https://nt2-blog-staging.eavatar.workers.dev/categories/tech Engineering deep dives into the architecture and implementation behind NT² Vault. en Thu, 24 Dec 2026 00:00:00 GMT https://nt2-blog-staging.eavatar.workers.dev/control-plane-nearby-bulk-plane-webrtc https://nt2-blog-staging.eavatar.workers.dev/control-plane-nearby-bulk-plane-webrtc Thu, 24 Dec 2026 00:00:00 GMT A proximity session has a budget. Contact invites and share manifests fit. PDF scans usually do not—so attachments leave on a bulk plane after SDP exchange, not stuffed into every control frame. NT² share cryptography privacy web webrtc https://nt2-blog-staging.eavatar.workers.dev/bootstrap-qr-stays-off-the-web https://nt2-blog-staging.eavatar.workers.dev/bootstrap-qr-stays-off-the-web Sun, 20 Dec 2026 00:00:00 GMT If a proximity bootstrap can live in an ordinary https link, the authenticator has already toured browser history, referrers, and OS camera → URL launch paths. NT² share cryptography privacy security web https://nt2-blog-staging.eavatar.workers.dev/proximity-session-is-not-a-peer-connection https://nt2-blog-staging.eavatar.workers.dev/proximity-session-is-not-a-peer-connection Thu, 17 Dec 2026 00:00:00 GMT Connecting beside someone is a short-lived session. Recognizing them as a vault contact—and accepting a share into your vault—are still separate acts. NT² share contacts cryptography zero-knowledge privacy web https://nt2-blog-staging.eavatar.workers.dev/share-file-link-and-machine-handoff-passphrase https://nt2-blog-staging.eavatar.workers.dev/share-file-link-and-machine-handoff-passphrase Sun, 13 Dec 2026 00:00:00 GMT Ciphertext and the secret that opens it should not travel as one convenient email. NT² splits carriers—file or link—from OOB passphrase delivery, and treats Strong as machine-handoff. NT² share cryptography security privacy zero-knowledge deep-links https://nt2-blog-staging.eavatar.workers.dev/delayed-legacy-release-not-password-recovery https://nt2-blog-staging.eavatar.workers.dev/delayed-legacy-release-not-password-recovery Thu, 10 Dec 2026 00:00:00 GMT Estate and emergency access tempt products to hold a second key “just in case.” NT² refuses that oracle. Legacy is a sealed package on a delay—not a support console unlock. NT² share recovery security zero-knowledge privacy legacy https://nt2-blog-staging.eavatar.workers.dev/outbox-revoke-what-you-already-sent https://nt2-blog-staging.eavatar.workers.dev/outbox-revoke-what-you-already-sent Sun, 06 Dec 2026 00:00:00 GMT After a share leaves your vault, “did they open it?” and “can I kill it?” are sender questions. The answers live in a local outbox—not a cloud mailbox of readable mail. NT² share architecture privacy zero-knowledge edge local-first https://nt2-blog-staging.eavatar.workers.dev/peer-connection-is-not-a-phone-contact https://nt2-blog-staging.eavatar.workers.dev/peer-connection-is-not-a-phone-contact Thu, 03 Dec 2026 00:00:00 GMT Sharing to “someone in Contacts” only works if the row holds encryption material for that vault—not a phone number you hope matches the right person. NT² share contacts identity cryptography zero-knowledge privacy https://nt2-blog-staging.eavatar.workers.dev/four-surfaces-one-field-set https://nt2-blog-staging.eavatar.workers.dev/four-surfaces-one-field-set Sun, 29 Nov 2026 00:00:00 GMT If “form fields,” “share fields,” and “expiry fields” are three schemas, they will drift—and someone will see more than you meant. One active field set keeps every surface honest. NT² structured-vault semantic-fields sharing selective-disclosure category-templates https://nt2-blog-staging.eavatar.workers.dev/searchable-metadata-sealed-field-values https://nt2-blog-staging.eavatar.workers.dev/searchable-metadata-sealed-field-values Thu, 26 Nov 2026 00:00:00 GMT A vault that cannot find a title is unusable. A vault that full-text indexes every password on a server is not a vault. The boundary is projected metadata versus sealed field values. NT² structured-vault cbf fts5 zero-knowledge local-first search https://nt2-blog-staging.eavatar.workers.dev/compose-domains-from-one-type-system https://nt2-blog-staging.eavatar.workers.dev/compose-domains-from-one-type-system Sun, 22 Nov 2026 00:00:00 GMT A medical pack and an IT pack should not each reinvent “expiry date.” Domains grow by composing a shared semantic catalog into category templates—then enabling the packs you need. NT² structured-vault category-templates field-packs semantic-fields