Crate aethel_vault 

aethel-vault

aethel-vault is the agent-held wallet: the crate is aethel-vault, the repository is aethel-runtime. Not to be confused with pqc-privacy’s unrelated AES-GCM + Reed-Solomon shard module (historically also called “vault” there — that is a research component; this crate owns the word “wallet”).

Two assets, not one (V-7)

This crate holds and moves two entirely separate things, and never bridges between them:

• Confidential internal balance (fhe-state feature, vault/client) — an FheUint64 ciphertext the vault never decrypts, homomorphically transferred between agent-chosen ledger entries. It exists only in the agent’s own storage (which may be a hostile host); privacy here is against that storage. It is not a token, not on any chain, and not USDC. Older docs in this crate described this as “on-chain” with “validator” processing — that language was wrong and has been corrected; there is no chain and no validator anywhere in this crate.
• Settlement asset (signer feature, default, settlement) — USDC on Base, Ethereum, or Arbitrum One, moved by an EIP-3009 transferWithAuthorization signature the agent’s external wallet produces. Public by nature; bounded by policy::SpendPolicy.

An FHE transfer never moves USDC, and an EIP-3009 authorization never changes an FHE balance unless the agent explicitly records it — there is no bridge in this crate. See vault’s module docs for more detail.

Zero ECDSA / 100% PQC signer; secp256k1 lives in the agent’s wallet

This crate never implements, produces, or verifies a secp256k1 ECDSA signature. The settlement::SettlementSigner trait is the injection point: an agent’s existing wallet (hardware, MPC, browser, HSM) signs the EIP-712 digest this crate builds. This crate’s own signatures — spend intents, settlement receipts, wallet-bind attestations, HITL approvals — are all ML-DSA-65 via aethel_core::signing::Identity, under the purpose-separated contexts in aethel_core::signing::purpose. A hybrid (PQC + classical) posture, if wanted, belongs at SAGP (the gateway), not here. See settlement’s module docs for the full rationale and the locked rules it encodes.

Custody rule: the ServerKey — and the settlement signer — never leave the agent

• ServerKey (fhe-state feature): held only in a process-local, never-serialized runtime structure. It never appears in exported or persisted [vault::VaultState] bytes — see vault’s “Custody rule” docs (V-2).
• Settlement signer (signer feature): the settlement::SettlementSigner trait is injected by the caller; no implementation ships in this crate except a test-only mock. This crate never holds a secp256k1 private key.
• There is no “hosted vault” mode. Naming a Cargo feature hosted is a hard compile error (see below). Do not host aethel-vault on a third party’s infrastructure; the agent runtime, or a wallet process the principal already runs, holds every secret this crate touches.

Feature Flags

• signer (default) — settlement (EIP-3009/x402 export), policy (standing spend policy), receipt (optional signed receipts). No tfhe, no HelixDB gRPC stack. This is the Wave-1 “vault as signer of a normal USDC wallet” path.
• fhe-state — the confidential internal ledger (vault’s VaultState/homomorphic transfer state machine, client’s NativeVaultClient). Pulls tfhe. Optional: a differentiator for agents storing state on a hostile host, not a Wave-1 gate.
• helixdb — the [storage::helixdb] gRPC adapter. Pulls tokio, tonic, prost, and runs prost-build in build.rs.
• std (default) — standard library support. Does not, by itself, pull tokio/tonic/prost (that is helixdb’s job) or tfhe (that is fhe-state’s job).
• wasm — wasm-bindgen exports for the confidential-ledger state machine and client.
• hosted — does not exist as a real feature. Enabling it is a hard compile_error! (see below). This is the custody rule enforced structurally, not just documented.

default = ["std", "signer"]: a plain cargo add aethel-vault builds the thin signer path only — no tfhe, no tokio, no tonic, no prost anywhere in the dependency graph (confirm with cargo tree -e normal).

Modules

• settlement — EIP-3009/x402 export (signer, default). Chain table, TransferWithAuthorization, SettlementSigner trait, Wallet::authorize_eip3009.
• policy — standing spend policy (signer, default). SpendPolicy, PolicyState, Rail, HitlApproval.
• receipt — optional signed settlement receipts (signer, default).
• error — VaultError, the Rust-native error type for the signer-mode surface.
• vault — the confidential-ledger state machine (fhe-state). Homomorphic balance management using FheUint64 ciphertexts via tfhe-rs.
• client — the confidential ledger’s client SDK (fhe-state native, or wasm for JS).
• [storage] — HelixDB storage adapter (helixdb feature only).
• sdk — Client SDK module. TypeScript and Rust SDK utilities.

