nx_vault.nx

nx_vault.nx -- sovereign secrets vault CLI (HashiCorp-Vault-class, bits-up; ZERO third-party dependency). Operator 2026-05-27: "stored like hashicorp vault or something from zero up so you can deploy on the nas easily and powerfully." Composes the substrate's at-rest crypto primitives (nx_password_vault: HKDF-SHA256 key derivation + ChaCha20-Poly1305 AEAD). This file adds the on-disk read/write + the put/get/init/list CLI. SEAL MODEL (auto-unseal, HashiCorp-style): The vault store (NXVLT format) is encrypted at rest under a 32-byte master key derived HKDF(salt, unseal_passphrase). The unseal passphrase lives in a SEPARATE 0600 key file (the "unseal key"). Possession of the encrypted store alone cannot recover secrets. Auto-unseal = the key file is machine-local, so no operator re-entry. THREAT MODEL: disk theft of BOTH files (key + store together) defeats it -- store them on different media for stronger posture, or switch to passphrase-prompt mode (a future flag). USAGE (paths supplied by caller so the binary is $HOME-agnostic): nx_vault init <keypath> <storepath> nx_vault put <keypath> <storepath> <name> <value> nx_vault get <keypath> <storepath> <name> # prints value to stdout nx_vault list <keypath> <storepath> # prints names, one per line File format (big-endian), NXVLT version 1: magic[8]="NXVLT\0\0\1" salt[32] nonce_base[12] n_entries[4] per entry: name_len[2] name[name_len] ct_len[4] ct[ct_len] tag[16] license_tier: ORIGINAL (sovereign; composes RFC 8439 + RFC 5869 prims)