tai/taicpp/docs/wiring/seal.md

Wiring: seal (for the integrator)

Sources: src/seal/*.cpp (picked up by the Makefile find src -name '*.cpp'; headers are included by relative path, no new -I needed). No new link flags.

In main.cpp, where repl::BootOptions is filled (see foundation.md section 4):

#include "seal/seal_factory.h"
boot.seal_factory = detz::seal::SealFactory::maker();

SealFactory::make(home, passphrase, default_key) does the whole boot() seal step: opens or creates <home>/.seal, performs the default-key to TAI_PASSPHRASE upgrade (rotation of vault and profile files, prints the upgrade line), and sets default_key. It throws store::SealError, which Boot::open already propagates. An empty passphrase yields a disabled seal (not an error).

Tests: make -f tests/seal.mk test (standalone, same pattern as foundation.mk).