Audit the SDK

Optional

Sonnet, read the Tessera SDK and CLI. Confirm encryption happens before erasure coding. Confirm the data key never leaves this machine in the clear. Confirm no code path sends object bytes, keys, or the recovery phrase to Tessera or anywhere else. List any phone-home, telemetry, or logging of secrets.