feat(platform-wallet-storage)!: layered opt-in secret protection (Tier-2 password envelope)#3953

Draft

Claudius-Maginificent wants to merge 10 commits into

fix/wallet-core-derived-rehydrationfrom

feat/platform-wallet-secret-protection

Commits on Jun 22, 2026

feat(platform-wallet-storage): SecretString serde/schemars/is_blank (opt-in, default-off)

lklimek
and
claude
committed
feat(platform-wallet-storage): error taxonomy for Tier-2 secret protection

lklimek
and
claude
committed
feat(platform-wallet-storage): Tier-2 secret envelope (wrap/unwrap)

lklimek
and
claude
committed
feat(platform-wallet-storage)!: strict fail-closed Tier-2 read (L-1 keystone)

lklimek
and
claude
committed
feat(platform-wallet-storage): SecretStore Tier-2 write API + reprotect

lklimek
and
claude
committed
feat(platform-wallet-storage)!: Tier-1 blank-passphrase guard + open_unprotected + docs

lklimek
and
claude
committed
refactor(platform-wallet-storage): use keyring_core::mock::Store; annotate v5 deviations

lklimek
and
claude
committed
docs(platform-wallet-storage): QA fixes — rustdoc clarity + ephemeral-ID scrub

lklimek
and
claude
committed
test(platform-wallet-storage): QA fixes — Os read bound, Os crash test, test gaps

lklimek
and
claude
committed
test(platform-wallet-storage): cover Os read-size guard; pin new() source-wipe

lklimek
and
claude
committed