Skip to content

COOKBOOK

Recipes.

Practical, copy-paste-ready patterns for common Engyon use cases.

Classification

Classified document with multiple clearance levels

Create a document with Top Secret, Secret, and Unclassified sections.

Provenance

Signed provenance chain

Build a chain of signed anchors tracking every modification.

Collaboration

Team secrets in Git

Manage team secrets in a Git repository with automatic encryption.

Encryption

Multi-recipient encrypted distribution

Encrypt for multiple recipients using ML-KEM encapsulation.

Redaction

Redactable public report

Publish a public version with sensitive sections muted.

Integrity

Immutable license block

Lock a license with a hash so modifications are detected.

Classified document with multiple clearance levels

// Intelligence briefing
// <( BEGIN top_secret )>
Source Alpha reports troop movement along the northern border.
// <( END top_secret )>

Public assessment: The situation remains stable.

// <( BEGIN secret )>
Source Bravo confirms supply line disruptions.
// <( END secret )>

Distribute the unclassified version:

enprot encrypt -w top_secret=ts_pass -w secret=s_pass briefing.txt

Reclassify after edits:

enprot decrypt -w top_secret=ts_pass -w secret=s_pass briefing.txt

Signed provenance chain

// Sign the initial version
enprot encrypt --signer alice_priv.pem --anchor contract.txt

// Alice makes changes, signs again
enprot encrypt --signer alice_priv.pem --anchor contract.txt

// Bob co-signs
enprot encrypt --signer bob_priv.pem --anchor contract.txt

// Verify the full chain
enprot verify contract.txt
# Anchor 1: signer=alice, parents=(none)
# Anchor 2: signer=alice, parents=hash1
# Anchor 3: signer=bob,   parents=hash2

Team secrets in Git

# .gitattributes
.env*        filter=enprot diff=enprot merge=enprot
**/secrets.* filter=enprot diff=enprot merge=enprot

# .git/config
[filter "enprot"]
    clean = enprot encrypt-store -w team
    smudge = enprot fetch -w team

# Team members clone and get plaintext automatically
git clone repo

# Commit changes -- Git stores encrypted version
git add .env && git commit -m "Update DB URL"

Multi-recipient encrypted distribution

# Generate ML-KEM keypairs for each recipient
enprot keygen --alg ml-kem-65 --output alice_mlkem.pem
enprot keygen --alg ml-kem-65 --output bob_mlkem.pem

# Encrypt for both recipients
enprot encrypt \
  -w shared \
  --recipient alice_mlkem_pub.pem \
  --recipient bob_mlkem_pub.pem \
  document.txt

Each recipient gets the same AES key, encapsulated with their own ML-KEM public key.

Redactable public report

// Original report
// <( IMMUTABLE methodology sha3-256=a1b2c3... )>
Standard methodology: interviews, document analysis.
// <( MUTABLE methodology )>

// <( BEGIN classified_findings )>
The investigation found evidence of...
// <( END classified_findings )>

Conclusion: The project is proceeding as planned.
# Mute the classified findings (replace with hash pointer)
enprot store -w classified_findings=.pass report.txt

Result:

// <( STORED classified_findings ct sha3-256=d4e5f6... )>

Conclusion: The project is proceeding as planned.

Immutable license block

// <( IMMUTABLE license sha3-256=abc123... )>
Copyright (c) 2026 Ribose Inc. All rights reserved.
Redistribution and use in source and binary forms...
// <( MUTABLE license )>
# Verify on every CI run
enprot verify --strict source.rs
# IMMUTABLE license: hash matches

Any modification breaks the hash — verify catches it immediately.