local-first https://nt2-blog-staging.eavatar.workers.dev/semantic-columns-not-form-widgets https://nt2-blog-staging.eavatar.workers.dev/semantic-columns-not-form-widgets Thu, 19 Nov 2026 00:00:00 GMT A password field is not “a secret text box on this screen.” It is a semantic column type the whole vault understands—masking, health, share defaults, and wire shape included. NT² structured-vault semantic-fields category-templates field-registry local-first https://nt2-blog-staging.eavatar.workers.dev/slots-not-a-blank-page https://nt2-blog-staging.eavatar.workers.dev/slots-not-a-blank-page Sun, 15 Nov 2026 00:00:00 GMT A passport, a bank account, an API key, and a seed phrase are not the same kind of text. A vault that treats them as one blank page will always ask you to remember the structure yourself. NT² structured-vault category-templates local-first document-model zero-knowledge https://nt2-blog-staging.eavatar.workers.dev/replica-batch-under-the-hood https://nt2-blog-staging.eavatar.workers.dev/replica-batch-under-the-hood Thu, 12 Nov 2026 00:00:00 GMT Blind sync is easier to trust when you can picture the packet. The edge sees shapes, sizes, and progress—not titles, notes, or a searchable attic of your secrets. NT² architecture sync privacy zero-knowledge edge local-first durable-objects r2 https://nt2-blog-staging.eavatar.workers.dev/threat-model-2026-browser-and-extensions https://nt2-blog-staging.eavatar.workers.dev/threat-model-2026-browser-and-extensions Sun, 08 Nov 2026 00:00:00 GMT Threat models age with browsers. This 2026 refresh keeps the residual risks named—XSS, unlocked theft, hostile extensions, origin supply chain—and checks which defenses still hold when the client world moves. NT² security threat-model browsers extensions web-crypto xss zero-knowledge local-first https://nt2-blog-staging.eavatar.workers.dev/benchmarks-from-a-10k-item-opfs-vault https://nt2-blog-staging.eavatar.workers.dev/benchmarks-from-a-10k-item-opfs-vault Thu, 05 Nov 2026 00:00:00 GMT A large local vault is not proven by a slogan. It is proven by measuring the paths people actually use—first page after unlock, debounced search, FTS versus filter queries—and by being honest about what those numbers do not mean. NT² architecture local-first sqlite opfs performance benchmarks fts5 pwa https://nt2-blog-staging.eavatar.workers.dev/offline-is-the-happy-path https://nt2-blog-staging.eavatar.workers.dev/offline-is-the-happy-path Sun, 01 Nov 2026 00:00:00 GMT Many apps call themselves offline-capable when they mean a read-only cache and a queue that hopes the tower returns. A local-first vault puts full CRUD on the device first. Sync is an optional second path. NT² architecture local-first offline pwa sync privacy zero-knowledge https://nt2-blog-staging.eavatar.workers.dev/threat-model-xss-device-theft https://nt2-blog-staging.eavatar.workers.dev/threat-model-xss-device-theft Thu, 29 Oct 2026 00:00:00 GMT A vault that advertises invincibility is selling theater. NT² names the residual risks—XSS while unlocked, a stolen unlocked device, a hostile extension—and designs so those failures do not also become password oracles or exportable key dumps. NT² security threat-model web-crypto xss zero-knowledge local-first crypto https://nt2-blog-staging.eavatar.workers.dev/hundred-percent-coverage-on-crypto-packages https://nt2-blog-staging.eavatar.workers.dev/hundred-percent-coverage-on-crypto-packages Sun, 25 Oct 2026 00:00:00 GMT Specs bound scope. Security veto owns residual risk. Coverage floors own a narrower job: no uncovered line in the shared packages that seal, wrap, and describe vault facts—because agents will otherwise ship “done” with a hole. NT² ai-agents testing coverage crypto human-in-the-loop product-development engineering https://nt2-blog-staging.eavatar.workers.dev/security-veto-in-the-agent-loop https://nt2-blog-staging.eavatar.workers.dev/security-veto-in-the-agent-loop Thu, 22 Oct 2026 00:00:00 GMT Agents can draft patches and greenlights. They cannot own the decision that a vault still refuses password escrow, extractable keys, or a “helpful” recovery desk. Security veto is a role with authority—not a mood in chat. NT² ai-agents security human-in-the-loop crypto secure-sdlc product-development engineering https://nt2-blog-staging.eavatar.workers.dev/spec-driven-development-for-agents https://nt2-blog-staging.eavatar.workers.dev/spec-driven-development-for-agents Sun, 18 Oct 2026 00:00:00 GMT An agent that codes from