Share a vault with a team, without the server holding a key

M3's teams, sharing and ACLs. Teams with roles, a public-key directory, the
append-only key log served for clients to check it against, team-owned vaults,
and vault key grants wrapped by a client and stored opaquely by the server.
VaultAccessService resolves team membership to PermissionFlags, so a viewer may
pull and may not push; the desktop client reads and syncs every vault it holds
a key for, and a real TEAMS screen replaces the one that said it did not exist.
No migration: team, team_membership, vault.team_id and vault_key_grant have all
been there since the first one, which is what carrying two unused tables bought.

Membership is authorisation. A grant is access. The obvious model is one
concept — "access", with a role attached, handed out by the server — and this
architecture cannot implement it: a vault key is sealed to each member's X25519
key, and only a client holding the plaintext can seal it for somebody else. So
"give Bob access" decomposes into a database write and a wrap, which happen on
different machines. Adding a member makes the server serve them the vault; it
cannot make it readable. VaultSummary.WrappedVaultKey is null in the meantime
and the vault appears in their list saying it is waiting for a key, because
hiding it until a grant existed would have been tidier and would have implied
the server was the thing granting access. The screen says the same thing after
every add, in the status line. ADR 0009 records the whole decision.

Sharing verifies or refuses. A directory lookup is a claim by the server about
a third party's public key, and wrapping to an unverified claim hands the vault
to whoever made it — no amount of transport security helps, because the server
is inside the threat model. KeyLogAudit reads the whole log, recomputes every
entry's hash from its own contents, checks the chain from genesis, and refuses
unless the offered key appears in it unchanged. There is no override flag: one
that exists gets used on the day the log is briefly unreachable, and the
resulting grant is indistinguishable from a correct one afterwards. What it
still cannot promise is that the key is the right person's, so the fingerprint
comes back for an out-of-band comparison and the success message says so every
time. A test corrupts the fake server's log by one byte and watches the client
refuse rather than warn.

The roles are only the ones that are enforceable. There is no ConnectOnly,
despite the design asking for one and TeamRole having room: SSH terminates on
the client, so a session needs the credential's plaintext on that machine, and
"may connect but may not read the key" cannot be enforced here. Shipping it as
an option in a dropdown would have been a lie. Connect rides along with Read
and is documented as an interface hint. Removal is named for what it does — it
revokes grants and flags the vault for rekey, and claims nothing about what is
already on somebody's laptop.

Three things are deliberately absent, and each is a refusal rather than an
omission. The rekey itself, because re-wrapping every item's data key under a
new vault key needs a client holding the current one; the server records that a
rotation is owed and the interface reports it, which is more honest than a
button that only appears to do it. Ownership transfer, because allowing an
owner to be removed without one leaves a team nobody can administer. And
cross-vault host key trust: a pin in a team vault is listed but not consulted
at connect time, because any member with Write could otherwise pre-approve a
fingerprint another member's client then trusts silently for a host in their
own vault. Scoping trust properly needs a scope on the SSH connect path, which
IKnownHostStore has not got; until then the narrow direction is the safe one
and the cost is in the README rather than hidden.

Reading now spans vaults and writing still does not. Every list on the vault
and hosts screens covers each vault the keyring opened, rows carry the vault
they came from, and an edit goes back to that vault rather than to the active
one — writing it to the active vault would fork the item and only show up when
a colleague wondered why their change never arrived. A new item goes wherever a
picker says, defaulting to the personal vault and never moving on its own,
because an item filed into a team's vault is visible to that team and moving it
back means deleting and retyping. The sidebar heading stops naming one vault
once there are two, and each row names its own.

The server checks what it can and nothing it cannot. It will not record a grant
for a key its recipient no longer holds, for a superseded generation, or for
somebody who is not in the team — each of those would otherwise surface days
later at the far end as a tag failure indistinguishable from corruption. It
does not verify the wrap or the signature, and the grant service says so: that
would be a convenience and never the boundary, and would put an asymmetric
implementation on a machine that is supposed to hold no keys.

Two bugs the tests found. TeamsViewModel's busy gate blocked its own reload, so
a team created a moment earlier was missing from the list it had just been
added to. And syncing every vault turned a failure from an exception into a
report, which made a background pass announce an unreachable vault once a
minute — the exact behaviour AnAutomaticPassThatFails_LeavesTheStatusAlone
exists to prevent. The fact is recorded and the message swallowed, as it was
before; pressing Sync still names the vault and the reason.

