# Local usability improvements

These changes are in this local clone and the portfolio source download. They have not been pushed to GitHub.

## Run

```sh
./run.sh encrypt sample.txt
./run.sh decrypt sample.txt.wncry -o restored.txt
```

The launcher creates `.venv` and installs `requirements.txt` on first use. Python 3.12 is the verified runtime. Override the interpreter with `PYTHON_BIN` or use a prepared environment through `PROJECT_PYTHON`.

## Changes

- New encryption uses streamed AES-256-GCM with authenticated headers; legacy CBC remains readable.
- Decryption publishes output only after authentication, and the engine refuses to overwrite existing files.
- Validated CLI headers, rejected failed integrity checks, and constrained archive extraction.
- Added a virtual-environment launcher.

## Verification and scope

8 tests passed covering empty/block/chunk-sized files, wrong keys, tampering, overwrite protection, complete CLI envelopes and backup restore. New inner file format is CVGCM2. Legacy CBC files are not upgraded until re-encrypted. Python 3.12+ is required for the archive extraction filter. This is not an independently audited encryption product.

## Run the regression tests

```sh
.venv/bin/python -m pip install -r requirements-dev.txt
.venv/bin/python -m pytest -q
```