feat: encrypted data + credential vaults, and the private-data onboarding architecture (ADRs 045–049)

.gitignore

@@ -29,3 +29,25 @@ data/
 .claude-flow/
 ruvector.db
 *.db
+
+# ═══════════════════════════════════════════════════════════════════
+# PRIVATE HEALTH DATA — NEVER COMMIT. THIS IS A PUBLIC REPO.
+# Real PHI: Apple Health exports, clinical & pharmacy records,
+# derived intelligence, personal vector stores. Best practice is to
+# keep this OUTSIDE the repo entirely (see docs/Helix-Build-Spec.md).
+# ═══════════════════════════════════════════════════════════════════
+/Stu Health Data/
+Stu Health Data/
+**/Stu Health Data/
+# Defense-in-depth: PHI file types anywhere in the working tree
+Health Records*.json
+HealthAutoExport*.zip
+*_apple_health_export.json
+*immunization*.pdf
+prescriptions*.pdf
+claw_health_*.json
+claw_health_*.md
+claw_swarm_memory.db*
+ros3-agentdb.db
+# Convention for any future private data — put it under private/
+/private/

crates/helix-vault/Cargo.toml

@@ -15,7 +15,22 @@ helix-provenance = { path = "../helix-provenance", version = "0.1.0" }
 chacha20poly1305 = "0.10"
 getrandom = "0.2"
 zeroize = { version = "1", features = ["derive"] }
+# Disk persistence backend. Optional + off by default so the standard build and
+# any wasm target never compile redb/filesystem code (ADR-001 wasm-safety).
+redb = { version = "2", optional = true }
+# Argon2id passphrase KDF for the CredentialVault. Optional + off by default for
+# the same reason: the standard build and wasm target never pull in the KDF.
+argon2 = { version = "0.5", optional = true }
+# JSON encoding of a `Credential` before it is sealed. Optional + persist-gated;
+# the default build already carries serde_json only as a dev-dependency.
+serde_json = { workspace = true, optional = true }
 
 [dev-dependencies]
 proptest.workspace = true
 serde_json.workspace = true
+tempfile = "3"
+
+[features]
+# Non-default: enables the disk-backed, encrypted-at-rest `PersistentVaultStore`
+# and the passphrase-unlocked `CredentialVault` (Argon2id KDF).
+persist = ["dep:redb", "dep:argon2", "dep:serde_json"]