# openalice-vault

> Soul Vault: security-critical identity custodian — sealed, versioned, crypto-shreddable identity bundles with owner-scoped RLS.

## At a glance
| field | value |
|---|---|
| kind | `service` |
| priority | `—` |
| default branch | `mvp` |
| last activity | 2026-06-17T17:02:55+00:00 |
| features catalogued | **2** |
| runtime deps declared | **1** |

## Env drift

**Code reads, manifest omits (11):**
- `DATABASE_URL`
- `INTERNAL_SECRET`
- `OA_SECRETS_MASTER_KEY`
- `OPENALICE_ENV`
- `OPENALICE_VAULT_MODE`
- `SHARED_JWT_SECRET`
- `VAULT_PORT`
- `VAULT_RATE_LIMIT_PER_MINUTE`
- `VAULT_RLS_ENFORCE`
- `VAULT_SIGNING_KEY_PATH`
- `VAULT_STORE_DIR`

## Features (2)

### vault/crate
- **`vault.crate.identity-custodian`** — Rust/Axum service (port 3992) that seals, versions, and crypto-shreds per-owner *identities* — NOT a generic secrets store. Each identity is a signed, content-addressed bundle (manifest + encrypted blob), wrapped by a per-identity Data Encryption Key (DEK) that itself is KEK-wrapped. Crypto shred = drop the wrapped DEK → the blob is permanently unreadable. Owner isolation is enforced by Postgres Row-Level Security keyed on `app.owner_id` (see [`db`]); the app role MUST be NOSUPERUSER NOBYPASSRLS for FORCE RLS to bite (applied at boot via `VAULT_RLS_ENFORCE`). M1.1 ships the COMPILING skeleton: HTTP wire surface (health + 501-stub identity routes), the owner-scoped DB/RLS plumbing, and the schema. The crypto / bundle / store / audit / consent / api modules are STUBS — Tycho implements them in M1.2+.  
  *src/lib.rs:3*

### vault/middleware
- **`vault.middleware.rate-limit`** — Per-owner token-bucket rate limiter on /v1/identities/* (default 600 req/min ≈ 10 RPS, overridable via VAULT_RATE_LIMIT_PER_MINUTE). Guards against a runaway agent loop abusing a single owner's bearer while staying invisible to normal interactive use. Provided by openalice-axum-common::rate_limit. default-rpm: 600 Routes are split into: * `/health`            — Traefik liveness probe. * `/metrics`           — Prometheus scrape. * `/v1/identities/*`   — owner-facing identity lifecycle (create, seal, versions, export, crypto-shred). M1.1: 501 stubs (see `router`). The identity handlers (crypto/store/audit-backed) land in M1.2+; for now they stub-respond 501 so the wire surface + RLS scaffold ship first.  
  *src/main.rs:3*

---

*Generated by [openalice-atlas](https://atlas.blal.pro) — single source of truth for the openalicelabs ecosystem.*