Crate vta_keyspaces 

Central registry of the VTA’s keyspace names.

Every store.keyspace(..) call in the VTA (vta-service server, offline CLIs, backup, tests) names its keyspace through a const here rather than a bare string literal. This is the single source of truth that killed the "imported" / "imported_secrets" test-vs-production divergence (a test opened a different, empty keyspace than the one production writes). The no_bare_keyspace_literals guard in vta-service keeps it that way by scanning that crate’s source for bare .keyspace("…") literals.

Keyspace names live here; per-keyspace key formats (the key:, seed:, path_counter: … record families inside a keyspace) are a separate concern and are not yet centralised.

This is a dependency-free leaf crate: it holds only the shared vocabulary so that every VTA subsystem crate can name keyspaces without depending on vta-service.

Constants

ACL

ACL entries + the seal record + the integrity-anchor root.

ALL

Every production keyspace. Partitioned by BACKED_UP + EXCLUDED_FROM_BACKUP; the [tests::backup_partition_is_total] guard asserts the partition stays exhaustive so a newly-added keyspace can’t be silently omitted from the backup decision.

AUDIT

Audit log.

BACKED_UP

Keyspaces whose contents a full export_backup captures (as typed collections — see operations::backup).

BACKUP_BUNDLES

In-flight backup-bundle control-plane records.

BOOTSTRAP

KMS-protected, unencrypted boot keyspace (TEE integrity manifest, etc.).

CACHE

Ephemeral cache (resolver/auth caches).

CONSENT

Inbound-messaging consent: durable grants + TTL’d pending requests (vti_common::consent). The VTA is the first gate for bridged conversations.

CONSENT_APPROVERS

Per-(platform, context) approver bindings — who decides consent and how the prompt routes (vti_common::consent::ApproverBinding).

CONTEXTS

Trust contexts (the BIP-32 key hierarchy roots).

DID_TEMPLATES

Stored DID templates (global + context-scoped).

DRAINS

Persisted protocol-management drain set.

EXCLUDED_FROM_BACKUP

Keyspaces deliberately not in a backup.

IMPORTED_SECRETS

Imported secret material (KEK-wrapped). Named imported_secrets, not imported — the latter was a long-standing test-only typo that operated on an empty keyspace disjoint from production. Always reference this const.

ISSUED_CREDENTIALS

VTA-issued credentials (minted by vta/credentials/issue/0.1, revoked by vta/credentials/revoke/0.1). One record per credential keyed cred:<id>; revocation is a tombstone (revokedAt set in place), not a delete. Distinct from VAULT (which stores credentials the holder holds).

KEYS

Master seed + key records (key:, seed:, path_counter:, active_seed_id, imported_kek_salt, …) and the backup import sentinel.

MEMORY

Per-context key/value store for AI-agent memory (vta/memory/{put,list, delete}/0.1). One record per (contextId, key) pair, keyed mem:<contextId>:<key>; list is a mem:<contextId>: prefix scan. Durable user data → in BACKED_UP.

OUTBOX

Durable reliable-messaging outbox backing vti_common::outbox_store:: VtiOutboxStore for the delivery-layer MessagingService (D2 P2a cut-over). Holds Guaranteed-delivery outbox entries; dormant in P2a (all current sends are BestEffort) but wired so the drain/confirmation loops persist across restarts once P2b adds guaranteed VTA pushes. Runtime state, not backed up.

PASSKEY_VMS

In-flight passkey-as-verificationMethod enrolment state.

POLICY

Rego policy modules for the Policy Decision Point (policy/{upsert,list, delete,evaluate}). One policy::PolicyModule per id, keyed policy:<id>; the active set is every enabled row, priority-ordered. Durable operator security config → in BACKED_UP (a lost policy set would silently drop enforcement on restore).

SEALED_NONCES

Sealed-bootstrap anti-replay nonce log.

SERVICE_STATE

Persistent runtime service-enable state (operations::protocol::runtime_state).

SESSIONS

Auth sessions + challenges.

SNAPSHOT

Per-kind previous-config snapshots for fail-forward rollback. (Historically operations::protocol::snapshot::KEYSPACE_NAME.)

TASK_CONSENT

Task-execution consent for the PDP’s requireConsent disposition: pending approvals keyed by payload digest, and granted consents a re-submitted task consumes. Distinct from CONSENT (messaging-bridge conversation consent). One policy::consent::PendingTaskConsent per pending:<digest> and policy::consent::TaskConsentGrant per grant:<digest>:<requester>. Durable operator-facing security state → BACKED_UP.

VAULT

Holder credential vault (third-party secrets stored on this VTA).

WEBVH

WebVH DID records + did.jsonl state.