Also fixes a build break this branch started with: QuickConnectTests was never
updated when M2 added ISftpSessionFactory to the shell's constructor, so
nothing built at all.

docs/adr/0009-team-access-model.md

@@ -0,0 +1,89 @@
+# ADR 0009 — Team access: membership authorises, a grant unlocks
+
+- Status: accepted
+- Date: 2026-07-31
+- Builds on: [ADR 0001](0001-e2ee-trust-model.md)
+
+## Context
+
+M3 makes vaults shareable. The obvious way to model that is one concept — "access" — with a role
+attached, and to let the server hand it out. Every hosted competitor works that way, and it is what
+the imported design drew: a members table with a role column, and a share button beside each item.
+
+This architecture cannot implement that concept, and the interesting part of M3 was working out
+what it can implement instead.
+
+The server holds ciphertext and no keys. A vault key is 32 random bytes sealed to each member's
+X25519 public key (`docs/crypto.md` §3), and only a client holding the plaintext key can produce a
+seal for somebody else. So "give Bob access" decomposes into two operations that live on different
+machines and cannot be performed by the same actor:
+
+- deciding that the server will **serve** Bob this vault's rows, which is a database write; and
+- **wrapping** the vault key to Bob's public key, which needs a client that already holds it.
+
+The schema anticipated this — `team`, `team_membership`, `vault.team_id` and `vault_key_grant` have
+existed since the first migration — but nothing had had to name the split.
+
+## Decision
+
+**Membership is authorisation. A grant is access. The product says so out loud.**
+
+`VaultAccessService` resolves a team vault through `team_membership`, mapping the role to
+`PermissionFlags` by a union with no Deny rules. That decides what the server serves and nothing
+else. Whether the caller can read what it serves is decided by whether they hold a grant, which the
+server records, cannot produce and cannot verify.
+
+Four consequences, each of which is a place where a more reassuring design was rejected:
+
+- **A member with no grant is a normal state, not an error.** `VaultSummary.WrappedVaultKey` is null
+  and the vault appears in their list saying it is waiting for a key. Hiding it until a grant existed
+  would have been tidier and would have implied the server was the thing granting access.
+- **The roles are only the ones that are enforceable.** There is no `ConnectOnly`, despite the design
+  asking for one and `TeamRole` having room. SSH terminates on the client, so opening a session needs
+  the credential's plaintext on that machine; "may connect but may not read the key" cannot be
+  enforced here, and shipping it as a role would have been a lie in a dropdown. `Connect` rides along
+  with `Read` and is documented as an interface hint.
+- **Sharing verifies the recipient's key against the append-only key log, or refuses.** A directory
+  lookup is a claim by the server about a third party's public key; wrapping to an unverified claim
+  hands the vault to whoever made it. `KeyLogAudit` reads the whole log, checks its hash chain from
+  genesis, and refuses unless the offered key appears in it unchanged. There is no override flag,
+  because a flag that exists gets used on the day the log is briefly unreachable.
+- **Removal is named for what it does.** It revokes grants and flags the vault for rekey. It does not
+  claim to reach anything already downloaded, and the interface says the remediation is rotating the
+  credential — the same non-retroactive limit ADR 0001 records.
+
+Two things were deliberately **not** built, and both are refusals rather than omissions:
+
+- **The rekey itself.** Only a client holding the current vault key can re-wrap every item's data key
+  under a new one. The server records that a rotation is owed and the interface reports it. M5.
+- **Ownership transfer.** The owner cannot be demoted or removed, with its own problem code. Allowing
+  it without a transfer would leave a team nobody can administer, recoverable only by an operator
+  editing the database.
+
+Two smaller choices, recorded because the alternative was written down first and rejected:
+
+- **No `v_user_vault_permission` view.** ADR-adjacent notes and the old `VaultAccessService` remark
+  both anticipated one. The rules turned out to be about sixteen lines of C# shared by the two
+  methods that need them; a view would have moved the authorisation model into migrations, where a
+  test cannot reach it without a container.
+- **Host key trust stays vault-scoped to the personal vault.** Pins in a team vault are listed but
+  not consulted at connect time. Consulting them would let any member with Write pre-approve a
+  fingerprint that another member's client then trusts silently for a host in their *own* vault,
+  which is a cross-boundary trust escalation. Scoping trust properly needs a scope on the SSH connect
+  path (`IKnownHostStore.FindAsync` takes host, port and algorithm and knows nothing about vaults);
+  until that exists, the safe direction is the narrow one, and the cost — approving a team host's key
+  once per member per machine — is stated in the README rather than hidden.
+
+## Consequences
+
+The sharing graph is visible to the operator: who is in which team, which vaults exist, and who holds
+a grant are all plaintext rows. That was already true of metadata generally (`docs/crypto.md` §10)
+and is not made worse here, but it is now a graph rather than a list.
+
+A malicious granter can seal garbage. The recipient detects it as a tag failure and the grant's
+Ed25519 signature names who issued it — detectable and attributable, which is the most that is
+achievable without the server holding a key.
+
+The two-step model costs a step in the interface and buys the property the whole product is for. It
+also makes a class of bug impossible: there is no code path on the server that could accidentally
+grant read access to plaintext, because there is no plaintext on the server to grant.

