From d4d87b85b6db0c3d918528cf1a8d8f30809500c8 Mon Sep 17 00:00:00 2001 From: Avi Date: Tue, 22 Sep 2026 17:46:17 -0500 Subject: [PATCH] docs: replace blanket 'keys never leave the machine' claim with per-mode truth External NIP-46 signer mode is a stronger posture, not a caveat: the key never arrives on this machine, so a compromised desktop cannot extract it. The old claim only holds for embedded/bunker modes and undersold the external-signer option. UI already ranked modes correctly; no code change. --- DESIGN.md | 2 +- PRODUCT.md | 6 +++--- README.md | 12 +++++++++--- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/DESIGN.md b/DESIGN.md index b496f5c..b1df175 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -109,7 +109,7 @@ components: **Creative North Star: "Vault & Atelier"** -Nostr Keynctr is an atelier, not a dashboard — a warm, quiet workshop where identity work is done with care. The space feels like heavy paper and soft stone, with ink that is near-black, not pure black. Instruments are laid out plainly; nothing shouts for attention. Trust is built through precision: consistent edges, settled type, and state that is always legible. The product truth — keys never leave Rust — is mirrored visually: the UI is restrained, the material is honest, and every destructive or security-relevant moment is given deliberate weight. +Nostr Keynctr is an atelier, not a dashboard — a warm, quiet workshop where identity work is done with care. The space feels like heavy paper and soft stone, with ink that is near-black, not pure black. Instruments are laid out plainly; nothing shouts for attention. Trust is built through precision: consistent edges, settled type, and state that is always legible. The product truth — in local modes keys never leave Rust, and in external-signer mode they never arrive on this machine at all — is mirrored visually: the UI is restrained, the material is honest, and every destructive or security-relevant moment is given deliberate weight. The aesthetic is *warm and human*, not technical or bold. Density is Operate: scannable lists, clear hierarchies, and generous but not loose spacing (8/12/16/20/32). The four themes (light, dark, glass/Aurora, neon) share the same semantic roles; only the material values shift. Neon and glass are gated expressions, never the default. diff --git a/PRODUCT.md b/PRODUCT.md index 0a7bf5d..daae4dd 100644 --- a/PRODUCT.md +++ b/PRODUCT.md @@ -11,10 +11,10 @@ Primary: Linux Nostr users (daily use) who manage one or more keypairs and need Secondary/expanded: Newcomers creating their first Nostr identity via a friendly GUI. The product is progressive — zero-to-first-profile onboarding is frictionless, but the same vault scales to power workflows (multiple profiles, CLI, remote signer). Success means the user can create, select, and publish as any profile, keep keys encrypted at rest, and never feel forced to paste an `nsec` elsewhere. ## Product Purpose -Nostr Keynctr (Nostr Feed Manager) pairs a hardened Rust core with an Electron + React desktop shell so private keys never leave the machine. It makes self-custodied Nostr publishing practical: generate/switch profiles, compose with preview and rich attachments, publish with per-relay receipts, curate relays and feeds, and serve as a NIP-46 remote signer ("bunker") for other Nostr apps. Success is a trustworthy, local-first identity manager you can use daily, via GUI or the same Rust CLI. +Nostr Keynctr (Nostr Feed Manager) pairs a hardened Rust core with an Electron + React desktop shell so private keys stay under your control: in embedded/bunker modes they live only in the local encrypted vault, and in external-signer mode they never touch this machine at all. It makes self-custodied Nostr publishing practical: generate/switch profiles, compose with preview and rich attachments, publish with per-relay receipts, curate relays and feeds, and serve as a NIP-46 remote signer ("bunker") for other Nostr apps. Success is a trustworthy, local-first identity manager you can use daily, via GUI or the same Rust CLI. ## Positioning -**Keys never leave the machine — and the architecture proves it.** The renderer never receives secret material; all key generation, signing, relay communication, and encryption happen inside the Rust backend over a JSON-lines IPC channel, with NIP-46 approval gating every external sign/decrypt request. A neighboring app could copy features, but cannot truthfully copy this verifiable separation while offering the same dual CLI + GUI surface. +**Keys under your control, in whichever mode you choose — and the architecture proves it.