Sanctum Vault Armor (BFU/AFU)

A winter ice storm snaps the hydro line at 2 a.m. Four hours pass. Power flickers back, the Mac mini chimes in a cold basement, and nobody is home to type a password. Turn on stock whole-disk FileVault and the machine stalls forever at a pre-boot login screen — deaf to SSH, blind to Tailscale, unable to warm the cathedral or watch the pipes. Leave FileVault off with an unattended login password on disk and any thief who grabs the aluminum chassis walks out with every secret the Haus owns.

Phones solved this thirteen years ago. Every iPhone splits storage into two cryptographic strata: Before First Unlock (BFU), which boots the kernel, radio, and reachability stack immediately after power returns, and After First Unlock (AFU), which keeps keys and credentials sealed inside Apple Silicon’s xART Secure Enclave keystore until authentication succeeds. Sanctum Vault Armor (sanctum-vault-armor) brings that exact BFU / AFU split to macOS. Zero USB dongles. Zero custom filesystems. Lockout is mechanically impossible.

Two strata, zero custom filesystems

Custom encrypted containers fail operators on their worst day. When a bespoke FUSE mount or third-party cipher breaks during an OS upgrade, recovery turns into forensics under stress. Vault Armor refuses that trap. The AFU vault is a 100% native Apple Silicon Encrypted APFS volume (SanctumVault) inside the existing disk3 container, backed directly by the Secure Enclave’s hardware anti-replay keystore.

Stratum	Mount	Boot behavior	What lives here	What a stolen chassis yields
BFU (Rescue & Reachability Plane)	/ and /System/Volumes/Data	Boots immediately on AC restore	macOS, sshd, tailscaled, Screen Sharing, sanctum-vault-armor, from=... forced-command witness key, local ML-KEM-768 decapsulation key	OS binaries, public configs, a point-eval-only witness key, and a ciphertext envelope
AFU (Crown-Jewel Vault)	/Volumes/SanctumVault	Locked (FileVault: Yes, Locked: Yes) until 2-of-3 witness quorum	~/.sanctum/secrets, mTLS Root CA + client keys (certs/), pq-terminator TLS keys, unencrypted ~/.ssh private keys, keys/, dragonpit + gh creds, deadman-cancel-card.txt, and SOPS/age break-glass bundles	Zero — hardware AES-XTS media keys remain sealed inside Secure Enclave xART

The BFU plane never touches sshd, ~/.ssh/authorized_keys, tailscaled, or Screen Sharing. No bug in Vault Armor can brick remote access. Even if every witness on Earth disappears at once, the operator still lands on the box over SSH and unlocks /Volumes/SanctumVault with stock /usr/sbin/diskutil.

The cryptographic spine

Naive network-bound disk encryption leaks identity or trusts a single server blindly. Vault Armor does neither. Four primitives stack together so no witness ever learns the vault key, no single witness can unlock or poison recovery, and no quantum adversary recording traffic today can unwrap a stolen SSD tomorrow.

flowchart LR
    Boot["Cold Boot (BFU Plane)"] --> Blind["Scalar-Blind Vault Point (r * H)"]
    Blind --> W1["Witness #1: LAN Router + Alarmo Gate"]
    Blind --> W2["Witness #2: Off-Site Peer / Cloud Witness"]
    W1 --> DLEQ["Verify Chaum-Pedersen DLEQ Proofs"]
    W2 --> DLEQ
    DLEQ --> Lagrange["Unblind + 2-of-3 Lagrange Interpolation"]
    PQ["Local ML-KEM-768 Decapsulation (FIPS 203)"] --> HKDF["HKDF-SHA256 + AES-256-GCM (UUID-Bound AAD)"]
    Lagrange --> HKDF
    HKDF --> APFS["diskutil apfs unlockVolume (Secure Enclave xART)"]

1. Blinded 2-of-3 Ed25519 Threshold OPRF. At initialization, Vault Armor samples a random Ed25519 base point P and splits a master scalar k via degree-1 Shamir secret sharing over the prime-order subgroup L into three shares (1, k_1), (2, k_2), and (3, k_3). On boot, the Mac samples a fresh blinding scalar r and sends only B = r * P to reachable witnesses. It unblinds their replies Z_i = k_i * B by r^-1 and combines any two shares via Lagrange interpolation to recover Y = k * P. Witnesses learn nothing.
2. Per-share Chaum-Pedersen DLEQ verification. Every witness carries a public verification point V_i = k_i * G pinned in manifest.json and returns a non-interactive zero-knowledge proof (RFC 9497 / SHA-512 Fiat-Shamir) that log_G(V_i) == log_B(Z_i). Garbage replies fail verification immediately. Vault Armor drops the bad share and falls back cleanly to the remaining quorum pair.
3. Post-quantum hybrid key encapsulation (ML-KEM-768). During init, Vault Armor encapsulates a 256-bit post-quantum secret with NIST FIPS 203 ML-KEM-768, storing the decapsulation key (0600) on the local BFU disk and the ciphertext inside manifest.json. Compromising two remote witnesses yields nothing without the physical Mac; stealing the physical Mac yields 0/3 threshold shares.
4. Hardware UUID-bound AES-256-GCM. The 200-bit Crockford Base32 APFS recovery key (SVLT-...) is sealed under HKDF-SHA256(ikm = Y || ss_pq) with the APFS hardware Volume UUID bound into the AES-256-GCM associated data (AAD). Volume-swap attacks fail closed.