docs/design-import-gaps.md

@@ -26,11 +26,12 @@ file transfer is a *separate connection* rather than a second channel, because S
 its own transport. See [File transfer](#file-transfer-the-designs-sftp-screen), which is the one place in
 this document where what shipped differs from what the row predicted.
 
-**Teams are schema and nothing else.** The `team` and `team_membership` tables exist from the first
-migration, with entities in `DodoSSH.Domain/Teams.cs` and a `TeamRole` enum — and no endpoint reads or
-writes any of it. `VaultAccessService.ResolveAsync` returns `Denied` for every vault that is not the
-caller's own personal one. That removes the Teams screen entirely, and with it every role chip, scope and
-"shared with" affordance the vault screen was drawn with.
+**~~Teams are schema and nothing else.~~ Built in M3.** The `team` and `team_membership` tables were there
+from the first migration with nothing reading them, and `VaultAccessService.ResolveAsync` denied every vault
+that was not the caller's own. Both changed in M3 and neither needed a migration, which is what carrying two
+unused tables bought. See [Teams](#teams). What has *not* changed is the split underneath: the server
+decides what it will serve, and only a client can decide who can read it — so "shared with" is two facts on
+this screen, not one.
 
 **The client has no preferences store.** It writes exactly two files — `cache.db` and `device.key` — and the
 cache has six tables, none of them settings. Nothing on the design's TERMINAL preferences panel can be
@@ -48,7 +49,7 @@ protocol rather than a protocol change.
 
