feat: S17.04 cryptographic confidentiality for at-rest records — AES-256-GCM (mbedTLS, FreeRTOS)#511

Merged

DavidCozens merged 6 commits into

mainfrom

feat/s17-04-mbedtls-aes-gcm

Jun 2, 2026

Commits on Jun 2, 2026

feat: S17.04 mbedTLS AES-256-GCM at-rest SecurityPolicy

DavidCozens
and
claude
committed
test: S17.04 AES-256-GCM policy integration tests against real mbedTLS

DavidCozens
and
claude
committed
feat: S17.04 wire aes-256-gcm at-rest policy into the FreeRTOS BDD target

DavidCozens
and
claude
committed
refactor: S17.04 pass SecurityRecord to AES-GCM crypto helpers; clear analysis gates

DavidCozens
and
claude
committed
fix: S17.04 static-assert the AES-GCM trailer fits the shared integrity buffer

DavidCozens
and
claude
committed
test: S17.04 clamp MbedTlsFake GCM capture lengths to buffer capacity

DavidCozens
and
claude
committed