[samgbafa]

TC-887. This is the last PR of the refreshed at-rest stack (base: #521). The harness now checks a node that encrypts, not only that plaintext stays plaintext.

What

• harness.sh:
  • New TC887_AT_REST_ROOT_SOURCE (escrow or env), which maps to TINYCLOUD_AT_REST__ROOT_SOURCE.
  • With env, up generates a per-run root key (standard base64 of 32 bytes, stored in secrets/at-rest-root-key with mode 0600, never on argv or in logs) and passes it as TINYCLOUD_AT_REST_ROOT_KEY.
  • harness.env now carries TC887_NODE_ROOT_FILE and TC887_NODE_ROOT_ENCODING, so the checks re-derive the key hierarchy from the root the node actually seals under.
  • State records root_source.
  • With mode encrypt or strict, test red now expects both KV and SQL to be green.
• at_rest_harness.rs:
  • Decodes the root with the encoding the harness names.
  • Treats an env root like escrow_none: no escrow bundle or record may appear in the key mirror.
• CI (rust.yml, at-rest-harness): now a matrix with fail-fast: false.
  • plaintext: the default node. test red --expect red must find plaintext KV and SQL.
  • encrypt: TC887_AT_REST_MODE=encrypt with TC887_AT_REST_ROOT_SOURCE=env. test red --expect green must find KV blocks and SQL artifacts sealed, with every mirrored key authenticating under the env-derived hierarchy.
  • The MinIO store tests write their own objects, so they run once, in the plaintext leg, after the checks.
• README updated.

Verification (local, native PostgreSQL + MinIO)

• Encrypt leg (TC887_AT_REST_MODE=encrypt TC887_AT_REST_ROOT_SOURCE=env):
  • test green: kv=green, sql=green.
  • test red --expect green: "red checks as expected (kv=green, sql=green)".
• Plaintext leg:
  • test green: green.
  • test red --expect red: "both TC-887 RED checks report data not sealed at rest (KV and SQL)".

SQL cold read (review follow-up, 3c00837). The SQL check's payload heuristics stayed GREEN with a trigger appending random bytes to every payload. The check now opens every artifact row with keys it re-derives from its root and the authenticated DEK mirrors, through open_row (manifest tag, AEAD, exact length), and requires a SQLite database that passes PRAGMA integrity_check and holds exactly the rows written. selftest_sql_check_flags_appended_and_omitted_sealed_parts covers appended checkpoint/delta bytes and a dropped delta. Local run (encrypt leg): clean = kv=green, sql=green; with a BEFORE INSERT OR UPDATE trigger appending 32 random bytes to payload: SQL RED (checkpoint failed its at-rest integrity check).