Task — engineering-spec@1

"Desktop at-rest encryption - SQLCipher + OS keychain + file perms"

draftTASK-MEMORY-235

module memory · class product · priority p1 · created 2026-07-08 · shipped null
depends on TASK-MEMORY-233 · blocks none

TASK-MEMORY-235: Desktop at-rest encryption - SQLCipher + OS keychain + file perms

1. Description

DB+WAL encrypted, key in keychain, 0600 perms; key-loss recovery = re-hydrate documented and tested

Migrated 2026-07-08 from the memory improvement backlog, folded into the task system as class: improvement. Source report refs: R66, F27.

Acceptance criteria

[ ] DB+WAL encrypted, key in keychain, 0600 perms; key-loss recovery = re-hydrate documented and tested