Questions worth asking a secrets product.

No. Protocol v1 is proposed and in security review, and the production sync API stays switched off until an independent review signs off on issue #8. The local ak secrets vault works today.

The local vault in the AgentKit CLI: importing a .env file, setting, rotating and inspecting secrets, ${secret:NAME} references, agent grants and approvals, and the access audit. See Part 1 of the guide.

No date is promised. Sync ships when every item in the release gates is met at the release commit, including the external review. Progress is tracked on the epic.

Yes. The Worker, the TypeScript and Go protocol implementations and the cross-language test vectors are in the public repository under the MIT license.

The design says no. The server stores ciphertext and wrapped keys only, and never receives your master password, recovery key or device private keys. It can see the metadata listed in the data classification. Treat this as a design claim until the review completes.

Random vault and item IDs, revisions, tombstone flags, key epochs, ciphertext sizes, timestamps, device public keys, roles, token claims and request metadata such as IP address and timing. Secret names, descriptions and values are encrypted.

It cannot decrypt, and signed records, an owner-signed member list and checkpoints let devices detect tampering, rollback and forks. It can still withhold updates a device has never seen (a freeze attack) and observe metadata. See the threat card.

XChaCha20-Poly1305, Ed25519, X25519, HKDF-SHA256 and Argon2id from audited libraries, plus ES256 tokens for transport. There is no custom cryptography, and an unknown algorithm is refused.

That is a release gate: with sync off, ak secrets must make zero network requests, and resolve must work with the Worker unreachable.

Running agents are not affected. resolve reads the local vault and never waits on the network. Changes made offline sync on the next successful connection.

Neither edit is silently lost. Writes are compare-and-swap on a revision; the second writer gets a conflict and its version is kept as a branch until you choose. There is no last-writer-wins. See the diagram.

Not by accident. A delete is a signed tombstone, and a stale write based on a revision older than the delete gets 409 tombstoned, so an offline device cannot resurrect it. You can still re-create the secret deliberately.

The design target is about a minute on a healthy connection. It is a target, not a measured result.

Not within one vault. A vault key decrypts every item in the vault, so v1 makes no per-secret access claim. Put the secrets you want to share in a separate shared vault.

An agent sees a value only when you grant or approve it, and then it receives plaintext. Planned search and describe let agents find secrets by description without seeing values.

It can try. ak treats descriptions, URLs and profiles as untrusted, author-attributed data, never instructions, but an agent that reads a description (for example through the planned describe) can still be influenced by it. Portable policy can only narrow local grants and high-sensitivity secrets always need fresh approval, which bounds what a misled agent can obtain.

The vault moves to a new key epoch wrapped only to the remaining members, and affected items are marked to rotate. Values the member already saw cannot be taken back.

Revoke the device. Revocation is checked on every request, so a revoked device or session is refused. Anything it already decrypted cannot be clawed back, so rotate sensitive credentials at the provider.

A fresh device can recover with your master password or your recovery key through the encrypted recovery bundle. If you lose all devices, the password and the recovery key, nobody can decrypt the vault, including AgentKit.

Both devices show the same six-digit code derived from the enrollment transcript. Approve only if the codes match; a mismatch aborts. See enrollment.

Privately, through GitHub security advisories. Please do not open a public issue.

The normative protocol v1 spec, the threat model and ADR 0001 are on GitHub.

ak-vault is the sync service for ak secrets, the secrets vault in the AgentKit CLI. It uses your AgentKit account to sign in.