Home / Articles / When is the vault actually used? In Mondweep Chakravorty's SGit × Ruflo run, the encrypted vault is written or read in three steps of twelve, on one machine, inside the adapter, and why that is the honest shape of a recovery copy / Versions / v1.2.0
When is the vault actually used? In Mondweep Chakravorty's SGit × Ruflo run, the encrypted vault is written or read in three steps of twelve, on one machine, inside the adapter, and why that is the honest shape of a recovery copy: what changed in v1.2.0
From v1.1.0 (2026-10-17, 04eef66c8) to v1.2.0 (2026-10-18, 9f74e5714), paragraph by paragraph.
0 paragraphs added, 0 removed, 3 changed in place, 56 unchanged. About 6 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
26 unchanged paragraphs, under In short {#in-short}, Six short answers {#answers}, The component map {#map}…
!shot rf-stage-05.webp | images/ | Step 5: the checkpoint tool passes the policy gate; a SQLite backup takes a consistent copy of memory.db; fingerprints of the database, the ABP and the policy are taken; the SGit library encrypts on the machine and writes ciphertext only to the checkpoint store, with keys kept apart. | small | architecture
5 unchanged paragraphs, under Step 8: the vault is read {#step-8}
!shot rf-stage-08.webp | images/ | Step 8: a new MCP server process restores the checkpoint; the policy gate allows it; the SGit library reads ciphertext from the vault and keys from the private folder, decrypts and verifies, and writes memory.sqlite into the fresh-runner workspace, with the same SHA-256 as in step 5. | narrow | architecture
4 unchanged paragraphs, under Step 11: the vault is read, and refuses {#step-11}
!shot rf-stage-11.webp | images/ | Step 11: one object in the vault is altered; the restore tool passes the policy gate; the adapter compares the digest of the stored ciphertext with the one recorded in step 5, finds a mismatch, and a ValueError means the tampered workspace is never created; SGit is never asked to decrypt. | narrow | architecture
21 unchanged paragraphs, under Steps 6 and 7: protected, then left standing {#step-6}, Where the vault lives {#where}, Is three steps of twelve a weakness? {#three}…