Development log 01: key handling and offline integrity

23 October 2026 · By V. This entry summarises the recorded internal development review for VVault/VRelay 0.2.9 and V Cipher 0.1.9 research. Development records and the live download are separate: check the version shown in the app and its release notes before testing.

Reduce raw private-key export

V Cipher’s active and restored identity keys now use non-extractable browser keys in the reviewed development source. Fresh creation prepares the encrypted backup before hardening and activating the identity. Tests cover export refusal, interoperability, cleanup and interrupted operations.

This reduces one export surface. It cannot stop compromised page code from using an available key, protect an already compromised device or guarantee browser memory erasure. Keep the original encrypted backup: active and restored sessions deliberately refuse re-export.

Offline integrity includes response policy

Checking file bytes alone does not verify the policy under which they run. The reviewed offline implementation pins canonical response headers alongside content hashes and reconstructs responses from that pinned policy. Missing policy metadata fails closed. The internal record reports 31 offline tests passing after the changes.

Verify dependencies and native payloads

The recorded checks compare retained QR dependency source and generated runtime files with their documented transformations. A separate clean compilation reproduced the VGuard candidate’s eight uncompressed APK payload entries using the specified toolchain. That does not mean the complete signed APK container was reproduced byte for byte, or that Android enforcement was tested.

Evidence and remaining work

The source record reports 240 Node tests passing for that review. This is an internal result, not an independent audit or a new test run performed for this article. Physical Android routing, phone-browser behaviour and two-phone camera operation remain open. V Cipher lacks forward secrecy and keeps replay history for one unlocked session.

Read the detailed source record · Current testing boundaries