Problem
Developer secrets need strong local protection, while agent workflows introduce authority and disclosure risks a normal password manager does not solve.
Actual state
Production 1.2 is Developer ID signed, notarized, and installed after owner acceptance, with no network entitlement or broker surface. A separately identified pilot, limited to synthetic fixtures, demonstrates one human-approved request workflow without any access to the production vault. Agent access to real secrets is not implemented.
System architecture
A sandboxed SwiftUI app with an in-process, statically linked Rust cryptographic and storage core and no network entitlement. The pilot is a separately signed app, relay, and connector that never links the vault.
Christian's role
Designed the native and Rust boundary and the threat-model direction for narrowly scoped future approvals; directed the signing workflow and security checks, and reviewed and tested the implementation.
Verified evidence
Safety, privacy, and authority boundary
- No agent broker exists for the real vault
- Agents do not receive real vault secrets
- The pilot uses synthetic fixtures only
- Not publicly released
Current limitation
- Attended Touch ID enrollment-change, sleep, and screen-lock checks, a full accessibility review, and deeper fuzzing and fault injection remain open.
Next milestone
Complete the attended Touch ID, sleep, and screen-lock checks.