Module custody 

Where this device keeps its opened keys and its member’s two key pairs (E1).

Structs

InMemoryCustody

In-memory custody for StoreKeyring or MemberIdentity, erased with the session.

KeySession

Held keys and the capability that saves them, released together on close. Consumers read memory; only opening calls the configured custody’s unlock. Share this owner across every worker using the same custody.

Keychain

The OS keychain capability, constructed only at a composition root. It never exposes native entries or its underlying credential store.

KeychainError

A native keychain error whose diagnostic output never includes secret bytes. Its original typed cause remains available through std::error::Error.

KeyringCustody

OS keychain custody for StoreKeyring or MemberIdentity, built at a composition root.

Passphrase

A memorized secret that protects custody with Argon2id (E1).

PassphraseCustody

Passphrase file custody for StoreKeyring or MemberIdentity (E1). The composition root supplies the corresponding reserved AtomicFile.

PersonEntries

One store’s restore code and the S3 key saved beside it, in iCloud Keychain or Block Store. They belong to the person, not to this device: every device on the person’s Apple account sees them, and a phone set up from this one receives them. So removing the store from one device keeps them, and only the person leaving the store deletes them (§13.1, §14.1). Every read, write and deletion here uses the person scope; this device’s own entries belong to StoreKeychain.

StoreCustody

The store’s identity and host secrets, retaining their custody and keychain. Shares the unlocked sessions used by the handle and its workers.

StoreKeychain

One store’s entries kept on this device only: its device id, store and member keys, provider credentials, the invite code of a join under way, the record of a restore or a replacement under way and the app’s host secrets (§12.4, §13.1, §13.2, §19.3). They never leave the device, so deleting them reaches no other device of the person. Every read, write and deletion here uses the device-only scope; the person’s entries belong to PersonEntries.

Enums

CustodyChoice

Where this device keeps T (E1).

IdentityError

Initializing this device’s member identity failed (E11).

KeyError

A failure unlocking, keeping or forgetting keys or host secrets (E11).

PersonRestoreCode

One store’s saved restore-code entry, as listing found it (§13.1).

RestoreCodeChange

What PersonEntries::change_restore_code does with the entry it read.

Traits

Custody

The app’s own store for key material this device holds (E1).

KeyMaterial

What custody keeps: the store keys or the member’s identity. Sealed: coven alone says how each is named and encoded.