{
  "description": "🤖 Vault fold vectors — the cross-implementation contract for the Vault app's reducer, INCLUDING the lock layer (docs/locked-vaults.md). The web reducer (web/static/apps/vault.js) and the Go fold (internal/vault) must fold every event_sequence from an empty state to exactly expected_state. States are compared in CANONICAL form: every item/log/keyring field present, \"\" / 0 defaults for absent strings/numbers, keyring null when the vault is unlocked. Access follows THREAD MEMBERSHIP: a lock hands the vault key to each member (`handoffs`, each a `member` wrap sealed to their roster key); a member self-enrols a durable wrap (`vault.enroll`, which drops their `member` handoff by uid); an insider gives a latecomer a handoff (`vault.give`). There is no request/grant. Vectors are the spec: if one side disagrees, fix the implementation, never the vector.",
  "app": "vault",
  "source": "web/static/apps/vault.js (events reducer) + internal/vault/vault.go (Fold)",
  "state_shape": {
    "items": [{ "id": "", "name": "", "value": "", "sealed": "", "kind": "text", "by": "", "byName": "", "at": 0, "updatedBy": "", "updatedByName": "", "updatedAt": 0 }],
    "log": [{ "id": "", "ref": "", "action": "add|change|remove|lock|enroll|give|revoke", "name": "", "by": "", "byName": "", "at": 0 }],
    "keyring": { "v": 1, "pub": "", "wraps": [{ "id": "", "kind": "passkey|keychain|member", "label": "", "uid": "", "credId": "", "wrapped": "" }] }
  },
  "vectors": [
    {
      "name": "plain add, change, remove — items and audit log",
      "event_sequence": [
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "WiFi", "value": "hunter2", "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.change", "id": "s1", "aid": "a2", "value": "hunter3", "uid": "u2", "name": "James", "ts": 2000 },
        { "type": "vault.add", "id": "s2", "aid": "a3", "label": "Door", "value": "0000", "uid": "u1", "name": "Paul", "ts": 3000 },
        { "type": "vault.remove", "id": "s1", "aid": "a4", "uid": "u1", "name": "Paul", "ts": 4000 }
      ],
      "expected_state": {
        "items": [
          { "id": "s2", "name": "Door", "value": "0000", "sealed": "", "kind": "text", "by": "u1", "byName": "Paul", "at": 3000, "updatedBy": "", "updatedByName": "", "updatedAt": 0 }
        ],
        "log": [
          { "id": "a1", "ref": "s1", "action": "add", "name": "WiFi", "by": "u1", "byName": "Paul", "at": 1000 },
          { "id": "a2", "ref": "s1", "action": "change", "name": "WiFi", "by": "u2", "byName": "James", "at": 2000 },
          { "id": "a3", "ref": "s2", "action": "add", "name": "Door", "by": "u1", "byName": "Paul", "at": 3000 },
          { "id": "a4", "ref": "s1", "action": "remove", "name": "WiFi", "by": "u1", "byName": "Paul", "at": 4000 }
        ],
        "keyring": null
      }
    },
    {
      "name": "replays dedupe — a re-folded add changes nothing",
      "note": "addItem keys items by id and log entries by aid, so folding the same event twice (a reconnect catch-up overlapping a snapshot) is a no-op.",
      "event_sequence": [
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "WiFi", "value": "hunter2", "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "WiFi", "value": "hunter2", "uid": "u1", "name": "Paul", "ts": 1000 }
      ],
      "expected_state": {
        "items": [
          { "id": "s1", "name": "WiFi", "value": "hunter2", "sealed": "", "kind": "text", "by": "u1", "byName": "Paul", "at": 1000, "updatedBy": "", "updatedByName": "", "updatedAt": 0 }
        ],
        "log": [
          { "id": "a1", "ref": "s1", "action": "add", "name": "WiFi", "by": "u1", "byName": "Paul", "at": 1000 }
        ],
        "keyring": null
      }
    },
    {
      "name": "malformed adds fold to no-ops",
      "note": "missing id/aid/label, both value+sealed, neither, and empty sealed are all rejected; a remove of an unknown id still logs (the item may have raced away) but touches no items.",
      "event_sequence": [
        { "type": "vault.add", "id": "", "aid": "a1", "label": "X", "value": "v" },
        { "type": "vault.add", "id": "s1", "aid": "", "label": "X", "value": "v" },
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "  ", "value": "v" },
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "X", "value": "v", "sealed": "s" },
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "X" },
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "X", "sealed": "" },
