# Aftercurve Vault 1.0.0

An installable, offline Manifest V3 extension for desktop Chromium browsers. Stores logins, API keys, private notes, and recovery codes. Includes a random password generator, local password-health checks, encrypted backups, explicit exact-origin autofill, password/key rotation, and verified offline ML-KEM-768 device transfer. No contracts, account, server, analytics, cloud sync, or runtime network requests.

## Install the release

1. Download `aftercurve-vault-1.0.0.zip` from https://aftercurve.app/vault.html and compare its SHA-256 with the published checksums if desired.
2. Extract the ZIP into a permanent folder. Open `chrome://extensions` (or the equivalent extensions page in a Chromium browser).
3. Enable Developer mode, choose **Load unpacked**, and select the extracted folder containing `manifest.json`.
4. Pin Aftercurve Vault. Click it to open the vault, choose a long unique master password (minimum 16 characters), and export an encrypted backup.

This download is an unpacked extension, not a Chrome Web Store listing. Desktop Chromium is the release target; this is not an Android application. No signing key or store-publishing account is bundled.

## Use

- Add entries and save. The success message appears only after ciphertext has been persisted.
- Use the toolbar icon on an HTTPS login page, unlock the vault, open a saved login for that exact origin, then choose **Fill login**. It never submits the form. Cross-origin forms, ambiguous fields, iframes, and new-password forms fail closed.
- The vault locks when its tab is hidden, closed, or reloaded, and after the selected idle interval. Unlocking after browser restart is required.
- Backups are encrypted with the password in effect at export time. Keep that password separately. Uninstalling deletes local storage. There is no password reset.
- Restore a backup into an empty installation, or unlock an existing vault and import it. Imports preview entries, add without overwriting, and skip identical records.
- Device transfer uses three offline steps described in `TRANSFER.md`.
- Change the master password in Settings. This generates a new vault encryption key and reencrypts all data. Export a fresh backup after changing it.

## Update

Export a backup first. Replace the files in the same permanent extension folder, then click Reload on the existing extension entry. Do not remove and reinstall it to update: removal deletes extension storage. Close duplicate vault tabs before updating. All browser-managed extension updates terminate the current unlocked page session.

## Build and verify

Requires Node 24+, Python 3, Pillow, and the pinned npm lockfile. In the source tree:

```sh
npm ci --ignore-scripts
npm run build
python3 scripts/package.py
npm test
```

In the downloadable standalone source archive, brand assets are included in `brand-assets/`; the build and packaging scripts support that layout. The website repository instead supplies the same assets under `../dist/assets/`.

`release/aftercurve-vault/` is loadable via Developer mode. ZIP files are deterministically packaged with fixed timestamps. `dist/downloads/checksums.txt` lists SHA-256 digests. All runtime dependencies are bundled; no remote executable code is fetched. This source includes the application tests, crypto vector provenance, dependency lockfile, threat model, and privacy policy.

## Security status

Version 1.0.0 is functional software, not a mocked interface. It has **not received an independent security audit**, and source/unit/integration verification does not constitute browser compatibility certification. See `SECURITY.md` for validation details and remaining release-assurance work. It does not change Ethereum signatures or make an existing wallet quantum-resistant. Do not treat it as a hardware wallet.