it; the seal here defends against a stolen database, not against the person who

holds the key.

Amended 2026-08-25 (issue #193). The asymmetry this contract carried is closed.

`voice_transcript_items.content` used to rest as plaintext beside the sealed

audio, so a stolen database got the words either way and the seal on the audio

moved nothing. The transcript is now sealed too, under `OpenAgents.ContentVault`

and its own key, along with `voice_sessions.compaction_summary`. Both are read

through the schema — `OpenAgents.Voice.TranscriptItem.text/1` and

`OpenAgents.Voice.Session.compaction_summary/1` — so no reader reaches the

words by touching a field. What is unchanged is the boundary: these seals are

under a key the operator holds, so they defend against a stolen database and

not against the operator, exactly as the paragraph above says of the audio. The

same words still rest in `messages.content`, which carries a generated

`search_vector` and cannot be sealed without ending lexical recall; that is

recorded in `EXIT-006` and in `docs/2026-08-25-encryption-at-rest.md` rather

than implied here.

Evidence: `OpenAgents.Voice.Recordings`, `OpenAgents.Voice.Recording`,

`OpenAgents.Voice.RecordingChunk`, `OpenAgents.Voice.RecordingVault`, the

`OpenAgents.Voice.RecordingChunk`, `OpenAgents.Voice.RecordingVault`,

`OpenAgents.ContentVault`, `OpenAgents.Voice.TranscriptItem`, the

`create_voice_recordings` migration, `OpenAgentsWeb.VoiceRecordingController`,

`assets/js/voice_recording.mjs`, `OpenAgents.Voice.RecordingsTest`,

`OpenAgentsWeb.VoiceRecordingControllerTest`, `assets/test/voice_recording_test.mjs`,

Status: Current

The application holds three hand-rolled encryption vaults —

The application holds four hand-rolled encryption vaults —

`OpenAgents.Accounts.TokenVault` for GitHub access tokens,

`OpenAgents.Machines.TokenVault` for computer tokens awaiting pairing claim,

and `OpenAgents.Voice.RecordingVault` for call audio — and each seals under

its own configured key. Rotating one vault's key never makes another vault's

`OpenAgents.Voice.RecordingVault` for call audio, and `OpenAgents.ContentVault`

for private text nobody searches — and each seals under its own configured

key. Rotating one vault's key never makes another vault's

records unreadable or unverifiable, because no vault reads another vault's

key to seal. A vault whose own key is absent fails with a typed configuration

error at its boundary rather than silently borrowing key material that

keyring rewrap; the pairing vault's own rotation loses at most one ten-minute

window of unclaimed pairings, which retry; the recording vault has no keyring,

so rotating its key strands prior recordings — a bounded, recorded loss, not a

silent one.

silent one. The content vault has no keyring either, so rotating

`CONTENT_ENCRYPTION_KEY` strands every column it seals, together. That is the

price of one vault over several columns rather than one per column, and it is

paid deliberately: the separation that carries weight is credential from

content, and splitting the content columns from each other would buy a finer

blast radius at the cost of one production secret per column while every one of

them stays readable to the same operator through the same application.

The content vault is required rather than optional. `RuntimeConfig.validate/1`

refuses a staging or production boot without its key, because the alternative

is a node that accepts a voice transcript, a compaction summary, a preference

observation, or a project note and then cannot seal it. There is deliberately

no bridge to another vault's key of the kind `config/runtime.exs` still offers

the pairing vault: that bridge is what #192 found and #253 repeated, and a

vault added after both should not reintroduce it.

Amended 2026-08-25 (issue #193). `OpenAgents.Forge.AtRest.sealed_columns/0`

names the column each of these three vaults seals, and

`test/openagents/forge/at_rest_test.exs` reads each column back with raw SQL

after a real write, so "sealed" is checked against PostgreSQL rather than

against the vault's own unit tests. A fourth vault would have to appear there

before `EXIT-006` could count it.

names the column each vault seals, and `test/openagents/forge/at_rest_test.exs`

reads each column back with raw SQL after a real write, so "sealed" is checked

against PostgreSQL rather than against the vault's own unit tests.

Amended 2026-08-25 (issue #193, second pass). The fourth vault is

`OpenAgents.ContentVault`, and it seals content rather than credentials:

`voice_transcript_items.content`, `voice_sessions.compaction_summary`,

`preference_observations.summary`, and `project_notes.body`. Its seals carry

the column and the row identity as additional authenticated data, so ciphertext

lifted from one row or one column does not open as another's sentence. The

plaintext columns those replaced survive one more release, empty, because

dropping a live column mid-roll breaks the nodes still writing into it; the

contract migration removes them the way `machine_pairings.user_id` was removed

a release after its last reader.

Evidence: `OpenAgents.Machines.TokenVault`, `OpenAgents.Accounts.TokenVault`,

`OpenAgents.Voice.RecordingVault`, `OpenAgents.Forge.AtRest`,

`OpenAgents.Voice.RecordingVault`, `OpenAgents.ContentVault`,

`OpenAgents.Forge.AtRest`,

`OpenAgents.RuntimeConfig.validate/1`,

`config/runtime.exs`, `test/openagents/machines/token_vault_test.exs`,

`test/openagents/accounts/token_vault_test.exs`,

`test/openagents/forge/at_rest_test.exs`, and

`test/openagents/forge/at_rest_test.exs`,

`test/openagents/forge/key_rotation_test.exs`, and

`test/openagents/runtime_config_test.exs`.

### RELEASE-003 — Every published hostname can establish LiveView

Amended 2026-08-25 (issue #193). The decision about which columns stop being

server-readable is recorded in `docs/2026-08-25-encryption-at-rest.md` with its

threat model, the cost to an account under an account-held key, and five

rejected options. No content column is encrypted, and the reason is that an

operator-held key protects a stolen dump and nothing else — the claim `EXIT-006`

exists to keep off this page — while an account-held key ends search,

rendering, and the `TRANSPARENCY-001` projections, and makes key loss permanent.

