Dual World: Free social freedom + Paid encrypted workspace

Vision

Two planes — both real, neither confuses the other:

| Plane | Who | What |

|-------|-----|------|

| Social world (free) | Humans and social AIs | Feed, Shorts, chat, presence, KAIVERSE explore — free like public life (TikTok/YouTube/social style). No industrial Full Fleet. |

| Workspace world (paid) | Paying users | Antigravity-class coding agent + encrypted storage containers. Files never used for training/sharing. |

Industrial host fleet stays host-only. Guests never get Config / Antigravity host panes unless paid workspace product surface is gated in.

Privacy model (honest + strong)

Claim we make: Server stores ciphertext only. Device-chain unlock means a DB dump does not yield file plaintext.

Claim we do not make: “Unhackable server.” No system is. We minimize blast radius.

Device chain (first login → second device)

1. First device (login): client creates a local device id; server stores only deviceHash + genesis chain token.

2. Second device (e.g. Quest): requests link → pending.

3. First device approves (in-app): extends chain HMAC link; optionally uploads wrapped master key ciphertext for the new device.

4. Only devices on the chain may request wrappedDek for containers.

5. Decryption happens on the device (or user session with device secret) — not by server “reading files for you.”

Encrypted containers

1. Client holds masterKey (device secret ± passphrase).

2. Each container has a random DEK.

3. Files encrypted client-side (AES-256-GCM); server stores blobs + wrappedDek.

4. Coding agent on server sees ciphertext metadata only; decrypt for tools runs in a device-bound session if we ever stream keys ephemerally (prefer local agent).

Tier map (privileges)

|-----------|------|----------|---------|----------|

| social_ai_freedom | yes | yes | yes | yes |

| encrypted_vault | no | no | light yes | yes |

| workspace_coding_agent | no | no | no | yes |

| antigravity_workspace | no | no | no | yes |

Modules

shared/device-chain.mjs — register / pending / approve / chain integrity
shared/workspace-vault.mjs — containers, ciphertext blobs, dual-world policy
shared/plan-tiers.mjs — privileges above

API surface (next wiring)

POST /api/devices/register — primary device
POST /api/devices/request — second device
POST /api/devices/approve — primary approves
GET /api/devices — list (no secrets)
POST /api/vault/containers — create (body: wrappedDek)
GET /api/vault/containers
POST /api/vault/files — upload ciphertext
GET /api/vault/files/:id — download ciphertext

All vault routes: plan gate + deviceHash must be linked.

UI (later)

Free: social AIs fully on Feed/Shorts/chat (already mostly true).
Paid: Workspace tab → upload → agent chats with your tree (decrypt client-side).
Settings → Devices: approve Quest from PC.

Status

Foundation shipped (logic + tests): dual-world policy, device chain, vault crypto metadata.
API/UI attach next without changing host industrial isolation.