hanzoai/base
2
0
Fork 0
mirror of https://github.com/hanzoai/base.git synced 2026-10-21 03:41:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,284 Commits 5 Branches 401 Tags
dev
Commit Graph
6 Commits
Author SHA1 Message Date
zeekay 278b0c8481 doc: vault security guide — MPC/KMS/Base production settings, key hierarchy, threat model 2026-03-02 13:27:04 -07:00
zeekay 270c3ffdac refactor: unify vault SDK — remove version markers, one coherent API 
Remove all v2/v3/v4 section headers. The vault SDK is one product:
- Encrypted SQLite shards + CRDT sync + chain anchoring (core)
- Shared vaults + multi-device + collection sharing + recovery (sharing)
- Provider interfaces + export/import + metering (providers)
- Confidential compute + policy engine + audit log (confidential)

Rename test files: v2_test → sharing_test, v3_test → providers_test,
v4_test → confidential_test. 50 tests, all pass.

Product name: Base Vault SDK (not "plugin").
 2026-03-02 13:19:30 -07:00
zeekay f11070fcf8 feat: vault v2+v3+v4 — complete Web5 data SDK, 50 tests 
v2 — Sharing & Recovery:
- Shared vaults (org/team) with member access control
- Multi-device enrollment with per-device wrapping keys
- Per-collection sharing (recipient decrypts only shared collection)
- Threshold recovery (XOR split, Shamir in v3)

v3 — Provider Marketplace:
- SyncProvider, StorageProvider, RecoveryProvider interfaces
- Local providers (filesystem, content-addressed, share storage)
- Export/Import portable vault bundles (encrypted snapshot + oplog)
- Usage metering (puts, gets, syncs, anchors per vault)

v4 — Confidential Compute:
- ConfidentialEngine interface (opt-in FHE/ZK, NOT default)
- Local engine (decrypt-compute-prove baseline)
- PolicyEngine with capability-based access control (grant/check/revoke/expiry)
- Append-only audit log with hash-chained entries + merkle root

50 tests total. Zero failures. Zero external dependencies.
Multi-instance HA: each instance runs its own SQLite shard, CRDT
sync handles consistency. Encryption at rest via DEK/KEK hierarchy.
 2026-03-02 13:14:19 -07:00
zeekay e6da9b68f6 test: 6 E2E tests — full user lifecycle, multi-device, org isolation 
- FullUserLifecycle: register → store → read → anchor
- MultiDeviceSync: laptop writes → phone syncs → phone edits → laptop merges
- OrgMultiTenant: same user in different orgs gets different DEKs
- ConcurrentAccess: 50 parallel writers, all readable, correct oplog
- AnchorDeterministic: same state → same root, new write → new root
- DeviceRevocation: close session zeroes DEK, reads fail after revoke

18 total tests. All pass. Zero external deps.
 2026-03-02 12:44:11 -07:00
zeekay e635cbe277 feat: vault SDK — 5 primitives, 12 tests, zero dependencies 
Standalone SDK (no Base app required):
  v, _ := vault.Open(cfg)
  s, _ := v.OpenUser("alice")
  s.Put("key", value)        // encrypted, logged
  s.Get("key")               // decrypted
  s.Sync()                   // CRDT merge with peers
  s.Anchor()                 // merkle root for chain

5 primitives:
  1. Identity  — OpenUser, per-user DEK derivation
  2. KeyAccess — DEK/KEK hierarchy, HSM or K-Chain unwrap
  3. LocalDB   — encrypted put/get/delete with oplog
  4. Sync      — CRDT merge of encrypted ops (peers see ciphertext only)
  5. Anchor    — merkle root receipt for chain commitment

12 tests: round-trip encryption, cross-user isolation, cross-user
cannot decrypt, org isolation, CRDT merge, duplicate op skip,
anchor receipt, missing key, invalid master key.

Encrypted CRDT ops sync across authorized replicas;
chain only sees anchors/metadata.
 2026-03-02 12:40:52 -07:00
zeekay 6fc10be26d feat: vault plugin — per-user encrypted SQLite shards with CRDT sync 
Local-first data SDK for Hanzo Base apps:
- Per-user SQLite shard (encrypted, isolated)
- DEK/KEK hierarchy: Master KEK → Org KEK → User DEK → AES-256-GCM
- Master KEK from HSM (AWS/GCP/Azure) or K-Chain ML-KEM threshold
- CRDT sync via ZAP for conflict-free multi-device merge
- Merkle root anchoring to chain (identity, not row data)
- API: /vault/put, /vault/get, /vault/anchor, /vault/sync, /vault/export
- All routes require auth — user ID from Base auth context

Zero integration: import plugin, register, done. Each user gets
their own encrypted database file. Reads/writes instant. Sync background.
Chain stores roots, never data.
 2026-03-02 12:39:19 -07:00