bare-operating-system/docs/security/vault-multisig-continuity.md

Vault multi-device continuity (sketch)

Bare OS identity today centers on HDMS / autopass flows documented in the handbook and users manual. Optional multi-device continuity (threshold approvals, device loss recovery) can follow Holepunch hyper-multisig / pear-multisig-link patterns without changing the default single-device vault.

Design constraints

• Backward compatible: default /.bare/ metadata and **login / savevault** flows keep working when multisig is off.
• Guest-visible only as hints: synthetic /proc/bare_os JSON and host process.emit sketches — no silent network from the guest kernel.
• Operator-owned keys: multisig public material is not embedded in the system image; distributors ship allowlists and boot policy pins.

Stock surfaces (today)

Surface	Role
/proc/bare_os/hyper_multisig_trust_pointer.json	Operator-facing trust pointer sketch (see booter VFS proc table).
/proc/bare_os/multisig_quorum_pointer.json	Quorum pointer sketch for dashboards.
ctx.bareOsEmitMultisigPointer, ctx.bareOsMultisigQuorumPointer	Emit bare-os:multisig-pointer / bare-os:multisig-quorum-pointer on the host process for integrators.
BARE_OS_HYPER_MULTISIG_VERIFY	Seeder can run hyper-multisig verify when the binary is on PATH (see environment appendix).
BARE_OS_VAULT_MULTISIG_CONTINUITY_JSON	Merged into hyper_multisig_trust_pointer.json (schema 2) as vaultMultisigContinuity — operator-owned continuity sketch only.
BARE_OS_VAULT_MULTISIG_CONTINUITY_AUDIT_NDJSON	When 1 / true, login / unlock appends a vault.multisig_continuity_login_sketch audit row (public-key hex prefix only).
Boot policy	extensionSignerPinsV2…V5 pin extension signers; see OTA and bundles. Multisig is an identity layer above bundle trust.

When to enable

Use multisig operator flows when the host integrates Holepunch multisig tooling and documents pointer emission for your fleet — see OTA and bundles and identity handbook.