# Vault and key-rotation threat model (Bare OS)

Bare OS keeps **Ed25519** account material sealed for the personal Hyperdrive using **`bare-crypto`** (see **`identity-session.js`**). This note is intentionally short: it records **what the guest trusts** and **what operators must still verify on the host**.

## Trust boundaries

- **Guest image (`/bin`, kernel, booter)** is assumed **integrity-checked** by your release process (manifest signing, Pear channel policy, or offline LKG keys). Compromised image ⇒ full session compromise regardless of vault design.
- **Personal drive** is writable by the unlocked session. In **guest** mode the stock VFS **denies** read/write/chmod/unlink on **`/.bare/account`**, **`/.bare/vault/`****, and **`/.bare/vault-rotation-audit.ndjson`** so ciphertext and rotation logs are not visible without unlocking (**`BARE_OS_GUEST_BARE_READ_ALL=1`** lifts this for tests). **`ctx.bareOsAppendVaultRotationCheckpoint`** appends **plaintext NDJSON audit rows** to **`/.bare/vault-rotation-audit.ndjson`** — useful for continuity evidence, **not** a secret store. Do not place raw private keys there. After **`saveVaultToDrive`** / **`logout --save`**, a row with **`kind`**: **`vault_save`** and **`fileCount`** is appended when the personal drive is writable.
- Host audit mirrors can be hash-chained; tampering with any row should invalidate downstream hashes. Use chain verification checks during incident response and release forensics.
- **Host Corestore / filesystem** holds material the guest cannot fully audit. Treat disk encryption, backups, and multi-device signing policy as **operator responsibilities**.

## Rotation

- **`BARE_OS_ACCOUNT_KEY_ROTATION_STATE_JSON`** (env) may describe overlapping validity windows for signing keys. Checkpoints on disk should list **which key** signed **which artifact** and **when**, so rollback does not silently accept stale trust.
- **`/proc/bare_os/security_posture.json`** (**`accountKeyRotationContinuity`**, schema **2**) mirrors only **structural** hints (**`stateKeyCount`**, **`rotationHintPresent`**) — never raw private material — so operators can audit continuity without exposing vault bytes.

## Operational guidance

- Prefer **short-lived** guest-visible hints over long-lived secrets in proc or env.
- When experimenting with **`BARE_OS_VFS_ENFORCE_ACL`**, remember ACL sidecars are **metadata**, not a hardware root of trust.

## Crypto parameters (audit checklist)

- **Ed25519** is used for **boot manifest verification** (**`verifyBootManifestEd25519`**), **extension signer pins**, **stable `hostid**` derivation from the unlocked identity public key, and **Hyperdrive discovery** material. Regression tests in **`packages/bare-os-booter/test.js`** cover manifest signature rejection; keep algorithm names and key lengths aligned across those surfaces when rotating governance tooling.
- **AEAD / sealing** for vault snapshots should use **`bare-crypto`** primitives (ChaCha20-Poly1305 or documented equivalents) with **unique nonces per seal** and KDF parameters (PBKDF2 iteration counts or Argon2id when adopted) aligned with current **`bare-crypto`** release notes. **`bare-crypto`**-backed **tamper rejection** for sealed blobs (**`openBytes`** after flipping an authentication tag byte) is covered in **`packages/bare-os-booter/test.identity.js`** (run via **`brittle-bare`**, same as account encode/decode).
- Compare envelope layout with Holepunch **`safe-sodium-buffer`** guidance where applicable: avoid reusing `(key, nonce)` pairs; zeroize sensitive `Uint8Array` copies in host bridges when the runtime allows.
- **`savevault` / `logout --save`**: verify `bareOsKeySchema` version bumps include migration notes in the booter changelog when ciphertext layout changes. **`identity-session.js`** keeps a single-session Ed25519 account model: **`logout --save`** persists the encrypted vault snapshot and mirrors a **`vault_save`** audit row when the personal drive is writable; `**login` / `unlock**` rehydrate keys through the same **`bare-crypto`** paths used for **`hostid`** and boot-manifest verification. Extension **`kernel.ext.d`** scripts pinned by **`extensionSignerPins`** in **`boot.policy.json`** must ship a **`signaturePointer`** and verify with **`ctx.bareOsVerifyBootManifestSignature`** before execution (strict boot fails closed) so vault-bearing sessions do not load unsigned extension code when pins are declared.

## Seeder multisig verification (guest-visible hint)

The Pear seeder may set **`BARE_OS_SEEDER_MULTISIG_VERIFY_RESULT`** (**`ok`** / **`failed`** / **`skipped`**) when **`logPearMultisigKernelHint`** runs. The stock booter copies a redacted sketch into **`/proc/bare_os/security_posture.json`** under **`pearMultisigSeeder.verifyResult`** so operators can see **whether** multisig verification ran — not the signing keys or raw **`pear.multisig.json`** payload.

See also: [environment appendix](environment-and-posix-appendix.md), [handbook ch.4 — booter runtime](../../handbook/04-the-booter-runtime.md).