[ety001]

Part of #381

Summary

Replaces the A0–A5 whole-envelope vault with the per-key hierarchy (handoff R1–R3) and adds real-browser coverage. One PR by design.

R1 — hierarchical V1 envelope, per-key encryption

• Root { version: 1, vaultName, salt, accounts }; each account has owner/active/posting/memo arrays of { iv, ciphertext, note }. Outer account names, roles and notes are public (readable while locked and in backups; all four locales warn that notes must not hold secrets).
• One vault password + shared salt (PBKDF2-SHA256 600k), a fresh random 12-byte IV for every encryption, vault-wide IV uniqueness, AAD unchanged (steem-wallet.vault.v1). No migration layer: the whole-envelope format never shipped.
• Signing takes keyIv + vaultPassword, decrypts only the selected key, zero-fills the KEK and clears the password/WIF in finally; SignResult.locked is always true. No global "all WIFs in memory" state exists.
• Kept from A2–A4: revision/lockEpoch/createdAt CAS, cross-tab hard line, post-merge lock, preMergeBackup delivery, target-first dedupe on (accountName, role, publicKey), failure atomicity, authority pre-check traffic contract, recover_account exclusion, memo never signs, privateKey default.
• Merge authenticates the target with targetPassword (no pre-unlock). Empty-vault rulings: merge into and change-password on a keyless vault are rejected with VAULT_EMPTY (no silent re-key under a typo); unlock and add-key on an empty vault stay allowed.

R2 — key management and notes

• key-management.ts: one sorted, de-duplicated fresh: true accounts query; scans every key_auths entry and compares memo against memo_key; degraded/missing/malformed data fails closed (VAULT_AUTHORITY_UNAVAILABLE). Only account names leave the browser.
• vault-key-manager.tsx / import-key-dialog.tsx: locked browsing of accounts, per-role key counts and notes; two-step add (local WIF check → on-chain verdict → confirm); idempotent duplicates; removal by account + role + IV with a second confirmation; note editing. Sub-threshold and not-on-chain keys may be stored with an explicit warning; the single-key signer still fails closed. WIF lives only in the dialog's transient state and is cleared on success, cancel and unmount.

R3 — identity selection without unlocking

• LoginForm is now a signing-mode dispatcher; the classic form moved verbatim into PrivateKeyLoginForm (insert-only diff, existing login tests unchanged).
• vault-login-form.tsx: two native selects (vault, account) fed by the public directory; default active vault; switching clears the account; stale responses are dropped; empty/no-vault/storage-error states never fall back to PrivateKey.
• auth/setVaultIdentity sets sessionKind: 'vault' and nulls all six key fields. No unlock, no decryption, no /api/auth/challenge|login, no Legacy remembered-key access; vault logout is local-only.
• Embedded re-auth callers (fixedUsername / requiredAuthTypes) show an explicit "not available in Vault Mode yet" notice until A6.

Review

• R1: three-way review (spec / crypto / engineering) → fix round (65bb7d35: empty-vault anchors, restored backup coverage, dead KEK derivation removed, case-variant merge target) → three-way verification (adversarial replays, mutation checks, end-to-end journey).
• R2: focused security/spec review, five P3s folded into R3.
• Integration review on the full branch: spec/acceptance and engineering/e2e passed; the security lane found a P1 — the claim-rewards banner restored the Legacy remembered posting key for a keyless vault session and signed with it. Fixed in 202f7425 (gate on sessionKindOf(auth) !== 'vault', regression test mutation-checked), then a post-fix three-way round passed: fix verification, remaining security items (raw IndexedDB scan after create/add/export/import/merge/change-password shows no WIF, password or KEK; all key consumers fail closed under a vault session; DevTools sanitizer unchanged), full verify + e2e.
• e2e surfaced and fixed one product bug: useSigningMode instances held stale local state after a switch inside the Work Mode modal (300ce8c0, re-read on modal close and tab visibility).

Test plan

• pnpm verify: exit 0 — type-check clean; lint 0 errors (3 pre-existing warnings in untouched files); 145 files / 1528 tests; coverage 84.52% stmts / 75.68% branches / 83.23% funcs / 86.78% lines; production build OK.
• pnpm e2e: 14/14 (smoke 3, wallet-main-flows 4, vault-mode 2, new vault-per-key 5) against real Chromium IndexedDB + Web Crypto.
• node tests/node/vault-wif-real-check.mjs: 9/9.
• Fixture tests/fixtures/vault-development-test-vectors.json is byte-identical to the reviewed source.

Not verified / known limits

• e2e intercepts /api/query/accounts with controlled responses (fixture accounts do not exist on chain); real-RPC verification is left to a dev deployment.
• A6 is out of scope: a vault session cannot sign yet (useActiveSigningKey() is null), and the facade's privateKey backend is not wired. "Decrypt only the selected key" and "scrub before broadcast" are pinned by vault-signer.test.ts, not by e2e.
• Pre-A6 UX gaps (no key exposure): market/proposals login dialogs pass no requiredAuthTypes, so in Vault Mode they offer identity selection and a later order/vote reopens the dialog; transfer-form / delegate-form keep their hard-coded "Not authenticated" text for a vault session.
• Documented residuals: rename leaves a session pointer that self-heals on the next unlock; a failed merge/change-password can leave a non-sensitive session pointer; same-millisecond remove+recreate can still collide until records get a random id; a single corrupted ciphertext makes unlock report VAULT_PASSWORD_INVALID.

docs/AI-driver/09-vault.md is rewritten for the landed design (21 invariants, module map, pitfalls); 02-auth.md and 06-frontend.md are updated for the dispatcher and the vault-session exclusions.