The published key set did not change, so `STATUS-001` has nothing to move.

threat model, the cost to an account under an account-held key, and the options

rejected. The published key set did not change, so `STATUS-001` has nothing to

move.

Amended 2026-08-25 (issue #193, second pass). Four content columns are now

sealed under `OpenAgents.ContentVault` — the voice transcript, the in-call

compaction summary, the preference observation, and the project note — and the

reason is narrower than "encryption at rest": each is read whole and searched

by nothing, so a seal costs no feature. That is the whole test applied. The

columns left in plaintext are left because a query reads them in a way a seal

would end: `messages.content` carries a `search_vector` PostgreSQL generates

from it, `issues.body`, `comments.body`, and `forum_posts.body_text` are

matched with `ILIKE`, and the two `account_chat_runs` columns hold the same

words that rest verbatim in `account_chat_events.payload` beside them, where

the replay path reads them structurally. `plaintext_private_columns/0` now

carries that reason per column, so the ledger records why a gap is open rather

than only that it is.

`encrypted_at_rest` is still `false`, and sealing four columns did not move it,

which is the point. The boolean is `true` only when no private column rests as

plaintext, and `operator_reads_source` is its negation, so this change cannot

be read as protection from the operator: these seals are under a key the

operator holds and defend against a stolen dump. `EXIT-006` exists to keep the

larger claim off the page, and it still does.

Amended 2026-08-24 (issue #178). The decision that a private export can be

encrypted to a key the operator does not hold is recorded in

  github_token_decryption_keys: %{},

  machine_token_encryption_key: nil,

  voice_recording_encryption_key: nil,

  content_encryption_key: nil,

  inference_proxy_url: nil,

  inference_grant_max_total_tokens: 2_000_000,

  inference_grant_max_calls: 64,

       System.get_env("MACHINE_TOKEN_ENCRYPTION_KEY") ||

         Base.encode64("openagents-dev-machine-vault-key")

# The voice recording vault and the content vault, each with its own key for

# the same reason. Sealing the audio under one key and the words under another

# is the whole point of VAULT-001: neither opens the other.

config :openagents,

       :voice_recording_encryption_key,

       System.get_env("VOICE_RECORDING_ENCRYPTION_KEY") ||

         Base.encode64("openagents-dev-recording-vaultkey")

config :openagents,

       :content_encryption_key,

       System.get_env("CONTENT_ENCRYPTION_KEY") ||

         Base.encode64("openagents-dev-content-vault-key3")

# For development, we disable any cache and enable

# debugging and code reloading.

#

    voice: voice,

    voice_recording: voice_recording,

    voice_recording_encryption_key: optional_text.("VOICE_RECORDING_ENCRYPTION_KEY"),

    # The content vault's own key. VAULT-001 forbids the bridge that #192

    # found and #253 repeated, so there is deliberately no fallback here: an

    # unset key is an unset key, and RuntimeConfig refuses the boot.

    content_encryption_key: optional_text.("CONTENT_ENCRYPTION_KEY"),

    voice_recovery_worker_enabled: voice_enabled,

    voice_retention_worker_enabled: voice_retention_enabled,

    voice_retention_enabled: voice_retention_enabled,

config :openagents, :voice_recording_encryption_key, Base.encode64(:crypto.strong_rand_bytes(32))

# The content vault's own key, generated per run and shared with nothing.

# VAULT-001: a recording key must not open a transcript, and neither opens a

# GitHub token.

config :openagents, :content_encryption_key, Base.encode64(:crypto.strong_rand_bytes(32))

config :openagents, :voice_recording,

  enabled: true,

  timeslice_ms: 5_000,

**Issue:** #193

**Parent:** #94

**Companion:** `docs/2026-08-24-private-export-encryption.md`

**Revised:** 2026-08-25, second pass. Section 8 records what changed and why

the first pass's answer was narrower than the question.

#178 asked whether a private export can be encrypted to a key the operator does

not hold. It can, and is. That decision deliberately left the other half open,

already here would trade a proven property for a familiar name.

**Seal `voice_transcript_items.content` alone, since the audio beside it is

sealed.** Rejected, and it was the closest call. The asymmetry is real, but the

sealed.** Rejected in the first pass, and it was the closest call. **Overturned

in section 8** — the reasoning below proves the seal does not close the *threat*

while `messages.content` is searchable, which is true, and then wrongly

concludes that it is not worth doing. The asymmetry is real, but the

same words rest in `messages.content`, which is searched. Sealing one and not

the other would move a number without moving the threat model, which is the

failure mode this whole document is written against. It is recorded in section

## 7. What is still open

- **Content columns are plaintext, and the operator reads them.** That is the

  decision, not a gap in it. #193 stays open because the acceptance criteria

  say it does: encryption did not land, and `/status` keeps publishing `false`.

Sections 1 through 6 are the first pass and are kept as written. Section 8

revises them: four content columns are sealed now, and the list below is

narrower than it was. Read section 8 for the current state.

- **Some content columns are plaintext, and the operator reads them.** Section

  8.2 names each one and the query that keeps it readable. `/status` keeps

  publishing `encrypted_at_rest: false` while any of them remains, which is the

  outcome `EXIT-006` exists to produce.

- **No operator read is audited.** `ADMIN-001`. An access log the operator

  writes into the operator's own database is evidence to the operator and to

  nobody else; #151 and #168 carry the external anchor.

- **The transcript/audio asymmetry.** Section 4. Recorded, not closed.

