# Vault Adoption Drafts

Draft-only browser implementation plan for `/Users/june/Downloads/peach-vault-adoption-brief.md`.

Nothing in this folder is active code. `src/drafts/**` is excluded from both
`tsconfig.json` and `vitest.config.ts`, so these files are inert until an
integration pass copies the destination-form code/tests into real source.

Drafted against current dev state, not the brief's older base:
- Browser is already v4.0.13, not v4.0.3.
- `PAIR_IDENTITY` already carries optional `vault_id` and Pro `license`.
- Sync is already ungated for non-Pro pairing attempts.
- Settings already exposes phone/tablet and desktop pairing options directly.

## Files

| Draft file | Purpose |
|---|---|
| `vault-createVaultFromRootKey.ts` | Phase 1 destination-form vault code for adopting an existing root key. |
| `vault-createVaultFromRootKey.test.ts` | T-A01 through T-A05. |
| `messages-CREATE_VAULT_FROM_ROOT_KEY.ts` | Phase 2 message type and handler draft. |
| `messages-CREATE_VAULT_FROM_ROOT_KEY.test.ts` | T-A06 through T-A09. |
| `chirp-adopt.ts` | Phase 3 adoption sub-protocol module. |
| `chirp-adopt.test.ts` | T-A10 through T-A15. |
| `AdoptionConsentModal.tsx` | Phase 4 source-device consent modal. |
| `AdoptionConsentModal.test.tsx` | T-A16 through T-A20. |
| `onboarding-adopt-path.tsx` | Phase 5 receiver onboarding path and `AdoptVaultView` sketch. |
| `onboarding-adopt-path.test.tsx` | T-A21 through T-A25. |
| `chirp-pair-adopt-source.ts` | Phase 6 source-side `ADOPT_REQUEST` routing. |
| `chirp-pair-adopt-source.test.ts` | T-A26 through T-A29. |
| `INTEGRATION-CONTRACT.md` | Source of truth for the later integration pass. |

## Security Notes

- `root_key_hex` is a crown-jewel secret. It is validated before use, copied
  only into wrapped vault storage and the in-memory unlocked-session key, and
  zeroed as bytes after creation.
- `ADOPT_GRANT` is sent only after the regular SAS gate and the source-side
  master-password re-auth gate both pass.
- The receiver creates a local password before chirp/SAS, so the source root
  key is not held while prompting for a password.
- Source persistence is two-phase: do not save the receiver as paired until
  `ADOPT_IDENTITY` arrives after the receiver has successfully created the
  adopted vault.