Trust chain

Architecture Explanatory schematic

Architecture schematic for Albert Lane’s SSO → Vault → Device model. This page is explanatory only—it does not implement biometric APIs, issue certificates, or place private keys in the browser.

Focus Secure chain of trust. Public ledgers stay anonymous. Privately secured data remains owned by the user. The public-facing ID is what ledgers see; private key material stays on the vault side of the model for the account, while the device holds a certificate for biometric / passport-style access.

Flow diagram

flowchart TB
  subgraph dual["Dual SSO"]
    SSO_A["SSO A
albertlane.net account"]
    SSO_B["SSO B
studio / proxy identity"]
    SSO_A <-->|"identity confirmation"| SSO_B
  end
  SSO_A -->|"SSO identity via account"| VAULT["Vault
account custody"]
  VAULT -->|"registers by default"| PYTERM["Registered PyTerm App
Python Terminal"]
  PYTERM --> DEVICE["Device"]
  VAULT -->|"public key + certificate"| DEVICE
  VAULT -.->|"retains private key material
vault side of model"| VAULT
  DEVICE -.->|"biometric / passport-style access
certificate on device"| DEVICE
  DEVICE -->|"public-facing ID only"| LEDGER["Public ledgers
anonymous"]
  classDef box fill:#fff,stroke:#000,color:#111
  class SSO_A,SSO_B,VAULT,PYTERM,DEVICE,LEDGER box

Mermaid schematic of the SSO → Vault → Device trust chain. An accessible step list follows.

Accessible step list

SSO → Vault → User
SSO identity via account. The signed-in albertlane.net account is the identity that vault custody attaches to.
↓
SSO ↔ SSO
Identity confirmation (dual SSO). Two sides of the identity—site session and studio/proxy possession—confirm each other before trust advances.
↓
Vault → Registered PyTerm App → Device
Python Terminal (PyTerm) registers to the vault by default, linking the app instance on the device into the chain.
↓
Vault → Public Key and Certificate → Device
Vault supplies a public key and a certificate used for biometric / passport-style access on the device. Schematic only—no biometric API is exposed on this site yet.
↓
Custody split
Vault retains the user’s private key material on the vault side of the model for the account. The device receives a certificate for biometric access. Public ledgers see only the public-facing ID.

Roles at a glance

SSO

Account identity and dual confirmation. Opens the path into vault custody without publishing private material.

Vault

Account-side custody: retains private key material in the vault model, binds public key / certificate for device access, and registers apps such as PyTerm.

Device

Holds the certificate used for biometric / passport-style access. Runs the registered PyTerm app. Does not become the public ledger identity.

Public ledgers

Observe the public-facing ID only. Ledgers stay anonymous relative to privately secured user data.

AI Studio vault host

Serverless host endpointAI Studio posts to POST https://albertlane.net/api/vault/host (alias /api/vault/ingest), signed with X-Lane-Signature (HMAC-SHA256 of the raw body; secret stays in Studio). Data lands in private vault storage; the public ledger keeps anonymous receipts only.

What this page is not

Not a live biometric enrollment or WebAuthn/passkey implementation.
Not a browser store for real private keys.
Not a claim that cryptography described here is fully deployed end-to-end on albertlane.net today.
Not an SEC filing.

Related: Create account · Sign in · Vault · Home

Aliases: /architecture · /trust-chain