Implement vault seal/unseal lifecycle #4

New Issue

Skipper · 2026-02-14T11:30:33Z

Skipper commented

2026-02-14 11:30:33 +00:00

Implement the vault sealed/unsealed state lifecycle as described in ARCHITECTURE.md section 5.

The server state machine already defines Sealed and Ready states, and unseal.proto defines the messages, but the unseal flow is not wired up.

Requirements:

On boot, server starts in Sealed state — no signing operations possible
- User Agent initiates unseal by requesting a one-time server key pair
- Server returns ephemeral public key; User Agent encrypts password with it
- Server decrypts password, derives user key, decrypts root key
- On success: transition to Unsealed, root key placed in hardened memory cell
- On failure: return error, remain sealed
- Re-encrypt any entries pending encryption scheme migration on unseal
  Depends on: Key hierarchy implementation, memory protection

Implement the vault sealed/unsealed state lifecycle as described in ARCHITECTURE.md section 5. The server state machine already defines `Sealed` and `Ready` states, and `unseal.proto` defines the messages, but the unseal flow is not wired up. **Requirements:** - On boot, server starts in `Sealed` state — no signing operations possible - - User Agent initiates unseal by requesting a one-time server key pair - - Server returns ephemeral public key; User Agent encrypts password with it - - Server decrypts password, derives user key, decrypts root key - - On success: transition to `Unsealed`, root key placed in hardened memory cell - - On failure: return error, remain sealed - - Re-encrypt any entries pending encryption scheme migration on unseal **Depends on:** Key hierarchy implementation, memory protection

Skipper added the

labels 2026-02-14 11:30:33 +00:00

Skipper self-assigned this 2026-02-16 16:35:13 +00:00

Skipper commented