ADR: define authenticated encrypted representations and key capabilities

[flyingrobots]

Outcome

Define a native Keep representation contract for authenticated encryption that preserves BlobId and LayoutId across encryption, re-encryption, recipient changes, and key rotation.

Dependencies

• ADR-0001 and ADR-0002
• Implement precise verification reports and corruption refusal #20 precise verification reports
• Informs Implement deterministic GC planning and identity-preserving compaction #21 physical GC and ADR: decide the git-cas import and compatibility posture #25 git-cas import

Decision questions

• Which audited AEAD suite and nonce strategy are admitted first?
• How are independently authenticated frames encoded and bounded?
• Which AAD fields bind blob, layout, representation version, frame coordinate, and declared context?
• How are random DEKs wrapped for multiple recipient KEKs?
• What semantic key capability crosses the Keep port without importing a Keychain, KMS, CLI, or application keyRef type?
• Which metadata remains visible, confidential, or equality-revealing?
• How do rotation, recipient addition or removal, missing keys, and revoked keys affect representation identity and receipts?
• What must be authenticated before any plaintext reaches a caller?

Acceptance criteria

• A numbered ADR freezes the identity, framing, AAD, nonce, recipient-envelope, and verification laws.
• BlobId continues to name exact logical plaintext and does not move under key rotation.
• RepresentationId names exact authenticated encoded bytes and changes when representation bytes change.
• Random per-representation DEKs and multi-recipient KEK wrapping are specified.
• Convergent or deterministic encryption is explicitly excluded from the private-content profile.
• Key material never enters durable formats, diagnostics, receipts, or test logs.
• Missing, unavailable, unauthorized, revoked, malformed, and authentication-failed key paths remain distinct.
• Streaming restore never releases unauthenticated plaintext.
• Dependency, side-channel, zeroization, crash, backup, and recovery implications are reviewed.
• Independent golden and mutation corpora are required before the codec is admitted.

Non-goals

• Owning external key custody or application purge authority.
• Copying git-cas manifests or Git object identity.
• Choosing an algorithm by implementation convenience before the ADR.
• Metadata-oblivious storage without a separately proved design.