aidevops 3.22.3 → 3.22.5

package/README.md

@@ -58,7 +58,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.22.3-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.22.5-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)
@@ -129,6 +129,18 @@ Since the last README feature refresh, aidevops has added or expanded:
 
 **Comprehensive DevOps framework with tried & tested services integrations, popular and trusted MCP servers, and enterprise-grade infrastructure quality assurance code monitoring and recommendations.**
 
+**Vault security model:** aidevops defines protected data classes, provider
+routing labels, trust boundaries, and phased encrypted sync architecture in
+`.agents/reference/vault.md`. Vault guidance is local-first: third-party AI
+providers can only reason over data that has been decrypted into their prompt or
+tool context, so provider-side logs/retention remain outside Vault's technical
+control. Future local LLM mode reduces provider exposure but not local host
+compromise risk.
+
+**Vault passphrase warning:** aidevops cannot recover a lost Vault passphrase.
+Save it in a trusted password manager with backups; never paste it into AI chat,
+CLI arguments, environment variables, logs, issue comments, or test fixtures.
+
 ### Report creation, previews, and PDF exports
 
 Use aidevops to turn evidence bundles into decision-ready reports while keeping Markdown or JSON as the canonical source. Report agents can produce AI-search audits, SEO/GEO scorecards, delivery reviews, campaign reports, board packs, incident summaries, recurring client handoffs, and before/after remediation evidence.

package/VERSION

@@ -1 +1 @@
-3.22.3
+3.22.5

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.22.3
+# Version: 3.22.5
 
 set -euo pipefail
 
@@ -861,6 +861,7 @@ _help_commands() {
 	echo "  review-gate <cmd>  Configure review_gate merge policies (rate-limit/completion)"
 	echo "  github-app-auth    GitHub App auth setup/status and API route decisions"
 	echo "  secret <cmd>       Manage secrets (set/list/run/init/import/status)"
+	echo "  vault <cmd>        Local encrypted Vault broker (init/unlock/lock/status/read/update)"
 	echo "  config <cmd>       Feature toggles (list/get/set/reset/path/help)"
 	echo "  knowledge <cmd>    Knowledge plane management (init/status/provision)"
 	echo "  campaign <cmd>     Campaign plane: init/provision/ls (P1) + asset (P4) + new/list/status/archive (P2) + draft (P5) + launch/promote (P6)"
@@ -937,6 +938,14 @@ _help_detailed_sections() {
 	echo "  aidevops secret import       # Import from credentials.sh to gopass"
 	echo "  aidevops secret status       # Show backend status"
 	echo ""
+	echo "Vault:"
+	echo "  aidevops vault init          # Create local encrypted Vault metadata"
+	echo "  aidevops vault status        # Show uninitialized/locked/unlocked/corrupted"
+	echo "  aidevops vault unlock        # Unlock into an in-memory local broker"
+	echo "  aidevops vault lock          # Stop broker and forget in-memory keys"
+	echo "  aidevops vault read NAME     # Read protected data through broker"
+	echo "  aidevops vault update NAME   # Encrypt stdin value through broker"
+	echo ""
 	echo "GitHub App Auth:"
 	echo "  aidevops github-app-auth status --json       # Show active auth mode and budgets"
 	echo "  aidevops github-app-auth route issue-list    # Explain route decision"
@@ -1055,9 +1064,8 @@ _help_management_sections() {
 	echo "  aidevops skills categories   # List all categories"
 	echo ""
 	echo "Installation:"
-	echo "  npm install -g aidevops && aidevops update      # via npm (recommended)"
-	echo "  brew install marcusquinn/tap/aidevops && aidevops update  # via Homebrew"
-	echo "  bash <(curl -fsSL https://aidevops.sh/install)                     # manual"
+	echo "  brew install marcusquinn/tap/aidevops && aidevops update  # macOS/Homebrew"
+	echo "  npm install -g aidevops && aidevops update                # Linux/cross-platform"
 	echo ""
 	echo "Documentation: https://github.com/marcusquinn/aidevops"
 	return 0
@@ -1632,6 +1640,7 @@ main() {
 	opencode-sandbox | oc-sandbox) _dispatch_helper "opencode-sandbox-helper.sh" "opencode-sandbox-helper.sh" "$@" ;;
 	review-gate | review_gate) _dispatch_helper "review-gate-config-helper.sh" "review-gate-config-helper.sh" "$@" ;;
 	secret | secrets) _dispatch_helper "secret-helper.sh" "secret-helper.sh" "$@" ;;
+	vault) _dispatch_helper "vault-helper.sh" "vault-helper.sh" "$@" ;;
 	approve) _dispatch_helper "approval-helper.sh" "approval-helper.sh" "$@" ;;
 	circuit-breaker | circuit_breaker | cb)
 		# Supervisor circuit breaker control (t1331). Bare invocation defaults to status.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.22.3",
+  "version": "3.22.5",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "workspaces": [

package/packages/gui-api/package.json

@@ -3,6 +3,9 @@
   "version": "0.0.0",
   "private": true,
   "type": "module",
+  "scripts": {
+    "test": "bun test tests"
+  },
   "exports": {
     ".": "./src/app.ts"
   }

package/packages/gui-api/src/app.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import { BANNED_ROUTE_PATTERNS, FILE_EXPLORER_ROUTE_MANIFEST, STATUS_ROUTE_MANIFEST } from "../../gui-shared/src";
+import { BANNED_ROUTE_PATTERNS, FILE_EXPLORER_ROUTE_MANIFEST, STATUS_ROUTE_MANIFEST, VAULT_STATUS_ROUTE_MANIFEST } from "../../gui-shared/src";
 import { readFileExplorer } from "./file-adapter";
-import { readStatus } from "./status-adapter";
+import { readStatus, readVaultStatus } from "./status-adapter";
 
 export function createGuiApiApp() {
   const app = new Hono();
@@ -10,6 +10,10 @@ export function createGuiApiApp() {
     return context.json(readStatus());
   });
 
+  app.get(VAULT_STATUS_ROUTE_MANIFEST.route, (context) => {
+    return context.json(readVaultStatus());
+  });
+
   app.get(FILE_EXPLORER_ROUTE_MANIFEST.route, (context) => {
     const root = context.req.param("root");
     const path = context.req.query("path") ?? "";

package/packages/gui-api/src/status-adapter.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import {
   assertNoSecretSentinels,
   createEnvelope,
+  VAULT_STATUS_ROUTE_MANIFEST,
   type GuiAiAppSummary,
   type GuiAiProviderId,
   type GuiOAuthPoolSummary,
@@ -15,6 +16,7 @@ import {
   type GuiSettingsSummary,
   type GuiSetupTargetSummary,
   type GuiStatusData,
+  type GuiVaultStatusData,
   statusFixture,
 } from "../../gui-shared/src";
 import {
@@ -30,6 +32,9 @@ import {
   stringField,
 } from "./status-adapter-utils";
 import { readLocalReposSetupSummary } from "./status-local-repos";
+import { readVaultSummary } from "./status-vault";
+
+export { readVaultSummary } from "./status-vault";
 
