dev_agentandClaude Opus 5.5 4c41f90805 Add secretbox for AES-256-GCM secrets at rest ...

internal/secretbox decodes the standard-base64 key from
MEALQUEST_SECRET_KEY_FILE, requires exactly 32 bytes, and seals secrets as
nonce ‖ ciphertext with a fresh random 12-byte nonce per call. Errors are
sentinels that never carry plaintext, ciphertext or key material.

The server builds the box before opening the database, so a non-base64 or
wrong-length key stops boot with an error naming the variable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-03 09:33:39 -04:00

..

config

Feature 01 task 1: Go module, fail-fast config and /health (#2)

2026-10-02 22:20:34 -04:00

db

Feature 02 task 4: sqlc configuration and core queries (#13)

2026-10-03 09:15:40 -04:00

frontend

Feature 01 task 3: Embed the PWA build with SPA fallback (#4)

2026-10-02 22:47:01 -04:00

secretbox

Add secretbox for AES-256-GCM secrets at rest

2026-10-03 09:33:39 -04:00

server

Feature 01 task 3: Embed the PWA build with SPA fallback (#4)

2026-10-02 22:47:01 -04:00

store

Feature 02 integration fix: repository coverage and boot-path tests (#15)

2026-10-03 09:27:22 -04:00