Security Properties

• Zero Plaintext Leakage (confidential ledger): fhe-state balances exist solely as FheUint64 ciphertexts in the agent’s own storage; this crate never decrypts them.
• Post-Quantum Hardness: the confidential ledger’s security reduces to LWE hardness over the Torus; this crate’s own signatures (spend intent, receipt, wallet bind, HITL approval) are ML-DSA-65.
• Ephemeral Vault IDs: anonymous vault identifiers derived from Polymorphic Lattice Projections; no persistent on-chain footprint — and no on-chain footprint of any kind, since the confidential ledger is not on any chain.
• Policy before signature: settlement::Wallet::authorize_eip3009 checks policy::SpendPolicy before it ever calls the injected SettlementSigner or signs a SpendIntent. A denied or unsatisfied-HITL request produces no signature of any kind.

---

The 0x307 crate family

aethel-vault is one of six open-source crates from 0x307, held to one audit and stability standard.

Crate	Tier	What it does
pqc-sig	Production	ML-DSA, SLH-DSA and FN-DSA signatures (FIPS 204/205/206)
pqc-kem	Production	ML-KEM (FIPS 203), the X25519 + ML-KEM-768 hybrid, X-Wing, and sealed boxes
aethel-core	Production	Post-quantum anonymous identity: a separate identifier per context, context-bound ML-DSA signing
aethel-sdk	Preview	The SDK over aethel-core, and the place to start
aethel-vault (this crate)	Preview	Agent-held wallet: policy-gated x402 / EIP-3009 signing with ML-DSA-65 spend records
pqc-privacy	Lab	Research bundle, kept off every identity and payment path

Production crates are thin, standards-bound libraries meant to be depended on today. Preview crates work and are published, with APIs still settling. Lab crates are research, never on an identity or payment path.

Runnable examples: 0x307/examples, one program per crate, pinned to the published versions.

Audit status: None of these crates has been independently audited, and none holds a CMVP / FIPS 140-3 validation. “FIPS 203/204/205/206” means the algorithms follow those standards, not that the code is certified. Known issues for this crate are in SECURITY.md. Versioning and yanks: STABILITY.md.

Re-exports

pub use vault::derive_vault_id;

pub use vault::ERR_DESER;

pub use vault::ERR_INSUFFICIENT_BALANCE;

pub use vault::ERR_INVALID_KEY;

pub use vault::ERR_NOT_FOUND;

pub use vault::ERR_OK;

pub use vault::ERR_UNAUTHORIZED;

pub use vault::ERR_WIRE_VERIFY_FAILED;

pub use client::LedgerPayload;

pub use error::VaultError;

pub use policy::Decision;

pub use policy::HitlApproval;

pub use policy::PolicyState;

pub use policy::PolicyViolation;

pub use policy::Rail;

pub use policy::SpendPolicy;

pub use policy::SpendRequest;

pub use receipt::Receipt;

pub use receipt::SignedReceipt;

pub use settlement::Chain;

pub use settlement::SettlementAuthorization;

pub use settlement::SettlementError;

pub use settlement::SettlementSigner;

pub use settlement::SpendIntent;

pub use settlement::TransferWithAuthorization;

pub use settlement::Wallet;

Modules

client

The confidential ledger’s client SDK — key generation, balance encryption, payload construction. client::LedgerPayload is always available; [client::NativeVaultClient] requires fhe-state and [client::AethelVaultClient] requires wasm.

error

VaultError — the Rust-native error type for the signer-mode surface. Error type for the signer-mode surface (V-1/V-4/V-5).

policy

Standing spend policy, enforced before any settlement intent is signed (signer feature, default). Standing spend policy, enforced before any settlement intent is signed (SAGP-PG-001 V-4).

receipt

Optional signed settlement receipts (signer feature, default). Emitted only on request — see the module’s own docs (V-5 / UX-001). Optional signed settlement receipt (SAGP-PG-001 V-5).

sdk

SDK module — TypeScript and Rust utilities for HelixDB integration.

settlement

EIP-3009/x402 settlement export (signer feature, default). See the module’s own docs for the “Zero ECDSA / 100% PQC signer” statement. EIP-3009 / x402 settlement export (SAGP-PG-001 V-1).

vault

The confidential-ledger state machine (fhe-state feature) — homomorphic balance management, FheUint64 ciphertexts. See the module’s own docs for the “Two assets, not one” statement and the V-2 custody rule. vault::derive_vault_id and the ERR_* constants are available regardless of fhe-state.