a vague prompt will invent a product. An agent that codes from a written contract will ship the slice you approved—or stop where the contract ends. NT² ai-agents spec-driven-development human-in-the-loop product-development security engineering https://nt2-blog-staging.eavatar.workers.dev/what-the-workers-are-allowed-to-see https://nt2-blog-staging.eavatar.workers.dev/what-the-workers-are-allowed-to-see Thu, 15 Oct 2026 00:00:00 GMT Zero-knowledge is not a slogan about HTTPS. It is a permission list for the edge: what Workers may store, route, and bill for—and what they are never allowed to learn. NT² architecture cloudflare workers edge zero-knowledge privacy sync security https://nt2-blog-staging.eavatar.workers.dev/nt2backup-as-portable-sovereignty https://nt2-blog-staging.eavatar.workers.dev/nt2backup-as-portable-sovereignty Sat, 10 Oct 2026 00:00:00 GMT Local-first only means ownership if you can leave with an encrypted snapshot the cloud never had to hold. .nt2backup is that snapshot: portable vault profile sections and sealed payloads in a file you control. NT² backup local-first zero-knowledge architecture escape-hatch portability encryption https://nt2-blog-staging.eavatar.workers.dev/one-web-ui-three-shells https://nt2-blog-staging.eavatar.workers.dev/one-web-ui-three-shells Wed, 07 Oct 2026 00:00:00 GMT Unlock, list, search, and settings should not fork into three products. NT² Vault keeps one vault UI and lets each shell own only what the platform must own: how durable files live on that device. NT² pwa tauri webview opfs local-first attachments sqlite cross-platform https://nt2-blog-staging.eavatar.workers.dev/vault-meta-as-section-kv https://nt2-blog-staging.eavatar.workers.dev/vault-meta-as-section-kv Sat, 03 Oct 2026 00:00:00 GMT Salt, Key DID public material, sync cursors, and onboarding prefs are not one fat SQL row. They live as named vault profile sections—so backup, sync, and unlock can each touch only what they need. NT² architecture sqlite vault-meta local-first backup sync zero-knowledge pwa https://nt2-blog-staging.eavatar.workers.dev/incremental-vault-schema-migration https://nt2-blog-staging.eavatar.workers.dev/incremental-vault-schema-migration Wed, 30 Sep 2026 00:00:00 GMT A local vault is a real SQLite database on your device. When the product ships schema v60, launch-era vaults must upgrade in place—not force a wipe because the CREATE statement changed in the source tree. NT² architecture sqlite schema-migration local-first opfs pwa data-durability https://nt2-blog-staging.eavatar.workers.dev/password-verifier-fail-closed https://nt2-blog-staging.eavatar.workers.dev/password-verifier-fail-closed Sat, 26 Sep 2026 00:00:00 GMT Unlock is not a best-effort decrypt of everything you own. NT² checks a small local verifier first. Wrong password fails closed: the vault stays locked, and the UI stays honest. NT² architecture crypto security local-first zero-knowledge web-crypto aes-gcm unlock https://nt2-blog-staging.eavatar.workers.dev/cbf-payload-blobs-at-rest https://nt2-blog-staging.eavatar.workers.dev/cbf-payload-blobs-at-rest Wed, 23 Sep 2026 00:00:00 GMT A credential is a map of fields while you edit it. The moment those fields must survive a lock, a restart, or a replica, they need a portable ciphertext shape—not a JSON dump waiting for the next reader. NT² cryptography aes-gcm cbf local-first zero-knowledge envelope-encryption security https://nt2-blog-staging.eavatar.workers.dev/crypto-keys-must-not-survive-refresh https://nt2-blog-staging.eavatar.workers.dev/crypto-keys-must-not-survive-refresh Sat, 19 Sep 2026 00:00:00 GMT Encryption at rest is incomplete if the decrypted key handle outlives the unlocked session. NT² treats auto-lock as memory hygiene: non-extractable CryptoKeys, in-memory only, cleared on idle, refresh, and tab close. NT² web-crypto security crypto session auto-lock local-first pwa zero-knowledge https://nt2-blog-staging.eavatar.workers.dev/sqlite-in-a-web-worker https://nt2-blog-staging.eavatar.workers.dev/sqlite-in-a-web-worker Wed, 16 Sep 2026 00:00:00 GMT A local-first vault needs a real relational engine on device. Putting that engine on the UI thread makes every page query compete with paint and input. NT² Vault runs SQLite in a Web Worker, behind typed messages and a single lock chain, so the list can stay responsive while the database stays honest. NT² web-worker sqlite wasm wa-sqlite opfs local-first pwa concurrency