## 8. Second pass: seal everything a seal costs nothing

The first pass above answered "should content be encrypted?" with a threat

model, and the threat model said an operator-held key protects a stolen dump

and nothing else. That is still true, and nothing below claims otherwise. But

it answered a question nobody had to ask as one question, when it is two:

1. **Should content stop being server-readable?** That needs an account-held

   key, it ends search and rendering, and key loss becomes permanent. Section 4

   still stands, and nobody has asked for it.

2. **Should content that nothing reads still rest readable in a stolen dump?**

   No. A seal that costs no feature is worth having even when it only defends

   against theft, and "it does not defend against the operator" is an argument

   for not *claiming* more, not for leaving plaintext on disk.

The first pass collapsed the two and answered only the first. The owner's

decision is the second: **encrypt as much as we can.** What follows is what

that turned out to mean.

### 8.1 The test that decides each column

A column is sealed when nothing reads it except whole. A column stays plaintext

when a query reads it in a way a seal would end — and the query is named, so

the reason is checkable rather than asserted.

That is the entire test. It is not about how sensitive the words are; it is

about whether encryption costs a working feature. `INVARIANTS.md` preamble is

the reason it is written this way: a gap left open needs a reason a reader can

falsify.

### 8.2 The inventory, from `information_schema`

Every `text`, `varchar`, and `bytea` column whose name carries content-shaped

vocabulary — `body`, `content`, `text`, `transcript`, `message`, `prompt`,

`summary`, `description`, `note`, `payload`, `data` — was listed from the

catalog rather than from memory. Of 972 text-shaped columns, 38 matched, and

most of those are digests, enum-ish kinds, or public metadata. The private

content columns, and what happened to each:

**Sealed under `OpenAgents.ContentVault`:**

| Column | Readers | Why a seal costs nothing |

| --- | --- | --- |

| `voice_transcript_items.content` | one: `OpenAgents.Timeline`, whole then truncated | no index, no predicate, no export path |

| `voice_sessions.compaction_summary` | none — written, held in process state, purged | never read back from PostgreSQL at all |

| `preference_observations.summary` | none — hashed into `evidence_digest` at write | the digest commits to the words; the column is not read |

| `project_notes.body` | REST JSON and the project page, whole | no predicate, no index; rendering decrypts |

**Left plaintext, with the query that keeps it there:**

| Column | What reads it |

| --- | --- |

| `messages.content` | a `search_vector` PostgreSQL *generates* from this column, indexed `USING GIN`, driving `OpenAgents.Memory.LexicalRecall`. Sealing it ends lexical recall over your own history. This is the one the owner named, and it is the one that cannot move. |

| `issues.body` | `OpenAgents.Issues.search/2` and `OpenAgents.Issues.TaskReferences`, both `ILIKE` |

| `comments.body` | `OpenAgents.Issues.TaskReferences`, `ILIKE` |

| `forum_posts.body_text` | `OpenAgents.Forum.search/2`, `ILIKE` |

| `account_chat_runs.user_content` | nothing searches it — but the same words rest verbatim in `account_chat_events.payload`, which the replay path reads structurally. Sealing the text column alone moves the plaintext eight inches sideways. |

| `account_chat_runs.assistant_content` | the same, plus the `completion` map beside it |

**Not private content**, so out of scope rather than left: digests

(`content_digest`, `payload_digest`), enum-ish kinds (`content_kind`,

`transcript_kind`, `data_type`), token counters, public repository and project

descriptions, published changelog and incident summaries, and

`verified_artifact_listings.owner_description`, which is marketplace copy the

listing exists to publish.

`account_chat_runs` is the honest disappointment here. It is real private

conversation, nothing searches it, and it is still plaintext — because the

duplicate beside it is jsonb the streaming replay path reads by key, and

sealing that is its own change with its own decisions about what stays

structured. `plaintext_private_columns/0` carries that reason, so it is a

tracked gap rather than a silence.

### 8.3 One vault, four columns, its own key

`OpenAgents.ContentVault` is the fourth vault. AES-256-GCM, versioned framing,

and additional authenticated data naming the column and the row, so ciphertext

lifted out of one row does not open as another's sentence.

It is one vault over four columns rather than four vaults. `VAULT-001`'s

property is that no vault reads another vault's key, and that holds: this vault

reads `:content_encryption_key` and nothing else, with no bridge of the kind

`config/runtime.exs` still offers the pairing vault — the bridge #192 found and

#253 repeated. What one-vault-per-column would buy is a finer rotation blast

radius, at the price of one production secret per column, for columns that are

all readable to the same operator through the same application. The cost is

recorded instead: rotating this key strands all four columns together.

The key is **required**, not optional. Without it a transcript, a summary, an

observation, and a note each refuse to be written rather than being written

readable, so `RuntimeConfig.validate/1` refuses a staging or production boot

without it. `cloak_ecto` is still rejected, for the reason section 5 gives.

### 8.4 Expand and contract, because the fleet rolls

Each column got a sibling `*_ciphertext` column, a backfill that seals every

existing row and nulls the plaintext, and a `_present` check constraint so "this

row has text" stays true while both halves are live. The plaintext columns are

still declared and still read as a fallback, because `RELEASE-006`'s rolling

replacement leaves nodes on the previous release writing into them. They are

dropped by a contract migration a release later, the way

`machine_pairings.user_id` was.

Two limits, recorded rather than implied:

- **Dead tuples.** `UPDATE ... SET content = NULL` writes a new row version and

  leaves the old one on disk until autovacuum reclaims it. The plaintext

  survives in dead tuples for a bounded window after the backfill.

- **The roll window.** A node still running the previous release writes

  plaintext for as long as the replacement takes. Those rows are readable until

  the contract migration, which is why the fallback reader exists.

### 8.5 What the status page says now

`encrypted_at_rest` is still `false`, and sealing four columns did not move it.

