access: the vault delivers a secret sealed to an ephemeral recipient key — and the broker road exists this time

[mmeyerlein]

#307 deleted the two dead vault-broker edges because nothing ever emitted the route. This issue builds the road that should have carried them — with a delivery model that survives our own trace architecture.

Why plain delivery is impossible here: the colony journals every message body (message_log, blob offload). A plaintext credential on a normal message would be journaled forever. So delivery is sealed end-to-end:

• The consumer cell (proxy, llm) generates an ephemeral X25519 keypair per request and sends the public half with its policy-gated request.
• The vault answers with a sealed box (X25519 + XChaCha20-Poly1305 — the same cipher family it already speaks at rest) over the normal reply edge.
• The consumer unseals in RAM only, uses the credential (bearer header), never persists it. Forward secrecy: the ephemeral private half is gone before anyone can read the log.
• No long-lived vault keypair is needed: topology + policy decide who may ask, and the reply rides the established edge — the topology is the authenticity. A vault signature can be retrofitted later.

Scope: the `deliver sealed` vault op (behaviour-changing on a sealed cell → regression lock per the sealed-substrate taxonomy), the broker request path in `invoke` plus the two edges back, the consumer side in the proxy and llm cells, and the migration of the shipped credential knobs onto vault-backed delivery so `.env` shrinks toward the vault passphrase.

Acceptance pin: at no point does a plaintext secret appear in the message_log or in any blob — asserted by test over a full E2E round.

[mmeyerlein]

Implemented on w26-lane3-vault-sealed, 15 commits. Left open on purpose — proxy and web_search are still to come and are carried in docs/roadmap.md with a trigger.

What landed:

• vault.deliver, the sanctioned eighth operation. The requester mints an ephemeral X25519 pair per request and sends the public half through the policy-gated broker; the vault answers with a sealed box (X25519 agreement, HMAC-SHA256 as the KDF, XChaCha20-Poly1305 — the same cipher family as at rest). The vault mints its own ephemeral half per answer, so there is no long-lived vault key and nothing on disk can open an old box. The regression lock on the seven original operations was written and green before the eighth was added.
• The box does not prove who sealed it, deliberately. Authenticity is the topology (the vault answers only params.broker) plus the policy the broker enforced. A signature is addable later as a fourth field without breaking the wire form.
• The broker road is back (access@2.1.0): two edges ./invoke <-> ./vault, this time with a real emitter. A credential is spent like anything else — same four grant checks, same constraints, same usage/grant_events/audit rows. Which credential comes from the grant's cred_ref, never from the payload. avault is hive-internal; the box leaves on the existing ack lane, so the hive's lane contract is unchanged and meclaw-os needed no follow-up.
• The attestation is stricter (vault@1.1.0): a vault whose broker is not wired in stays locked. If the topology stands in for a signature, its absence must not attest.
• First consumer: the llm cell. params.credential_grant_id (optional, immutable) switches the path on; the credential lives in RAM only, never reaches cell.db, and does not survive a sleep. Without the key the cell behaves byte for byte as before — params.api_key stays the fallback. New error_code: credential_pending.
• The pin. A full round through a real colony, and the proof that it was real comes from the mock provider itself: it saw Authorization: Bearer <the seeded secret>. After that, 34 message_log rows and 30 blobs were searched for the value — no hits. A counter-proof test next door asserts that the same search does find a plaintext when one is there, and both branches were verified to go red against a real plaintext.
• One new dependency: x25519-dalek. It is the only one — the AEAD, the KDF input and the random source were already in the tree. cargo deny check licenses is green.
• Deprecated: params.inject_map, the plaintext push at unlock. It puts into the message log exactly what the sealed delivery exists to prevent. Not removed (that would be breaking); it warns per injection and is carried in docs/roadmap.md with a trigger.

Gates: workspace 5345 passed / 0 failed / 9 ignored across 604 suites; clippy -D warnings, cargo fmt --check, both corridor byte gates, the claim and ADR-anchor gates all green.

Two findings this strand made and did not fix, because each is a decision rather than a patch: #427 (a vault inside a sealed hive cannot be unlocked at all) and #428 (the inject_map push dead-letters as InvalidUbfBody before it is ever logged).

[mmeyerlein]

Shipped in 0.24.0 (vault@1.1.0, access@2.1.0, x25519-dalek): the vault delivers sealed to an ephemeral recipient key (X25519 + XChaCha20-Poly1305), the broker road in invoke exists with the two edges back, the llm cell is the first consumer (unseals in RAM, never persists). The E2E pin proves the whole promise: the mock provider SAW the bearer, then 34 message_log rows and 30 blobs grepped byte-wise — zero plaintext hits, with a counter-evidence test proving the sweep has teeth. Attestation now requires the wired broker (BrokerUnwired). Follow-ups tracked: #427 (unlock in a sealed hive — ruled: opt-in env unlock), #428 (inject_map removal — ruled: pulled into the next release), proxy/web_search as consumers 2 and 3 (roadmap).