must be named v1/<space tag>/…, with the space tag recomputed from the re-derived NK;
   • the tag must belong to a harness space whose DEK mirror authenticates.
     A missing DEK or ARK mirror, a foreign tag, or a plaintext-named block is RED.
5. INTERFACES status note now mentions feat(TC-887): seal KV blocks in the S3 store (S3c, stacked on #333) #336 (the S3 store seals KV blocks).

• Backstop scan: it now also decodes base32, strips any short label: prefix, and flags decodings longer than 32 bytes.

How it's tested

• cargo test -p tinycloud-node --test at_rest_harness: 7 self-tests pass, 4 live checks ignored. New self-tests:
  • selftest_key_mirror_refuses_escrow_contents_and_derived_keys: escrow none refuses both objects. Six planted derived secrets are each RED, with the EFP, name and MAC recomputed so that only this rule can catch them. Valid holder names that look like encoded halves give no findings.
  • selftest_key_mirror_bounds_absurd_generations
  • selftest_key_mirror_requires_mirrors_in_encrypt_mode
  • plus 3 new cases in selftest_key_mirror_flags_every_bypass.
• cargo clippy … --test at_rest_harness -- -D warnings, cargo fmt --check and bash -n harness.sh are clean.
• Live, node from the S3 sealing stack (feat(TC-887): seal KV blocks in the S3 store (S3c, stacked on #333) #336), encrypt mode, escrow none:
  • the check covered 5 control objects and 8 sealed blocks: KV GREEN, SQL RED; the real mirrors passed every new rule unchanged;
  • with one DEK mirror deleted after the puts, KV is RED with exactly 2 findings, one per block of that space;
  • mode off on the same binary is RED (20 KV, 16 SQL), and main's node is RED (24 KV, 16 SQL). No false GREEN.

[samgbafa]

APPROVE: see TC-887 (head cf546bbd71ea6ad07de6b927da2a1223bb9c09d9)