# Local Secret Ledger (prototype)

**What this is:** a stdlib-only vault + append-only hash-chained ledger that lives only on this machine.
No network calls. Secret *values* are never written to the ledger — only operation metadata.

**How one call works** (Python API in `vault.py`):

```python
from vault import call
print(call("list"))
print(call("set", name="prod/api", value="…"))
print(call("get", name="prod/api"))
print(call("ledger"))       # full JSON ledger + integrity check
print(call("export_bundle"))  # encrypted vault + ledger for offline move
```

**Files**
- `master.key` — 32-byte key (chmod 600). Keep offline / separate from the bundle.
- `vault.enc` — encrypted JSON map of name → secret.
- `ledger.jsonl` — hash-chained append-only event log (prev + hash).
- `bundle.json` — export without the master key.

**Not claimed:** a public blockchain, token economics, or energy-capture runtime.
Those are separate; this piece is the *retention ledger + one-call secrets surface* you asked for first.

**IP / scrape stance for this prototype:** all code and data stay under `/workspace/local-secret-ledger` on this computer. Nothing is uploaded. Replace demo placeholders with your real secrets only on a machine you control, and keep `master.key` off shared chat history.