# Aftercurve Vault 1.0.0 — validation record

Executed 12 October 2026 on Node 24.19.0, Linux. The Node test runner reported **30 passing tests, 0 failures, 0 skipped**. These are source, cryptographic, worker integration, mocked browser-boundary, and static package checks. They are not tests in an installed Chrome browser.

## Executed coverage

- Argon2id: RFC 9106 section 5.3 known-answer vector.
- Final ML-KEM-768: 34 NIST ACVP FIPS 203 cases: two key generations, two deterministic encapsulations, ten decapsulations (including implicit rejection), ten decapsulation-key checks and ten encapsulation-key checks. Fixture provenance and source-file hashes are in `tests/fixtures/nist-ml-kem-768.json`. This is a subset of ACVP cases, not a NIST validation or certification.
- Vault: complete-record round trip, absence of plaintext entry values in persisted envelopes, wrong passwords, modified ciphertext/ID/revision, new nonces, wrapped-key continuity, encrypted backups excluding transfer private keys, and best-effort key-buffer wiping.
- Hostile inputs: fixed KDF profile, unknown versions/fields, invalid lengths, oversized files, duplicate record IDs, HTTPS origin parsing and multi-megabyte Base64 regression.
- Transfers: round trip, independent recipient/package fingerprint checks, modified ciphertext and headers, expiry, unrelated recipient and replay rejection.
- Worker integration: create/save/read/delete, metadata-only summaries, backup restoration, explicit import previews, duplicate skipping, cancellation, fresh-key password rotation, wrong-current-password rejection, inactivity/backwards-clock locking and atomic transfer consumption.
- Mocked Chrome API boundary: sender ID/URL/frame validation, serialized compare-and-swap storage, stale/revision conflicts, quota failure, one-time toolbar permission, expiry and exact-origin/top-frame targeting.
- DOM model for autofill: expected field filling, no form submission, iframe/wrong-origin/hidden/read-only/new-password/ambiguous-field rejection, resolved cross-origin form destinations and submitter overrides.
- Static package: unique UI IDs and bindings, CSP, narrow permissions, no HTML injection sinks, lock-generation checks, bundled scripts/assets/licenses and documentation.

## Remaining release-assurance work

No independent application or cryptographic audit has been performed. The post-quantum dependency also does not claim an independent audit. No supported browser-control capability was available in this build environment, so no actual-browser installation, UI rendering, accessibility, browser restart/suspension, real-site autofill or multi-device compatibility result is claimed.

Before recommending this release for valuable secrets, an independent reviewer should inspect the design and code, and testers should install the ZIP in supported desktop browsers and complete these workflows:

1. Create a disposable vault; save all four entry types; reload, restart and unlock; verify every field.
2. Check keyboard focus, labels, dialogs, narrow and wide layouts, and screen-reader announcements.
3. Lock during password derivation, file reading, import and persistence; switch tabs, suspend the device and change its clock; verify secrets remain hidden and require re-unlock.
4. Use concurrent vault tabs; change the master password in one; ensure the other cannot overwrite it.
5. Export and restore an encrypted backup in a separate profile. Confirm the old password cannot unlock the rotated live vault, while old backups still require it.
6. Test exact-origin autofill and refusal on cross-origin, iframe, ambiguous, username-first and navigated forms. Verify browser permission prompts and no automatic submission.
7. Transfer entries between two devices, independently compare both complete fingerprints, cancel/retry a preview and confirm successful transfers cannot replay.
8. Update from the same unpacked folder without uninstalling; verify saved ciphertext survives. Restore from a backup after a deliberate disposable-profile removal.

Distribution is an unpacked, source-available extension. A signed extension-store listing and automatic-update channel have not been established. No browser-store review is claimed.