https://nt2-blog-staging.eavatar.workers.dev/selective-ssi-not-a-did-wallet https://nt2-blog-staging.eavatar.workers.dev/selective-ssi-not-a-did-wallet Sat, 12 Sep 2026 00:00:00 GMT Self-sovereign identity is useful when you take the parts that fit a zero-knowledge vault—and refuse the parts that turn the product into a general DID wallet. NT² identity did share architecture privacy zero-knowledge security cryptography https://nt2-blog-staging.eavatar.workers.dev/blind-share-relay-local-inbox https://nt2-blog-staging.eavatar.workers.dev/blind-share-relay-local-inbox Wed, 09 Sep 2026 00:00:00 GMT A cloud can help deliver sealed packages without becoming the place where pending shares live as readable mail. Relay indexes ciphertext. Inbox stays on the device. NT² share inbox architecture privacy zero-knowledge edge local-first https://nt2-blog-staging.eavatar.workers.dev/share-passphrase-is-not-master-password https://nt2-blog-staging.eavatar.workers.dev/share-passphrase-is-not-master-password Sat, 05 Sep 2026 00:00:00 GMT A share that opens with the same secret that unlocks the vault is not a handoff. It is a remote unlock of everything. NT² keeps those boundaries apart. NT² share cryptography security privacy zero-knowledge aes-gcm identity https://nt2-blog-staging.eavatar.workers.dev/key-did-challenge-response-auth https://nt2-blog-staging.eavatar.workers.dev/key-did-challenge-response-auth Wed, 02 Sep 2026 00:00:00 GMT Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge. NT² authentication identity cryptography did security privacy cloud zero-knowledge https://nt2-blog-staging.eavatar.workers.dev/single-writer-multi-tab-vault https://nt2-blog-staging.eavatar.workers.dev/single-writer-multi-tab-vault Sat, 29 Aug 2026 00:00:00 GMT Opening the same vault in two browser tabs is normal. Letting both tabs write the same on-device SQLite file is not. NT² Vault elects one Writer and keeps every other unlocked tab as a follower. NT² architecture multi-tab local-first pwa sqlite broadcastchannel web-locks concurrency https://nt2-blog-staging.eavatar.workers.dev/attachment-ciphertext-outside-sqlite https://nt2-blog-staging.eavatar.workers.dev/attachment-ciphertext-outside-sqlite Wed, 26 Aug 2026 00:00:00 GMT A vault needs to know which files belong to which items, how large they are, and how to unwrap their keys. It does not need those encrypted bytes sitting inside the relational database that answers those questions. NT² attachments sqlite blobstore opfs envelope-encryption local-first aes-gcm chunking https://nt2-blog-staging.eavatar.workers.dev/fts5-vs-table-scan-in-the-vault https://nt2-blog-staging.eavatar.workers.dev/fts5-vs-table-scan-in-the-vault Sat, 22 Aug 2026 00:00:00 GMT Local search is not one query shape. Free-text wants a full-text index on titles and search text. Category, trash, archive, and similar filters want ordinary table predicates. The product switches strategy so the UI never has to ship the whole vault into memory to feel searchable. NT² architecture local-first sqlite fts5 search performance pwa https://nt2-blog-staging.eavatar.workers.dev/paged-list-not-full-table-load https://nt2-blog-staging.eavatar.workers.dev/paged-list-not-full-table-load Wed, 19 Aug 2026 00:00:00 GMT A local vault can hold thousands of structured items without becoming a giant in-memory array. The durable store stays in SQLite. The UI holds only a paged window of lightweight list rows, rendered through a virtual list. NT² architecture local-first sqlite svelte performance virtual-list pagination pwa https://nt2-blog-staging.eavatar.workers.dev/no-password-oracle-in-d1 https://nt2-blog-staging.eavatar.workers.dev/no-password-oracle-in-d1 Sat, 15 Aug 2026 00:00:00 GMT An account table can contain no plaintext vault items and still create a dangerous password-testing surface. We removed the columns that could turn a database copy into an offline guessing or recovery system. NT² architecture security privacy zero-knowledge edge cloudflare d1 authentication https://nt2-blog-staging.eavatar.workers.dev/vault-durable-object-per-key-did https://nt2-blog-staging.eavatar.workers.dev/vault-durable-object-per-key-did Wed, 12 Aug 2026 00:00:00 GMT A vault does not need to enter a shared plaintext mailbox to sync. Its public cryptographic identity can name a dedicated edge coordinator that notifies replicas and points them to encrypted frames it cannot open. NT² architecture sync privacy durable-objects key-did edge