jazz_wallet

One master seed — everything derived from it. Replaces the (faked, in this env) HashiCorp vault for secrets. No server, no unseal, no daemon.

A single 256-bit seed lives in the macOS Keychain (conductor-wallet / master-seed, nothing on disk). HKDF-labeled derivation mints purpose keys:

| command | derives / does | |--------------------|----------------| | jazz_wallet init | generate the master seed → Keychain (once) | | jazz_wallet ssh [name] | ed25519 public key (git / device access) | | jazz_wallet evm [name] | secp256k1 account, address via Foundry cast (the ledger identity) | | jazz_wallet encrypt <n> | stdin → AES-256-GCM → secrets/<n>.enc (commit-safe; only the seed decrypts) | | jazz_wallet decrypt <n> | secrets/<n>.enc → stdout | | jazz_wallet seed | print seed hex for OFFLINE backup | | jazz_wallet identity | ssh pubkey + EVM address together |

Crypto: ed25519 + AES-256-GCM (Go stdlib), secp256k1 via genuine Foundry cast, HKDF hand-rolled with stdlib hmac/sha256, ssh format via x/crypto/ssh.

The ratchet

Built forward-only as version-0.0N detents — each crank is one atomic change, shadow-gated before it lands. Source src/, verify gate tests/wallet-shadow.py, installer install.py (refuses to install unless the shadow passes). Every crank + every runtime op logs to ~/.jazz/jazz_wallet.sqlite (self-observing).

Refactor safety

python3 tests/wallet-shadow.py — pins golden vectors (ssh, evm, a golden ciphertext) from a fixed seed and asserts the binary still reproduces/decrypts them. A change to derivation or encryption — which would orphan every existing key + secret — fails loudly. install.py runs it as a hard gate, so a broken build never ships.