Chapter 08 · research & sources
The Vault
Some material should not merely be handled carefully — it should be unreachable by default. The Vault is where sensitive sources live: encrypted, locked, and structurally out of everything else's way.
Per project, end to endWhat belongs in it
The Vault is a per-project encrypted store for the material that could get someone in trouble: source identities, contact notes, leaked documents, off-the-record recordings. Anything can be marked vault-resident — and when audio is, its transcript inherits the same protection automatically.
Keys that never leave the chipHow it protects
- A master key per project vault is generated inside your Mac's Secure Enclave. It never leaves the chip.
- Each item gets its own ChaCha20-Poly1305 key, wrapped by the master key. Vault blobs are stored as ciphertext only.
- Unlock is Touch ID (or your passcode). The vault auto-locks on a timeout and when the screen locks.
- Plaintext is decrypted on demand and zeroized afterward — it does not linger in memory, logs, or backups.
The source asked that her name never appear beside the documents. It does not — the documents are not beside anything.
Toggle the vault pill. Locked, the sidebar shows a count and a hint — never titles, never contents.
The strongest word in this manualAbsent, not hidden
Roono's rule is that vault items are structurally absent from agent workspaces, ordinary exports, Markdown mirrors, and Spotlight indexes. Not filtered out after the fact — unreachable in the first place. The workspace an agent receives is materialized from non-vault sources only; there is no code path by which a vault item could appear in it.
WHAT AN AGENT SEESopen ↓
├ draft.md · read-only
├ evidence/ · read-only
└ vault/ · does not exist
There is no vault folder to protect. That is what “structurally absent” means.
Read this before you need itNo recovery — by design
There is no server-side recovery. Nobody — not roono, not raastey, not Apple — holds a copy of your vault key. If you lose the key and every enrolled device, the contents are gone. That is not a gap in the design; it is the design. A recovery back door would be a way in for everyone, so there isn't one.
Enrolling a second device wraps the item keys for that device's key, so a lost laptop does not have to mean a lost vault. Do it before you need it.
The Vault is also why agents can be trusted in the same app: they work in a workspace where the vault simply does not exist.