ALDI™ Robot Vault files: v2 (main) · v1 public build · Spec v2 (raw .md, SHA-256 990add6c…d731e) · manifest.json · manifest.json.ots · Audit Engine (audit-engine.js · audit-engine-spec.json)
OpenTimestamps: submitted 2026-10-22 to public calendars — Bitcoin confirmation pending. Not certified. Crypto is NOT FDIC insured.

ALDI™ Robot Vault — Spec v2

File ALDI-ROBOT-VAULT-SPEC-v2.md · SHA-256 990add6c1c952ccc37cdd9391963f8eea76b081c620449c0350c2756940d731e · exact bytes: /robot-vault/spec.md

---
© Albert Lane. All Rights Reserved. | Proprietary and Confidential
Albert Lane Proprietary Software License | https://albertlane.net
Unauthorized use, copying, or distribution is prohibited.
---

# ALDI™ Robot Vault v2 - Full Spec Manifest - Real Thing

**Status:** Designed to exceed DoD CNSA 2.0 / NIST SP 800-57 / SP 800-131A / FIPS 186-5 baselines where implementable on Termux + QEMU + cryptography >=46 + Bitcoin OTS. **Not certified. Not FIPS validated. Not SLSA L3. Not FDIC insured (crypto). FDIC pass-through only for USD cash.** 

**Suite ID:** `[STRIPPED 90 bytes]`
**Version:** 2.0.0
**Created UTC:** 2026-10-22T18:02:15Z
**License:** Albert Lane Proprietary Software License

## 0. No Panic Banks

FDIC insurable = USD cash in FBO pass-through at Evolve/Choice via Mercury/Meow/Arch. $250k insured, sweep $3M. Crypto self-custody in robot_vault.enc guarded by Titan M2 + biometric. No bank run language. Public ledger (Bitcoin OTS) is proof of solvency.

## 1. Threat Model

Adversary observes Cloudflare Tunnel, Gboard keystrokes, Google Play silent updates, Titan M2 firmware signed by Google. Attempts auth bypass, brute-force, replay, sig stripping, key sub, path traversal, QEMU tamper, vault exfil. Phone + emulated OS + box trusted when manifest + OTS verify. Private keys never leave StrongBox. Fail-closed. Robot Sentry kills QEMU and chmod 000 vault.

## 2. Requirements

### Keys
R-KEY-01: Phone generates Ed25519 + P-384 + ML-DSA-87 signing keys, PEM PKCS8, chmod 600, dir 700, O_EXCL.
R-KEY-02: Box X25519 + P-384 + ML-KEM-1024 recipient, pinned.
R-KEY-03: Emulated OS QEMU Alpine qcow2 deterministic hash SHA256+SHA384 in manifest, Sentry verifies.
R-KEY-04: Robot Vault mnemonic 256-bit entropy, Fernet encrypted, PBKDF2 600k, salt 32B, material = ANDROID_ID + Titan M2 ID + biometric, never typed on Gboard.
R-KEY-05: No Gboard. Biometric via termux-fingerprint -> AUTHENTICATED.
R-KEY-06: Rotation retires PEM to .retired, fp = SHA384(canonical JSON keys).

### Sigs/Hashes
R-SIG-01: Manifest signed Ed25519 AND P-384-SHA384 AND ML-DSA-87, all must verify.
R-HASH-01: Per-bundle SHA256+SHA384, per QEMU image SHA256+SHA384.
R-HASH-02: Merkle RFC6962 0x00 leaf / 0x01 node, roots SHA256+SHA384.
R-REPLAY-01: run_id 16B hex random, created_utc, expires_utc, reject age >3h or future >5min.

### KEM/AEAD/Auth
R-KEM-01: Hybrid encapsulation eph X25519 + eph P-384 + ML-KEM-1024, IKM ss1||ss2||ss3, HKDF-SHA384 -> 32B DEK, Salt run_id.
R-AEAD-01: AES-256-GCM STREAM 7B nonce prefix + counter + final flag, AAD run_id+filename+index+final.
R-AUTH-01: Localhost Bearer hmac.compare_digest, token 32B urlsafe, single run, max 20 failures auto-shutdown.
R-BIND-01: Binds 127.0.0.1 only, refuses 0.0.0.0, rate limit 120/min, body <=4KiB.