 export interface StatusAdapterOptions {
   repoRoot?: string;
@@ -47,6 +52,7 @@ export function readStatus(
   const reposPathRef = "~/.config/aidevops/repos.json";
   const oauthPoolPathRef = "~/.aidevops/oauth-pool.json";
   const agentsPathRef = "~/.aidevops/agents";
+  const vaultPathRef = statusFixture.vault.path_ref;
   const settingsPath = expandHome(settingsPathRef);
   const reposPath = expandHome(reposPathRef);
   const oauthPoolPath = expandHome(oauthPoolPathRef);
@@ -57,11 +63,13 @@ export function readStatus(
   const restartRequired = installedVersion !== aidevopsVersion;
   const setupTargets = readSetupTargets(aidevopsVersion || "unknown", installedVersion || "unknown");
   const aiApps = readAiApps(aidevopsVersion || "unknown", installedVersion || "unknown");
+  const vault = readVaultSummary(repoRoot);
   const sourcePathRefs = [
     agentsPathRef,
     settingsPathRef,
     reposPathRef,
     oauthPoolPathRef,
+    vaultPathRef,
     "VERSION",
     ...setupTargets.map((target) => target.path_ref),
     ...aiApps.flatMap((app) => [app.app_path_ref, app.binary_path_ref, app.config_path_ref, app.aidevops_target_path_ref]),
@@ -110,6 +118,7 @@ export function readStatus(
     oauth_pool: readOAuthPoolSummary(oauthPoolPath, oauthPoolPathRef),
     setup_targets: setupTargets,
     ai_apps: aiApps,
+    vault,
   };
 
   const envelope = createEnvelope({
@@ -128,8 +137,27 @@ export function readStatus(
   return envelope;
 }
 
-const AI_PROVIDER_IDS: GuiAiProviderId[] = ["anthropic", "openai", "cursor", "google"];
+export function readVaultStatus(
+  options: StatusAdapterOptions = {},
+): GuiResponseEnvelope<GuiVaultStatusData> {
+  const data = readVaultSummary(options.repoRoot ?? process.cwd());
+  const envelope = createEnvelope({
+    operation_id: VAULT_STATUS_ROUTE_MANIFEST.operation_id,
+    source: {
+      surface: "vault",
+      authority: "aidevops vault helper",
+      path_refs: [data.path_ref],
+    },
+    data,
+    warnings: ["Vault status exposes metadata only; passphrases, keys, recovery material, and payloads are never returned."],
+    observed_at: options.observedAt,
+  });
 
+  assertNoSecretSentinels(envelope);
+  return envelope;
+}
+
+const AI_PROVIDER_IDS: GuiAiProviderId[] = ["anthropic", "openai", "cursor", "google"];
 const SETUP_TARGET_DEFINITIONS: Array<Pick<GuiSetupTargetSummary, "label" | "path_ref" | "purpose">> = [
   {
     label: "Deployed agents",

package/packages/gui-api/src/status-vault.ts

@@ -0,0 +1,110 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import {
+  type GuiVaultSetupState,
+  type GuiVaultStatus,
+  type GuiVaultStatusData,
+  statusFixture,
+} from "../../gui-shared/src";
+
+const GUI_VAULT_STATUSES = ["uninitialized", "locked", "unlocked", "corrupted", "unknown"] as const satisfies readonly GuiVaultStatus[];
+const GUI_VAULT_SETUP_STATES = [
+  "uninitialized",
+  "test-created",
+  "restart-required",
+  "test-verified",
+  "migration-ready",
+  "unknown",
+] as const satisfies readonly GuiVaultSetupState[];
+const INITIALIZED_VAULT_STATUSES = new Set<GuiVaultStatus>(["locked", "unlocked", "corrupted"]);
+const RESTART_TEST_SETUP_STATES = new Set<GuiVaultSetupState>(["test-created", "restart-required", "test-verified"]);
+
+export function readVaultSummary(repoRoot: string): GuiVaultStatusData {
+  const helperPath = join(repoRoot, ".agents", "scripts", "vault-helper.sh");
+  const helperExists = existsSync(helperPath);
+  const rawStatus = helperExists ? readVaultCommand(helperPath, ["status"], isGuiVaultStatus) : null;
+  const rawSetupState = helperExists ? readVaultCommand(helperPath, ["setup-state"], isGuiVaultSetupState) : null;
+  const helperStatus = vaultHelperStatus(helperExists, rawStatus, rawSetupState);
+  const status = rawStatus ?? "unknown";
+  const setupState = rawSetupState ?? fallbackSetupState(status);
+  const unlocked = status === "unlocked";
+  const collectionState = vaultCollectionState(status);
+
+  return {
+    ...statusFixture.vault,
+    status,
+    setup_state: setupState,
+    initialized: INITIALIZED_VAULT_STATUSES.has(status),
+    locked: !unlocked,
+    unlocked,
+    available: helperExists && helperStatus !== "error",
+    helper_status: helperStatus,
+    readiness: {
+      ...statusFixture.vault.readiness,
+      migration_allowed: unlocked && setupState === "migration-ready",
+      setup_required: status === "uninitialized" || setupState === "uninitialized",
+      restart_test_required: RESTART_TEST_SETUP_STATES.has(setupState),
+      locked_content_hidden: !unlocked,
+    },
+    collections: statusFixture.vault.collections.map((collection) => ({
+      ...collection,
+      state: collection.state === "planned" ? "planned" : collectionState,
+    })),
+  };
+}
+
+function readVaultCommand<T extends string>(
+  helperPath: string,
+  args: string[],
+  isAllowed: (value: string) => value is T,
+): T | null {
+  try {
+    const output = execFileSync("sh", [helperPath, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1_000,
+    }).trim();
+    const firstLine = output.split(/\r?\n/).find((line) => line.trim().length > 0)?.trim() ?? "";
+    return isAllowed(firstLine) ? firstLine : null;
+  } catch {
+    return null;
+  }
+}
+
+function isGuiVaultStatus(value: string): value is GuiVaultStatus {
+  return GUI_VAULT_STATUSES.includes(value as GuiVaultStatus);
+}
+
+function isGuiVaultSetupState(value: string): value is GuiVaultSetupState {
+  return GUI_VAULT_SETUP_STATES.includes(value as GuiVaultSetupState);
+}
+
+function vaultHelperStatus(
+  helperExists: boolean,
+  status: GuiVaultStatus | null,
+  setupState: GuiVaultSetupState | null,
+): GuiVaultStatusData["helper_status"] {
+  if (!helperExists) {
+    return "missing";
+  }
+  return status === null && setupState === null ? "error" : "available";
+}
+
+function fallbackSetupState(status: GuiVaultStatus): GuiVaultSetupState {
+  return status === "uninitialized" ? "uninitialized" : "unknown";
+}
+
+function vaultCollectionState(status: GuiVaultStatus): GuiVaultStatusData["collections"][number]["state"] {
+  if (status === "unlocked") {
+    return "unlocked";
+  }
+  if (status === "locked" || status === "corrupted") {
+    return "locked";
+  }
+  if (status === "uninitialized") {
+    return "not_configured";
+  }
+
+  return "unknown";
+}

package/packages/gui-shared/package.json

@@ -3,6 +3,9 @@
   "version": "0.0.0",
   "private": true,
   "type": "module",
+  "scripts": {
+    "test": "bun test tests"
+  },
   "exports": {
     ".": "./src/index.ts"
   }

package/packages/gui-shared/src/contracts.ts

@@ -1,6 +1,6 @@
 export type GuiRouteClassification = "read" | "write" | "destructive";
 
