Keys

Mechanisms only. No key material, secret values or configuration values appear in these pages, and none is needed to follow them.

The keys and what each opens

The salt is the only key the package ever sees. It takes every key from its caller, refuses one shorter than 16 bytes (keys.MIN_KEY), and has no default, no module-level key and no literal key. Turning stand-ins off (set_anon(None)) produces untokenized tags ([EMAIL]), never output keyed by something guessable.

What the salt keys

Each product label is fixed per product and each runner's tests/test_salt_source.py checks that every salt it hands the package comes from HMAC(deal data key, its own label), and forbids the other product's label. The package's test_salt_labels_stay_put pins both labels: renaming one changes every stand-in that product ever delivered (or orphans every sealed map); sharing one would link the products.

The person id in the linkage table (person_<12 hex>) is CSPRNG output in both modes.

Sealed identity map

The package hands the map over as bytes (Graph.state()) and never stores it. The reference runner seals it:

blob   {"v": 1, "alg": "A256GCM", "map": b64(nonce || ciphertext), "lookup": b64(nonce || ciphertext)}
map    Graph.state()                       under K_map     (AES-256-GCM, 12-byte random nonce)
lookup zlib JSON {index: [random stand-in, ...]}  under K_lookup
AAD    "<label>|<deal id>|<section>"       so a section can't be replayed into another deal or slot

The control plane stores the blob in parts of at most 2.5 MB. A run reads the head version, stages the new version's parts, and commits by moving the head from the version it read; a commit answers 409 when another run committed first, and the runner reads the newer map, absorbs it (nothing dropped, older person ids kept) and retries, up to 6 tries. A map in one mode refuses the other (ModeChanged). A claim whose map won't open under its key fails the job rather than starting an empty map.

Crypto-shredding

Destroying a deal's data key (the control plane deletes the wrapped key):

• the deal's vault objects can no longer be decrypted;
• the identity map no longer opens, so no new run can link to old ones;
• the salt can't be re-derived from the data key, so no new keyed stand-in can be made;
• watermark attribution for every version of the deal ends.

What survives, by design, until its own end: the narrow lookup key, if anything from the deal reached a buyer and the contract term hasn't ended. While it lives, the desk can still answer "which stand-ins could this person have become?" for a deletion request; it can't decrypt anything. Destroying it ends that too. A control plane's database backups can hold wrapped keys until their retention window ends; each product states that window in its deletion certificate.

Isolation contract

The package is shared code only. It never reaches infrastructure, keys or data of any product, and tests/test_isolation.py fails the build of every runner that vendors it if that changes:

• No outside IO. No network, process or host modules; no environment reads; no open() outside a short per-file allowlist, each entry with its reason; every git command local.
• No product names. No product name, domain, host, bucket, app, org, key label or claim field anywhere in the package, these pages included.
• Caller-held keys. Every keyed API takes its key from the caller and refuses a missing, empty or short one.
• Unlinkable output. The same input under two keys gives disjoint stand-ins, person ids, git identities, repository-file identities, owner-identity tokens and fingerprints; the same key always gives the same output.

Denied modules unless granted: aiobotocore, aiohttp, asyncio, azure, boto3, botocore, concurrent, ctypes, dbm, dotenv, ftplib, gcsfs, google, grpc, http, httpx, imaplib, mmap, multiprocessing, nntplib, paramiko, poplib, pty, requests, s3fs, smtplib, socket, socketserver, sqlite3, ssl, subprocess, telnetlib, urllib, urllib3, webbrowser, websocket, websockets, xmlrpc.

Third-party imports allowed: 7 (listed in the auditor edition).