slicc-vault

The separate-origin vault at vault.sliccy.ai. It holds the sealed secrets, OAuth tokens, and model and MCP credentials of SLICC seven, so that no value ever reaches the model provider. The design is secrets-tokens-design.md (revision 4) in slicc-agent-plan. This README is the spec of what is built.

• Built: the key store, records, origin namespacing, auto-unlock with an optional passkey or passphrase lock, the embedding API with its page and agent roles, the page’s put, seal, remove, restore, forgetLease, cancel and lock, the scrub state, the lock button and its popup, the attested policy (rules, [exec], [exits], [limits]), the injector and forward with the response scrub (S1), the agent’s redact, redactStream, endpoints, model and mcp (S3, S4), records, grant and refresh, the model and MCP refusal, exec tickets (materialize and materializeConsume), sessionMaterialize for kernel-verified TLS sessions, import (backups, KeePass, six’s secrets.env) and export, sign-in tokens with their grants and refresh through egress, and the vault side of the /dev/sealed ops seal, placeholder, list, test, request, status, cancel and materialize.
• The vault has no network stack. It never fetches anything but its own config.json and embedders.json: bios sends every request the vault prepares.

Documents and hosting

The build (npm run build) writes a flat static tree to dist/site/:

The bundles hold this repo’s code, @ai-ecoverse/slicc-scrub, and @ai-ecoverse/jerk-oauth (exact-pinned, for token refresh): its wasm is inlined into a separate chunk under chunks/ (about 970 KB) that loads only on the first refresh or MCP grant, never fetched. The only third-party code is for KeePass imports: kdbxweb (with @xmldom/xmldom and fflate) and hash-wasm’s argon2, exact-pinned and bundled into a separate chunk under chunks/ that the core frame loads only when a KeePass import starts; its wasm is inlined, never fetched. The sliccy-ai Worker serves the tree from the network on every load, never from OPFS, with:

• Content-Security-Policy with script-src 'self', no inline scripts or styles, and frame-ancestors listing the seven origins;