security UX: verify every key, clarify plaintext custody and add delivery evidence #3

Interaction review — 2026-10-23

P1 · 密钥工具必须先讲清明文保管、每项用途与复制后果，视觉整齐不能替代安全。

Observed evidence and scope

The in-app introduction calls the INI store a vault and says values only leave via clipboard. copyEntry writes the raw value to the system clipboard and reports that it stays off-screen; it does not disclose clipboard history/sync exposure at that action. Product selection also requests entries without a selection-generation guard in the shown Mac model. Existing #2 owns per-entry purposes; #3 owns security UX and should coordinate that work.

Source snapshot: 185637d052d6f3544b7d4989f13b93fb3503c706. Central policy read: d32f8400264c3b6dddd613d207331934e2d7694e; Rivet interaction guide read at 1ced9e9e898173d9b95a9fdd0e746ef822b6c51a.

• macos-host/Sources/RivetHost/ContentView.swift:63
• macos-host/Sources/RivetHost/RivetHostApp.swift:267
• macos-host/Sources/RivetHost/RivetHostApp.swift:260

Product decision

• State plainly in onboarding/choose-store and Help that INI/snapshots are plaintext and not OS-backed encrypted custody. Keep support/diagnostics secret-free.
• Group entries by purpose and trust domain with per-key verification status; implement Show per-entry purpose hints so sections with 3/4/5 entries are self-explanatory #2 rather than deleting unfamiliar 3/4/5-entry variants.
• For private material provide deliberate copy intent, an accurate copied-secret message and a documented optional expiry policy. If clearing, clear only the clipboard content this action still owns; never erase newer user content. Do not promise control over OS history/sync.
• Bind entries and Copy to the displayed product identity; ignore stale selection results. No actual user vault or secret is accessed by this review.

Acceptance before closing

• Using synthetic keys only, a new user can identify each item purpose, on-disk format and copy consequence before copying/deleting.
• Rapidly select two products: rows, check status and copy target always refer to the same product.
• If clipboard expiry is implemented, a later unrelated copy survives. Redacted diagnostics and screenshots never reveal private values.

Handoff boundary

This is an architect review and implementation contract, not a runtime fix. Refresh the repository, relevant open PRs and current policies before taking one bounded slice; record starting SHA, owned files and native evidence. Preserve active writers and existing release/security gates. A paused product is not automatically restarted. Source findings and required failure-injection scenarios above are not claimed as three-platform runtime validation. Use synthetic data; do not access real keys, publish content or operate real hardware for this review.

Shared baseline: product experience contract.

Earlier issue context (retained)

授权实施决定 / Authorization handoff — 2026-10-auth-1

不接商业 Permit/Commerce，不签发收费试用或激活凭据，不设置收费设备/席位门禁。

完整决定：PRICING.md § Authorization decision for implementation（同仓含完整中文版本）。后续商业授权工作以这一决定为准；旧的商业候选描述若冲突，已被替代。这里只补设计与交接，不宣称运行时接入已经完成，也不自动重启停工产品。

• 下一实施切片记录实际读取的 repo SHA、中央政策 SHA 与 2026-10-auth-1；文档存在不等于正在运行的 agent 已确认。
• 按本仓中英文授权决策完成相关验收，并将未执行/失败/排队证据分别记录；免费产品先验证历史门禁移除与数据兼容。

Latest implementation status (2026-10-23)

PR #4 is merged after all four engine/macOS/Windows/Linux checks succeeded. Issue #1 is closed. Local regression coverage was 69 engine tests plus backend compilation; real vault data was not used. The default-branch AGENTS now directly links delivery/language/portfolio policy and requires recording the source revision read at slice boundaries. Purpose hints (#2), native update/recovery and broader security UX evidence remain open gates.

执行更新：2026-10-v2

用户确认产品在开发、没有实际用户。当前角色：免费安全与发布基础设施。本地密钥管理、校验、发布辅助和诊断免费；不以密钥数量、安全修复或导出收费，不在本产品扩建云密钥托管。AGPL 权利不变。

不计划付费层，不接 Commerce/Permit 产品门禁。已补 定价/免费边界与 agent 路由；Payback 文档在独立 PR #21。此前移动收费或团队 Pro 候选已取消，下面历史段落不再作为商业任务。

先完成本仓 #3 的交付/维护门禁；免费并不降低签名更新、数据恢复或隐私要求。
逐钥/用途公钥匹配已在 PR #4 修复：先复现 4 个失败回归，再通过本地 69 项引擎测试与后端编译；Windows/Linux/engine CI 通过，macOS 仍排队。未合并前不称全平台完成；#2 的用途提示 UI 仍独立。

审查结论（P1，2026-10-23）

#1/#2分别记录多私钥只校验首项及缺少用途说明；README宣称Deep check较宽。快照0.2.0有hash sidecars但无update manifest，且没有rivet-acceptance契约。

实施顺序与范围

先沿#1/#2修每entry校验和用途提示，避免整节绿色掩盖未检查私钥。保留可逃生INI与明确plaintext设计，不擅自改成不可恢复加密仓；在初次使用说明磁盘/同步信任、快照保留、剪贴板暴露和可选自动清理。补私有安全反馈、最小三端packaged校验/复制/生成/恢复和签名更新交付规划；核心引擎零网络约定继续保留，更新若需要网络放独立受控adapter。

这是产品/架构路线入口。每次仅认领一个可验收切片，开工记录 starting SHA、owned files、命令与回滚；活动共享层切片完成后再进入，不重叠写入，不重写已有实现。

完成标准

每个私钥有独立解析/配对/指纹结果，故障项不显示总体全绿；截图/AX/日志无值；剪贴板清理不误删用户后续复制内容；坏INI不覆盖原件、快照可恢复；不把checksum当身份认证，不读取或上传用户真实vault用于测试。

固定审查证据

• README.md
• AGENTS.md
• app/core/keymeta.rkt

本轮是源码、文档、主页与公开发布资产的静态审查，未声称已经运行所有原生平台、硬件或真实支付。执行时重新核对当前状态。

沿用的工作

• Deep check covers only the first private key per section — multi-key sections leave the second key unverified #1
• Show per-entry purpose hints so sections with 3/4/5 entries are self-explanatory #2

家族规范入口

产品交付标准、完整审查与主页规划 PR。依赖图仍以 Keel family architecture 为准。具体实现与证据留在本仓已有 canonical 文档；不要另建平行规范。