Reasonably Good Token Vault (RGTV)

Important

Current status — read before using RGTV is alpha. It is not yet safe for production. See Known unsafe for production below and .machine_readable/6a2/STATE.a2ml for the authoritative critical-next-actions list. This repo was previously branded as a general-purpose post-quantum password manager ("Svalinn Vault"). That project was abandoned. The shipping code is not post-quantum, not formally verified, and not a password manager. What it is is described below.

1. What RGTV is

A credential-passing broker for LLM agents. When an autonomous agent needs an API token, it asks RGTV for a grant — a 16-byte opaque UUID. The agent passes the grant to the destination service via a trusted wrapper; the wrapper redeems the grant for the real token and uses it on the agent’s behalf. The agent itself never sees the token value.

The motivating threat: an LLM that has processed a raw credential string has potentially leaked it — to logs, context-window dumps, fine-tuning corpora, crash reports, or downstream caches. Opaque grants confine that exposure.

2. What RGTV is not

• Not a SOPS / age / Hashicorp Vault replacement. Those encrypt secrets at rest in files or a persistent store. RGTV passes live tokens over HTTP between a trusted operator’s environment and a trusted wrapper. Different problem, different design.

• Not post-quantum secure. No Kyber, no Dilithium, no lattice-based cryptography anywhere in the shipping code.

• Not formally verified. Zero Idris2 proofs, zero Lean4, zero ECHIDNA quorum. The working crates have zero automated tests today.

• Not a password manager for humans.

3. Architecture

Three crates, each independently buildable:

Component	Role
vault-broker/	Rust axum HTTP server (#![forbid(unsafe_code)]). Holds hint → Zeroizing<String> in-process. Used for local development and as a Fly.io spot-test backend. Not suitable for multi-tenant production.
vault-worker/	Cloudflare Workers WASM (crate-type = ["cdylib"], workers-rs 0.8). Issues grants and redeems them exactly once. Concurrency-safety comes from Cloudflare Durable Objects: KV has no atomic read+delete, so grants live in a DO instance where the single-threaded runtime serialises the check-and-delete. Credential values live in a CF KV namespace populated out-of-band by an operator.
rgtv-cli/	The rgtv binary. Sync ureq client for the broker/worker. Zeroizing on redeemed values so the secret is scrubbed from the CLI’s heap on drop.

Full design rationale is in EXPLAINME.adoc. The ADRs live in .machine_readable/6a2/META.a2ml.

4. Known unsafe for production

This is the current truth. `STATE.a2ml’s critical-next-actions list is authoritative; items below are the ones blocking production use.

1. Plaintext credentials in Cloudflare KV. The CREDENTIALS KV namespace stores token values unencrypted at rest. Anyone with KV-read access on the Cloudflare account can exfiltrate every credential. Fix: AES-256-GCM envelope encryption keyed by a Worker Secret.

2. Single shared bearer token for all agents. Every consumer authenticates to the broker with the same RGTV_AGENT_TOKEN. Compromise of any one consumer recovers every credential in the vault. Per-agent tokens plus a revocation list are needed before multi-consumer production use.

3. No audit log. Grants and redemptions are emitted only to tracing stderr. No durable record, no VeriSimDB feed, no alerting hook.

4. No rate limiting. A stolen agent token has no per-client rate cap.

5. Math.random() UUIDs in the Worker. vault-worker generates grant IDs via the WASM uuid crate’s fallback RNG, which reduces to Math.random() in Workers. That is not cryptographically secure. Grant IDs must be generated via crypto.getRandomValues before production use.

6. Zero tests. No unit tests, no integration tests, no fuzz, no property tests. The six minimum-viable test cases (grant→redeem round-trip, double-redeem → 410, expired → 410, wrong token → 401, unknown hint → 404, concurrent-redeem race) must all pass before shipping.

7. .expect("TODO") in live request handlers. vault-broker has Mutex::lock().expect() calls in endpoints. A poisoned mutex will panic the server. These must convert to fail-closed 500 responses.

Until these land, use SOPS+age for secrets-at-rest and keep RGTV as a dev-only tool.

5. Quickstart

Local broker, in-memory only:

just broker-run
# in another shell:
just cli-grant-create HINT=GITHUB_TOKEN
just cli-grant-redeem GRANT_ID=<uuid from above>

Cloudflare Worker, with a CF account configured:

# one-time: populate a credential value into KV (never commits it to git)
just worker-cred-put HINT=GITHUB_TOKEN VALUE=<real-token>

# deploy:
just worker-deploy

Full details in EXPLAINME.adoc.

6. License

This project is licensed under the Mozilla Public License, v. 2.0. See the LICENSE file for details.

SPDX-License-Identifier: CC-BY-SA-4.0

7. Contributing

See CONTRIBUTING.adoc. Security issues: see SECURITY.adoc.