--- © Albert Lane. All Rights Reserved. | Proprietary and Confidential Albert Lane Proprietary Software License | https://albertlane.net Unauthorized use, copying, or distribution is prohibited. --- # ALDI™ Robot Vault v2 - Full Spec Manifest - Real Thing **Status:** Designed to exceed DoD CNSA 2.0 / NIST SP 800-57 / SP 800-131A / FIPS 186-5 baselines where implementable on Termux + QEMU + cryptography >=46 + Bitcoin OTS. **Not certified. Not FIPS validated. Not SLSA L3. Not FDIC insured (crypto). FDIC pass-through only for USD cash.** **Suite ID:** `[STRIPPED 90 bytes]` **Version:** 2.0.0 **Created UTC:** 2026-10-22T18:02:15Z **License:** Albert Lane Proprietary Software License ## 0. No Panic Banks FDIC insurable = USD cash in FBO pass-through at Evolve/Choice via Mercury/Meow/Arch. $250k insured, sweep $3M. Crypto self-custody in robot_vault.enc guarded by Titan M2 + biometric. No bank run language. Public ledger (Bitcoin OTS) is proof of solvency. ## 1. Threat Model Adversary observes Cloudflare Tunnel, Gboard keystrokes, Google Play silent updates, Titan M2 firmware signed by Google. Attempts auth bypass, brute-force, replay, sig stripping, key sub, path traversal, QEMU tamper, vault exfil. Phone + emulated OS + box trusted when manifest + OTS verify. Private keys never leave StrongBox. Fail-closed. Robot Sentry kills QEMU and chmod 000 vault. ## 2. Requirements ### Keys R-KEY-01: Phone generates Ed25519 + P-384 + ML-DSA-87 signing keys, PEM PKCS8, chmod 600, dir 700, O_EXCL. R-KEY-02: Box X25519 + P-384 + ML-KEM-1024 recipient, pinned. R-KEY-03: Emulated OS QEMU Alpine qcow2 deterministic hash SHA256+SHA384 in manifest, Sentry verifies. R-KEY-04: Robot Vault mnemonic 256-bit entropy, Fernet encrypted, PBKDF2 600k, salt 32B, material = ANDROID_ID + Titan M2 ID + biometric, never typed on Gboard. R-KEY-05: No Gboard. Biometric via termux-fingerprint -> AUTHENTICATED. R-KEY-06: Rotation retires PEM to .retired, fp = SHA384(canonical JSON keys). ### Sigs/Hashes R-SIG-01: Manifest signed Ed25519 AND P-384-SHA384 AND ML-DSA-87, all must verify. R-HASH-01: Per-bundle SHA256+SHA384, per QEMU image SHA256+SHA384. R-HASH-02: Merkle RFC6962 0x00 leaf / 0x01 node, roots SHA256+SHA384. R-REPLAY-01: run_id 16B hex random, created_utc, expires_utc, reject age >3h or future >5min. ### KEM/AEAD/Auth R-KEM-01: Hybrid encapsulation eph X25519 + eph P-384 + ML-KEM-1024, IKM ss1||ss2||ss3, HKDF-SHA384 -> 32B DEK, Salt run_id. R-AEAD-01: AES-256-GCM STREAM 7B nonce prefix + counter + final flag, AAD run_id+filename+index+final. R-AUTH-01: Localhost Bearer hmac.compare_digest, token 32B urlsafe, single run, max 20 failures auto-shutdown. R-BIND-01: Binds 127.0.0.1 only, refuses 0.0.0.0, rate limit 120/min, body <=4KiB. ### Emulated OS + Sentry R-EMU-01: QEMU Alpine qemu-img create -f qcow2 aldi-os.qcow2 5G deterministic, hash in manifest. R-EMU-02: Runs proot-distro or qemu-system-x86_64, no Play Services, AOSP keyboard only. R-SENTRY-01: Daemon robot_sentry.py polls 60s: OS hash, OTS proof, vault existence, FDIC balance. On tamper -> pkill -9 qemu, chmod 000 vault. R-SENTRY-02: Requires biometric to decrypt vault. Gboard 0 chars. R-SENTRY-03: Enforces FDIC_LIMIT=250000 (or 3000000 sweep). If usd > limit -> refuse deposit, auto-sweep. ### FDIC Wrapper (No Panic) R-FDIC-01: USD in FBO Evolve/Choice via Mercury/Meow/Arch API. FDIC pass-through $250k, sweep $3M. Crypto NOT insured. Disclaimer on site. R-FDIC-02: Bank API keys in robot_vault.enc, never plaintext. R-FDIC-03: proof.json {btc, usd_balance, bank, os_hash} in Merkle tree, manifest OTS to Bitcoin. R-FDIC-04: No panic language. Must state: "USD cash is FDIC insured, crypto is self-custody, not insured." ### Ledger + Decentralization R-LEDGER-01: manifest canonical JSON sorted keys compact separators suite run_id digests Merkle roots kem repos os_hash usd_proof provenance. R-LEDGER-02: manifest.sig JSON {ed25519, ecdsa_p384_sha384, mldsa87} hex over exact manifest.json bytes. R-LEDGER-03: OTS stamp manifest.json -> .ots, ots verify anchored Bitcoin. R-LEDGER-04: IPFS/box hosting, not Google. Public via Cloudflare quick tunnel TLS, origin HTTP localhost-only. ## 3. Gap Register FIPS 140-3 module: uses OS/OpenSSL, not validated. CNSA pure P-384: hybrid X25519+P384 stronger but not pure-CNSA. Hardware keystore: PEM filesystem + StrongBox when available, Titan firmware signed by Google, GrapheneOS removes Google trust. SLSA L3: no isolated builder, SLSA-style only. Formal verification: none. FDIC: crypto NOT insured. bech32 API: fixed via segwit_addr.encode("bc",0,ripemd). ## 4. Message Formats pubkey.json, manifest.json, manifest.sig, bNNNN.enc ALDIXF1, robot_vault.enc base64(salt)::Fernet, watch_only.json {bc1q, robot, vault, os_hash}, aldi-os.qcow2, proof.json. ## 5. Traceability R-KEY-01..06 -> test_keys.py R-SIG-01 -> test_sig.py R-HASH -> test_hash.py R-KEM -> test_kem.py R-AEAD -> test_aead.py R-EMU -> test_emu.py R-SENTRY -> test_sentry.py R-FDIC -> test_fdic.py R-LEDGER -> test_ledger.py ## 6. Grok Bot Build 1. pkg install qemu-system-x86_64 proot-distro termux-api -y; pip install mnemonic ecdsa bech32 cryptography 2. python3 aldi_robot_vault.py (biometric, no Gboard) 3. qemu-img create -f qcow2 aldi-os.qcow2 5G; sha256sum aldi-os.qcow2 > aldi-os.hash 4. python3 aldi-fixed/aldi_xfer_pack.py --outdir ~/.aldi-xfer/out --no-serve 5. ots stamp ~/.aldi-xfer/out/manifest.json 6. ots verify; python3 aldi-fixed/pull_verify.py --expect-fp 7. nohup python3 robot_sentry.py > ~/.sentry.log & 8. Mercury FBO API keys into robot_vault.enc, FDIC_LIMIT=250000 ## 7. Disclaimer Not a bank. Not FDIC insured for crypto. USD cash pass-through FDIC insured. No panic banks. Educational. License: https://albertlane.net © Albert Lane. All Rights Reserved.