-export type GuiOperationId = "setup.status.read" | "capabilities.read" | "filesystem.read";
+export type GuiOperationId = "setup.status.read" | "capabilities.read" | "filesystem.read" | "vault.status.read";
 
 export type GuiFileRootId = "agents" | "config" | "localSetup" | "git";
 
@@ -201,6 +201,76 @@ export interface GuiMachineSummary {
   public_ip: string | null;
 }
 
+export type GuiVaultStatus = "uninitialized" | "locked" | "unlocked" | "corrupted" | "unknown";
+
+export type GuiVaultSetupState = "uninitialized" | "test-created" | "restart-required" | "test-verified" | "migration-ready" | "unknown";
+
+export type GuiVaultEncryptionState = "not_configured" | "locked" | "unlocked" | "planned" | "unknown";
+
+export interface GuiVaultCollectionSummary {
+  id: string;
+  label: string;
+  data_class: string;
+  labels: string[];
+  surface_ids: string[];
+  encrypted: boolean;
+  state: GuiVaultEncryptionState;
+  preview_policy: "hidden_while_locked" | "metadata_only" | "placeholder_only";
+  actions_policy: "disabled_while_locked" | "read_only" | "placeholder_disabled";
+}
+
+export interface GuiVaultReadinessSummary {
+  migration_allowed: boolean;
+  setup_required: boolean;
+  restart_test_required: boolean;
+  remote_unlock_enabled: boolean;
+  provider_routing_enforced: boolean;
+  locked_content_hidden: boolean;
+}
+
+export interface GuiVaultDeviceSummary {
+  id_ref: string;
+  label: string;
+  trust_state: "local" | "pending" | "trusted" | "limited" | "revoked" | "retired" | "planned" | "unknown";
+  last_seen: string;
+  audit_head_ref: string;
+}
+
+export interface GuiVaultSyncSummary {
+  status: "not_configured" | "planned" | "ready" | "error" | "unknown";
+  transport_policy: "encrypted_only_untrusted_transport";
+  encrypted_collections: number;
+  pending_requests: number;
+}
+
+export interface GuiVaultAuditSummary {
+  status: "not_started" | "planned" | "recording" | "error" | "unknown";
+  event_count: number;
+  latest_event_ref: string;
+}
+
+export interface GuiVaultStatusData {
+  status: GuiVaultStatus;
+  setup_state: GuiVaultSetupState;
+  initialized: boolean;
+  locked: boolean;
+  unlocked: boolean;
+  available: boolean;
+  helper_status: "available" | "missing" | "error" | "unchecked";
+  path_ref: string;
+  value_policy: "metadata_only_no_secret_material";
+  tooltip: string;
+  unlock_hint: string;
+  setup_hint: string;
+  readiness: GuiVaultReadinessSummary;
+  collections: GuiVaultCollectionSummary[];
+  devices: GuiVaultDeviceSummary[];
+  sync: GuiVaultSyncSummary;
+  secure_messages: GuiVaultSyncSummary;
+  backups: GuiVaultSyncSummary;
+  audit: GuiVaultAuditSummary;
+}
+
 export interface GuiStatusData {
   aidevops_version: string;
   update: {
@@ -231,6 +301,7 @@ export interface GuiStatusData {
   oauth_pool: GuiOAuthPoolSummary;
   setup_targets: GuiSetupTargetSummary[];
   ai_apps: GuiAiAppSummary[];
+  vault: GuiVaultStatusData;
   capabilities: GuiCapabilitySummary[];
   secrets: GuiSecretReference[];
   placeholders: string[];
@@ -258,6 +329,17 @@ export const FILE_EXPLORER_ROUTE_MANIFEST: GuiRouteManifest = {
   redactions: ["secret_values", "credential_paths", "private_key_material"],
 };
 
+export const VAULT_STATUS_ROUTE_MANIFEST: GuiRouteManifest = {
+  route: "/api/vault/status",
+  method: "GET",
+  operation_id: "vault.status.read",
+  classification: "read",
+  source_surface: "vault",
+  adapter: "statusAdapter.readVaultStatus",
+  command_pattern: ["aidevops", "vault", "status"],
+  redactions: ["secret_values", "credential_paths", "private_key_material", "vault_passphrases", "recovery_material"],
+};
+
 export const GUI_FILE_ROOTS: readonly GuiFileRootDefinition[] = [
   {
     id: "agents",
@@ -320,7 +402,7 @@ export function createEnvelope<TData>(input: {
     data: input.data,
     warnings: input.warnings ?? [],
     errors: input.errors ?? [],
-    redactions: ["secret_values", "credential_paths", "private_key_material"],
+    redactions: ["secret_values", "credential_paths", "private_key_material", "vault_passphrases", "recovery_material"],
     observed_at: input.observed_at ?? new Date().toISOString(),
   };
 }