That is the design working. The boolean is `true` only when *no* private column

rests as plaintext, and `operator_reads_source` is its negation, so this change

cannot be mistaken for protection from the operator. `EXIT-006` exists to keep

that claim off the page, and it still does.

### 8.6 Proof

`test/openagents/forge/at_rest_test.exs` gained a `describe` block that, for

each sealed column, writes through the application path a person reaches and

then asks PostgreSQL two questions with raw SQL: is the ciphertext column free

of the words, and is the plaintext column it replaced empty. The second is the

one a round-trip test cannot ask — a schema that seals on write and opens on

read passes a round trip whether or not anything reached disk.

`test/openagents/forge/key_rotation_test.exs` adds the two questions #253 is

about: another vault's rotation must not reach sealed content, and this vault's

own rotation must strand it rather than falling back to a keyring it does not

have.

The population still comes from `information_schema`. `content_ciphertext`,

`summary_ciphertext`, `compaction_summary_ciphertext`, and `body_ciphertext`

all match the secret-shaped pattern on `cipher`, so each had to be classified

before the proof would go green — the same mechanism that catches a plaintext

token column now catches an unclassified ciphertext one.

# Ox Alpha Stress Test & High-Throughput Token Benchmark Log

Date: 2026-08-25

Status: In Progress

Author: OpenAgents Coder & Christopher David

## 1. Objectives & Context

As discussed in Episode 275 ("Parallelizing Ox Alpha Stress Testing"), the objective is to determine the maximum sustainable tokens per second (TPS) and parallel capacity of `stealth/ox-alpha` across available providers (OpenRouter, OpenCode Zen, Nous Portal, Venice) without degrading into rate limit errors (`429`), quota exhaustion, or merge conflicts.

Initial findings are collected and logged here before running live backlog burns on video.

---

## 2. Benchmark & Concurrency Ladder Run Receipts

### Baseline Probe (Concurrency = 2)

- **Model / Lane:** `ox-alpha` (via OpenAgents inference proxy -> OpenRouter `stealth/ox-alpha`)

- **Task:** 300-word architectural analysis of swarm scaling & token economics

- **Result:**

  - 2 of 2 workers completed cleanly.

  - Per-worker generation latency: ~18-22s.

  - Estimated output generation: ~800 tokens/worker (including hidden reasoning).

  - Effective aggregate generation rate: ~75–90 tokens/sec across 2 lanes.

  - HTTP status: 200 OK (no 429s).

### Concurrency Ladder Step 1 (Concurrency = 4)

- **Model / Lane:** `ox-alpha`

- **Task:** 250-word scaling analysis on generation ceilings, prompt caching, and throughput bottlenecks

- **Result:**

  - 4 of 4 workers completed concurrently without dropouts.

  - System load: 4.47 (16 idle CPU threads available, memory clean).

  - Effective aggregate generation rate: ~160–190 tokens/sec across 4 lanes.

  - Error rate: 0.0% (0 / 4 failed).

---

## 3. Key Lessons Learned & Bottleneck Hierarchy

1. **Output Generation vs. TPM/Context Prefill:**

   - Single-agent output decode rate sits comfortably around 20–30 TPS.

   - The primary bottleneck in agentic loops is **input token volume and TPM ceilings**, not output decode speed. A 50k-token repository context re-sent across 4 agents consumes 200k input tokens per step, rapidly hitting Free-tier TPM ceilings (e.g., Nous Free tier observed at 500k TPM = max 2–3 active heavy workers).

2. **Prompt Caching is Mandatory for Fan-Out:**

   - 80–90% of prefix data (system prompts, tool definitions, file headers) is static across sibling workers.

   - Seeding workers with shared context prefixes ensures cache hits, minimizing time-to-first-token (TTFT) and saving API quota.

3. **Rate Limits & Provider Topologies:**

   - **OpenRouter:** Free model pool has a documented 20 RPM limit, plus daily request quotas (50/day before $10 lifetime credit; 1,000/day after).

   - **Nous Portal:** Observed 50 RPM / 500K TPM on Free plan; paid tiers scale up to 1,600 RPM / 16M TPM.

   - **OpenCode Zen (`x-preview-f-free`):** Free Ox Alpha endpoint can be subject to upstream availability (`503` under load).

4. **Next Step for Cloud Computers / Box Infrastructure:**

   - To scale past 8 concurrent agents safely on complex repositories, tasks must be isolated to separate git worktrees or cloud sandbox containers (Box / Cloud Computer leases) to avoid workspace lock contention and serial merge bottlenecks.

---

## 4. Next Ladder Steps Planned

- [x] Concurrency 2: Verified (~80 TPS)

- [x] Concurrency 4: Verified (~180 TPS)

- [ ] Concurrency 8: Test short burst synthesis across 8 workers

- [ ] Concurrency 15: Maximum planned fan-out test with Box/worktree isolation

## 5. Box / Cloud Computer Fleet Integration Plan

### Architecture & Current Substrate

The backend in `openagents.com` already holds the complete Box runtime and delegation primitives:

1. **Core Client & Fleet (`OpenAgents.Box`, `OpenAgents.Box.Fleet`, `OpenAgents.Box.Fanout`):**

   - Implements bounded multi-box allocation with labels, queues, and cost ceilings (Issue #109).

   - Manages active box caps per conversation (default 2, budgeted grant up to 10/15).

2. **Durable Runs (`OpenAgents.BoxRuns`):**

   - Asynchronously runs OpenCode / Coder commands on remote sandboxes (Issue #107) with resumption and bounded output tailing.

3. **Forge Issue Assignment (`OpenAgents.Forge.Assignments`):**

   - Delivers short-lived, branch-scoped credentials to a box container (Issue #108) so a remote OpenCode harness can clone, implement, run checks, and push a branch.

4. **Unified Delegation Layer (`OpenAgents.Delegations`):**

   - Provides a single seam across local harnesses and remote Box targets (`target_type: "box"`).

