The ratchet library's storage, sealed to the account. The library keeps its
device key and session state here; kernl writes each value only as
ciphertext the account signer encrypted to itself with nip44, under an
opaque slot number, and keeps the map from the library's key names (which
name correspondents) to slots in one more sealed entry. Nothing readable
reaches storage, so the key rule in SOUL.md opinion 1 holds for every
secret the library generates (D-016).
Values are decrypted once and then served from memory, so an extension or
remote signer is asked once per value per page load. Writes are applied in
order.
The ratchet library's storage, sealed to the account. The library keeps its device key and session state here; kernl writes each value only as ciphertext the account signer encrypted to itself with
nip44, under an opaque slot number, and keeps the map from the library's key names (which name correspondents) to slots in one more sealed entry. Nothing readable reachesstorage, so the key rule inSOUL.mdopinion 1 holds for every secret the library generates (D-016).Values are decrypted once and then served from memory, so an extension or remote signer is asked once per value per page load. Writes are applied in order.