package/packages/gui-shared/src/fixtures.ts

@@ -42,6 +42,7 @@ export const statusFixture: GuiStatusData = {
   ],
   navigation: [
     ["overview", "Overview", "Local setup, update, and API health."],
+    ["vault", "Vault", "Encrypted metadata, setup, sync, and audit."],
     ["agents", "Agents", "Read-only file explorer for deployed agent files."],
     ["config", "Config", "Read-only file explorer for aidevops config."],
     ["git", "Local Repos", "Read-only local git workspace browser."],
@@ -155,6 +156,106 @@ export const statusFixture: GuiStatusData = {
       needs_update: false,
     },
   ],
+  vault: {
+    status: "uninitialized",
+    setup_state: "uninitialized",
+    initialized: false,
+    locked: true,
+    unlocked: false,
+    available: true,
+    helper_status: "unchecked",
+    path_ref: "~/.config/aidevops/vault",
+    value_policy: "metadata_only_no_secret_material",
+    tooltip: "Encrypted by aidevops Vault; contents visible only when unlocked through app or authorised vault commands.",
+    unlock_hint: "Run `aidevops vault unlock` in a local terminal and enter the passphrase only into the hidden prompt.",
+    setup_hint: "Run `aidevops vault init` locally, verify the restart test, then unlock before protected previews or write actions are available.",
+    readiness: {
+      migration_allowed: false,
+      setup_required: true,
+      restart_test_required: false,
+      remote_unlock_enabled: false,
+      provider_routing_enforced: true,
+      locked_content_hidden: true,
+    },
+    collections: [
+      {
+        id: "vault-status",
+        label: "Vault status and setup",
+        data_class: "config metadata",
+        labels: ["internal", "confidential"],
+        surface_ids: ["vault"],
+        encrypted: true,
+        state: "not_configured",
+        preview_policy: "metadata_only",
+        actions_policy: "read_only",
+      },
+      {
+        id: "agent-guidance",
+        label: "Agent guidance and workflows",
+        data_class: "session/history",
+        labels: ["confidential"],
+        surface_ids: ["agents", "localSetup", "config"],
+        encrypted: true,
+        state: "not_configured",
+        preview_policy: "hidden_while_locked",
+        actions_policy: "disabled_while_locked",
+      },
+      {
+        id: "provider-routing",
+        label: "Provider routing metadata",
+        data_class: "config metadata",
+        labels: ["internal", "provider-allowed"],
+        surface_ids: ["security", "aiProviders"],
+        encrypted: true,
+        state: "not_configured",
+        preview_policy: "hidden_while_locked",
+        actions_policy: "disabled_while_locked",
+      },
+      {
+        id: "fleet-messages",
+        label: "Fleet, sync, and secure messages",
+        data_class: "mail/messages",
+        labels: ["client-confidential"],
+        surface_ids: ["devices", "messagingAccounts", "emailAccounts", "inbox", "campaigns", "cases", "projectConfig", "knowledge"],
+        encrypted: true,
+        state: "planned",
+        preview_policy: "hidden_while_locked",
+        actions_policy: "disabled_while_locked",
+      },
+    ],
+    devices: [
+      {
+        id_ref: "local-device",
+        label: "Local device",
+        trust_state: "local",
+        last_seen: "current session",
+        audit_head_ref: "not started",
+      },
+    ],
+    sync: {
+      status: "planned",
+      transport_policy: "encrypted_only_untrusted_transport",
+      encrypted_collections: 0,
+      pending_requests: 0,
+    },
+    secure_messages: {
+      status: "planned",
+      transport_policy: "encrypted_only_untrusted_transport",
+      encrypted_collections: 0,
+      pending_requests: 0,
+    },
+    backups: {
+      status: "planned",
+      transport_policy: "encrypted_only_untrusted_transport",
+      encrypted_collections: 0,
+      pending_requests: 0,
+    },
+    audit: {
+      status: "planned",
+      event_count: 0,
+      latest_event_ref: "not started",
+    },
+  },
   capabilities: [
     {
       id: "setup-status",

package/packages/gui-web/package.json

@@ -20,6 +20,7 @@
     "react-icons": "^5.5.0"
   },
   "scripts": {
-    "dev": "vite --host 127.0.0.1"
+    "dev": "vite --host 127.0.0.1",
+    "test": "bun test tests"
   }
 }

package/packages/gui-web/src/App.tsx

@@ -252,6 +252,7 @@ function DesktopStatusBar({ status }: { status: GuiStatusData }): ReactElement {
   const localRepoCount = status.local_repos.total || status.local_repos.repos.length;
   const remoteRepoCount = status.repos.total || status.repos.repos.length;
   const statusLabel = status.update.restart_required ? "Restart required" : "Ready";
+  const vaultLabel = status.vault?.unlocked ? "Vault unlocked" : `Vault ${status.vault?.status ?? "unknown"}`;
 
   return (
     <div className="desktop-status-bar" role="status">
@@ -262,6 +263,7 @@ function DesktopStatusBar({ status }: { status: GuiStatusData }): ReactElement {
       <span>{localRepoCount} local repos</span>
       <span>{remoteRepoCount} remote repos</span>
       <span>{status.secrets.length} secrets</span>
+      <span>{vaultLabel}</span>
       <span>{oauthAccounts} provider accounts</span>
       <span>{needsUpdate} need update</span>
     </div>

package/packages/gui-web/src/AppNavigation.tsx

@@ -22,6 +22,7 @@ import {
   FiLink,
   FiLink2,
   FiList,
+  FiLock,
   FiMail,
   FiMessageSquare,
   FiMonitor,
@@ -35,6 +36,7 @@ import {
 } from "react-icons/fi";
 import type { FontPreference, FontSizePreference, SidebarMode, SurfaceIconName, SurfaceId, SurfaceNavGroup, SurfaceNavItem, ThemePreference } from "./app-model";
 import { DEFAULT_ACCENT_HUE, dashboardNavItem, fontFamilyForPreference, fontOptions, fontSizeOptions, navGroups, sidebarModeForSurface, surfaceRecordCounts, text } from "./app-model";
+import { VaultPadlock, vaultCollectionForSurface } from "./VaultBadges";
 
 const surfaceIcons: Record<SurfaceIconName, IconType> = {
   apps: FiBox,
@@ -53,6 +55,7 @@ const surfaceIcons: Record<SurfaceIconName, IconType> = {
   hardDrive: FiHardDrive,
   link: FiLink,
   list: FiList,
+  lock: FiLock,
   mail: FiMail,
   message: FiMessageSquare,
   note: FiMessageSquare,
@@ -138,9 +141,9 @@ export function Sidebar({ activeSurface, accentHue, canGoBack, canGoForward, fon
       <nav className="sidebar-content">
         <SidebarModeTabs mode={sidebarMode} setMode={setSidebarMode} />
         <ul className="sidebar-top-link">
-          <SidebarItem activeSurface={activeSurface} item={dashboardNavItem} setActiveSurface={setActiveSurface} showCount={false} />
+          <SidebarItem activeSurface={activeSurface} item={dashboardNavItem} setActiveSurface={setActiveSurface} showCount={false} status={status} />
         </ul>
-        {visibleGroups.map((group) => <SidebarGroup activeSurface={activeSurface} group={group} key={group.label} recordCounts={recordCounts} setActiveSurface={setActiveSurface} showNavCounts={showNavCounts} />)}
+        {visibleGroups.map((group) => <SidebarGroup activeSurface={activeSurface} group={group} key={group.label} recordCounts={recordCounts} setActiveSurface={setActiveSurface} showNavCounts={showNavCounts} status={status} />)}
       </nav>
       <SidebarFooter
         accentHue={accentHue}
@@ -187,32 +190,36 @@ function SidebarModeTabs({ mode, setMode }: {
   );
 }
 
-function SidebarGroup({ activeSurface, group, recordCounts, setActiveSurface, showNavCounts }: {
+function SidebarGroup({ activeSurface, group, recordCounts, setActiveSurface, showNavCounts, status }: {
   activeSurface: SurfaceId;
   group: SurfaceNavGroup;
   recordCounts: Partial<Record<SurfaceId, number>>;
   setActiveSurface: (surface: SurfaceId) => void;
   showNavCounts: boolean;
+  status: GuiStatusData;
 }) {
   return (
     <section className="sidebar-group">
       <h2>{group.label}</h2>
       <ul>
-        {group.items.map((item) => <SidebarItem activeSurface={activeSurface} item={item} key={item.id} recordCount={recordCounts[item.id]} setActiveSurface={setActiveSurface} showCount={showNavCounts} />)}
+        {group.items.map((item) => <SidebarItem activeSurface={activeSurface} item={item} key={item.id} recordCount={recordCounts[item.id]} setActiveSurface={setActiveSurface} showCount={showNavCounts} status={status} />)}
       </ul>
     </section>
   );
 }
 