https://nt2-blog-staging.eavatar.workers.dev/no-password-reset-by-design https://nt2-blog-staging.eavatar.workers.dev/no-password-reset-by-design Sat, 08 Aug 2026 00:00:00 GMT “Contact support to reset your password” sounds reassuring. For an encrypted vault, it also reveals who ultimately controls access. NT² chooses a harder promise: recovery material stays with you, not our help desk. NT² security recovery zero-knowledge trust local-first https://nt2-blog-staging.eavatar.workers.dev/blind-replica-sync-on-the-edge https://nt2-blog-staging.eavatar.workers.dev/blind-replica-sync-on-the-edge Wed, 05 Aug 2026 00:00:00 GMT Sync does not have to turn a local vault into a cloud database. The edge can identify an account, store opaque replica frames, and deliver updates without learning what those updates contain. NT² architecture sync privacy local-first zero-knowledge edge https://nt2-blog-staging.eavatar.workers.dev/opfs-not-indexeddb-for-vault-sqlite https://nt2-blog-staging.eavatar.workers.dev/opfs-not-indexeddb-for-vault-sqlite Sat, 01 Aug 2026 00:00:00 GMT SQLite wants a file. A privacy vault wants durable relational storage that stays fast as its item count, indexes, and encrypted attachments grow. Putting a SQLite virtual file system on IndexedDB can bridge those worlds, but it makes the bridge part of every database operation. For NT² Vault, the browser vault file belongs in the Origin Private File System. NT² opfs indexeddb sqlite wasm wa-sqlite local-first pwa browser-storage https://nt2-blog-staging.eavatar.workers.dev/unlock-local-auth-cloud https://nt2-blog-staging.eavatar.workers.dev/unlock-local-auth-cloud Wed, 29 Jul 2026 00:00:00 GMT One screen can make two security events look like a single login. We keep them separate because opening encrypted data and proving an identity to a server are different jobs with different risks. NT² authentication local-first privacy security cryptography cloud https://nt2-blog-staging.eavatar.workers.dev/envelope-encryption-cek-per-object https://nt2-blog-staging.eavatar.workers.dev/envelope-encryption-cek-per-object Sat, 25 Jul 2026 00:00:00 GMT A vault can encrypt everything with one key and still claim that its data is encrypted. We wanted a more useful boundary: each item and attachment gets its own content encryption key, while the vault key protects those keys. NT² envelope-encryption aes-gcm cryptography local-first attachments opfs security https://nt2-blog-staging.eavatar.workers.dev/kdf-salt-stays-on-device https://nt2-blog-staging.eavatar.workers.dev/kdf-salt-stays-on-device Thu, 23 Jul 2026 00:00:00 GMT A salt is not a secret. Still, where it lives changes who can assemble a password-guessing system. NT² keeps the KDF salt and password verifier with the local vault, so unlocking begins and ends on the device. NT² architecture crypto security local-first zero-knowledge web-crypto pbkdf2 key-derivation https://nt2-blog-staging.eavatar.workers.dev/one-person-ai-coding-agent-product-lifecycle https://nt2-blog-staging.eavatar.workers.dev/one-person-ai-coding-agent-product-lifecycle Mon, 20 Jul 2026 00:00:00 GMT The useful question is not whether an AI agent can write code. It is how to give agents enough context and autonomy to move quickly while keeping product decisions, security boundaries, releases, and customer-facing actions under explicit human control. NT² ai-agents human-in-the-loop spec-driven-development tdd devops security product-development https://nt2-blog-staging.eavatar.workers.dev/why-pwa-local-first-zero-server-vault https://nt2-blog-staging.eavatar.workers.dev/why-pwa-local-first-zero-server-vault Thu, 09 Jul 2026 00:00:00 GMT In the era of massive cloud-first applications, we often overlook a powerful alternative: the Progressive Web App (PWA). Why maintain a heavy, expensive, and potentially vulnerable server infrastructure when the modern browser is capable of running a full-featured, secure, and high-performance application entirely on the user's device? NT² architecture pwa privacy security local-first zero-knowledge web-crypto sqlite wasm opfs https://nt2-blog-staging.eavatar.workers.dev/threshold-vault-key-did-self-sovereign-identity https://nt2-blog-staging.eavatar.workers.dev/threshold-vault-key-did-self-sovereign-identity Tue, 30 Jun 2026 00:00:00 GMT Self-sovereign identity sounds abstract. In NT², the practical version is simpler: your vault can prove itself, recover without a help desk, and share under your control while NT² stays blind. NT² trust identity