TECHNICAL NOTE TN-001 / IOS VAULT

Senvra vault architecture

Implementation invariants for storage, authenticated identity, crash consistency, recovery, bounded decryption, and process authority.

INV-01 / AMBIGUITY NEVER AUTHORIZES DELETION INV-02 / FILESYSTEM PATH IS NOT OBJECT IDENTITY INV-03 / COMMIT PHASE PRECEDES IRREVERSIBLE ACTION INV-04 / CAPTURE AUTHORITY CANNOT READ HISTORY

THE PREMISE

System scope and failure assumptions

AES-GCM provides confidentiality and authentication. Storage must also prove ownership, commit order, recovery authority, and bounded plaintext lifetime.

The model assumes termination at any instruction, torn metadata, valid-ciphertext replay, partial cross-directory operations, and unavailable catalogs. Unproven states fail closed and retain recovery evidence.

01 / CIPHERTEXT IDENTITY

THREAT / VALID CIPHERTEXT REPLAYED IN A DIFFERENT CONTEXT

Authenticated object identity

Authentication proves bytes were sealed by a key, not that chunk 12 belongs to this item, metadata to this object, or a wrapped key to this role.

THE SHORTCUT

Encrypt, name the file, trust the path.

Swap a valid encrypted blob and cryptography may still accept it. The path has silently become the security model.

SENVRA'S CONSTRAINT

Identity enters the authentication equation.

Item ID, chunk index, and role enter domain-separated AAD. Any contextual move fails authentication.

KEY GRAPH / PASSWORD SPACE

Compromise is contained by ownership boundaries.

CryptoBox.swift

UNLOCK MATERIAL Password or 32-byte access key

DERIVATION PBKDF2-SHA256 600,000 iterations + per-space salt

SPACE SCOPE Master key wrapped at rest; cleared on background

ITEM SCOPE 256-bit data key one encrypted media object

MEDIA AES-256-GCM AAD = itemID + chunkIndex

METADATA Separate domain AAD = itemID + metadata role

CAPTURE KEY Curve25519 wrapping private half sealed by master key

Changing a chunk index, envelope owner, or metadata role breaks authentication.

SWAP CHUNK 4 → 7 Tag verification fails.

MOVE METADATA → ANOTHER ITEM Item identity no longer matches.

REUSE CAPTURE KEY → HISTORY Decrypt authority is absent.

02 / CRASH CONSISTENCY

FAILURE / PROCESS TERMINATION AT ANY MOVE PHASE

Crash-consistent cross-space moves

A cross-space move changes ownership domains. If the app dies between target publication and source deletion, a boolean cannot identify the authoritative copy.

THE COMMIT POINT IS DATA

Phase is persisted before irreversible work. Recovery resumes from evidence already on disk.

CROSS-SPACE MOVE / DURABLE STATE MACHINE

There is no point where both copies are disposable.

VaultStore.swift

PHASE 01 Persist journal copying

PHASE 02 Re-encrypt staging .moving-<itemID>

PHASE 03 Authenticate target manifest + chunks

COMMIT POINT Advance journal deletingSource

PHASE 05 Publish target staging → final

PHASE 06 Delete source then clear journal

KILLED BEFORE COMMIT Source remains authoritative.

Incomplete target staging is rolled back.

KILLED AFTER COMMIT Target publication is completed.

Source deletion is reconciled only after target evidence exists.

Current and previous journals survive replacement. Contradictory evidence is a hard error, never permission to delete both sides.

03 / EVIDENCE-DRIVEN RECOVERY

FAILURE / PRIMARY CATALOG TORN, MISSING, OR STALE

Evidence-driven catalog recovery

Trusting one config lets a torn write hide every healthy object. Senvra reconstructs from independent witnesses only when they agree.

Recovery is not “pick the newest.” A catalog must agree with descriptors, receipts, digests, and credential anchors.

STARTUP RECOVERY / INDEPENDENT WITNESSES

The catalog is reconstructed from agreement, not optimism.

VaultStore.loadConfiguration()

PRIMARY Current catalog schema + descriptor digests

FALLBACK Previous catalog validated before restoration

SPACE WITNESS Descriptor evidence snapshots + commit receipts

KEYCHAIN WITNESS Credential anchors revision + key-material digest

VALIDATE Cross-check independent evidence

STAGE Write pending recovery catalog

COMMIT Publish only after validation

The same witnesses reconcile interrupted recordings, deletions, moves, descriptor loss, and catalog recovery. Disagreement stops execution.

FAIL-CLOSED RULE Ambiguity preserves evidence.

A failed recovery may block access. It never cleans up the only good copy.

04 / BOUNDED EXPOSURE

EXPOSURE / WHOLE-FILE PLAINTEXT CREATED FOR PARTIAL READ

Authenticated range decryption

Whole-file export turns playback into another plaintext store. Senvra authenticates bounded chunks and decrypts only requested ranges, without a complete temporary copy.

MEDIA OBJECT / AUTHENTICATED RANGE READ

Every chunk carries identity, order, and integrity.

ChunkedMediaCryptor.swift

MANIFEST Wrapped item key chunk count plaintext byte counts encrypted metadata

CHUNK 0000 8 MiB max nonce · ciphertext · tag

CHUNK 0001 8 MiB max nonce · ciphertext · tag

RANGE READ … open only intersecting chunks

CHUNK 00NN bounded tail nonce · ciphertext · tag

LAYOUT CHECK GCM TAG CHECK BYTE COUNT CHECK SHA-256 CHECK

A range read authenticates selected chunks, checks plaintext lengths, and returns only requested bytes. Missing, extra, reordered, or truncated chunks fail.

LOCKED CAPTURE

Write authority without read authority.

The capture surface gets only a Curve25519 public key. It can wrap a new media key, but cannot open history.

05 / PHYSICAL PRIVACY BOUNDARY

BOUNDARY / NETWORK-CAPABLE CODE INSIDE THE VAULT PROCESS

Process-level network isolation

A privacy toggle is policy; removing URLSession, WebView, local-network declarations, and network entitlements is architecture. Support hands off explicitly to the system browser.

NETWORK BOUNDARY / PROCESS OWNERSHIP

The support surface never enters the vault process.

Info.plist + entitlements

SENVRA APP PROCESS Local vault + App Group

No URLSession
No WKWebView
No local-network declaration
Entitlements: App Group only

VISIBLE USER ACTION UIApplication.open email parameter only

SYSTEM BROWSER PROCESS Support website

Separate origin and storage
No vault keys or media access
Conversation token stays in headers

Source, Info.plist, and entitlements expose this boundary. Browser Support can network; the vault process cannot inherit that capability.

VERIFICATION MATRIX

Verification status and unverified scope

Credibility depends on falsifiable checks. We publish the evidence and its boundary.

RECORDED 136 / 136

Simulator unit and integration baseline

Covers cryptographic envelopes, storage state machines, recovery paths, and app behavior in the recorded candidate.

ENFORCED SEC-GATE

Release source and entitlement gate

Rejects network clients and endpoints, debug instrumentation, unauthorized entitlements, and privacy-manifest drift.

NOT CLAIMED DEVICE

Destructive physical-device proof

Real SIGKILL, OOM, power-loss, low-storage, Data Protection, long recording, and signed extension behavior still require device evidence.

NOT CLAIMED EXT-AUDIT

Independent security certification

No third-party cryptographic review, penetration test, or certification is claimed.

FAIL-CLOSED CONDITION

If evidence cannot identify one authoritative state, execution stops and retains every recovery candidate.