-function SidebarItem({ activeSurface, item, recordCount, setActiveSurface, showCount }: {
+function SidebarItem({ activeSurface, item, recordCount, setActiveSurface, showCount, status }: {
   activeSurface: SurfaceId;
   item: SurfaceNavItem;
   recordCount?: number;
   setActiveSurface: (surface: SurfaceId) => void;
   showCount: boolean;
+  status: GuiStatusData;
 }) {
   const isActive = activeSurface === item.id;
-  const tooltip = `${item.label}: ${item.description}`;
+  const vaultCollection = vaultCollectionForSurface(status.vault, item.id);
+  const vaultTooltip = vaultCollection ? ` ${text.vaultTooltip}` : "";
+  const tooltip = `${item.label}: ${item.description}${vaultTooltip}`;
   const shouldShowCount = showCount && recordCount !== undefined && recordCount > 0;
 
   return (
@@ -232,6 +239,7 @@ function SidebarItem({ activeSurface, item, recordCount, setActiveSurface, showC
             {shouldShowCount ? <span className="surface-count">({recordCount})</span> : null}
           </span>
         </span>
+        {vaultCollection ? <VaultPadlock collection={vaultCollection} compact vault={status.vault} /> : null}
         {item.badge ? <em>{item.badge}</em> : null}
       </button>
     </li>

package/packages/gui-web/src/AppWorkspace.tsx

@@ -6,7 +6,8 @@ import type { SurfaceId, SurfaceNavItem } from "./app-model";
 import { inventorySurfaceConfigs, text } from "./app-model";
 import { FileExplorerSurface } from "./FileExplorerSurface";
 import { AppsSurface, EditableInventorySurface, InstallationSurface } from "./InventorySurfaces";
-import { AiProvidersSurface, LocalReposSurface, OverviewSurface, PlannedSurface, ProjectsSurface, SecuritySurface } from "./StatusSurfaces";
+import { AiProvidersSurface, LocalReposSurface, LockedVaultGate, OverviewSurface, PlannedSurface, ProjectsSurface, SecuritySurface, VaultSurface } from "./StatusSurfaces";
+import { isVaultSurfaceLocked, vaultCollectionForSurface } from "./VaultBadges";
 
 export function Workspace({ activeItem, activeSectionLabel, activeSurface, fileRoot, status }: {
   activeItem: SurfaceNavItem;
@@ -19,7 +20,7 @@ export function Workspace({ activeItem, activeSectionLabel, activeSurface, fileR
     <section className="app-inset" aria-label={text.workspaceLabel}>
       <WorkspaceHeader activeItem={activeItem} activeSectionLabel={activeSectionLabel} version={displayVersion(status)} />
       <div className="workspace-scroll">
-        <SurfaceContent activeSurface={activeSurface} fileRoot={fileRoot} status={status} />
+        <SurfaceContent activeItem={activeItem} activeSurface={activeSurface} fileRoot={fileRoot} status={status} />
       </div>
     </section>
   );
@@ -60,14 +61,17 @@ function displayVersion(status: GuiStatusData): string {
   return status.aidevops_version;
 }
 
-function SurfaceContent({ activeSurface, fileRoot, status }: {
+function SurfaceContent({ activeItem, activeSurface, fileRoot, status }: {
+  activeItem: SurfaceNavItem;
   activeSurface: SurfaceId;
   fileRoot: GuiFileRootId | undefined;
   status: GuiStatusData;
 }) {
   const inventoryConfig = inventorySurfaceConfigs[activeSurface];
+  const vaultCollection = vaultCollectionForSurface(status.vault, activeSurface);
   const staticSurfaces: Partial<Record<SurfaceId, ReactNode>> = {
     overview: <OverviewSurface status={status} />,
+    vault: <VaultSurface status={status} />,
     routines: <PlannedSurface label={text.routines} detail={text.routineDetail} />,
     devices: <PlannedSurface label={text.devices} detail={text.devicesIntro} />,
     vpnsProxies: <PlannedSurface label={text.vpnsProxies} detail={text.vpnsProxiesIntro} />,
@@ -98,6 +102,10 @@ function SurfaceContent({ activeSurface, fileRoot, status }: {
     aiProviders: <AiProvidersSurface status={status} />,
   };
 
+  if (isVaultSurfaceLocked(status.vault, activeSurface) && vaultCollection) {
+    return <LockedVaultGate collection={vaultCollection} label={activeItem.label} vault={status.vault} />;
+  }
+
   if (activeSurface === "git") {
     return <LocalReposSurface status={status} />;
   }

package/packages/gui-web/src/StatusSurfaces.tsx

@@ -1,9 +1,10 @@
 /* jshint esversion: 11 */
 import { useState } from "react";
-import type { GuiAiAppSummary, GuiLocalRepoSetupSummary, GuiOAuthProviderSummary, GuiSetupTargetSummary, GuiStatusData } from "../../gui-shared/src";
+import type { GuiAiAppSummary, GuiLocalRepoSetupSummary, GuiOAuthProviderSummary, GuiSetupTargetSummary, GuiStatusData, GuiVaultCollectionSummary, GuiVaultStatusData } from "../../gui-shared/src";
 import { plannedHomes, text } from "./app-model";
 import { FileExplorerSurface } from "./FileExplorerSurface";
 import { PathActions } from "./PathActions";
+import { VaultPadlock } from "./VaultBadges";
 
 export function OverviewSurface({ status }: { status: GuiStatusData }) {
   const metrics = [
@@ -103,6 +104,9 @@ export function SecuritySurface({ status }: { status: GuiStatusData }) {
         <h2>{text.security}</h2>
         <p>{text.securityBoundary}</p>
       </div>
+      <div className="notice compact-notice" role="note">
+        Vault data policy: Provider AI sends approved plaintext context to a third-party provider; Local AI keeps model processing on this device; Hybrid mode must redact or split protected context before any provider call.
+      </div>
       <ul className="object-list">
         {status.secrets.map((secret) => (
           <li key={secret.name}>
@@ -115,6 +119,149 @@ export function SecuritySurface({ status }: { status: GuiStatusData }) {
   );
 }
 
