local-first · v0.1

Vault Explorer

Phase IV · V1 — Given an authorized execution plan, how are secrets represented and released without exposing their values to anything? References only: no value field exists in any contract, no backend is connected, no material is ever released here. Inspection-only.

8
Secret references
4
Declared backends
11
Release evaluations
0
Material released
Release eligibility decisions (metadata only — nothing is released)
rel-dev-openaisecret:openai-dev
eligible
rel-stripe-prodsecret:stripe-prod
requires_approvalapproval
rel-cv-dbsecret:creditvector-db
requires_approvalapproval
rel-creativesecret:creative-provider
eligible
rel-webhooksecret:webhook-signing
requires_approvalapproval
rel-cross-productsecret:creditvector-db
deniedapproval
rel-expired-leasesecret:openai-dev
expired
rel-revokedsecret:legacy-revoked
revoked
rel-hsmsecret:hsm-sealed
backend_unavailableapproval
rel-policy-denysecret:openai-dev
policy_mismatch
rel-emergencysecret:emergency-locked
denied

The Universal Vault owns secret custody contracts — identity, classification, scope, versions, rotation, revocation, release eligibility, leases, and value-free audit — as the sole authority. One-Way Secret Law: every layer may carry a SecretRef; none may carry a value, and no value-bearing field exists in any public contract (the structural guarantee), reinforced by a deterministic credential-shape redaction scanner (defense-in-depth). Backends (HashiCorp/AWS/Keychain/…) are declared future adapters — none connected, no SDK imported. Release decisions are eligibility metadata: a decision is not a lease and not permission to execute. Value materialization is owned by the future Broker chain (V3–V4) at the final protected boundary, behind binding Policy allow and V2 Approval.