docs(specs): vault-tier-3-architecture-v0 prebuild (#178 + #180) #337

Merged

pdurlej merged 1 commit from claude/vault-tier-3-architecture-v0-prebuild into main

2026-05-23 10:30:57 +02:00

claude commented

2026-05-17 18:19:18 +02:00

Collaborator

Summary

Combined prebuild for #178 (Włóczykij curated vault) + #180 (IronKey Keypad 200C Tier 2 hardware). #180 supersedes #178 architecturally — IronKey is canonical Tier 2 storage.

BATCH G prebuild 3/4. Independent from siblings.

3-tier privacy architecture

Tier	Path	Agent access	Forcing function
0	`Iskra-i-Piotr/*` collaborative subset	Per ADR-0010 capabilities.yaml	none
1	`Iskra-i-Piotr/{Journal,Finance,Family,Health}`	Path-denylisted	none
2	`/Volumes/IRONKEY/Włóczykij/*`	Local-admin LLM ONLY (gemma-3, M1)	Physical USB + PIN

What's in

docs/specs/vault-tier-3-architecture-v0/ — 4-file Spec Kit
prompts/codex-vault-tier-3-architecture.md — execution prompt

Slice order

E (Full, FIRST): ADR draft + operator decision on Tier 2 backup policy
A (Full, canary 3+3): capabilities.yaml with vault_roots
B (Lite): one-way sync script Tier 0 → Tier 2
C (Lite): IronKey mount runbook
D (Full, canary 3+3): local-admin LLM Tier 2 reader gatekeeper

Constitution principles (P1-P8)

Safety by physical separation not filter / 3 tiers never 4 / hardware root of trust / default-deny allowlist-explicit / one-way sync / local-admin LLM only Tier 2 reader / tier-aware backup policy / ADR-0018 conformance.

Hardware on-hand

Kingston IronKey Keypad 200C (16GB, AES-256 XTS, FIPS 140-3 Level 3 Pending) — Black Friday Nov 2025 per IMG_9781.HEIC.

Tier: Trivial per ADR-0007.

Refs #178 #180 #177 #237 #64

## Summary Combined prebuild for #178 (Włóczykij curated vault) + #180 (IronKey Keypad 200C Tier 2 hardware). #180 supersedes #178 architecturally — IronKey is canonical Tier 2 storage. BATCH G prebuild 3/4. Independent from siblings. ## 3-tier privacy architecture | Tier | Path | Agent access | Forcing function | |---|---|---|---| | 0 | `Iskra-i-Piotr/*` collaborative subset | Per ADR-0010 capabilities.yaml | none | | 1 | `Iskra-i-Piotr/{Journal,Finance,Family,Health}` | Path-denylisted | none | | 2 | `/Volumes/IRONKEY/Włóczykij/*` | Local-admin LLM ONLY (gemma-3, M1) | Physical USB + PIN | ## What's in - `docs/specs/vault-tier-3-architecture-v0/` — 4-file Spec Kit - `prompts/codex-vault-tier-3-architecture.md` — execution prompt ## Slice order - **E** (Full, FIRST): ADR draft + operator decision on Tier 2 backup policy - **A** (Full, canary 3+3): `capabilities.yaml` with `vault_roots` - **B** (Lite): one-way sync script Tier 0 → Tier 2 - **C** (Lite): IronKey mount runbook - **D** (Full, canary 3+3): local-admin LLM Tier 2 reader gatekeeper ## Constitution principles (P1-P8) Safety by physical separation not filter / 3 tiers never 4 / hardware root of trust / default-deny allowlist-explicit / one-way sync / local-admin LLM only Tier 2 reader / tier-aware backup policy / ADR-0018 conformance. ## Hardware on-hand Kingston IronKey Keypad 200C (16GB, AES-256 XTS, FIPS 140-3 Level 3 Pending) — Black Friday Nov 2025 per IMG_9781.HEIC. Tier: Trivial per ADR-0007. Refs #178 #180 #177 #237 #64

claude added 1 commit

2026-05-17 18:19:18 +02:00

docs(specs): vault-tier-3-architecture-v0 prebuild (#178 + #180 )

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 14s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 20s

Details

672df0b5d1

Combines #178 (Włóczykij second-tier curated vault) and #180 (IronKey
Keypad 200C Tier 2 hardware) into single Spec Kit. #180 supersedes
#178 architecturally — IronKey is canonical Tier 2 storage.

3-tier privacy architecture, physical separation primary:
- Tier 0 (collaborative): Iskra-i-Piotr/* subset, agents allowed
- Tier 1 (operator-on-disk): Journal/Finance/Family/Health, path-denylisted
- Tier 2 (operator-on-physical-key): /Volumes/IRONKEY/Włóczykij/, local-admin LLM only when mounted

Slice order:
- E (ADR, FIRST): governance anchor + operator decision on Tier 2 backup policy
- A (capabilities.yaml): vault_roots accessible/denylist/tier_2_only_when_mounted
- B (sync script): one-way Tier 0 → Tier 2, filter agentic notes, dry-run
- C (IronKey runbook): mount/PIN/recovery procedures
- D (local-admin reader): gatekeeper for Tier 2, mount check + cousin identity check

Constitution (P1-P8): safety by physical separation not filter, three tiers
never four, hardware root of trust, default-deny allowlist-explicit,
one-way sync, local-admin LLM only Tier 2 reader, tier-aware backup,
ADR-0018 conformance.

Independent from siblings (secrets-pipeline-foundation-v0 #237,
vault-to-infisical-migration-v0 #64, pseudo-anonymization-readlayer-v0 #177).
This is foundation; others compose onto Tier 0 or different surface.

Tier: Trivial per ADR-0007 (Spec Kit + prompt, docs-only).

Refs #178 #180 #177 #237 #64 #142