Alien Agent ID — Vault

Portable single-file encrypted vault at ${AGENT_ID_STATE_DIR:-$HOME/.agent-id}/vault.enc.

The master key is held in slots, LUKS-style — passkey (Touch ID / Face ID / security key), agent-key (auto-unlock), passphrase, mobile (phone), owner-approval (Alien app).

Two modes (chosen at init, one-way):

• user mode (default) — NO passphrase, ever. Unlock by agent-key or owner-approval/mobile (the Alien app). The agent cannot add a passphrase, and a user-mode vault cannot be converted to dev mode (the mode is bound to the master key and verified on every unlock).
• dev mode (--dev, or providing a passphrase at init) — for developers / power users: passphrase slots are allowed, plus all the user-mode methods.

Passphrase is the exceptional, opt-in path — never something the agent enables.

Pairs with the agent-id-proxy plugin — the proxy unlocks the vault and injects values into outbound HTTP requests. The agent itself does not retrieve plaintext during normal operation; show exists only for manual export.