** In embedded/bunker modes the renderer never receives secret material: all key generation, signing, relay communication, and encryption happen inside the Rust backend over a JSON-lines IPC channel, with NIP-46 approval gating every external sign/decrypt request. In external-signer mode (Amber, hardware signer, remote bunker) no secret key is present on this machine at all — a stronger posture when the desktop itself is the thing you distrust, since a compromise of this machine cannot extract a key it never held. A neighboring app could copy features, but cannot truthfully copy this verifiable separation while offering the same dual CLI + GUI surface. ## Operating Context Workflows: create/switch/delete/undo profiles, compose (Write/Preview, character count, up to 3 link previews, image pick → nostr.build upload with NIP-92 imeta), publish with per-relay receipts, feed aggregation (all vs. My contacts, 24h window), relay add/remove/enable/disable/test, NIP-05 assignment, secret reveal after unlock, vault backup, lock/unlock. @@ -37,7 +37,7 @@ Name: Nostr Keynctr / Nostr Feed Manager (early beta v0.1.0, MIT, Forgejo-hosted Real content: Rust crate (`src/app, vault, crypto, profiles, publish, relays, signer, feed`), React screens (`Compose, Home, Profiles, Relays, Settings, Signer`), `frontend/src/lib/types`, `AppProvider` context, `fakeBackend` Vitest suite (99 tests), `CHECKPOINT-encryption.md`. No marketing site or pricing; no external testimonials to preserve. ## Product Principles -1. **Keys never leave** — every feature must preserve the Rust/renderer boundary and approval gates; convenience never bypasses explicit consent. +1. **Keys under your control** — every feature must preserve the Rust/renderer boundary and approval gates (secrets never reach the GUI in local modes, and never reach this machine in external-signer mode); convenience never bypasses explicit consent. 2. **Local-first, verifiable** — encrypt at rest, least-privilege files, per-relay receipts, and auditable IPC over transient convenience. 3. **Progressive disclosure** — newcomer can succeed in two clicks; power user can stay in CLI or manage many profiles without UI churn. 4. **One core, two doors** — GUI and CLI remain interchangeable via the same Rust engine; no feature lives only in one surface without justification. diff --git a/README.md b/README.md index 2304ccf..8e28086 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,8 @@ # Nostr Feed Manager > A friendly Linux desktop app for managing Nostr profiles, publishing notes, and acting as a -> **NIP-46 remote signer** — all while your private keys never leave your machine. +> **NIP-46 remote signer** — your private keys stay under your control: encrypted in a local +> vault, or, when you connect an external signer, held only on that device. [![Version](https://img.shields.io/badge/version-0.1.0-blue)]() [![License: MIT](https://img.shields.io/badge/license-MIT-yellow.svg)](LICENSE) @@ -258,8 +259,13 @@ Your keys are the crown jewels in any Nostr app, and nothing here compromises th (`set-password`, or Settings → Storage). Once set, every secret key is encrypted with **AES-256-GCM** under a key derived from your password with **Argon2id**. Labels and public keys remain readable so you can browse profiles while the vault is locked. -- **In-memory key only.** You unlock once per session; the derived key lives only in memory and is - never written to disk. +- **In-memory key only.** You unlock once per session; the derived key lives only in memory and + is never written to disk. +- **External signer mode can be *more* secure.** The Signer screen can also use a NIP-46 signer + located elsewhere (Amber on your phone, a hardware-backed signer, a bunker you host). In that + mode no secret key exists on this desktop at all — signing happens on the signer device, so a + compromise of this machine cannot expose the key. "Keys never leave the machine" describes + embedded and bunker modes; in external mode the key never *arrives* on this machine. - **Approve-before-any-signing.** The NIP-46 remote signer will not sign, encrypt, or decrypt until you explicitly approve each request. - **Least-privileged storage.** Files are written with directories `0700` and files `0600`.