nx_profile_backup.nx

nx_profile_backup.nx -- ENCRYPTED second-copy backup of the browser profile store (lib, no main). Operator 2026-07-02: "have it also create a backup so two is one one is none, on the os encrypted whether nishi os or windows or android". Blob = ChaCha20-Poly1305 AEAD under a key HKDF-derived from MACHINE IDENTITY (/etc/machine-id, 128-bit random) + a fresh random 32B salt PER BACKUP (fresh salt => fresh key => the (key,nonce) pair is never reused across snapshots -- the AEAD nonce-reuse hazard). Threat model (same as nx_machine_key/nx_vault): defeats offline theft of the backup file without the machine; NOT an attacker with local machine access. Destination = OS-level dir OUTSIDE the repo, from knowledge/hosting/profile_backup.conf (line 1) -- portable across NishiOS/Windows(drvfs)/Android paths. .nxpb v1 layout: "NXPB1\n"(6) | salt(32) | nonce(12) | ptlen(8 LE) | tag(16) | ct(ptlen). pb_backup_file WRITES then RE-READS + DECRYPTS + BYTE-COMPARES (a backup that doesn't restore is not a backup) -- returns 0 only on proven roundtrip. license_tier: ORIGINAL