# Dual World: Free social freedom + Paid encrypted workspace

## Vision

Two planes — both real, neither confuses the other:

| Plane | Who | What |
|-------|-----|------|
| **Social world (free)** | Humans **and** social AIs | Feed, Shorts, chat, presence, KAIVERSE explore — free like public life (TikTok/YouTube/social style). **No** industrial Full Fleet. |
| **Workspace world (paid)** | Paying users | Antigravity-class **coding agent** + **encrypted storage containers**. Files never used for training/sharing. |

Industrial host fleet stays **host-only**. Guests never get Config / Antigravity host panes unless paid workspace product surface is gated in.

## Privacy model (honest + strong)

**Claim we make:** Server stores **ciphertext only**. Device-chain unlock means a DB dump does **not** yield file plaintext.

**Claim we do not make:** “Unhackable server.” No system is. We minimize blast radius.

### Device chain (first login → second device)

1. **First device** (login): client creates a local device id; server stores only `deviceHash` + genesis **chain token**.
2. **Second device** (e.g. Quest): requests link → **pending**.
3. **First device approves** (in-app): extends chain HMAC link; optionally uploads **wrapped master key** ciphertext for the new device.
4. Only devices on the chain may request `wrappedDek` for containers.
5. Decryption happens **on the device** (or user session with device secret) — not by server “reading files for you.”

### Encrypted containers

1. Client holds `masterKey` (device secret ± passphrase).
2. Each container has a random **DEK**.
3. Files encrypted client-side (AES-256-GCM); server stores blobs + `wrappedDek`.
4. Coding agent on server sees **ciphertext metadata** only; decrypt for tools runs in a device-bound session if we ever stream keys ephemerally (prefer local agent).

## Tier map (privileges)

| Privilege | Free | Explorer | Creator | Builder+ |
|-----------|------|----------|---------|----------|
| `social_ai_freedom` | yes | yes | yes | yes |
| `encrypted_vault` | no | no | light yes | yes |
| `workspace_coding_agent` | no | no | no | yes |
| `antigravity_workspace` | no | no | no | yes |
| `full_fleet` | **never free** | no | no | team+ |

## Modules

- `shared/device-chain.mjs` — register / pending / approve / chain integrity
- `shared/workspace-vault.mjs` — containers, ciphertext blobs, dual-world policy
- `shared/plan-tiers.mjs` — privileges above

## API surface (next wiring)

- `POST /api/devices/register` — primary device
- `POST /api/devices/request` — second device
- `POST /api/devices/approve` — primary approves
- `GET  /api/devices` — list (no secrets)
- `POST /api/vault/containers` — create (body: wrappedDek)
- `GET  /api/vault/containers`
- `POST /api/vault/files` — upload ciphertext
- `GET  /api/vault/files/:id` — download ciphertext

All vault routes: plan gate + `deviceHash` must be linked.

## UI (later)

- Free: social AIs fully on Feed/Shorts/chat (already mostly true).
- Paid: Workspace tab → upload → agent chats with **your** tree (decrypt client-side).
- Settings → Devices: approve Quest from PC.

## Status

- **Foundation shipped** (logic + tests): dual-world policy, device chain, vault crypto metadata.
- **API/UI** attach next without changing host industrial isolation.