Routing-table indirection

Author: mrtinkz

.github/copilot-instructions.md

@@ -10,19 +10,19 @@
 
 ## Architecture
 
-- `src/core/crypto.ts` — PBKDF2-SHA-256 + AES-256-GCM. Stored format: `salt(16)‖iv(12)‖ct‖tag(16)`. Also `rotateKeyName` (deterministic AES-GCM with zero IV used as PRF for key-name obfuscation) and `generateHoneyCiphertext`.
+- `src/core/crypto.ts` — PBKDF2-SHA-256 + AES-256-GCM. Stored format: `salt(16)‖iv(12)‖ct‖tag(16)`. Also `rotateKeyName` (HMAC-SHA256 PRF for key-name obfuscation) and `generateHoneyCiphertext`.
 - `src/core/session.ts` — `KeySession` class: per-unlock instance, idle-timeout auto-lock, BroadcastChannel cross-tab sync, `reconfirmKey` for half-life access.
-- `src/core/lockout.ts` — exponential backoff, wipe/delay/throw actions
-- `src/core/config.ts` — `resolveConfig()`: merges developer config with defaults and enforces security floors (lockdown threshold ≥ 10, visibility floor ≥ 200 ms, etc.)
+- `src/core/lockout.ts` — exponential backoff, wipe/delay/throw actions. `signLockoutRecord` / `verifyLockoutRecord` sign **only `{lockedUntil}`** (not `attempts` or `backoffMs`) — signing the full record caused false-positive tamper errors on every correct-passcode unlock after a failed attempt.
+- `src/core/config.ts` — `resolveConfig()`: merges developer config with defaults and enforces security floors (lockout threshold ≥ 3, visibility floor ≥ 200 ms, etc.)
 - `src/core/events.ts` — `EventEmitter`: informational-only, fires after tessera has already acted. Handlers cannot cancel or delay security responses.
 - `src/core/suspicion.ts` — `SuspicionEngine`: in-memory score, rate-limit detection, visibility-change gating (platform-aware), honey-key tripwires, HMAC-failure recording. Has `destroy()` to remove document listener.
 - `src/core/splitter.ts` — XOR-based secret sharing: `splitValue`, `reconstructValue`, base64 helpers.
 - `src/core/wipe.ts` — `hardWipe`: overwrites storage slot with 256 bytes of random noise, then removes it. Best-effort forensic mitigation.
 - `src/storage/claim.ts` — `generateClaimToken` (returns clean token without prefix), `extractTokenId` (strips `CLAIM_TOKEN_PREFIX` from stored value), `isClaimToken`.
 - `src/storage/honey.ts` — `HoneyKeyManager`: tracks per-backend decoy keys in memory only. `generateHoneyKeys` mints new decoys after each real write.
-- `src/adapters/` — `local-storage.ts`, `session-storage.ts`, `cookie.ts`, `indexed-db.ts`. All share: key-name rotation via `rotateKeyName`, encrypted metadata block (`writeTime`, `readCount`, TTL, maxReads, half-life), suspicion rate-limiting, honey-key checks on read.
+- `src/adapters/` — `local-storage.ts`, `session-storage.ts`, `cookie.ts`, `indexed-db.ts`. All share: two-level routing-table indirection (stable index slot at `rotateKeyName(key)` → ephemeral data slot at a fresh random `t_<hex>` key, replaced on every write), encrypted metadata block (`writeTime`, `readCount`, TTL, maxReads, half-life), suspicion rate-limiting, honey-key checks on read.
 - `src/adapters/session-storage.ts` — additionally supports `mode: 'split'` (XOR secret sharing with IDB) and `mode: 'claim'` (pointer-in-session, value-in-IDB).
-- `src/adapters/cookie.ts` — additionally supports `mode: 'claim'`. Cookie names are NOT rotated (cookies travel with HTTP). Hard wipe on `remove()` targets the actual cookie name.
+- `src/adapters/cookie.ts` — additionally supports `mode: 'claim'`. Cookie names (both index and data slots) are `t_`-prefixed rotated names — the developer key name never appears on the wire. Cookies travel with every HTTP request so honey decoys add HTTP overhead; use `honeyKeys.count: 0` if that matters. No `split` mode. No `httpOnly`. Hard wipe on `remove()` uses `Set-Cookie: name=; expires=<past>` rather than `removeItem`.
 - `src/ui/pin-pad.ts` — Canvas-based PIN pad (digit zones in closure, never in DOM)
 - `src/framework/` — React, Vue, Svelte, Angular adapters
 - `src/tessera.ts` — Public API: `Tessera.unlock()` object literal returning `IEnhancedVault`
@@ -38,8 +38,8 @@
 - Adapter reads use `session.getKeySafe()` (returns null when locked).
 - Adapter writes use `session.getKey()` (throws `LOCKED` when locked).
 - All adapters use `encryptWithSalt` / `decryptFull` — never bare `encrypt` / `decrypt`.
-- Stored value format: `encryptedMeta.encryptedValue` where meta contains `writeTime`, `readCount`, TTL, maxReads, and half-life thresholds.
-- All developer-supplied key names are obfuscated via `rotateKeyName` before hitting storage (except cookie names, which travel with HTTP).
+- Stored layout: two-level routing-table. **Index slot** (`rotateKeyName(key)`) stores an encrypted pointer `{ slot: "<random>" }` written LAST. **Data slot** (fresh random `t_<hex>` per write) stores `encryptedMeta.encryptedValue`. Previous data slot forensically wiped before new slot written. Backward-compat: if index fails to decrypt as JSON pointer but raw value contains `.`, adapters fall back to old single-blob format.
+- All developer-supplied key names are obfuscated via `rotateKeyName` before hitting storage (all four adapters, including cookie — the developer key name never appears as a cookie name on the wire).
 - Claim token format: adapters store `ref:<token>` in the fast backend; the actual value lives encrypted in IDB under the token key. `generateClaimToken()` returns a clean token (no prefix) — adapters prepend `CLAIM_TOKEN_PREFIX` themselves.
 - Configuration is resolved once at `unlock` time via `resolveConfig()` and locked for the session. No mid-session reconfiguration.
 - `Tessera` is an object literal (not a class) — `unicorn/no-static-only-class`.
@@ -66,7 +66,7 @@
 
