位于vault.sliccy.ai的独立起点保险库。它保存SLICC七的封闭秘密、OAuth令牌以及模型和MCP凭证，确保任何值都无法到达模型提供者。设计为slicc-agent-plan中的secrets-tokens-design.md（修订版4）。此README是构建内容的规范。

• 构建： 密钥存储、记录、起源命名空间、带可选通行密钥或密码锁的自动解锁、嵌入 API 及其 page 和 agent 角色、页面的 put、seal、remove、restore、cancel 和 lock]，清除状态，锁定按钮及其弹窗，经过验证的策略（规则，[exec]、[exits]、[limits]）、注入器和带有响应清除（S1）的 forward， 代理的 redact、redactStream、endpoints、model 和 mcp（S3， S4）、records、grant 和 refresh]，型号和 MCP 拒绝，执行工单（[materialize 和 materializeConsume]）、sessionMaterialize 用于内核验证的 TLS 会话、import]（备份、KeePass、6 的“秘密”。

slicc-vault

The separate-origin vault at vault.sliccy.ai. It holds the sealed secrets, OAuth tokens, and model and MCP credentials of SLICC seven, so that no value ever reaches the model provider. The design is secrets-tokens-design.md (revision 4) in slicc-agent-plan. This README is the spec of what is built.

• Built: the key store, records, origin namespacing, auto-unlock with an optional passkey or passphrase lock, the embedding API with its page and agent roles, the page’s put, seal, remove, restore, cancel and lock, the scrub state, the lock button and its popup, the attested policy (rules, [exec], [exits], [limits]), the injector and forward with the response scrub (S1), the agent’s redact, redactStream, endpoints, model and mcp (S3, S4), records, grant and refresh, the model and MCP refusal, exec tickets (materialize and materializeConsume), sessionMaterialize for kernel-verified TLS sessions, import (backups, KeePass, six’s secrets.env) and export, sign-in tokens with their grants and refresh through egress, and the vault side of the /dev/sealed ops seal, placeholder, list, test, request, status, cancel and materialize.
• The vault has no network stack. It never fetches anything but its own config.json and embedders.json: bios sends every request the vault prepares.

Documents and hosting

The build (npm run build) writes a flat static tree to dist/site/:

The bundles hold this repo’s code, @ai-ecoverse/slicc-scrub, and @ai-ecoverse/jerk-oauth (exact-pinned, for token refresh): its wasm is inlined into a separate chunk under chunks/ (about 970 KB) that loads only on the first refresh or MCP grant, never fetched. The only third-party code is for KeePass imports: kdbxweb (with @xmldom/xmldom and fflate) and hash-wasm’s argon2, exact-pinned and bundled into a separate chunk under chunks/ that the core frame loads only when a KeePass import starts; its wasm is inlined, never fetched. The sliccy-ai Worker serves the tree from the network on every load, never from OPFS, with:

• Content-Security-Policy with script-src 'self', no inline scripts or styles, and frame-ancestors listing the seven origins;