feat: encrypted data + credential vaults, and the private-data onboarding architecture (ADRs 045–049)

[stuinfla]

Summary

This PR lays the secure, tested foundation that turns Helix from a stateless analyzer into a platform that can safely hold a person's health data and pull it in automatically — while keeping the local-first, user-owned promise of ADR-001.

It adds two encrypted vaults, the full architecture for automated multi-source data acquisition (5 new ADRs), the delivery spec, and completes the product-spec figure integration.

Zero blast radius: every new storage/crypto dependency is behind a non-default persist feature. The default build and the WASM build are byte-for-byte unaffected (helix-wasm does not depend on helix-vault; verified via cargo tree).

---

What's included

🔐 helix-vault — two encrypted stores (feature-gated, fully tested)

Store	What it does
PersistentVaultStore	Seals ProvRecords with XChaCha20-Poly1305, persists via redb — data survives a process restart. Closes the "everything evaporates on close" gap.
CredentialVault	Seals account logins under a master passphrase → Argon2id key. Wrong passphrase is rejected cleanly (no panic), Debug is redacted, and there is zero plaintext on disk — proven by reading the raw file bytes in-test.

Proof — all green:

cargo test  -p helix-vault                                   # default: unit + property pass; redb/argon2 NOT compiled
cargo test  -p helix-vault --features persist                # persistence round-trip + credential round-trip
                                                             #  + wrong-passphrase reject + encrypt-at-rest — all pass
cargo clippy -p helix-vault --features persist --all-targets -- -D warnings   # clean, 0 warnings

📐 Architecture — ADRs 045–049 (the automated-onboarding design)

• ADR-045 — Encrypted credential vault (zero-knowledge; never a plaintext .env)
• ADR-046 — Agentic-browser acquisition for no-API sources (local, session-persisted, treats scraped content as untrusted)
• ADR-047 — Single-tenant, local-first topology (each user runs their own instance → no central breach target)
• ADR-048 — AIMDS/AIDefence guardrails on the ingest + LLM surface (prompt-injection + PII gating)
• ADR-049 — Scheduled per-source pull cadences with auto-refresh (the "organic flow" of fresh data)

📄 Docs & figures

• docs/Helix-Build-Spec.md — the onboarding + proactive-analyst delivery plan (phased, with verifiable milestones).
• Product spec: the six architecture/concept diagrams migrated from bloated inline SVG → clean PNG figures, now numbered Figure 1–5 with captions and in-text cross-references (−546 lines of inline SVG, +6 committed images that render cleanly on GitHub).

---

Why this is safe to merge

• ✅ Tested and green — no todo!()/unimplemented!(); clippy -D warnings clean.
• ✅ Additive — builds on existing crates; no public API changed, no existing test touched.
• ✅ Feature-gated — argon2/redb compile only under persist; default + WASM builds unchanged.
• ✅ Security-first — encryption at rest proven by test; no credentials or PHI anywhere in the diff (verified with git log --name-only + git add -A --dry-run).
• ✅ Documented — 5 ADRs + a delivery spec explain every decision.

How to verify locally

git fetch && git checkout feat/vaults-and-acquisition-spec
cargo test  -p helix-vault --features persist
cargo clippy -p helix-vault --features persist --all-targets -- -D warnings

What's next (separate PRs on this foundation)

Source connectors (Apple Health, RENPHO, Quest, pharmacy, EMR, Lose It), the per-source scheduler, the helix creds intake CLI, and a full synthetic demo persona — each will land as its own reviewed PR.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01NsEPAr9R7jXAJcEYFN4acb