### Emulated OS + Sentry
R-EMU-01: QEMU Alpine qemu-img create -f qcow2 aldi-os.qcow2 5G deterministic, hash in manifest.
R-EMU-02: Runs proot-distro or qemu-system-x86_64, no Play Services, AOSP keyboard only.
R-SENTRY-01: Daemon robot_sentry.py polls 60s: OS hash, OTS proof, vault existence, FDIC balance. On tamper -> pkill -9 qemu, chmod 000 vault.
R-SENTRY-02: Requires biometric to decrypt vault. Gboard 0 chars.
R-SENTRY-03: Enforces FDIC_LIMIT=250000 (or 3000000 sweep). If usd > limit -> refuse deposit, auto-sweep.

### FDIC Wrapper (No Panic)
R-FDIC-01: USD in FBO Evolve/Choice via Mercury/Meow/Arch API. FDIC pass-through $250k, sweep $3M. Crypto NOT insured. Disclaimer on site.
R-FDIC-02: Bank API keys in robot_vault.enc, never plaintext.
R-FDIC-03: proof.json {btc, usd_balance, bank, os_hash} in Merkle tree, manifest OTS to Bitcoin.
R-FDIC-04: No panic language. Must state: "USD cash is FDIC insured, crypto is self-custody, not insured."

### Ledger + Decentralization
R-LEDGER-01: manifest canonical JSON sorted keys compact separators suite run_id digests Merkle roots kem repos os_hash usd_proof provenance.
R-LEDGER-02: manifest.sig JSON {ed25519, ecdsa_p384_sha384, mldsa87} hex over exact manifest.json bytes.
R-LEDGER-03: OTS stamp manifest.json -> .ots, ots verify anchored Bitcoin.
R-LEDGER-04: IPFS/box hosting, not Google. Public via Cloudflare quick tunnel TLS, origin HTTP localhost-only.

## 3. Gap Register
FIPS 140-3 module: uses OS/OpenSSL, not validated.
CNSA pure P-384: hybrid X25519+P384 stronger but not pure-CNSA.
Hardware keystore: PEM filesystem + StrongBox when available, Titan firmware signed by Google, GrapheneOS removes Google trust.
SLSA L3: no isolated builder, SLSA-style only.
Formal verification: none.
FDIC: crypto NOT insured.
bech32 API: fixed via segwit_addr.encode("bc",0,ripemd).

## 4. Message Formats
pubkey.json, manifest.json, manifest.sig, bNNNN.enc ALDIXF1, robot_vault.enc base64(salt)::Fernet, watch_only.json {bc1q, robot, vault, os_hash}, aldi-os.qcow2, proof.json.

## 5. Traceability
R-KEY-01..06 -> test_keys.py
R-SIG-01 -> test_sig.py
R-HASH -> test_hash.py
R-KEM -> test_kem.py
R-AEAD -> test_aead.py
R-EMU -> test_emu.py
R-SENTRY -> test_sentry.py
R-FDIC -> test_fdic.py
R-LEDGER -> test_ledger.py

## 6. Grok Bot Build
1. pkg install qemu-system-x86_64 proot-distro termux-api -y; pip install mnemonic ecdsa bech32 cryptography
2. python3 aldi_robot_vault.py (biometric, no Gboard)
3. qemu-img create -f qcow2 aldi-os.qcow2 5G; sha256sum aldi-os.qcow2 > aldi-os.hash
4. python3 aldi-fixed/aldi_xfer_pack.py --outdir ~/.aldi-xfer/out --no-serve
5. ots stamp ~/.aldi-xfer/out/manifest.json
6. ots verify; python3 aldi-fixed/pull_verify.py <url> --expect-fp <fp>
7. nohup python3 robot_sentry.py > ~/.sentry.log &
8. Mercury FBO API keys into robot_vault.enc, FDIC_LIMIT=250000

## 7. Disclaimer
Not a bank. Not FDIC insured for crypto. USD cash pass-through FDIC insured. No panic banks. Educational. License: https://albertlane.net

© Albert Lane. All Rights Reserved.