Per-workspace libsodium envelope encryption, write-only agents that cannot decrypt, tenant isolation that fails closed, and a stated threat model.