+export function VaultSurface({ status }: { status: GuiStatusData }) {
+  const vault = status.vault;
+  const vaultCollection = vault.collections.find((collection) => collection.surface_ids.includes("vault")) ?? vault.collections[0];
+  const readiness = [
+    { label: "migration", value: vault.readiness.migration_allowed ? "ready" : "blocked" },
+    { label: "setup", value: vault.readiness.setup_required ? "required" : "done" },
+    { label: "restart test", value: vault.readiness.restart_test_required ? "required" : "verified" },
+    { label: "remote unlock", value: vault.readiness.remote_unlock_enabled ? "enabled" : "disabled" },
+  ];
+  const featureCards = [
+    { label: text.vaultStatus, value: vault.status, detail: "Metadata-only lock state from the local helper." },
+    { label: text.vaultSetup, value: vault.setup_state, detail: vault.setup_hint },
+    { label: text.vaultLockUnlock, value: vault.locked ? "locked" : "unlocked", detail: vault.unlock_hint },
+    { label: text.vaultDevices, value: `${vault.devices.length} device`, detail: "Device trust metadata only; private keys are never exposed." },
+    { label: text.vaultSync, value: vault.sync.status, detail: "Encrypted bundles and signed manifests over untrusted transports." },
+    { label: text.vaultMessages, value: vault.secure_messages.status, detail: "Secure message placeholders keep payloads hidden while locked." },
+    { label: text.vaultBackups, value: vault.backups.status, detail: "Encrypted backups and recovery flows are metadata-only here." },
+    { label: text.vaultAudit, value: vault.audit.status, detail: `${vault.audit.event_count} redacted audit events; ${vault.audit.latest_event_ref}.` },
+  ];
+
+  return (
+    <section className="surface-page vault-surface" aria-label={text.vault}>
+      <div className="hero-panel vault-hero">
+        <div className="section-heading split-heading">
+          <div>
+            <p className="eyebrow">{vault.value_policy}</p>
+            <h2>{text.vault}</h2>
+            <p>{text.vaultIntro}</p>
+          </div>
+          {vaultCollection ? <VaultPadlock collection={vaultCollection} vault={vault} /> : null}
+        </div>
+        <div className="vault-readiness-strip" aria-label="Vault readiness">
+          {readiness.map((item) => <span key={item.label}><strong>{item.label}</strong>{item.value}</span>)}
+        </div>
+      </div>
+      {vault.locked ? (
+        <div className="notice compact-notice" role="note">
+          {text.vaultLockedPreview} {vault.unlock_hint}
+        </div>
+      ) : (
+        <div className="notice compact-notice" role="note">
+          Vault is unlocked for this local session. Protected actions remain read-only until audited write routes are implemented.
+        </div>
+      )}
+      <div className="vault-card-grid">
+        {featureCards.map((card) => <VaultFeatureCard detail={card.detail} key={card.label} label={card.label} value={card.value} />)}
+      </div>
+      <section className="panel vault-setup-panel" aria-label={text.vaultSetup}>
+        <div className="section-heading split-heading">
+          <div>
+            <p className="eyebrow">{text.vaultSetup}</p>
+            <h2>{vault.readiness.setup_required ? "Setup required" : "Setup metadata"}</h2>
+            <p>{vault.setup_hint}</p>
+          </div>
+          <button className="secondary-action vault-cta" disabled title={vault.unlock_hint} type="button">{text.vaultUnlockCta}</button>
+        </div>
+        <ol className="vault-step-list">
+          <li>Initialize locally with the hidden-prompt helper.</li>
+          <li>Verify the harmless restart test before migrating real data.</li>
+          <li>Keep passphrases, recovery material, and private keys out of chat, arguments, environment variables, logs, issues, and fixtures.</li>
+        </ol>
+        <code>{vault.unlock_hint}</code>
+      </section>
+      <section className="panel" aria-label="Vault encrypted collections">
+        <div className="section-heading">
+          <p className="eyebrow">{text.vaultStatus}</p>
+          <h2>Encrypted collections</h2>
+          <p>{text.vaultCollectionIntro}</p>
+        </div>
+        <ul className="object-list vault-collection-list">
+          {vault.collections.map((collection) => <VaultCollectionRow collection={collection} key={collection.id} vault={vault} />)}
+        </ul>
+      </section>
+      <section className="panel" aria-label="Vault devices and audit">
+        <div className="section-heading split-heading">
+          <div>
+            <p className="eyebrow">{text.vaultDevices}</p>
+            <h2>Devices, sync, messages, backups, and audit</h2>
+            <p>These placeholders expose readiness and redacted metadata only. Git, object storage, messaging, SSH, VPNs, and VPS disks remain untrusted transports.</p>
+          </div>
+          <span className="count-pill">{vault.sync.transport_policy}</span>
+        </div>
+        <div className="vault-device-grid">
+          {vault.devices.map((device) => (
+            <article className="vault-device-card" key={device.id_ref}>
+              <p className="eyebrow">{device.trust_state}</p>
+              <h3>{device.label}</h3>
+              <Detail label="device" value={device.id_ref} />
+              <Detail label="last seen" value={device.last_seen} />
+              <Detail label="audit head" value={device.audit_head_ref} />
+            </article>
+          ))}
+        </div>
+      </section>
+    </section>
+  );
+}
+
+export function LockedVaultGate({ collection, label, vault }: {
+  collection: GuiVaultCollectionSummary;
+  label: string;
+  vault: GuiVaultStatusData;
+}) {
+  return (
+    <section className="panel vault-locked-gate" aria-label={`${label} locked by Vault`}>
+      <div className="section-heading split-heading">
+        <div>
+          <p className="eyebrow">{collection.data_class}</p>
+          <h2>{label} is locked</h2>
+          <p>{text.vaultLockedPreview}</p>
+        </div>
+        <VaultPadlock collection={collection} vault={vault} />
+      </div>
+      <div className="notice compact-notice" role="note">
+        {text.vaultTooltip} {vault.unlock_hint}
+      </div>
+      <button className="secondary-action vault-cta" disabled title={vault.unlock_hint} type="button">{text.vaultUnlockCta}</button>
+    </section>
+  );
+}
+
+function VaultFeatureCard({ detail, label, value }: { detail: string; label: string; value: string }) {
+  return (
+    <article className="vault-feature-card">
+      <span>{label}</span>
+      <strong>{value}</strong>
+      <small>{detail}</small>
+    </article>
+  );
+}
+
+function VaultCollectionRow({ collection, vault }: { collection: GuiVaultCollectionSummary; vault: GuiVaultStatusData }) {
+  return (
+    <li>
+      <strong>{collection.label}</strong>
+      <VaultPadlock collection={collection} compact vault={vault} />
+      <span>{collection.preview_policy}</span>
+      <small>{collection.labels.join(", ")}</small>
+      <small>{collection.surface_ids.join(", ")}</small>
+    </li>
+  );
+}
+
 export function LocalReposSurface({ status }: { status: GuiStatusData }) {
   const [activeTab, setActiveTab] = useState<"setup" | "files">("setup");
 
@@ -309,6 +456,9 @@ export function AiProvidersSurface({ status }: { status: GuiStatusData }) {
         </div>
         <span className="count-pill">{status.oauth_pool.value_policy}</span>
       </div>
+      <div className="notice compact-notice" role="note">
+        Data-leaves-device warning: provider accounts can process prompts outside this machine. Use `data_classification` and `runtime_policy` metadata to require Local AI or explicit provider approval for confidential work.
+      </div>
       <div className="provider-grid">
         {status.oauth_pool.providers.map((provider) => <ProviderCard key={provider.provider} provider={provider} />)}
       </div>

