Home / Articles / When is the vault actually used? In Mondweep Chakravorty's SGit × Ruflo run, the encrypted vault is written or read in three steps of twelve, on one machine, inside the adapter, and why that is the honest shape of a recovery copy / Versions / v1.3.0
When is the vault actually used? In Mondweep Chakravorty's SGit × Ruflo run, the encrypted vault is written or read in three steps of twelve, on one machine, inside the adapter, and why that is the honest shape of a recovery copy: what changed in v1.3.0
From v1.2.0 (2026-10-18, 9f74e5714) to v1.3.0 (2026-10-27, db67c5ce1), paragraph by paragraph.
0 paragraphs added, 0 removed, 6 changed in place, 53 unchanged. About 0 words added and 210 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
2 unchanged paragraphs
!shot rf-matrix.webp | images/ | Who does what, step by step: thewhich vaultsteps is writtenwrite or read inthe steps 5, 8vault and 11,which protected in step 6 and survives step 7;use Ruflo's own command line touches memory in steps 3, 9 and 10, where the ABP is not on the path. From the architecture addendum to the analysis of Mondweep Chakravorty's video.line. | comparison
20 unchanged paragraphs, under In short {#in-short}, Six short answers {#answers}, The component map {#map}
!shot rf-map.webp | images/ | The component map: the test script callsscript, Ruflo's command line in steps 3, 9 and 10 and the ABP adapter's tools in steps 4, 5, 6, 8 and 11; the ABP rows are compiled to Ruflo rules and checked by a pinned copy of Ruflo's evaluator in enforce mode, which leads to the SGit library, which writes the vault and its keys on the machine's disk. Ruflo's hive-mind, its running policy state and a remote vault server were not used. Blue is Ruflo, amberline, the ABP adapter, greenthe SGit library and the vault,vault greyon plain files.disk. | architecture
2 unchanged paragraphs, under Step 5: the vault is written {#step-5}
!shot rf-stage-05.webp | images/ | Step 5: the checkpoint tool passes the policy gate; a SQLite backup takes a consistent copy of memory.db; fingerprints of the database, the ABPgate and the policy are taken; the SGit library encrypts on the machine and writes ciphertext only to the checkpoint store, with keys kept apart.store. | small | architecture
5 unchanged paragraphs, under Step 8: the vault is read {#step-8}
!shot rf-stage-08.webp | images/ | Step 8: a new MCP server process restores the checkpoint; the policy gate allows it; the SGit library reads ciphertext from the vaultcheckpoint, and keysmemory.sqlite fromis the private folder, decrypts and verifies, and writes memory.sqlitewritten into the fresh-runner workspace, with the same SHA-256 as in step 5.workspace. | narrow | architecture
4 unchanged paragraphs, under Step 11: the vault is read, and refuses {#step-11}
!shot rf-stage-11.webp | images/ | Step 11: one object in the vault is altered; the restore tool passes the policy gate;altered, the adapter compares the digest of the stored ciphertext with the one recorded in step 5, finds a mismatch,digest mismatch and a ValueError means the tamperedno workspace is never created; SGit is never asked to decrypt.created. | narrow | architecture
6 unchanged paragraphs, under Steps 6 and 7: protected, then left standing {#step-6}, Where the vault lives {#where}
!shot rf-where.webp | images/ | Where the video's vault lives: on one machine, with the adapteradapter, andthe SGit library, the checkpoint store, the private key folderstore and the workspaces; a vault server was not used.keys. | architecture
14 unchanged paragraphs, under Is three steps of twelve a weakness? {#three}, Where to go next {#next}, What this does not claim {#limits}…