One encrypted document, finite side state.
The vault owns encrypted records; separate bounded state machines own grants, acquisition replay protection, audit linkage, donations, bonds, and credential operations.
Canonical writes#
Vault and side-state updates use owner-only temporary files, fsync, and atomic rename under a directory lock. Readers observe the old complete document or the new complete document, never a partial append.
Side state#
- Capability state stores bearer hashes, exact capabilities, expiry, audience, and workload bindings.
- Acquisition state stores accepted proof hashes and one-use bearer hashes only for their bounded replay windows.
- The audit journal stores non-sensitive operation identifiers in a hash chain.
- Credential-operation records store state, receipt, and quarantine evidence without granting value reads. The sealed directory contract is the lifecycle's other record family and carries its own kind, so the two are told apart by what they declare rather than by how their ids are spelled.
- Bond and donation state move ciphertext and provenance without silently merging ownership.
Interfaces#
The owner CLI is the complete administration surface. The loopback HTTP broker serves scoped consumers. MCP, browser native messaging, synchronization, and Stado adapters are narrower projections that retain their own authentication and validation boundaries.