decrypt

Overview ¶

Command decrypt is the user-side standalone decrypt CLI (Path A, decisions.md).

It runs entirely offline: a Take-Out directory plus the user's Recovery Key, no network, no OpenCloud, no server. The plaintext Recovery Key never crosses the network and is never accepted as a command-line argument — command lines end up in shell history and in every process listing — so it is prompted for, or read from standard input when a script pipes it in.

This binary is the family's last resort. Keep it small, keep it dependency- light, and keep it able to read *every* historical key-envelope and Take-Out version, forever.