Module vault_container 

Sanctuary vault v2 on-disk container (S3) — CBOR-native, additive; not yet wired into the vault.

The vault is an n-layer, CBOR-serialized container (per the vault-v2 ADR). Each Layer is independently keyed; the collection generalises to any number of layers (real + decoy(s) + reserved padding) so the count of layers on disk is a constant, revealing nothing about how many are real / decoy / empty (ADR §9 constant-shape).

No JSON, no migration. There is no deployed vault, so there is nothing to migrate — the format is CBOR from the start, and no JSON path exists here. When S5 reconciles this with the live vault it removes serde_json from the vault entirely (records + container both CBOR).

Honest scope: CBOR is binary but self-describing — this is consistency + not-text-editor- readable, not cryptographic hiding (a decoder still recovers the structure). The reserved padding layers here carry empty blobs; making them byte-indistinguishable from real layers (size-matched random ciphertext) is finished in S5. What S3 fixes is the structural shape.

Structs

EncBlob

An AEAD ciphertext blob (hex) + the chunk index used to derive its nonce.

Layer

One independently-keyed layer.

VaultContainerV2

The v2 vault container.

WrappedKey

A key wrapped under a superior layer’s key (the one-way hierarchy: the real layer wraps the decoy layer key and the audit secret). blob_hex is the output of sanctuary_audit::wrap_key.

Enums

KdfDescriptor

Per-layer KDF descriptor. Every real/decoy layer carries one (Argon2id in production); None only on reserved padding, which is never opened.

LayerRole

The role a layer plays. Reserved layers exist only to keep the container shape constant.

Constants

CONTAINER_SLOTS

Number of layer slots every container carries, so the layer count is constant regardless of how many are actually in use (real + decoy(s) + reserved).

CONTAINER_VERSION