papers/lux-sovereign-keys/sections/01-the-sovereign-app-model.tex

\section{The Sovereign App Model}

\label{sec:model}

\subsection{Local-First Principle}

In the sovereign model, the user's device is the primary data store.  Data
is encrypted at rest on the device; the provider never sees plaintext.  The
chain provides verifiable checkpoints and ordering, but is not the primary
storage layer for user data.

\begin{definition}[Sovereign Application]
An application is \emph{sovereign} if:
\begin{enumerate}[nosep]
  \item The user holds the root decryption key.
  \item The provider cannot derive the root key from any data it holds.
  \item The application functions offline (reads and writes to local state).
  \item Sync, storage, and recovery services are replaceable without data loss.
\end{enumerate}
\end{definition}

\subsection{Chain Anchors}

The blockchain provides three services to sovereign applications:
\begin{enumerate}[nosep]
  \item \textbf{Ordering}: a total order on state transitions, preventing
        equivocation.
  \item \textbf{Availability}: encrypted data blobs can be anchored on-chain
        for disaster recovery (the chain stores ciphertext, not plaintext).
  \item \textbf{Capability tokens}: on-chain tokens representing access
        permissions, revocable by the key holder.
\end{enumerate}

The chain never stores plaintext user data.  It stores commitments
(hashes), encrypted envelopes, and capability references.

\subsection{Provider Agnosticism}

The sync layer (cloud backup, multi-device replication) is a replaceable
service.  The provider receives only encrypted envelopes.  Switching
providers requires re-uploading encrypted blobs; no re-encryption is needed
because the provider never held a key.

% ======================================================================