        { "type": "vault.change", "id": "ghost", "aid": "a2", "value": "v" },
        { "type": "vault.remove", "id": "ghost", "aid": "a3", "uid": "u1", "name": "Paul", "ts": 500 }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a3", "ref": "ghost", "action": "remove", "name": "", "by": "u1", "byName": "Paul", "at": 500 }
        ],
        "keyring": null
      }
    },
    {
      "name": "lock seals covered items, keeps uncovered plaintext, hands the key to members, installs the keyring",
      "note": "vault.lock carries the locker's own durable wrap PLUS a `member` handoff per other member (the vault key sealed to their roster key). Both fold into the keyring; the handoff is dropped once that member self-enrols.",
      "event_sequence": [
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "WiFi", "value": "hunter2", "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.add", "id": "s2", "aid": "a2", "label": "Door", "value": "0000", "uid": "u1", "name": "Paul", "ts": 2000 },
        { "type": "vault.lock", "aid": "a3", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "handoffs": [{ "id": "h2", "kind": "member", "uid": "u2", "label": "James", "wrapped": "handoff-james" }], "sealed": { "s1": "sealed-s1" }, "uid": "u1", "name": "Paul", "ts": 3000 }
      ],
      "expected_state": {
        "items": [
          { "id": "s1", "name": "WiFi", "value": "", "sealed": "sealed-s1", "kind": "text", "by": "u1", "byName": "Paul", "at": 1000, "updatedBy": "", "updatedByName": "", "updatedAt": 0 },
          { "id": "s2", "name": "Door", "value": "0000", "sealed": "", "kind": "text", "by": "u1", "byName": "Paul", "at": 2000, "updatedBy": "", "updatedByName": "", "updatedAt": 0 }
        ],
        "log": [
          { "id": "a1", "ref": "s1", "action": "add", "name": "WiFi", "by": "u1", "byName": "Paul", "at": 1000 },
          { "id": "a2", "ref": "s2", "action": "add", "name": "Door", "by": "u1", "byName": "Paul", "at": 2000 },
          { "id": "a3", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 3000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [
            { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" },
            { "id": "h2", "kind": "member", "uid": "u2", "label": "James", "credId": "", "wrapped": "handoff-james" }
          ]
        }
      }
    },
    {
      "name": "lock is one-way; malformed locks fold to no-ops; junk wrap fields and non-member handoffs are dropped",
      "note": "a handoff must be a well-formed `member` wrap — a passkey-kind entry in `handoffs` is dropped, and spare wrap fields never fold in.",
      "event_sequence": [
        { "type": "vault.lock", "aid": "b1", "pub": "", "wrap": { "id": "w0", "kind": "passkey", "wrapped": "x" } },
        { "type": "vault.lock", "aid": "b2", "pub": "p", "wrap": { "id": "w0", "kind": "usb-fob", "wrapped": "x" } },
        { "type": "vault.lock", "aid": "b3", "pub": "p", "wrap": { "id": "w0", "kind": "passkey", "wrapped": "" } },
        { "type": "vault.lock", "aid": "a1", "pub": "first-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1", "evil": "extra" }, "handoffs": [{ "id": "hbad", "kind": "passkey", "uid": "u2", "wrapped": "x" }, { "id": "h2", "kind": "member", "uid": "u2", "label": "James", "wrapped": "handoff-james" }], "sealed": {}, "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.lock", "aid": "a2", "pub": "second-pub", "wrap": { "id": "w2", "kind": "passkey", "label": "Mallory", "credId": "cred-2", "wrapped": "wrap-2" }, "sealed": {}, "uid": "u9", "name": "Mallory", "ts": 2000 }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a1", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 1000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "first-pub",
          "wraps": [
            { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" },
            { "id": "h2", "kind": "member", "uid": "u2", "label": "James", "credId": "", "wrapped": "handoff-james" }
          ]
        }
      }
    },
    {
      "name": "membership: a member self-enrols from their handoff (dropping it), an insider gives a newcomer access, they self-enrol too",
      "note": "the whole no-request flow — lock hands James a key, James turns it into a durable keychain wrap (his `member` handoff drops), Paul gives Carol (who joined later) a handoff, Carol self-enrols a passkey (her handoff drops). enroll drops the enroller's `member` handoff by uid.",
