{
  "id": "encrypted_storage_baseline",
  "label": "Encrypted Storage Baseline Canonical",
  "phase": "phase-12",
  "category": "bootstrap_security_runtime_installation",
  "status": "ACTIVE_DH_MIRROR",
  "purpose": "Encrypted Storage Baseline Canonical is the Phase 12 authority that decides where sensitive YEFF AI v1 state may physically live on the server.",
  "function": "Establish protected local storage custody with key aliasing, mount persistence, directory ownership, permission boundaries, backup alignment and validation evidence before database or runtime state is allowed to persist.",
  "technology_requirements": [
    {
      "technology": "Encrypted Storage Baseline",
      "required_for": "Encrypted Storage Baseline Canonical is the Phase 12 authority that decides where sensitive YEFF AI v1 state may physically live on the server.",
      "required_by_phase": "phase-12",
      "required_by_category": "encrypted_storage_baseline",
      "required_by_buckets": [
        "Prerequisites",
        "Installation",
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery",
        "Completion & Promotion"
      ],
      "expected_version": "MISSING until Encrypted Storage Baseline is implemented and validated in the future Execution & Monitoring Panel",
      "validation_command": "MISSING until encrypted_storage_baseline can prove scope, evidence, execution state and promotion decision",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/encrypted_storage_baseline.json",
      "status_source": "Documentation Hub + future Execution & Monitoring Panel",
      "blocking_if_missing": true,
      "failure_impact": "If this gate fails, sensitive client/runtime material may be created before Devon can prove where it lives, who can read it and how it will be protected."
    }
  ],
  "depends_on": [],
  "used_by": [],
  "overview": {
    "summary": "Encrypted Storage Baseline Canonical is the Phase 12 authority that decides where sensitive YEFF AI v1 state may physically live on the server.",
    "function": "FUNCTION: Establish protected local storage custody with key aliasing, mount persistence, directory ownership, permission boundaries, backup alignment and validation evidence before database or runtime state is allowed to persist.",
    "system_position": "This category owns local data custody, not backup policy and not database schema. It defines the protected filesystem floor that later database and runtime categories consume. The exclusive risk here is silent data placement. A correct database or runtime can still be unsafe if its files are born on unmanaged paths, broad permissions or storage with no key-custody evidence.",
    "failure_impact": "If this gate fails, sensitive client/runtime material may be created before Devon can prove where it lives, who can read it and how it will be protected."
  },
  "failure_impact": "If this gate fails, sensitive client/runtime material may be created before Devon can prove where it lives, who can read it and how it will be protected."
}