What satchel proves
Satchel's evidence for the Mera One Passkey Many Keys bounty and Track 04: one passkey ceremony, a separate key for every app and folder, a second app that reads without the passkey, and a registry write that takes the access back. Open your vault once and the live results below fill in from it, against the Monad testnet registry. The recorded runs sit beside each result.
Create your vault
No vault in this browser yet. One passkey prompt creates the same vault Pip uses, and every result below fills in.
A second app reads your memory without the passkey
One person's AI memory, written by one app and read by another. No account, no signer and no wallet address appears on the screen: Pip holds the passkey, Fern holds its own key and rebuilds its grant from a transaction hash. Revoking moves the folder to a new epoch, Pip seals its memories again there, and Fern's next read is GRANT_REVOKED.
Registry 0xd6c895f5c9254dc6eaafc335fff0930fd7012e6d on Monad testnet. A recorded grant 0x397282e2 and its revoke 0x64daf652 moved the namespace from epoch 1 to 2. Recorded: the Pip to Fern click-through, grant and revoke receipts read back from chain, the read-back going red on a wrong value, mutation runs on fetchGrant, OWNER_UNFUNDED and openOrEnrol, the deployment record, the ABI.
One passkey, a key per namespace
Each folder derives its own key from the one passkey output: the HKDF info string, the current epoch and the key fingerprint for your vault, read now. HKDF separates namespaces, AES-256-GCM seals the data with the header as authenticated data, and HPKE hands a reader the epoch key. Recorded: the namespacing mutation, red, and green.
A wrong namespace is refused before any decryption
A record sealed under memory/assistant opens there and fails under memory/notes with NAMESPACE_MISMATCH, before any decryption. The call below is real and ran when your vault opened.
Nothing sensitive stays in the browser
The scan reads localStorage, sessionStorage, IndexedDB and cookies for this origin and flags any value that is not ciphertext, a public id or a key the browser will not export.
The same keys on a second device
The same passkey on two devices derives the same keys, so the same namespace prints the same eight characters. The recorded run opens the vault in a fresh page load and gets the fingerprint it had before: the passkey ceremony with a fresh page load and a foreign authenticator, its negative control.