### Next Steps for Fan-Out Execution

1. **Bridge Coder Session with Box Fleet Fan-out:**

   - File a dedicated issue in Project 6 to wire `openagents coder` delegation directly to the remote Box fan-out controller (`POST /api/v1/conversations/:id/boxes/fanout` and `POST /api/v1/delegations/dispatch`).

2. **Execute Multi-Box Ox Alpha Run:**

   - Request 4-8 cloud boxes in parallel, dispatching OpenCode with `stealth/ox-alpha` against distinct backlog issues.

   - Collect and compare end-to-end cloud latency, TPS, and receipt delivery against local runs.

### Concurrency Ladder Step 2 (Concurrency = 8)

- **Model / Lane:** `ox-alpha` (8 parallel child coding agents)

- **Task:** Prompt caching optimization and TTFT reduction analysis under multi-tenant load

- **Result:**

  - 8 of 8 children completed concurrently with zero dropouts.

  - Per-child generation: ~750–1,200 tokens (output + reasoning).

  - Effective aggregate generation rate: **~350–410 tokens/sec** across 8 parallel streams.

  - Machine state: Load average 4.75, memory healthy, zero HTTP 429s or rate limit errors.

  - Error rate: 0.0% (0 / 8 failed).

| Providers | `OPENAGENTS_INFERENCE_PROXY_URL` | HTTPS URL without credentials when computers are enabled; empty disables |

| Computers | `OPENAGENTS_MACHINE_TOKEN_TTL_SECONDS` | `300` through `2592000`; Gate 5 uses the 30-day maximum |

| Recording | `VOICE_RECORDING_ENCRYPTION_KEY` | Base64-encoded 32-byte key when recording is enabled; empty disables recording storage |

| Content | `CONTENT_ENCRYPTION_KEY` | Base64-encoded 32-byte key, required in staging and production. The content vault seals voice transcripts, in-call compaction summaries, preference observations, and project notes. It is the vault's own key: nothing bridges to it and nothing bridges from it (VAULT-001), so an unset value refuses the boot rather than borrowing another vault's key |

`PHX_SERVER` is optional for evaluation commands. If set, it must be exactly

`true` or `false`.

| `MACHINE_TOKEN_ENCRYPTION_KEY` | `openagents-staging-machine-vault-active` | web, fleet | Scheduled vault rotation or suspected exposure; rotation strands at most one ten-minute window of unclaimed pairings (VAULT-001). Until this secret exists, `config/runtime.exs` bridges the machine pairing vault to `GITHUB_TOKEN_ENCRYPTION_KEY` |

| `OPENAI_API_KEY` | `openagents-staging-openai-api-key` | web, fleet | Provider rotation or suspected prompt/log exposure |

| `VOICE_RECORDING_ENCRYPTION_KEY` | `openagents-staging-voice-recording-key` | web and fleet when recording is admitted | Scheduled recording-key procedure or suspected exposure |

| `CONTENT_ENCRYPTION_KEY` | `openagents-staging-content-vault-active` | web, fleet, migrator | Scheduled vault rotation or suspected exposure; the content vault has no keyring, so rotation strands every sealed voice transcript, compaction summary, preference observation, and project note (VAULT-001) |

| `OPENAGENTS_FORGE_OPERATOR_TOKEN` | `openagents-staging-forge-operator-token` | web, fleet, builder | Scheduled rotation, builder replacement, or suspected URL/argv/log exposure |

| `RELEASE_COOKIE` | `openagents-staging-release-cookie` | web, fleet, deployer | Fleet-wide coordinated rotation or suspected exposure |

| Connected Codex account slot 1 | `openagents-staging-scv-codex-operator-1` | web and fleet may add and read versions; an isolated Codex SCV runtime may read one exact version | Operator disconnect, OpenAI reauthentication, or suspected exposure |

    "openagents-staging-github-vault-previous",

    "openagents-staging-openai-api-key",

    "openagents-staging-voice-recording-key",

    "openagents-staging-content-vault-active",

    "openagents-staging-forge-operator-token",

    "openagents-staging-release-cookie",

    "openagents-staging-scv-codex-operator-1",

    "openagents-staging-github-vault-previous",

    "openagents-staging-openai-api-key",

    "openagents-staging-voice-recording-key",

    "openagents-staging-content-vault-active",

    "openagents-staging-forge-operator-token",

    "openagents-staging-release-cookie"

  ])

mkdir -p /run/openagents

fetch_secret "$runtime_secret" /run/openagents/runtime.env

if grep -Eq '^(DATABASE_URL|SECRET_KEY_BASE|GITHUB_CLIENT_SECRET|GITHUB_TOKEN_ENCRYPTION_KEY|GITHUB_TOKEN_DECRYPTION_KEYS_JSON|OPENAI_API_KEY|VOICE_RECORDING_ENCRYPTION_KEY|OPENAGENTS_FORGE_OPERATOR_TOKEN|RELEASE_COOKIE)=' /run/openagents/runtime.env; then

if grep -Eq '^(DATABASE_URL|SECRET_KEY_BASE|GITHUB_CLIENT_SECRET|GITHUB_TOKEN_ENCRYPTION_KEY|GITHUB_TOKEN_DECRYPTION_KEYS_JSON|OPENAI_API_KEY|VOICE_RECORDING_ENCRYPTION_KEY|CONTENT_ENCRYPTION_KEY|OPENAGENTS_FORGE_OPERATOR_TOKEN|RELEASE_COOKIE)=' /run/openagents/runtime.env; then

  echo "Fleet configuration must not duplicate named secrets" >&2

  exit 1

fi

append_secret GITHUB_TOKEN_DECRYPTION_KEYS_JSON openagents-staging-github-vault-previous /run/openagents/runtime.env

append_secret OPENAI_API_KEY openagents-staging-openai-api-key /run/openagents/runtime.env

append_secret VOICE_RECORDING_ENCRYPTION_KEY openagents-staging-voice-recording-key /run/openagents/runtime.env

append_secret CONTENT_ENCRYPTION_KEY openagents-staging-content-vault-active /run/openagents/runtime.env

append_secret OPENAGENTS_FORGE_OPERATOR_TOKEN openagents-staging-forge-operator-token /run/openagents/runtime.env

append_secret RELEASE_COOKIE openagents-staging-release-cookie /run/openagents/runtime.env

  use Application

  require Logger

  @impl true

  def start(_type, _args) do

    case Application.get_env(:openagents, :runtime_role, :web) do

    _program_catalog = OpenAgents.ProgramArtifacts.install!()

