Alice — manager device · acting
Creates the vault, admits and removes members, encrypts records. Her private keys never leave this panel.
Bob — member device · acting
Trusts nothing: independently verifies the signed chain before accepting any state or key material.
Bob's documents should read byte-for-byte identical to Alice's once decrypted — the server in between never held anything but ciphertext.
What happened — newest first
○Backup enrollment is mandatory and structural: no group operation is reachable until it completes (spec §9.6)
○Zero-knowledge server: stores only ciphertext and non-secret bookkeeping (spec §5.1)
○Membership is a signed hash chain, verified by every client — never trusted from the server (spec §9.1)
○Keys travel only inside per-device sealed envelopes (X25519 + AES-256-GCM) (spec §6)
○New members verifiably inherit the full workspace history (spec §9.7)
○Access is cryptographic, not policy: non-members fail decryption, whatever the server says (spec §13)
○The relay learns no identity, no device key, no action, no membership — every transition is the same shape (spec §5.8, §6.5)
○A removed member is told, by a signed notice only they and the remaining members can open (spec §6.5, §9.3)
○Revocation rotates keys: removed members are cut off from all future data (spec §9.3)