lvls
lvls machine vaulting.
The cryptographic trust root of the tas cluster. Credentials never persist on disk, never sit in environment files, and exist in memory only for the millisecond duration of an authorized call.
The Three-Key Model
lvls divides cryptographic responsibility across three independent key sets. No single breach can compromise the entire chain.
Root Master Key (Server-Bound — isolated root, never leaves server memory) ├── Server Ed25519 Signing Pair — authenticates & signs all lease delivery envelopes └── Server ML-KEM-768 Cipher — seals database secrets at rest (NIST FIPS 203) Machine Identity Seed (Host-Bound — scoped cryptographically to hardware identity) └── Client Ed25519 Token — generates single-use request attestation signatures ML-KEM-768 Transport Pair (Provisioned Per Node — zero-disk ephemeral transport) ├── Node Public Key — registered with vault to encapsulate secret payloads └── Node Private Key — held in node RAM only, never written to disk or network
Lease-Based Secret Delivery
Secrets are never stored in config files, Docker containers, or environment variables. Each service acquires keys dynamically at runtime, holds them in memory for a single call, and immediately drops them.
Request Attestation
Machine signs lease request using ephemeral Ed25519 key derived from its hardware TOTP seed.
Clearance Verification
lvls validates machine signature and verifies request against compartmented clearance tier.
ML-KEM-768 Encapsulation
Secret is re-encrypted using machine's public ML-KEM transport key (NIST FIPS 203 post-quantum).
In-Memory Delivery
Client decrypts secret in RAM with its private key. Secret never touches the filesystem or disk.
Instant Lease Expiry
Secret is held strictly for the duration of the API call, then purged. Next request starts fresh.
Machine Vaults
Every service in the cluster gets its own machine vault — a cryptographically sealed identity that restricts exactly what credentials it is permitted to request.
Mission pipeline state, HMAC webhook signers, operator approval tokens
Per-call provider keys (OpenAI, Anthropic, Gemini) leased on demand
Cluster node telemetry tokens, Wazuh API credentials, Redis bus access
Task execution scratchpad tokens, restricted sandbox credentials
Graduated Clearance Tiers
lvls organizes secrets into four isolated compartments, each sealed from the others. A service operating at Everyday level cannot access Critical secrets. Enforced at the cryptographic layer.
Everyday
High-frequency operational tokens, external web scrapers, search APIs
Professional
Integration credentials, GitHub tokens, Jira webhooks, internal APIs
Personal
Individual identity tokens, tenant-isolated private data, user credentials
Critical
Break-glass root infrastructure keys, server master keys, cloud IAM roots
ML-KEM-768 (NIST FIPS 203)
lvls uses ML-KEM-768 for all secret transport. Delivered secrets are mathematically immune to harvest-now-decrypt-later attacks where an adversary intercepts encrypted traffic today to decrypt once quantum computers scale.
Instant Revocation
lvls is the cluster's master kill switch. Because every secret credential flows dynamically through it, revoking a machine vault or rotating the master key severs an agent or compromised node instantly — no restarts, no manual secret rotation.
Explore the full platform
Five integrated components. One unified system.