      "event_sequence": [
        { "type": "vault.lock", "aid": "a1", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "handoffs": [{ "id": "h2", "kind": "member", "uid": "u2", "label": "James", "wrapped": "handoff-james" }], "sealed": {}, "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.enroll", "aid": "a2", "wrap": { "id": "w2", "kind": "keychain", "uid": "u2", "label": "James — CLI", "wrapped": "wrap-2" }, "uid": "u2", "name": "James", "ts": 2000 },
        { "type": "vault.give", "aid": "a3", "wrap": { "id": "h3", "kind": "member", "uid": "u3", "label": "Carol", "wrapped": "handoff-carol" }, "uid": "u1", "name": "Paul", "ts": 3000 },
        { "type": "vault.enroll", "aid": "a4", "wrap": { "id": "w3", "kind": "passkey", "uid": "u3", "label": "Carol", "credId": "cred-3", "wrapped": "wrap-3" }, "uid": "u3", "name": "Carol", "ts": 4000 }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a1", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 1000 },
          { "id": "a2", "ref": "", "action": "enroll", "name": "James — CLI", "by": "u2", "byName": "James", "at": 2000 },
          { "id": "a3", "ref": "", "action": "give", "name": "Carol", "by": "u1", "byName": "Paul", "at": 3000 },
          { "id": "a4", "ref": "", "action": "enroll", "name": "Carol", "by": "u3", "byName": "Carol", "at": 4000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [
            { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" },
            { "id": "w2", "kind": "keychain", "uid": "u2", "label": "James — CLI", "credId": "", "wrapped": "wrap-2" },
            { "id": "w3", "kind": "passkey", "uid": "u3", "label": "Carol", "credId": "cred-3", "wrapped": "wrap-3" }
          ]
        }
      }
    },
    {
      "name": "enroll drops only the enroller's own handoff, never another member's",
      "note": "lock hands James (u2) and Carol (u3) a key each; James enrolling drops h2 only — Carol's h3 stays until she enrols.",
      "event_sequence": [
        { "type": "vault.lock", "aid": "a1", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "handoffs": [{ "id": "h2", "kind": "member", "uid": "u2", "label": "James", "wrapped": "hj" }, { "id": "h3", "kind": "member", "uid": "u3", "label": "Carol", "wrapped": "hc" }], "sealed": {}, "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.enroll", "aid": "a2", "wrap": { "id": "w2", "kind": "passkey", "uid": "u2", "label": "James", "credId": "cred-2", "wrapped": "wrap-2" }, "uid": "u2", "name": "James", "ts": 2000 }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a1", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 1000 },
          { "id": "a2", "ref": "", "action": "enroll", "name": "James", "by": "u2", "byName": "James", "at": 2000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [
            { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" },
            { "id": "h3", "kind": "member", "uid": "u3", "label": "Carol", "credId": "", "wrapped": "hc" },
            { "id": "w2", "kind": "passkey", "uid": "u2", "label": "James", "credId": "cred-2", "wrapped": "wrap-2" }
          ]
        }
      }
    },
    {
      "name": "revoke drops a wrap but never the last one",
      "event_sequence": [
        { "type": "vault.lock", "aid": "a1", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "sealed": {}, "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.revoke", "aid": "a2", "wrapId": "w1", "uid": "u1", "name": "Paul", "ts": 2000 },
        { "type": "vault.enroll", "aid": "a3", "wrap": { "id": "w2", "kind": "keychain", "uid": "u1", "label": "Paul — CLI", "wrapped": "wrap-2" }, "uid": "u1", "name": "Paul", "ts": 3000 },
        { "type": "vault.revoke", "aid": "a4", "wrapId": "w1", "uid": "u1", "name": "Paul", "ts": 4000 }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a1", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 1000 },
          { "id": "a3", "ref": "", "action": "enroll", "name": "Paul — CLI", "by": "u1", "byName": "Paul", "at": 3000 },
          { "id": "a4", "ref": "", "action": "revoke", "name": "Paul", "by": "u1", "byName": "Paul", "at": 4000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [{ "id": "w2", "kind": "keychain", "uid": "u1", "label": "Paul — CLI", "credId": "", "wrapped": "wrap-2" }]
        }
      }
    },
    {
      "name": "a legacy recovery wrap folds to a no-op",
