feat(storage): encrypt content-bearing secondary databases

AGENTS.md

@@ -367,7 +367,7 @@ Edge builds run `scripts/build-edge.mjs` which sets `DEPLOY_TARGET=edge` and pat
 - **Supply-chain:** SHA-pinned GitHub Actions, Dependabot weekly updates, OpenSSF Scorecard, CodeQL SAST, SLSA build provenance on `main`.
 - **Collaboration:** Yjs + `packages/collab-transport` (vendor fork of y-webrtc 10.3.0) with AES-256-GCM E2E encryption baked in (PBKDF2, 600k iterations, `extractable: false`). Signaling URLs are user-configurable.
 - **Tauri isolation:** `vite.config.ts` externalizes `/^@tauri-apps//` so web builds never bundle Tauri APIs. Abstract Tauri calls through `services/tauriRuntime.ts`.
-- **IDB at-rest encryption:** Optional feature (`featureFlags.enableIdbAtRestEncryption`) encrypts all project data, snapshots, and settings with AES-256-GCM + PBKDF2-derived key (600k iterations, SHA-256, 32-byte random salt). Web build uses passphrase unlock screen; Tauri build uses OS keychain via `tauri-plugin-stronghold`.
+- **IDB at-rest encryption:** Optional feature (`featureFlags.enableIdbAtRestEncryption`) encrypts primary project data, snapshots, assets, Codex/RAG data, and content-bearing secondary IDB payloads with AES-256-GCM + PBKDF2 (600k iterations, SHA-256, 32-byte random salt). DuckDB structural metadata and large LoRA weight blobs are documented exceptions. Secondary stores fail closed while locked and lazily migrate legacy plaintext after unlock. Cross-database passphrase rotation remains an active journaled-migration follow-up; do not call it atomic or complete.
 - **Encrypted library backup:** One-click encrypted ZIP export from Settings → Data; `vault.bin` encrypted with AES-256-GCM, passphrase-derived key via PBKDF2.
 - **Vulnerability reporting:** GitHub Private Vulnerability Reporting preferred. 90-day coordinated disclosure embargo.
 

CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **Content-bearing secondary IndexedDB databases now honor at-rest encryption.** Scene revisions,
+  AI inference results, ProForge memory/history, cross-project descriptive metadata and embeddings,
+  and LoRA adapter metadata/datasets/training runs store sensitive fields in versioned AES-256-GCM
+  envelopes. Configured-but-locked storage rejects reads and writes instead of silently falling back
+  to plaintext; legacy plaintext records migrate lazily after unlock, and corrupt envelopes fail
+  closed. Large LoRA weight blobs and approved DuckDB structural analytics metadata remain explicit
+  exceptions. Passphrase rotation across these independent databases is tracked separately as a
+  durable, resumable journal rather than being described as atomic.
+
 ## [1.26.0] — 2026-08-01
 
 ### Added
@@ -761,7 +772,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **B-1 — IDB At-Rest Encryption** (`services/storage/storageEncryptionService.ts`): Full AES-256-GCM passphrase-derived encryption for IndexedDB stores. PBKDF2 (600 000 iterations, SHA-256, 32-byte random salt stored in `app-data` as `idb_kdf_salt_v1`). `CryptoKey` is `{ extractable: false }`. Feature-flagged behind `enableIdbAtRestEncryption` (off by default). Tauri build uses `tauri-plugin-stronghold` for OS-keychain-backed passphrase (zero user friction). Web build shows passphrase unlock modal on cold start (session-scoped in-memory key wiped on tab close). GDPR threat model: encrypted blobs unreadable without passphrase from browser profile or malicious extension. Storage decomposition in `services/storage/` (`idbCore`, `idbProjectStore`, `idbSnapshotStore`, `idbKeyStore`, `idbCodexStore`, `idbAssetStore`).
+- **B-1 — IDB At-Rest Encryption** (`services/storage/storageEncryptionService.ts`): Full AES-256-GCM passphrase-derived encryption for IndexedDB stores. PBKDF2 (600 000 iterations, SHA-256, 32-byte random salt stored in `localStorage` as `worldscript-idb-kdf-salt-v1`). `CryptoKey` is `{ extractable: false }`. Feature-flagged behind `enableIdbAtRestEncryption` (off by default). Tauri build uses `tauri-plugin-stronghold` for OS-keychain-backed passphrase (zero user friction). Web build shows passphrase unlock modal on cold start (session-scoped in-memory key wiped on tab close). GDPR threat model: encrypted blobs unreadable without passphrase from browser profile or malicious extension. Storage decomposition in `services/storage/` (`idbCore`, `idbProjectStore`, `idbSnapshotStore`, `idbKeyStore`, `idbCodexStore`, `idbAssetStore`).
 
 - **B-2 — Voice WASM Engine Scaffold** (`services/voice/wasmSttEngine.ts`, `services/voice/sileroVadEngine.ts`): Whisper.cpp WASM STT engine interface scaffold (model download, chunked inference, 99+ language detection). Silero VAD v4 via ONNX Runtime Web (~2 MB model, lazy-loaded). Both implement the existing abstract `SttEngine` / `VadEngine` interfaces from `voiceTypes.ts`. Feature-flagged behind `enableVoiceWasm` (off by default); falls back to `WebSpeechSttEngine` / `WebRtcVadEngine` when off.
 

