The design lives in QRun-IO/qqq docs/SECURED-DATA.md; this repo implements §5–§8.