aeat.application.user_profile._custody_carry module

Generic per-bucket secure-object custody carry for portable bundles.

The portable bundle’s five typed categories (profile, work units, ledger, calculation revisions, filing records) are carried by dedicated typed fields. Every other durable per-bucket secure-object store is carried generically by this module so an export/import round-trip restores the whole bucket: evidence bytes, the cross-period calculation inputs, the live captures, and the audit trail.

Mechanism. Each carried row is read from the encrypted substrate with its decrypted Envelope payload bytes intact and re-keyed by its natural object key (never the stored HMAC digest, which is derived from the per-bucket data-encryption key and is therefore unreadable in a recipient bucket — see the custody roundtrip tests). On import each row is re-saved through the raw secure-object substrate under that natural key, which the recipient bucket re-digests under its own DEK and re-encrypts. This is the substrate-level counterpart of the typed categories’ repository.save re-encrypt-on-import path and honours the same D2 decrypted-payload custody contract.

The set of carried namespaces is registry-driven: it is exactly the namespaces whose StorageCustodyDisposition is in the requested custody profile, minus the five typed-category namespaces this module deliberately leaves to the typed bundle fields. A populated, carried-disposition namespace with no natural key resolver fails the export fail-closed, so a newly-registered durable store cannot be silently dropped.

carried_namespace_definitions(profile)[source]

Return carried SecureObjectNamespaceDefinition rows for profile.

Return type:

tuple[SecureObjectNamespaceDefinition, ...]

Parameters:

profile (StorageCustodyProfile)

serialize_carried_objects(*, bucket_id, profile)[source]

Serialise every generically-carried CarriedSecureObject row for profile.

Reads each carried namespace from the active bucket’s encrypted substrate, resolving each row’s natural key. A populated carried namespace with no resolver raises, fail-closed, so the carry can never silently drop a store.

Return type:

tuple[CarriedSecureObject, ...]

Parameters:
restore_carried_objects(carried_objects, *, target_bucket_id)[source]

Re-save every carried secure-object row into target_bucket_id.

Each row is written through the raw secure-object substrate under its natural key, so the recipient bucket re-digests the key under its own DEK and re-encrypts the payload. The caller holds the target bucket session.

Return type:

None

Parameters: