cube-frontend now wraps its kernel store in cube-store-seal's SealedStore. When
a key is available — `--key FILE`, or what systemd unsealed into
$CREDENTIALS_DIRECTORY — `cell put` seals and `cell get` opens, so the machine's
clients keep speaking the same language and the store holds ciphertext. With no
key, the wrapper passes envelopes through untouched, and `stats` reports
store=kernel+sealed=true/false so the state is visible rather than inferred.
The front-end's exact code path is now unit-tested without a kernel: the command
language over a sealed store round-trips — `cell put` leaves an envelope at rest,
`cell get` returns the plaintext — which is the claim the whole cutover depends
on, held by a test that runs in milliseconds instead of a boot.
SealedStore gained `inner()`, the raw ciphertext view, for that inspection and
for a process that deliberately wants what is at rest.
luulu
504a667cd9