feat(s025): seal the blob classes a deployment names, and close the slice

Trinity.Vault gains per-class sealing, off by default. The skills staging seals
staged changes on write and opens either kind on read, so the only place that has
to know is the one that writes; the archive export seals its manifest the same
way.

Off by default is a decision rather than an omission, and the module says why. A
sealed export restores only where the key is, which is exactly what a regulated
deployment wants and exactly what someone moving their data to a new laptop does
not, and a sealed skill file cannot be edited in a text editor. The mechanism is
built and proven; which blobs it covers is the deployment's call, and open/1
passes unsealed blobs through so the choice can change later without a migration.

maybe_seal!/2 keeps the call site reading the same whether sealing is on or off,
because a path that branches on whether encryption is enabled is a path where one
branch is less tested than the other.

The boundary refused the first version of this, correctly: Trinity.Vault had to
be exported before the skills and archive sub-boundaries could call it.

mix gate exit 0; 610 passed; coverage 80.31%.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

coverage.tsv

@@ -23,3 +23,4 @@ slice_id	percent	sha	date
 061	80.05	c6b6faa	2026-09-22
 050	80.31	c01466d	2026-09-22
 002	80.31	d65c48c	2026-09-23
+025	80.31	PENDING	2026-09-23

lib/trinity.ex

@@ -21,6 +21,8 @@ defmodule Trinity do
     exports:
       [
         Paths,
+        # Slice 025: the skills staging and the archive export seal through it.
+        Vault,
         Repo,
         Repo.Receipts,
         UUID,

lib/trinity/archive.ex

@@ -42,7 +42,11 @@ defmodule Trinity.Archive do
     try do
       with {:ok, staged} <- stage(layout, tmp, keys?),
            manifest = Manifest.build(staged, schema_versions(layout), keys?),
-           :ok <- File.write(Path.join(tmp, Manifest.file_name()), Manifest.encode(manifest)),
+           :ok <-
+             File.write(
+               Path.join(tmp, Manifest.file_name()),
+               Trinity.Vault.maybe_seal!(Manifest.encode(manifest), :exports)
+             ),
            entries = [
              {~c"manifest.json", String.to_charlist(Path.join(tmp, Manifest.file_name()))}
              | staged_entries(staged)

lib/trinity/skills/staging.ex

@@ -124,7 +124,10 @@ defmodule Trinity.Skills.Staging do
     |> Path.join("**")
     |> Path.wildcard(match_dot: true)
     |> Enum.filter(&File.regular?/1)
-    |> Map.new(fn p -> {Path.relative_to(p, dir), File.read!(p)} end)
+    |> Map.new(fn p ->
+      {:ok, content} = Trinity.Vault.open(File.read!(p))
+      {Path.relative_to(p, dir), content}
+    end)
   end
 
   @doc "Removes a change's staged files (a rejection, or after a promotion)."
@@ -295,7 +298,10 @@ defmodule Trinity.Skills.Staging do
     for {rel, content} <- tree do
       path = Path.join(dir, rel)
       File.mkdir_p!(Path.dirname(path))
-      File.write!(path, content)
+      # Slice 025: staged changes are one of the blob classes the vault can seal. Sealing is off
+      # unless a deployment turns it on, and `read_tree/1` opens either kind, so this is the only
+      # place that has to know.
+      File.write!(path, Trinity.Vault.maybe_seal!(content, :staged_skills))
     end
 
     :ok

lib/trinity/vault.ex

@@ -36,6 +36,36 @@ defmodule Trinity.Vault do
   @tag_bytes 16
   @key_bytes 32
 
+  @doc """
+  Whether a class of blob is sealed on write.
+
+  Configured per class and **off by default**:
+
+      config :trinity, :vault, seal: [:staged_skills, :exports]
+
+  Off by default because sealing is not free in ways that matter to the person using this. A
+  sealed export can only be restored where the key is, which is exactly what a regulated
+  deployment wants and exactly what someone moving their data to a new laptop does not. A sealed
+  skill file cannot be edited in a text editor. The mechanism is built, tested and available; which
+  blobs it applies to is the deployment's call rather than this slice's, and `open/1` passes
+  unsealed blobs through unchanged so the choice can be made later without a migration.
+  """
+  @spec sealing?(atom()) :: boolean()
+  def sealing?(class) when is_atom(class) do
+    class in (Application.get_env(:trinity, :vault, [])[:seal] || [])
+  end
+
+  @doc """
+  Seals a blob if its class is configured for sealing, and returns it unchanged if not.
+
+  The call site reads the same either way, which is the point: a path that has to branch on whether
+  encryption is on is a path where one branch is less tested than the other.
+  """
+  @spec maybe_seal!(binary(), atom()) :: binary()
+  def maybe_seal!(plaintext, class) when is_binary(plaintext) and is_atom(class) do
+    if sealing?(class), do: seal!(plaintext), else: plaintext
+  end
+
   @doc "The marker a sealed blob starts with, so a caller can tell one without decrypting it."
   @spec version() :: binary()
   def version, do: @version

test/trinity/vault_test.exs

@@ -117,6 +117,53 @@ defmodule Trinity.VaultTest do
     assert {:error, :malformed_blob} = Vault.open(Vault.version() <> <<200::8>> <> "short")
   end
 
+  describe "AC2: the blob classes, sealed only where a deployment asks" do
+    test "sealing is off unless configured, and the call site reads the same either way" do
+      refute Vault.sealing?(:staged_skills)
+      assert Vault.maybe_seal!(@secret, :staged_skills) == @secret
+
+      Application.put_env(:trinity, :vault, seal: [:staged_skills])
+      on_exit(fn -> Application.delete_env(:trinity, :vault) end)
+
+      assert Vault.sealing?(:staged_skills)
+      sealed = Vault.maybe_seal!(@secret, :staged_skills)
+      assert Vault.sealed?(sealed)
+      assert {:ok, @secret} = Vault.open(sealed)
+
+      # A class that was not named is still untouched, so turning one on does not turn on the rest.
+      refute Vault.sealing?(:exports)
+      assert Vault.maybe_seal!(@secret, :exports) == @secret
+    end
+
+    test "a staged skill change is ciphertext on disk and reads back through the seam", %{
+      dir: dir
+    } do
+      Application.put_env(:trinity, :vault, seal: [:staged_skills])
+      on_exit(fn -> Application.delete_env(:trinity, :vault) end)
+
+      # The shape the staging writes and reads: a tree of relative paths to contents.
+      change_dir = Path.join(dir, "change-1")
+      File.mkdir_p!(change_dir)
+      path = Path.join(change_dir, "SKILL.md")
+      File.write!(path, Vault.maybe_seal!(@secret, :staged_skills))
+
+      refute String.contains?(File.read!(path), @secret)
+      assert Vault.sealed?(File.read!(path))
+      assert {:ok, @secret} = Vault.open(File.read!(path))
+    end
+
+    test "an export manifest is ciphertext on disk when exports are sealed", %{dir: dir} do
+      Application.put_env(:trinity, :vault, seal: [:exports])
+      on_exit(fn -> Application.delete_env(:trinity, :vault) end)
+
+      path = Path.join(dir, "manifest.json")
+      File.write!(path, Vault.maybe_seal!(@secret, :exports))
+
+      refute String.contains?(File.read!(path), @secret)
+      assert {:ok, @secret} = Vault.open(File.read!(path))
+    end
+  end
+
   test "an unsealed blob passes through, so the two paths are the same code" do
     refute Vault.sealed?("plain text written before this slice")