# Vault multi-device continuity (sketch)

Bare OS identity today centers on **HDMS / autopass** flows documented in the handbook and users manual. **Optional multi-device continuity** (threshold approvals, device loss recovery) can follow Holepunch **hyper-multisig** / **pear-multisig-link** patterns without changing the default single-device vault.

## Design constraints

- **Backward compatible**: default **`/.bare/`** metadata and `**login` / `savevault`** flows keep working when multisig is off.
- **Guest-visible only as hints**: synthetic **`/proc/bare_os`** JSON and host **`process.emit`** sketches — no silent network from the guest kernel.
- **Operator-owned keys**: multisig public material is not embedded in the system image; distributors ship allowlists and boot policy pins.

## Stock surfaces (today)

| Surface | Role |
|---------|------|
| **`/proc/bare_os/hyper_multisig_trust_pointer.json`** | Operator-facing trust pointer sketch (see booter VFS proc table). |
| **`/proc/bare_os/multisig_quorum_pointer.json`** | Quorum pointer sketch for dashboards. |
| **`ctx.bareOsEmitMultisigPointer`**, **`ctx.bareOsMultisigQuorumPointer`** | Emit **`bare-os:multisig-pointer`** / **`bare-os:multisig-quorum-pointer`** on the host process for integrators. |
| **`BARE_OS_HYPER_MULTISIG_VERIFY`** | Seeder can run **`hyper-multisig verify`** when the binary is on **`PATH`** (see [environment appendix](../reference/environment-and-posix-appendix.md)). |
| **`BARE_OS_VAULT_MULTISIG_CONTINUITY_JSON`** | Merged into **`hyper_multisig_trust_pointer.json`** (**schema 2**) as **`vaultMultisigContinuity`** — operator-owned continuity sketch only. |
| **`BARE_OS_VAULT_MULTISIG_CONTINUITY_AUDIT_NDJSON`** | When **`1`** / **`true`**, login / unlock appends a **`vault.multisig_continuity_login_sketch`** audit row (**public-key hex prefix** only). |
| **Boot policy** | **`extensionSignerPinsV2`**…**`V5`** pin extension signers; see [OTA and bundles](../deployment/OTA_AND_BUNDLES.md). Multisig is an **identity** layer above bundle trust. |

## When to enable

Use multisig operator flows when the host integrates **Holepunch multisig** tooling and documents pointer emission for your fleet — see [OTA and bundles](../deployment/OTA_AND_BUNDLES.md) and [identity handbook](../../handbook/05-identity-vault-and-hdms.md).