package/packages/gui-web/src/VaultBadges.tsx

@@ -0,0 +1,39 @@
+import type { GuiVaultCollectionSummary, GuiVaultStatusData } from "@aidevops/gui-shared";
+import { FiLock, FiUnlock } from "react-icons/fi";
+import type { SurfaceId } from "./app-model";
+import { text } from "./app-model";
+
+export function vaultCollectionForSurface(
+  vault: GuiVaultStatusData,
+  surface: SurfaceId,
+): GuiVaultCollectionSummary | undefined {
+  return vault.collections.find((collection) => collection.surface_ids.includes(surface));
+}
+
+export function isVaultSurfaceLocked(vault: GuiVaultStatusData, surface: SurfaceId): boolean {
+  const collection = vaultCollectionForSurface(vault, surface);
+  return surface !== "vault" && collection?.encrypted === true && !vault.unlocked;
+}
+
+export function VaultPadlock({ collection, compact = false, vault }: {
+  collection: GuiVaultCollectionSummary;
+  compact?: boolean;
+  vault: GuiVaultStatusData;
+}) {
+  const locked = collection.state !== "unlocked" || !vault.unlocked;
+  const stateLabel = locked ? "Locked" : "Unlocked";
+  const Icon = locked ? FiLock : FiUnlock;
+  const tooltip = `${stateLabel}: ${text.vaultTooltip}`;
+
+  return (
+    <span
+      aria-label={`${stateLabel} by aidevops Vault: ${collection.label}`}
+      className={compact ? "vault-padlock compact" : "vault-padlock"}
+      data-vault-state={locked ? "locked" : "unlocked"}
+      title={tooltip}
+    >
+      <Icon aria-hidden="true" focusable="false" />
+      <span>{compact ? stateLabel : `${stateLabel} by Vault`}</span>
+    </span>
+  );
+}

package/packages/gui-web/src/app-model.ts

@@ -32,6 +32,7 @@ export const surfaceIconNames = {
   hardDrive: true,
   link: true,
   list: true,
+  lock: true,
   mail: true,
   message: true,
   note: true,
@@ -45,6 +46,7 @@ export const surfaceIconNames = {
 export type SurfaceIconName = keyof typeof surfaceIconNames;
 export const surfaceIds = [
   "overview",
+  "vault",
   "agents",
   "config",
   "localSetup",
@@ -180,7 +182,7 @@ export const text = {
   aiApps: "AI Apps",
   aiAppsIntro: "Local AI app, CLI, config, and aidevops prompt targets. Versions are read-only and compare installed aidevops files with the current checkout.",
   aiProviders: "AI Providers",
-  aiProvidersIntro: "OAuth pool account metadata by provider. Tokens stay hidden; management controls are shown as planned safe actions.",
+  aiProvidersIntro: "OAuth pool account metadata by provider. Tokens stay hidden; Provider AI means task data leaves this device unless Vault policy routes it to Local AI or Hybrid mode.",
   madeForCreators: "Made for creators",
   maintenance: "Maintenance",
   management: "Management",
@@ -218,7 +220,7 @@ export const text = {
   searchPlaceholder: "Search setup, files, providers",
   secrets: "Secrets",
   security: "Secrets",
-  securityBoundary: "No write routes, no shell bridge, no hosted app control, no pairing, no secret values.",
+  securityBoundary: "No write routes, no shell bridge, no hosted app control, no pairing, no secret values. Vault policy distinguishes Provider AI, Local AI, and Hybrid modes before protected data leaves the device.",
   servers: "Servers",
   serversIntro: "Server inventory by provider, operating system, orchestrator, and installed apps.",
   setup: "Setup",
@@ -238,6 +240,21 @@ export const text = {
   fontSize: "Font size",
   truncated: "Preview truncated for safety.",
   update: "Update",
+  vault: "Vault",
+  vaultAudit: "Audit Logs",
+  vaultBackups: "Backups & Recovery",
+  vaultCollectionIntro: "Encrypted collections are metadata-only while locked. Protected previews and write actions stay disabled until a local unlock succeeds.",
+  vaultDevices: "Devices",
+  vaultIntro: "Local encrypted metadata, lock/unlock readiness, device trust, encrypted sync, secure messages, backups, and audit placeholders.",
+  vaultLockedPreview: "Vault locked: protected previews are hidden and write actions are disabled.",
+  vaultLockUnlock: "Lock / Unlock",
+  vaultMessages: "Secure Messages",
+  vaultSetup: "First-use Setup",
+  vaultStatus: "Status",
+  vaultSync: "Sync",
+  vaultTooltip: "Encrypted by aidevops Vault; contents visible only when unlocked through app or authorised vault commands.",
+  vaultUnlockCta: "Unlock Vault",
+  vaultUnlockHint: "Run `aidevops vault unlock` in a local terminal and enter the passphrase only into the hidden prompt.",
   website: "Website",
   websites: "Websites",
   websitesIntro: "Websites, landing pages, publishing homes, and ownership status are planned.",
@@ -286,6 +303,7 @@ export const navGroups: SurfaceNavGroup[] = [
     label: text.operations,
     mode: "devops",
     items: [
+      { id: "vault", label: text.vault, description: "Encrypted metadata, setup, sync, and audit", icon: "lock" },
       { id: "agents", label: "Agents", description: "~/.aidevops/agents explorer", icon: "document" },
       { id: "config", label: text.config, description: "~/.config/aidevops explorer", icon: "settings" },
       { id: "localSetup", label: text.localSetup, description: "~/.aidevops explorer", icon: "terminal" },
@@ -392,6 +410,7 @@ export const installationRows = [
 
 export const plannedHomes = [
   { area: "Setup/status", home: "Dashboard + Local Setup", phase: "P6" },
+  { area: "Vault", home: "Vault status, setup, devices, sync, messages, backups, audit", phase: "P6/Vault" },
   { area: "Local and remote repos", home: "Local Repos + Remote Repos", phase: "P7" },
   { area: "Infrastructure inventory", home: "Domains, Registrars, Hosts, Servers", phase: "P8" },
   { area: "Provider catalog", home: "Registrars, Hosts, Apps", phase: "P9" },
@@ -536,6 +555,7 @@ export function surfaceRecordCounts(status: GuiStatusData): SurfaceRecordCounts
     registrars: populatedInventoryRowCount("registrars"),
     security: status.secrets.length,
     servers: populatedInventoryRowCount("servers"),
+    vault: status.vault.collections.length,
   };
 }
 

