bpforbes/keyquorum

How bpforbes/keyquorum works

KeyQuorum is a hardware-key-quorum file-sharing system with a command-line interface and a browser lab that runs the real commands in a sandbox. The principal workflow registers keys, organizes them into a recursive threshold tree, protects a file, then reconstructs the key from presented shares to unlock it. The graph also includes device custody, transfers, bridges, relay/provider services, and the lab experience. Arrows use README statements or indexed source references; several implementation details are unsampled, so uncertain internal calls are omitted.

Main entry points: mod.rs KeyQuorum CLI · state.rs Lab state · key_tree.rs Recursive key tree · quorum.rs Quorum access

Components 21

Command interfaces

KeyQuorum CLI src/cli/mod.rs
Device CLI src/cli/device_cmd.rs

Keys and custody

Key registry src/keys.rs
Device custody src/device.rs
Recursive key tree src/key_tree.rs
Quorum access src/quorum.rs
Cryptography src/crypto.rs

Protected files

Protected files src/locked_files.rs
Password vault src/vault.rs
SQLite store src/db/mod.rs
Storage backends src/storage.rs

Sharing and relay

Sealed envelopes src/envelope.rs
Key transfers src/transfer.rs
Private bridges src/private_bridge.rs
Relay client src/relay/client.rs
Relay service src/relay/service.rs
Provider identity src/provider.rs

Browser lab

Sandbox machine src/lab/vm.rs
Lab state src/lab/state.rs
Lab interface lab/src/App.tsx

Other components

Operator

Connections 30

Operator → KeyQuorum CLI: runs commands
Operator → Device CLI: manages devices
KeyQuorum CLI → Key registry: registers keys src/cli/mod.rs
KeyQuorum CLI → Recursive key tree: manages trees src/cli/mod.rs
KeyQuorum CLI → Quorum access: requests access src/cli/mod.rs
KeyQuorum CLI → Protected files: protects files src/cli/mod.rs
Device CLI → Device custody: manages slots
Device custody → Key registry: binds keys src/device.rs
Recursive key tree → SQLite store: reads tree src/key_tree.rs
Recursive key tree → Key registry: checks keys src/key_tree.rs
Quorum access → Recursive key tree: reconstructs shares src/quorum.rs
Quorum access → Device custody: checks devices src/quorum.rs
Quorum access → Cryptography: uses primitives src/quorum.rs
Protected files → Cryptography: encrypts content src/locked_files.rs
Protected files → Storage backends: stores ciphertext src/locked_files.rs
Protected files → SQLite store: records files
Password vault → Cryptography: derives keys src/vault.rs
KeyQuorum CLI → Key transfers: moves identities src/cli/mod.rs
Key transfers → Sealed envelopes: seals letters
KeyQuorum CLI → Private bridges: manages bridges src/cli/mod.rs
Private bridges → Sealed envelopes: packages updates src/private_bridge.rs
KeyQuorum CLI → Relay client: uses relay src/cli/mod.rs
Relay client → Relay service: sends requests src/relay/service.rs
Relay service → Provider identity: checks identity src/relay/service.rs
Lab interface → Lab state: invokes actions
Lab state → Sandbox machine: runs commands src/lab/state.rs
Lab state → Device custody: simulates custody src/lab/state.rs
Lab state → Recursive key tree: uses tree logic src/lab/state.rs
Lab state → Key transfers: supports transfers src/lab/state.rs
Lab state → Relay client: uses relay client src/lab/state.rs

More Rust diagrams: kwsc98/fusen-rs · muvon/octocode · qymis-tech/qymcad · sloganking/codevis · tritonvm/triton-vm

Drawn by GitDiagram on September 30, 2026 from the repository's file tree, README and source files. Read as Markdown ·