🔐
🗝️
🛡️
Sovereign Secrets Vault · smilinTux ecosystem

skvault

Your secrets. Your key. Your machine.
A KeePass vault sealed to your sovereign identity — opened by gpg-agent, never by a password on disk.

The KeePass master is PGP-sealed to your sovereign key and unlocked into gpg-agent. Reached through one stable shim, so the code can move without breaking a single caller.

skvault unlock && skvault get github

One stable verb (~/.skenv/bin/skvault) — unlock once, then fetch any secret. Read the source ↗

PGP-sealed master · gpg-agent unlock KeePass-backed · open format Depends on capauth.seal · one crypto home GPL-3.0 · free forever

What it does

A vault that holds secrets,
not your master key.

skvault keeps your credentials in a KeePass database. The database's master passphrase is never typed and never sits on disk in the clear — it's PGP-sealed to your sovereign identity and lives, while unlocked, only inside gpg-agent. Lock it and it's gone again.

🗄️ The vault 🔐

KeePass secrets store

An open-format KeePass DB you own. Add credentials, fetch them by query, list and filter — all from the CLI, all on your machine.

  • vault_creds — store / get / list credentials
  • creds-init migrates the DB to skvault's path
  • Query by site, reveal only with --show
  • No browser, no cloud, no sync-to-vendor
  • Standard KeePass — read it with any client
🗝️ The seal 🔑

gpg-agent seal lifecycle

unlock / lock / status drive a gpg-agent seal. The master is PGP-sealed to your sovereign key via capauth.seal; unlock unseals it into the agent, lock evicts it.

  • unlock [--word W] — unseal into gpg-agent
  • lock — evict the master from the agent
  • status — is the vault open right now?
  • An unlock-word blob, sealed not stored
  • Sensitive actions can require a TOTP gate
🧬 The safety net 🛟

Sovereign social recovery

Lose the key and you're not locked out forever. Split the passphrase into k-of-n Shamir shares, each PGP-sealed to a holder. No single holder can recover alone — the HashiCorp-Vault unseal model, made sovereign.

  • vault-share-init --holders a,b,c
  • vault-recover --providers a,b
  • Shamir secret sharing over GF(256)
  • Each share sealed to one holder's PGP key
  • RFC-6238 TOTP second-factor on recovery

Where it sits in the ecosystem

capauth seals it. skvault keeps it. Everyone else asks skvault.

One crypto home, one secrets home, many consumers. capauth owns identity and the seal/unseal primitive. skvault is the only thing that holds secrets. Apps never touch the master — they go through the shim.

Sibling services — split from the same lineage

skvault sits alongside the other single-purpose sk* services. skingest used to be the vault's home — now both seal through capauth and do exactly one job.


The fixins

The engineering decisions behind it.

skvault is the result of a deliberate refactor (EPIC 11eeac9e). Four choices define it.

✂️
F1
Split out of skingest

The vault used to live inside skingest. Secrets management and document ingestion are different jobs, so the vault became its own package. skingest is now pure ingestion; both seal the same way, neither owns the other.

📐
F2
Depends on capauth.seal

Crypto has one home: capauth — identity, sign/verify, and the seal/unseal primitive. skvault doesn't reimplement any of it; it depends on capauth.seal to PGP-seal the master and unseal it into gpg-agent. skingest seals through the same primitive.

🔌
F3
The stable shim seam

Every caller — agents, .claude hooks, skos.secrets, skguide — invokes the skvault shim at ~/.skenv/bin/skvault, never the package. When the backend moves, you edit one line in the shim and nothing downstream breaks. The seam outlives the implementation.

🛡️
F4
Never holds the master

The KeePass master passphrase is never stored in plaintext and never kept by skvault itself. It's sealed to your sovereign PGP key; while unlocked it lives only in gpg-agent; lock evicts it. Compromise the vault file and you still have nothing without the key.


The stable verb

One shim. Every command.

skvault unlock | lock | status | get <q> | list [filter] | creds-* | vault-*

Consumers like skos.secrets, skguide, and your .claude hooks call the exact same shim — never the package, never the master.


The guarantee

The vault never holds your master.

Most secret stores keep a key that unlocks everything — steal the store, steal the kingdom. skvault doesn't. The master is sealed to your sovereign PGP identity by capauth, held only by gpg-agent while open, and evicted on lock. The vault file alone is worthless. Crypto lives in capauth, secrets live in skvault, callers go through one shim — and your master goes nowhere.


The SKWorld family

Part of the smilinTux ecosystem

skvault is the secrets layer of the SKWorld sovereign AI ecosystem. It seals through capauth and is consumed by skos, skguide, and the rest of the family.


🔐

Own your secrets.

KeePass secrets, a PGP-sealed master, one stable shim. The vault holds everything — except the one key that would matter.

skvault unlock && skvault get github

"staycuriousANDkeepsmilin" 🐧