package/packages/gui-web/src/dashboard.ts

@@ -27,6 +27,9 @@ export function renderDashboardHtml(status: GuiResponseEnvelope<GuiStatusData>):
   const aiApps = status.data.ai_apps
     .map((app) => `<li>${escapeHtml(app.name)}: ${escapeHtml(app.status)} ${escapeHtml(app.aidevops_version)} → ${escapeHtml(app.latest_version)}</li>`)
     .join("");
+  const vaultCollections = status.data.vault.collections
+    .map((collection) => `<li>${escapeHtml(collection.label)}: ${escapeHtml(collection.state)} ${escapeHtml(collection.preview_policy)}</li>`)
+    .join("");
   const settings = status.data.settings.keys
     .map((key) => `<li>${escapeHtml(key)}</li>`)
     .join("");
@@ -35,7 +38,7 @@ export function renderDashboardHtml(status: GuiResponseEnvelope<GuiStatusData>):
     .join("");
   const navSections = [
     { heading: "Development", items: ["Local Repos", "Remote Repos", "Secrets", "AI Providers"] },
-    { heading: "Operations", items: ["Dashboard", "Agents file explorer", "Config", "Local Setup", "Routines"] },
+    { heading: "Operations", items: ["Dashboard", "Vault", "Agents file explorer", "Config", "Local Setup", "Routines"] },
     { heading: "Infrastructure", items: ["Devices", "VPNs & Proxies", "Apps", "Installation", "Registrars", "Hosts", "Servers"] },
     { heading: "Identities", items: ["Brands", "Domains", "Personas"] },
     { heading: "Sites", items: ["Websites", "Forums", "Social Media", "Marketplaces"] },
@@ -53,11 +56,13 @@ export function renderDashboardHtml(status: GuiResponseEnvelope<GuiStatusData>):
     `<p>AI-assisted development workflows, code quality, and deployment automation.</p>`,
     `<p>Theme follows system preferences with light and dark overrides. Sidebar modes: DevOps and Comms. Appearance controls can be hidden or shown, and include editable Hue, icon Reset, Show borders toggle, Show counts toggle, Font size choices xs, s, m, lg, xl, and Font options: IBM Plex Mono, IBM Plex Sans, IBM Plex Serif, Inter, Menlo (default), Playpen Sans, Poppins, Source Sans, Source Serif, Tilt Neon, Ubuntu Mono. A desktop status bar shows local readiness, repo totals, secret reference count, provider accounts, and update state.</p>`,
     `<p>Secret references stay read-only and redacted.</p>`,
+    `<p>Vault surfaces show padlock indicators. Encrypted by aidevops Vault; contents visible only when unlocked through app or authorised vault commands.</p>`,
     `<p>${escapeHtml(status.data.update.message)}</p>`,
     renderedNavSections,
     `<h2>Path health</h2><ul>${paths}</ul>`,
     `<h2>Installed aidevops targets</h2><ul>${setupTargets}</ul>`,
     `<h2>AI Apps</h2><ul>${aiApps}</ul>`,
+    `<h2>Vault</h2><p>${escapeHtml(status.data.vault.status)} / ${escapeHtml(status.data.vault.setup_state)}</p><ul>${vaultCollections}</ul>`,
     `<h2>Local Repo Setup</h2><ul>${localRepos}</ul>`,
     `<h2>Remote Repos</h2><ul>${repos}</ul>`,
     `<h2>AI Provider Pools</h2><ul>${aiProviders}</ul>`,

package/packages/gui-web/src/status-client.ts

@@ -85,6 +85,17 @@ function normalizeStatusEnvelope(envelope: GuiResponseEnvelope<Partial<GuiStatus
       oauth_pool: { ...statusFixture.oauth_pool, ...data.oauth_pool, providers: data.oauth_pool?.providers ?? statusFixture.oauth_pool.providers },
       setup_targets: data.setup_targets ?? statusFixture.setup_targets,
       ai_apps: data.ai_apps ?? statusFixture.ai_apps,
+      vault: {
+        ...statusFixture.vault,
+        ...data.vault,
+        readiness: { ...statusFixture.vault.readiness, ...data.vault?.readiness },
+        collections: data.vault?.collections ?? statusFixture.vault.collections,
+        devices: data.vault?.devices ?? statusFixture.vault.devices,
+        sync: { ...statusFixture.vault.sync, ...data.vault?.sync },
+        secure_messages: { ...statusFixture.vault.secure_messages, ...data.vault?.secure_messages },
+        backups: { ...statusFixture.vault.backups, ...data.vault?.backups },
+        audit: { ...statusFixture.vault.audit, ...data.vault?.audit },
+      },
       capabilities: data.capabilities ?? statusFixture.capabilities,
       secrets: data.secrets ?? statusFixture.secrets,
       placeholders: data.placeholders ?? statusFixture.placeholders,

package/packages/gui-web/src/styles.css

@@ -430,6 +430,39 @@ code {
   font-weight: 700;
 }
 
+.vault-padlock {
+  align-items: center;
+  background: color-mix(in srgb, #d97706 13%, transparent);
+  border: 1px solid color-mix(in srgb, #d97706 38%, transparent);
+  border-radius: 999px;
+  color: #b45309;
+  display: inline-flex;
+  flex: 0 0 auto;
+  font-size: 0.74rem;
+  font-weight: 900;
+  gap: 4px;
+  padding: 5px 9px;
+  text-transform: uppercase;
+  white-space: nowrap;
+}
+
+.vault-padlock svg {
+  height: 14px;
+  stroke-width: 2.6;
+  width: 14px;
+}
+
+.vault-padlock.compact {
+  font-size: 0.66rem;
+  padding: 3px 6px;
+}
+
+.vault-padlock[data-vault-state="unlocked"] {
+  background: color-mix(in srgb, var(--accent) 14%, transparent);
+  border-color: color-mix(in srgb, var(--accent) 38%, transparent);
+  color: var(--accent);
+}
+
 .sidebar-group h2 {
   font-size: max(12.5px, 0.84em);
 }
@@ -755,6 +788,32 @@ code {
   padding: clamp(24px, 5vw, 42px);
 }
 
+.vault-hero {
+  display: grid;
+  gap: 16px;
+}
+
+.vault-readiness-strip {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+.vault-readiness-strip span {
+  background: var(--surface-elevated);
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  color: var(--text-secondary);
+  display: inline-flex;
+  gap: 6px;
+  padding: 7px 10px;
+}
+
+.vault-readiness-strip strong {
+  color: var(--accent);
+  text-transform: uppercase;
+}
+
 .compact-hero h2 {
   font-size: clamp(3rem, 10vw, 5rem);
   letter-spacing: -0.08em;
@@ -1141,7 +1200,9 @@ code {
 .repo-card-grid,
 .provider-grid,
 .setup-card-grid,
-.ai-app-grid {
+.ai-app-grid,
+.vault-card-grid,
+.vault-device-grid {
   display: grid;
   gap: 14px;
   grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
@@ -1150,7 +1211,9 @@ code {
 .repo-setup-card,
 .provider-card,
 .setup-target-card,
-.ai-app-card {
+.ai-app-card,
+.vault-feature-card,
+.vault-device-card {
   background: var(--surface-muted);
   border: 1px solid var(--border);
   border-radius: 18px;
@@ -1175,11 +1238,48 @@ code {
 .repo-setup-card h3,
 .provider-card h3,
 .setup-target-card h3,
-.ai-app-card h3 {
+.ai-app-card h3,
+.vault-device-card h3 {
   font-size: 1rem;
   margin: 0 0 5px;
 }
 
+.vault-feature-card span {
+  color: var(--accent);
+  font-size: 0.76rem;
+  font-weight: 900;
+  text-transform: uppercase;
+}
+
+.vault-feature-card strong {
+  display: block;
+  font-size: 1.35rem;
+  letter-spacing: -0.04em;
+}
+
+.vault-feature-card small {
+  color: var(--text-muted);
+}
+
+.vault-step-list {
+  color: var(--text-secondary);
+  margin: 0;
+  padding-left: 1.2rem;
+}
+
+.vault-setup-panel code {
+  display: inline-block;
+  margin-top: 10px;
+}
+
+.vault-cta {
+  justify-self: start;
+}
+
+.vault-collection-list li {
+  align-items: center;
+}
+
 .repo-setup-card code,
 .repo-remotes code,
 .setup-path-row code {

package/setup.sh

@@ -12,7 +12,7 @@ shopt -s inherit_errexit 2>/dev/null || true
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.22.3
+# Version: 3.22.5
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)