papers/hanzo-base-runtime/sections/09-hanzoai-sqlite.tex

\section{hanzoai/sqlite}

\label{sec:sqlite}
% ============================================================================

Base's storage layer uses \texttt{hanzoai/sqlite}, a custom SQLite build with
two additions: sqlcipher encryption and threshold write attestation.

\subsection{sqlcipher Integration}

The \texttt{hanzoai/sqlite} package compiles SQLite with the sqlcipher extension,
providing transparent AES-256-CBC page-level encryption. The integration:

\begin{itemize}[leftmargin=1.1em]
    \item Uses 256-bit AES-CBC with HMAC-SHA512 for page authentication.
    \item Derives the page encryption key from the master key via PBKDF2-SHA512
    (256,000 iterations by default, configurable).
    \item Encrypts every database page including the header, WAL, and journal.
    \item Supports key rotation without full database re-encryption (re-key
    operation encrypts pages lazily on next write).
\end{itemize}

\subsection{Threshold Write Attestation}

For multi-party collections, \texttt{hanzoai/sqlite} integrates with the Lux
T-Chain to require threshold signatures before committing a write transaction:

\begin{equation}
\text{commit}(tx) \leftarrow \text{verify}\bigl(\sigma_{k/n},\;
\text{SHA3-256}(\text{WAL}(tx))\bigr)
\end{equation}

The write is held in the WAL (write-ahead log) until $k$-of-$n$ signers
attest. If attestation is not received within a configurable timeout
(default: 30 seconds), the write is rolled back. This enables use cases where
no single party can unilaterally modify the database---financial ledgers,
shared medical records, multi-party legal agreements.

% ============================================================================