plugin-enc

Version	2026.182.0001
Repo	box/github.com/opencharly/plugin-enc:v2026.242.0527
Plugin	yes — see the plugin reference

ENCRYPTED-VOLUME (gocryptfs) MECHANICS plugin (C16a) — runs the gocryptfs / systemd-run –scope / fusermount3 shell mechanics that mount, unmount, initialize (auto-init on charly start), and re-key charly’s gocryptfs-backed encrypted volumes. It is the security-sensitive external-command surface carved out of charly core (the former charly/enc.go is DELETED, K-wave 2). The deploy-model around it — ResolvedBindMount / ResolveVolumeBacking (sdk/deploykit/deploy_volume.go), the config loader (LoadEncryptedVolume, sdk/deploykit/enc_probe.go), the path/probe helpers, and the credential store — is sdk/deploykit + plugin-side, and the enc shim (candy/plugin-pod/enc_cmd.go) host-prelifts a self-contained per-volume plan + resolved passphrase into this plugin’s OpExecute. Compiled-in (charly config mount/unmount/passwd + charly start call the shim, which Invokes verb:enc in-proc so the passphrase never crosses a socket).

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
check	the encrypted-volume mechanics plugin ships a buildable Go module the host compiles in