dev_agentandClaude Opus 5.5
4c41f90805
internal/secretbox decodes the standard-base64 key from MEALQUEST_SECRET_KEY_FILE, requires exactly 32 bytes, and seals secrets as nonce ‖ ciphertext with a fresh random 12-byte nonce per call. Errors are sentinels that never carry plaintext, ciphertext or key material. The server builds the box before opening the database, so a non-base64 or wrong-length key stops boot with an error naming the variable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>