      "note": "the passphrase-derived kind:recovery break-glass (#995) was removed 2026-07-25 — recovery is a passkey, never a passphrase. wrapShape rejects the kind, so a historical (or hostile) recovery enroll leaves the keyring untouched.",
      "event_sequence": [
        { "type": "vault.lock", "aid": "a1", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "sealed": {}, "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.enroll", "aid": "a2", "wrap": { "id": "rec", "kind": "recovery", "label": "Recovery key (1Password)", "wrapped": "recov-blob" }, "uid": "u1", "name": "Paul", "ts": 2000 }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a1", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 1000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [{ "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }]
        }
      }
    },
    {
      "name": "junk gives/enrolls fold to no-ops on a locked vault",
      "note": "a give must be a well-formed `member` wrap WITH a uid; an enroll wrap must be durable (never `member`); malformed wraps are rejected by wrapShape.",
      "event_sequence": [
        { "type": "vault.lock", "aid": "a1", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "sealed": {}, "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.give", "aid": "b1", "wrap": { "id": "g1", "kind": "member", "wrapped": "x" } },
        { "type": "vault.give", "aid": "b2", "wrap": { "id": "g2", "kind": "passkey", "uid": "u2", "wrapped": "x" } },
        { "type": "vault.give", "aid": "b3", "wrap": { "id": "", "kind": "member", "uid": "u2", "wrapped": "x" } },
        { "type": "vault.enroll", "aid": "b4", "wrap": { "id": "", "kind": "passkey", "wrapped": "x" } },
        { "type": "vault.enroll", "aid": "b5", "wrap": { "id": "w9", "kind": "member", "uid": "u2", "wrapped": "x" } }
      ],
      "expected_state": {
        "items": [],
        "log": [
          { "id": "a1", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 1000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [{ "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }]
        }
      }
    },
    {
      "name": "keyring events before any lock fold to no-ops",
      "event_sequence": [
        { "type": "vault.enroll", "aid": "a1", "wrap": { "id": "w1", "kind": "passkey", "wrapped": "x" } },
        { "type": "vault.give", "aid": "a2", "wrap": { "id": "g1", "kind": "member", "uid": "u2", "wrapped": "x" } },
        { "type": "vault.revoke", "aid": "a3", "wrapId": "w1" }
      ],
      "expected_state": { "items": [], "log": [], "keyring": null }
    },
    {
      "name": "sealed add on a locked vault; a change carrying sealed replaces stale plaintext",
      "event_sequence": [
        { "type": "vault.add", "id": "s1", "aid": "a1", "label": "WiFi", "value": "hunter2", "uid": "u1", "name": "Paul", "ts": 1000 },
        { "type": "vault.lock", "aid": "a2", "pub": "vault-pub", "wrap": { "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }, "sealed": {}, "uid": "u1", "name": "Paul", "ts": 2000 },
        { "type": "vault.add", "id": "s2", "aid": "a3", "label": "Token", "sealed": "sealed-s2", "uid": "u2", "name": "James", "ts": 3000 },
        { "type": "vault.change", "id": "s1", "aid": "a4", "sealed": "sealed-s1-now", "uid": "u2", "name": "James", "ts": 4000 }
      ],
      "expected_state": {
        "items": [
          { "id": "s1", "name": "WiFi", "value": "", "sealed": "sealed-s1-now", "kind": "text", "by": "u1", "byName": "Paul", "at": 1000, "updatedBy": "u2", "updatedByName": "James", "updatedAt": 4000 },
          { "id": "s2", "name": "Token", "value": "", "sealed": "sealed-s2", "kind": "text", "by": "u2", "byName": "James", "at": 3000, "updatedBy": "", "updatedByName": "", "updatedAt": 0 }
        ],
        "log": [
          { "id": "a1", "ref": "s1", "action": "add", "name": "WiFi", "by": "u1", "byName": "Paul", "at": 1000 },
          { "id": "a2", "ref": "", "action": "lock", "name": "", "by": "u1", "byName": "Paul", "at": 2000 },
          { "id": "a3", "ref": "s2", "action": "add", "name": "Token", "by": "u2", "byName": "James", "at": 3000 },
          { "id": "a4", "ref": "s1", "action": "change", "name": "WiFi", "by": "u2", "byName": "James", "at": 4000 }
        ],
        "keyring": {
          "v": 1,
          "pub": "vault-pub",
          "wraps": [{ "id": "w1", "kind": "passkey", "uid": "u1", "label": "Paul", "credId": "cred-1", "wrapped": "wrap-1" }]
        }
      }
    }
  ]
}