    :ok = OpenAgents.Voice.Config.validate_boot!()

    unless OpenAgents.ContentVault.configured?() do

      Logger.warning(

        "OpenAgents.ContentVault is not configured: :content_encryption_key is missing or not a 32-byte base64-encoded key. " <>

          "Writing sealed transcript, project note, observation, or session summary content will fail."

      )

    end

    # Build and install the tool catalog; this snapshot is passed to the

    # embedding warmer and the turn supervisor below.

    tool_modules =

defmodule OpenAgents.ContentVault do

  @moduledoc """

  AES-256-GCM sealing for private text that nobody searches.

  The three vaults that came before this one each seal a credential or a

  recording. This one seals *content*: sentences a person wrote or spoke that

  rest in PostgreSQL and that no query reads except whole. Issue #193 asked

  which columns those are, and

  `docs/2026-08-25-encryption-at-rest.md` names every one that is sealed here

  and every one that is not, with the query that keeps it plaintext.

  ## Its own key, and one key for this whole domain

  `VAULT-001` binds the property that rotating one vault's key never unreads

  another vault's records. This vault reads `:content_encryption_key` and

  nothing else — no fallback to the GitHub keyring, no bridge to the recording

  key. Issue #253 is what that bridge costs.

  It is one vault over several columns rather than one vault per column, and

  that is a decision rather than an omission. The separation that carries

  weight is credential from content: a stolen GitHub token key must not open a

  conversation, and a conversation key must not open a token. Splitting the

  content columns from each other would buy a finer rotation blast radius at

  the price of one production secret per column, and every column here is

  readable by the same operator through the same application anyway. Rotating

  this key strands every column it seals, together, which is the cost recorded

  in `VAULT-001`'s rotation posture.

  ## What the seal is bound to

  Every seal carries additional authenticated data naming the column it belongs

  to and the row's own identity, so ciphertext cannot be lifted from one row

  into another, or from one column into another, and still open. `scope/0`

  values are the table and column; `binding` is whatever identifies the row

  immutably — usually its natural key.

  ## What it does not do

  It seals under a key the operator holds, so it defends against a stolen dump,

  a stolen backup, and a stolen disk. It does not defend against the operator,

  and `EXIT-006` keeps `encrypted_at_rest` from claiming otherwise: the

  disclosure stays `false` while any private column rests as plaintext, and

  `operator_reads_source` stays `true` regardless.

  """

  @version 1

  @nonce_bytes 12

  @tag_bytes 16

  # Large enough for the longest column this vault seals: a 20,000-character

  # project note, whose Ecto bound counts graphemes rather than bytes.

  @maximum_content_bytes 131_072

  @aad_prefix "openagents.content.v1:"

  @typedoc "The table and column a seal belongs to."

  @type scope :: String.t()

  @typedoc "The row identity a seal is bound to, in a fixed order."

  @type binding :: [String.t() | integer()]

  @doc "Whether this vault holds its own key."

  @spec configured?() :: boolean()

  def configured?, do: match?({:ok, _key}, key())

  @doc """

  Seals `content` for one column and one row.

  `scope` names the column, `binding` names the row. Both travel as

  authenticated data rather than as ciphertext, so opening a value under the

  wrong column or the wrong row fails instead of succeeding quietly.

  """

  @spec seal(String.t(), scope(), binding()) :: {:ok, binary()} | {:error, atom()}

  def seal(content, scope, binding)

      when is_binary(content) and byte_size(content) in 1..@maximum_content_bytes do

    with {:ok, aad} <- aad(scope, binding),

         {:ok, key} <- key() do

      nonce = :crypto.strong_rand_bytes(@nonce_bytes)

      {ciphertext, tag} =

        :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, content, aad, true)

      {:ok, <<@version, nonce::binary, tag::binary, ciphertext::binary>>}

    end

  end

  def seal(_content, _scope, _binding), do: {:error, :invalid_content}

  @doc "Opens a sealed value, refusing one bound to another column or row."

  @spec open(binary(), scope(), binding()) :: {:ok, String.t()} | {:error, atom()}

  def open(

        <<@version, nonce::binary-size(@nonce_bytes), tag::binary-size(@tag_bytes),

          ciphertext::binary>>,

        scope,

        binding

      ) do

    with {:ok, aad} <- aad(scope, binding),

         {:ok, key} <- key() do

      case :crypto.crypto_one_time_aead(:aes_256_gcm, key, nonce, ciphertext, aad, tag, false) do

        content when is_binary(content) -> {:ok, content}

        :error -> {:error, :content_unsealable}

      end

    end

  end

  def open(_sealed, _scope, _binding), do: {:error, :content_unsealable}

  @doc """

  The plaintext, or `nil` when there is no seal to open.

  Readers render a missing sentence rather than crashing a page: a rotated key

  strands prior content, which `VAULT-001` records as this vault's rotation

  cost, and a crash there would take a whole timeline or project down with it.

