glm-5.3-flash
f4424b7e58
A conflation in the research set: alkvault's derive-and-custody surface (derive_ed25519, SLIP-0010 paths) was being sketched as the SSH key path. Corrected across the docs — held SSH keys (client outgoing keys and the server's own host key) are bearer-token-class secrets: opaque bytes the family holds, vault-encrypted at rest, decrypted at use (the alkhttp ADR-014 posture). No derivation story, no vault-custody design, and the Signer-injection idea is withdrawn and recorded with its dismissal rationale. - auth-bridge.md: client-side gap re-framed as at-rest storage — the at-rest shape (OpenSSH encoding inside alkvault EncryptedData), the at-use lifecycle (decrypt-at-dial, one-time decode_secret_key, zeroized for the dial), the KeySource-like source shape - pocs.md: POC-2 rewritten to at-rest key handling (formats comparison, decrypt-at-use lifecycle, locked-vault fail-closed, Signer dismissal) - vision.md: principle 5 scoped (secret store, not key generator/custodian) - russh.md: Signer seam noted as not presumed to be the vault shape - AGENTS.md/CHANGELOG: convention 6 + context updated to match Verification: cargo doc --no-deps, cargo fmt --check, cargo test (docs-only change)