Nexus Per Endpoint Encryption - #525
Draft
Quinn-With-Two-Ns wants to merge 1 commit into
Draft
Quinn-With-Two-Ns wants to merge 1 commit into
Quinn-With-Two-Ns wants to merge 1 commit into
Conversation
Quinn-With-Two-Ns
force-pushed
the
nexus-per-endpoint-encryption
branch
from
August 7, 2026 18:28
46c9c34 to
d902861
Compare
Quinn-With-Two-Ns
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was changed
Added a Nexus encryption sample demonstrating how to use NexusSerializationContext to select an AES-GCM encryption key based on the Nexus endpoint handling an operation. The same context can also support key selection by service, operation, or a combination of those values.
The sample includes synchronous and workflow-backed asynchronous operations across two endpoints, along with tests and setup instructions. It also documents the limitation that operations attached to the same workflow execution share one serialized result and therefore must resolve to the same encryption key.
Why?
Context-aware serialization lets applications protect Nexus payloads according to where they are sent. For example, services can isolate payloads across endpoints, services, operations, tenants, or security domains without creating separate data-converter implementations for each one.
This sample gives users a practical reference for implementing that pattern safely, including guidance for workflow executions shared by multiple attached Nexus operations.