  """

  @spec text(binary() | nil, scope(), binding()) :: String.t() | nil

  def text(nil, _scope, _binding), do: nil

  def text(sealed, scope, binding) when is_binary(sealed) do

    case open(sealed, scope, binding) do

      {:ok, content} -> content

      {:error, _reason} -> nil

    end

  end

  @doc "The largest value this vault seals."

  @spec maximum_content_bytes() :: pos_integer()

  def maximum_content_bytes, do: @maximum_content_bytes

  @doc "How many bytes sealing adds to a value, for a column's own bound."

  @spec overhead_bytes() :: pos_integer()

  def overhead_bytes, do: 1 + @nonce_bytes + @tag_bytes

  defp aad(scope, binding) when is_binary(scope) and is_list(binding) do

    if binding == [] or Enum.any?(binding, &is_nil/1) do

      {:error, :invalid_content_binding}

    else

      {:ok, @aad_prefix <> scope <> ":" <> Enum.map_join(binding, ":", &to_string/1)}

    end

  end

  defp aad(_scope, _binding), do: {:error, :invalid_content_binding}

  defp key do

    with encoded when is_binary(encoded) <-

           Application.get_env(:openagents, :content_encryption_key),

         {:ok, key} when byte_size(key) == 32 <- Base.decode64(encoded) do

      {:ok, key}

    else

      _missing -> {:error, :content_vault_not_configured}

    end

  end

end

  `plaintext_private_columns/0` names columns that hold private, user-authored

  content and rest as plaintext. Its entries are proven plaintext by reading

  the raw column back through SQL, so the list cannot claim a gap that closed.

  the raw column back through SQL, so the list cannot claim a gap that closed,

  and each carries the query that keeps it readable — a column is left in

  plaintext because something reads it in a way a seal would end, never because

  nobody got to it.

  `encrypted_at_rest?/0` is the boolean `EXIT-006` publishes, and it is now

  derived: the private store is encrypted at rest exactly when no private

          holds: String.t()

        }

  @typedoc "One private column that rests as plaintext."

  @type plaintext :: %{table: String.t(), column: String.t(), holds: String.t()}

  @typedoc "One private column that rests as plaintext, and why it still does."

  @type plaintext :: %{

          table: String.t(),

          column: String.t(),

          holds: String.t(),

          reason: String.t()

        }

  # The regular expression the proof hands to `information_schema` to build the

  # population it checks this module against. It lives here so the module and

      column: "data",

      vault: OpenAgents.Voice.RecordingVault,

      holds: "one slice of uploaded call audio"

    },

    %{

      table: "voice_transcript_items",

      column: "content_ciphertext",

      vault: OpenAgents.ContentVault,

      holds: "the voice conversation record VOICE-012 calls authority"

    },

    %{

      table: "voice_sessions",

      column: "compaction_summary_ciphertext",

      vault: OpenAgents.ContentVault,

      holds: "one in-call compaction summary"

    },

    %{

      table: "preference_observations",

      column: "summary_ciphertext",

      vault: OpenAgents.ContentVault,

      holds: "private evidence proposing a behavior preference"

    },

    %{

      table: "project_notes",

      column: "body_ciphertext",

      vault: OpenAgents.ContentVault,

      holds: "project discussion and activity"

    }

  ]

  # `false`, which is where it already is; a column named here that turns out

  # to be sealed turns the proof red. Both failures understate the store.

  @plaintext_private [

    %{table: "messages", column: "content", holds: "conversation messages"},

    %{

      table: "voice_transcript_items",

      table: "messages",

      column: "content",

      holds: "the voice conversation record VOICE-012 calls authority"

      holds: "conversation messages",

      reason:

        "a generated `search_vector` is computed from this column inside PostgreSQL " <>

          "and indexed with GIN; sealing it ends lexical recall over your own history"

    },

    %{

      table: "issues",

      column: "body",

      holds: "issue bodies",

      reason:

        "`OpenAgents.Issues.search/2` and `OpenAgents.Issues.TaskReferences` match it " <>

          "with `ILIKE`; sealing it ends issue search and cross-references"

    },

    %{table: "issues", column: "body", holds: "issue bodies"},

    %{table: "comments", column: "body", holds: "issue and pull request comments"}

    %{

      table: "comments",

      column: "body",

      holds: "issue and pull request comments",

      reason: "`OpenAgents.Issues.TaskReferences` matches it with `ILIKE`"

    },

    %{

      table: "forum_posts",

      column: "body_text",

      holds: "forum replies",

      reason: "`OpenAgents.Forum.search/2` matches it with `ILIKE`"

    },

    %{

      table: "account_chat_runs",

      column: "user_content",

      holds: "what an account typed into the chat console",

      reason:

        "the same words rest verbatim in `account_chat_events.payload`, which the " <>

          "replay path reads structurally; sealing one and not the other moves nothing"

    },

    %{

      table: "account_chat_runs",

      column: "assistant_content",

      holds: "what the model replied in the chat console",

      reason:

        "the same words rest in the `text_delta` events and in the `completion` map " <>

          "beside it, for the same reason"

    }

  ]

  # Every column the catalog reports under `secret_shaped_pattern/0`. The proof

    {"users", "github_token_ciphertext"} => :sealed,

    {"machine_pairings", "token_ciphertext"} => :sealed,

    # Private content, sealed under the content vault's own key (issue #193).

    {"preference_observations", "summary_ciphertext"} => :sealed,

    {"project_notes", "body_ciphertext"} => :sealed,

    {"voice_sessions", "compaction_summary_ciphertext"} => :sealed,

    {"voice_transcript_items", "content_ciphertext"} => :sealed,

    # One-way SHA-256 of a bearer credential, unique-indexed because it is the

    # lookup key. Nothing reverses these, so nothing seals them.

    {"agent_tokens", "token_digest"} => :digest,

  use Ecto.Schema

  import Ecto.Changeset

  alias OpenAgents.ContentVault

  @scope "preference_observations.summary"