CLAUDE.md

@@ -425,7 +425,7 @@ Feature-specific implementation patterns (Plot Board, ProForge Pipeline, scene-l
 See `AUDIT.md` and `TODO.md`. Key items:
 - `workers/v2/inference.worker.ts` (v1 deleted, ADR-0015) — `@huggingface/transformers` v3 path alias in `tsconfig.json`; if the alias breaks, fix the path alias or the package's type declaration directly — do not suppress with `@ts-expect-error` (conflicts with the suppression-ratchet policy above).
 - **DS-5:** Delete legacy bridge block from `index.css` — deferred until DS-1 verified in production.
-- **B-1 (IDB encryption):** Passphrase UX complete (`IdbUnlockModal`, `PassphraseModal`). Actual IDB read/write integration for stores is Phase 4 (service-layer only currently).
+- **B-1 (IDB encryption):** Primary and content-bearing secondary IDB reads/writes are integrated, fail closed while locked, and lazily migrate legacy plaintext. DuckDB structural metadata and large LoRA weights are documented exceptions. Remaining: durable resumable passphrase rotation across every registered database.
 - **B-2 (Voice WASM):** Engine + download UI shipped. Remaining: E2E integration test coverage.
 - **SW version sync:** `public/sw.js` `APP_VERSION` and the Tauri versions are **auto-synced** from `package.json` `version` by `scripts/sync-sw-version.mjs` + `scripts/sync-tauri-version.mjs`, which run on every `predev`/`prebuild` — no manual edit needed (just bump `package.json` for a release). The earlier "must hand-sync" note is obsolete.
 

TODO.md

@@ -8,23 +8,32 @@ Status: 🔄 in progress | ⬜ open | ✅ done
 
 ---
 
-## Release — v1.25.0 published (2026-08-01)
+## Release — v1.26.0 published (2026-08-01)
 
 > **Status: ✅ Done.** Tagged, released, and live — see the GitHub Release link below.
 
-Native Grok/Claude providers, opt-in Browser-Ollama, and DuckDB `codex_mentions.excerpt`
-cell-level encryption (SEC-6) all shipped in this cycle — see
-[`docs/history/completed-v1.25.0-providers.md`](docs/history/completed-v1.25.0-providers.md) for
-the full completed checklist. `CHANGELOG.md`, `package.json`/`README.md`, and `src-tauri`/`public/sw.js`
-are all version-bumped and synced for this release.
-
-- ✅ PR #303 (DuckDB excerpt encryption SEC-6 + CodeRabbit fix + doc-truth fixes) merged to `main`
-  at `256264d3` via admin-bypass squash-merge (fresh maintainer authorization; `mergeStateStatus`
-  cache-lag artifact — all 20/20 checks green, 0 unresolved review threads, Tauri Rust build
-  manually verified green on all 3 platforms before merge).
-- ✅ Tagged and published `v1.25.0` after `main`'s post-merge CI (`build` + `e2e`) went green — the
-  GitHub Release is live with all Tauri installer assets (macOS/Linux/Windows) and `.sig` files; see
-  [`v1.25.0` on GitHub](https://github.com/qnbs/WorldScript-Studio/releases/tag/v1.25.0).
+The authoritative WorkerBus scheduler, bounded critical reserve, queue-inclusive inactivity timeout,
+and native task-completion notifications shipped in this release. Native Grok/Claude providers,
+opt-in Browser-Ollama, and DuckDB `codex_mentions.excerpt` cell-level encryption shipped in v1.25.0;
+see [`docs/history/completed-v1.25.0-providers.md`](docs/history/completed-v1.25.0-providers.md).
+
+## Active security follow-up — secondary storage and rotation
+
+- ✅ Content-bearing secondary IDB payloads encrypted: scene revisions, inference cache, ProForge
+  memory/history, cross-project descriptive metadata/embeddings, and LoRA metadata/datasets/runs.
+- ✅ Configured-but-locked access fails closed; legacy plaintext migrates lazily after unlock;
+  corruption and raw-record canaries are covered by focused tests.
+- ⬜ Add a durable cross-database rotation journal with bounded checkpoints and restart recovery;
+  retain the old verifier until all registered stores have completed.
+- ⬜ Add recursive, bounded, content-minimizing durable-log sanitization and one clear-diagnostics
+  operation covering memory, IndexedDB, and Tauri JSONL sinks.
+
+- ✅ PR #309 merged to `main` at `804793aa` via approved admin-bypass squash merge after required
+  review and cloud checks completed.
+- ✅ Signed annotated tag `v1.26.0` published; tag CI/CD, Docker, and Tauri workflows are green.
+- ✅ GitHub Release contains 14 verified desktop assets and signatures for Linux, Windows, and
+  macOS plus a `latest.json` updater manifest; see
+  [`v1.26.0` on GitHub](https://github.com/qnbs/WorldScript-Studio/releases/tag/v1.26.0).
 
 
 ---