Per-Store HMAC Key Derivation (security/key_derivation.py)

Derives deterministic 32‑byte HMAC keys per store from a master key using HKDF‑SHA256 with domain tags, ensuring isolation and preventing cross‑store replay attacks.

# Source: https://github.com/sipyourdrink-ltd/bernstein | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
# Provided via justclaw.it.com; keep this notice with the code.
"""Per-store HMAC key derivation using HKDF-SHA256 (RFC 5869).

The lineage spine (``bernstein.core.lineage.spine``) and the audit chain
(``bernstein.core.security.audit``) historically shared one HMAC key loaded
via :func:`bernstein.core.security.audit.load_or_create_audit_key`. Sharing a
key across two stores means a record in one chain can be replayed or replayed
against the other, and a compromise of either store's records leaks nothing
about the other only by luck of the domain separation in the preimage.

This module provides the KDF that separates them: each store derives 

... (truncated -- full source via MCP)