Works for any Haus — zero extra hardware

Most households do not own a second cabin. They do not need one. Vault Armor’s three share slots map onto gear a normal Haus already runs:

Share	Default Manoir topology	Single-site Haus topology	What holds it
Share 1 (Physical / LAN Witness)	manoir-fw (Firewalla Gold Pro) gated by HA Green Alarmo state	Router appliance (sanctum-witness.py, zero pip deps) or Raspberry Pi / NAS	Stays in the building; refuses evaluation if alarm_control_panel.alarmo == triggered or /revoked exists
Share 2 (Off-Site Witness)	chalet Mac mini over SSH	$0 Oracle/Fly/Cloudflare tunnel witness (sanctum-vault-armor witness-serve) or a trusted friend’s Haus over Tailscale	Survives physical burglary of the entire home; revocable in one tap from a phone
Share 3 (Owner Break-Glass)	1Password Sanctum vault	1Password / Bitwarden / paper fire-safe card	Offline emergency quorum share plus the raw APFS diskutil recovery passphrase

Grab the Mac mini and bolt out the front door: Share 1 stays on the router, Share 2 sits off-site, and the thief holds 0/3 shares. Rip both the Mac mini and the router out of the rack during a break-in and two independent defenses slam shut. Alarmo’s triggered state blocks Share 1 before the cable comes out, and even a forensic chip-off dump of the router yields 1/3 shares — mathematically indistinguishable from random noise without Share 2.

Four anti-lockout invariants

Security tools that lock out their own owner are bugs disguised as armor. Four mechanical invariants make lockout impossible:

Escrow before seal — verified on disk, proven by rollback

sanctum-vault-armor init pipes the 200-bit APFS passphrase and Share 3 into 1Password via stdin JSON (never argv), reads the item back by ID, and compares the round-tripped passphrase byte-for-byte before writing manifest.json. When 1Password rejects a write, init immediately runs diskutil apfs deleteVolume so an unescrowed lock can never land on disk.

1. The BFU rescue plane stays untouched. sshd, tailscaled, Screen Sharing, and user login remain on standard APFS Data.
2. Read-back escrow precedes sealing. No manifest.json is written unless 1Password already holds and verified both password (SVLT-...) and share3_json.
3. Apple’s stock diskutil is the escape hatch. diskutil apfs unlockVolume SanctumVault unlocks the volume directly with the 1Password password field — even if sanctum-vault-armor is deleted from disk.
4. Sensors gate witnesses; they never halt the host. Unlike power-sense shutdown, a false motion trigger on Alarmo never calls shutdown -h now. While the Haus is running, a cat in the hallway does nothing; Alarmo only withholds Share 1 during a cold boot while actively triggered.

Operating the armor

sanctum vault-armor wraps the Rust binary for everyday inspection, cryptographic self-tests, and live unlock drills:

sanctum vault-armor self-test                  # offline TOPRF + DLEQ + ML-KEM-768 suite
sanctum vault-armor status --probe-witnesses   # live APFS xART state + witness DLEQ check
sanctum vault-armor lock                       # unmount and cryptographically lock SanctumVault
sanctum vault-armor unlock --wait 180          # 2-of-3 blinded witness unlock (boot LaunchAgent)

Symmetric dual-site DAG without opening satellite ACLs

Both manoir and chalet run phase2-afu-enforced Vault Armor, yet Tailscale ACLs intentionally forbid chalet from initiating inbound TCP or SSH to manoir. Weakening hub isolation to unlock a cabin Mac would trade one attack surface for another. Instead, the two vaults form a strict acyclic boot DAG with zero inbound satellite holes:

1. Cold boot on manoir. gui/501/haus.sanctum.vault-armor invokes /usr/bin/ssh -F /dev/null with StrictHostKeyChecking=yes against manoir-fw (from="10.0.0.0/24",restrict,command=... on physical LAN — off-LAN Tailscale source IPs and shell commands are rejected at sshd) and chalet (restrict,command=...), unlocks manoir:/Volumes/SanctumVault in 2.00s, and fires vault-armor-post-unlock.sh to kickstart secret- and cert-consuming daemons.
2. Hub witness + reverse tunnel. Post-unlock immediately starts haus.sanctum.vault-armor-witness (127.0.0.1:42071/v1/eval, reading chalet-share-2.json from manoir’s AFU vault) and haus.sanctum.chalet-witness-tunnel (ssh -N -R 127.0.0.1:42071:127.0.0.1:42071 chalet).
3. Headless cold boot on chalet. Because chalet runs 100% headless with no Aqua login (gui/501 absent), system/haus.sanctum.vault-armor runs as a system LaunchDaemon at boot, querying chalet-fw (from="10.0.0.0/24",restrict,command=... over -F /dev/null) and http://127.0.0.1:42071/v1/eval over the hub-initiated tunnel, while com.tailscale.tailscaled (KeepAlive=true + 5m root watchdog) holds the mesh online across upgrades. chalet:/Volumes/SanctumVault unlocks unattended in 4s.

Rollout completed in two verified waves alongside Closing the Apocalypse Seams, The Sentinel That Patches the Fleet, and Sanctum Continuity:

• Phase 1 — Non-Destructive Shadow Canary (verified). Proved 0/3 local share storage, round-trip break-glass escrow, and 2.00s 2-of-3 unlock across manoir-fw and chalet with zero disruption to the 41-service stack.
• Phase 2 — Full AFU Enforcement (active on manoir and chalet). ~/.sanctum/secrets and deadman-cancel-card.txt live inside /Volumes/SanctumVault with rm -P shredded BFU originals, sanctum-boot-ready gates on .sanctum-vault-canary.json, sanctum-r2-breakglass resolves symlinked secret directories via os.path.realpath, and sanctum-power locks SanctumVault automatically before low-battery shutdown.

The box still wakes itself in the dark after the ice storm clears. Now, if someone carries it out into the snow instead, the aluminum shell has nothing left to say.