Introduces an in-process keyserver that holds cryptographic key material
and exposes operations by opaque key ID — callers (including AI agents)
never see raw key bytes.
New packages:
- pkg/keystore: Trix-based encrypted key store with Argon2id master key
- pkg/keyserver: KeyServer interface, composite crypto ops, session/ACL,
audit logging
New CLI commands:
- trix keystore init/import/generate/list/delete
- trix keyserver start, trix keyserver session create
Specification: RFC-0005-Keyserver-Secure-Environment
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
447f3ccaca