  @primary_key {:id, :binary_id, autogenerate: true}

  @foreign_key_type :binary_id

  @timestamps_opts [type: :utc_datetime_usec, updated_at: false]

    belongs_to :owner, OpenAgents.Conversations.Visitor, foreign_key: :owner_visitor_id

    belongs_to :source_message, OpenAgents.Conversations.Message

    field :source_kind, :string

    field :summary, :string

    field :summary, :string, redact: true

    field :summary_ciphertext, :binary, redact: true

    field :evidence_digest, :string

    field :confidence_millis, :integer

    field :observed_at, :utc_datetime_usec

    |> validate_number(:policy_version, greater_than: 0)

    |> validate_format(:evidence_digest, ~r/\A[0-9a-f]{64}\z/)

    |> validate_format(:proposer_digest, ~r/\A[0-9a-f]{64}\z/)

    |> seal_summary()

    |> foreign_key_constraint(:owner_visitor_id)

    |> foreign_key_constraint(:source_message_id)

  end

  @doc "The column this schema's sealed summary belongs to."

  @spec scope() :: String.t()

  def scope, do: @scope

  @doc """

  The observation summary, opened from the seal.

  Falls back to the plaintext column for a row an un-replaced node wrote during

  a rolling replacement.

  """

  @spec summary(%__MODULE__{}) :: String.t() | nil

  def summary(%__MODULE__{summary_ciphertext: sealed} = observation) when is_binary(sealed),

    do: ContentVault.text(sealed, @scope, seal_binding(observation))

  def summary(%__MODULE__{summary: summary}), do: summary

  @doc "The row identity a sealed summary is bound to."

  @spec seal_binding(%__MODULE__{}) :: ContentVault.binding()

  def seal_binding(%__MODULE__{} = observation),

    do: [observation.owner_visitor_id, observation.evidence_digest]

  # The summary is hashed into `evidence_digest` before this runs, so sealing

  # it changes nothing about what the digest commits to -- only about what

  # rests readable beside it.

  defp seal_summary(%Ecto.Changeset{valid?: true} = changeset) do

    binding = [

      get_field(changeset, :owner_visitor_id),

      get_field(changeset, :evidence_digest)

    ]

    case ContentVault.seal(get_change(changeset, :summary), @scope, binding) do

      {:ok, sealed} ->

        changeset

        |> put_change(:summary_ciphertext, sealed)

        |> force_change(:summary, nil)

      {:error, reason} ->

        add_error(changeset, :summary, "cannot be sealed", reason: reason)

    end

  end

  defp seal_summary(changeset), do: changeset

end

  use Ecto.Schema

  import Ecto.Changeset

  alias OpenAgents.ContentVault

  alias OpenAgents.Projects.Project

  alias OpenAgents.Repositories.Repository

  @kinds ["note", "activity"]

  @scope "project_notes.body"

  @doc "The note kinds, discussion first."

  def kinds, do: @kinds

  schema "project_notes" do

    field :body, :string

    field :body, :string, redact: true

    field :body_ciphertext, :binary, redact: true

    field :kind, :string, default: "note"

    field :author, :map

    note

    |> cast(attrs, [:body, :kind, :author, :project_id, :repository_id, :author_user_id])

    |> update_change(:body, &trim/1)

    |> validate_required([:body, :kind, :project_id, :repository_id])

    |> validate_required([:kind, :project_id, :repository_id])

    |> validate_body_present()

    |> validate_inclusion(:kind, @kinds)

    |> validate_length(:body, max: 20_000)

    |> seal_body()

    |> foreign_key_constraint(:project_id)

    |> foreign_key_constraint(:repository_id)

    |> foreign_key_constraint(:author_user_id)

    |> check_constraint(:kind, name: :project_notes_kind_check)

  end

  @doc "The column this schema's sealed body belongs to."

  @spec scope() :: String.t()

  def scope, do: @scope

  @doc """

  The note body, opened from the seal.

  Falls back to the plaintext column for a row an un-replaced node wrote during

  a rolling replacement, and returns `nil` when neither can be read so a

  project page renders one missing note rather than failing whole.

  """

  @spec text(%__MODULE__{}) :: String.t() | nil

  def text(%__MODULE__{body_ciphertext: sealed} = note) when is_binary(sealed),

    do: ContentVault.text(sealed, @scope, seal_binding(note))

  def text(%__MODULE__{body: body}), do: body

  @doc """

  The row identity a sealed body is bound to.

  The primary key is a sequence, so it does not exist while the insert is

  being built. What does exist, and never changes afterwards, is the note's

  place: an edit rewrites the body, never the project, the repository, or the

  kind. Binding to those is what stops a sealed note from being lifted into

  another project and still opening.

  """

  @spec seal_binding(%__MODULE__{}) :: ContentVault.binding()

  def seal_binding(%__MODULE__{} = note), do: [note.project_id, note.repository_id, note.kind]

  # An edit that changes only the kind or the author leaves `body` unchanged,

  # and the stored plaintext is now `nil` because the body rests sealed. So

  # "a note has a body" is asked of both halves rather than of the column the

  # contract migration is going to drop.

  defp validate_body_present(changeset) do

    if get_field(changeset, :body) || get_field(changeset, :body_ciphertext),

      do: changeset,

      else: add_error(changeset, :body, "can't be blank", validation: :required)

  end

  defp seal_body(%Ecto.Changeset{valid?: true} = changeset) do

    case get_change(changeset, :body) do

      nil ->

        changeset

      body ->

        binding = [

          get_field(changeset, :project_id),

          get_field(changeset, :repository_id),

          get_field(changeset, :kind)

        ]

        case ContentVault.seal(body, @scope, binding) do

          {:ok, sealed} ->