 - Explicit return types on public functions.
 - No `any` types — use `unknown` and narrow with type guards.
-- Passcode: 6–8 characters (PIN pad is digit-only; direct API accepts alphanumeric).
+- Passcode: minimum 8 characters (PIN pad is digit-only; direct API accepts alphanumeric; lower bound enforced by `validatePasscode` in `src/core/crypto.ts`).
 - PBKDF2: ≥ 310,000 iterations (OWASP 2024 minimum).
 - `for...of` over `.forEach()` and C-style for loops.
 - `addEventListener('error', ...)` over `.onerror` assignment.

CHANGELOG.md

@@ -5,6 +5,24 @@ Format follows [Conventional Commits](https://www.conventionalcommits.org).
 
 ---
 
+## [0.1.8] — 2026-05-21
+
+### Security
+
+- **Routing-table indirection eliminates temporal survivor attack** — Previously, every adapter stored encrypted data at a deterministic slot (`rotateKeyName(key)`). A temporal observer who captured two storage snapshots could identify the real entry as the one that persists and updates across writes, even with honey keys present.
+
+  Fix: `localStorage`, `sessionStorage`, and `indexedDB` adapters now use a two-level routing-table scheme. Each developer key has a stable _index slot_ (`rotateKeyName(key)`) that stores an encrypted pointer `{slot: <random>}`. The actual encrypted data lives at a randomly-generated slot (`t_<32-hex-chars>`) that is replaced on every write. Honey slots rotate identically. A temporal observer now sees 1 stable index entry plus N+1 equally-random entries — the real data slot is no longer distinguishable.
+
+  The cookie adapter is unchanged; cookie names cannot be rotated because they travel with every HTTP request.
+
+- **Default `honeyKeys.count` raised from 3 to 4** — With routing-table indirection, each developer key produces 1 index + 1 data + N honey entries. Raising the default count to 4 restores an 80% honey ratio (4 out of 5 randomly-keyed entries are decoys) from an external storage view.
+
+### Migration
+
+- **Silent backward-compatible migration** — Vault data written by v0.1.7 and earlier is read transparently: if the index slot fails to decrypt as a routing pointer but the raw value contains a dot separator, the adapter falls back to the old single-blob format. Data migrates to the new routing-table format automatically on the next write.
+
+---
+
 ## [0.1.7] — 2026-05-20
 
 ### Security