 | Design element | Layer | What it would take | What ships instead |
 | --- | --- | --- | --- |
-| Org chip `dodotech / platform` | contracts + server | An organisation name a client can read. `VaultSummary.TeamId` exists and is always null. | The vault's own name, and the account this machine is enrolled as. |
+| Org chip `dodotech / platform` | contracts + server | An *organisation* above teams, which does not exist — `VaultSummary.TeamId` is no longer always null since M3, but a team is not an org and there is exactly one tenant per deployment. | The vault's own name, and the account this machine is enrolled as. Team names are on the TEAMS screen, where they are about something. |
 | `SYNCED` dot, always green | client-app | Nothing — the design's claim is simply unconditional. | Green **only** when a connection is held, the last sync pass actually reached the server, and the outbox is empty; otherwise `UNREACHABLE`, the count of changes still waiting, or `OFFLINE`. Holding an `IVaultServer` proves a sign-in once succeeded and nothing more, so a laptop whose lid has been shut all afternoon still has one — reachability comes from the outcome of the last pass. A permanently green light is the same as no light. |
 | `VAULT SYNCED 11:02` | client-session | `StoredSyncState.LastPulledAt`/`LastPushedAt` are persisted, but `VaultSession` exposes the store as `internal`. A property away. | Omitted. The one honest sync fact — the outbox depth — is in the titlebar and the status bar. |
 | `⌘K` command palette running commands | client-domain | A snippet or saved-command item type (`SyncEntityType.Snippet = 8` is reserved). | Ctrl+K opens a real host search that connects on Enter. The box says "search hosts", not "search hosts · run command". |
@@ -71,8 +72,8 @@ caption buttons and window title drawn on top of the application's own — two s
 | Design element | Layer | What it would take | What ships instead |
 | --- | --- | --- | --- |
 | Tag chips (`nginx`, `eu`, `pg16`) | client-domain | A tag item type and a host-tag join. Both reserved on the wire (`Tag = 5`, `HostTag = 6`), neither implemented, plus a payload schema bump on `HostSecret`. | Omitted. The filter box searches name, address and notes instead. |
-| Groups `PRODUCTION` / `STAGING` / `PERSONAL` | client-domain | A host-group item type (`HostGroup = 4`, reserved) or a group field on `HostSecret`. | One collapsible heading, named after the vault — the only grouping a host actually has. A second appears when a second vault becomes reachable. |
-| Group badge `TEAM·PLATFORM` | server | Teams. | Omitted. |
+| Groups `PRODUCTION` / `STAGING` / `PERSONAL` | client-domain | A host-group item type (`HostGroup = 4`, reserved) or a group field on `HostSecret`. | One heading per vault — the only grouping a host actually has. Since M3 there is genuinely more than one when somebody is in a team, which is what that row always predicted. |
+| Group badge `TEAM·PLATFORM` | server | **Built in M3.** | The vault's name on each row, and the personal vault ordered first. Not the team's name: two of a team's vaults would then carry the same badge and the badge would be naming the wrong thing. |
 | Per-host status dot, three colours | client-ssh | The amber state would mean "reachable but not connected", and nothing here ever probes a host. | Two states, both real: green when a terminal is open on that host, grey when not. |
 | `· ⤷ bastion-eu` in the host subtitle | client-ssh | **Jump hosts are data-only.** `HostSecret.JumpHostIds` is a `JumpChain` that is stored, encrypted, synced and three-way merged — and nothing reads it at connect time. `SshConnectionRequest` carries one host. | Omitted. The stored chain is preserved untouched by every edit. |
 | `SPLIT ⌘D` and side-by-side panes | client-ssh + ui | The renderer stacks panes and shows one (`terminal.css`: `.pane { position:absolute; inset:0; display:none }`). Tiling needs a real pane geometry and a splitter. | Omitted. Tabs ship instead, over the same one-WebView multiplexing. |
@@ -131,10 +132,10 @@ and both editors. What follows is what the design drew around them.
 | Design element | Layer | What it would take | What ships instead |
 | --- | --- | --- | --- |
 | `ACCESS` column and `your access → CONNECT-ONLY` | server | Per-item ACLs. `EncryptedPayload.DataKeyId` is documented as the seam for per-item grants **in M5**. `VaultSummary` does carry an opaque `int Permissions`, but nothing gives the bits a meaning on the wire — `PermissionFlags` itself lives in `DodoSSH.Domain` — and those are per *vault*, never per item. There is no `ConnectOnly` role in `TeamRole` at all. | Omitted. The column shows sync state instead — whether a change is still sitting in this machine's outbox — which the design had no column for. |
-| `SHARED WITH · 6` avatars | server | The whole sharing stack: grants, a member directory, and re-wrapping a vault key for another account. | Omitted. |
+| `SHARED WITH · 6` avatars | server | **Built in M3**, minus the avatars — no picture is stored anywhere. `GET /api/v1/vaults/{id}/grants` lists who holds a key. | The list lives on the TEAMS screen, beside the members it is about, rather than as a count on an item row: a grant is per *vault*, and putting a number on an item would imply per-item sharing, which is M5. |
 | "Private key never leaves the vault. Sessions sign through the team agent (dodod)" | client-ssh | **Both sentences are false here, and the second cannot be made true by this architecture.** There is no agent of any kind, and the connect path decrypts the private key and hands the bytes to SSH.NET. | Omitted. The key editor already says what is true: the key and its passphrase are encrypted here and never reach the server in a readable form. |
-| Scope rail: `PERSONAL` / `TEAM · PLATFORM` / `TEAM · DATA` | server | Team vaults. `VaultAccessService.ListAsync` filters to personal vaults owned by the caller. | The real vault list, which today has one entry, with a line saying why. |
-| `SCOPE` column | server | As above — and note scope here is a property of a *vault*, never of an item. | Omitted. |
+| Scope rail: `PERSONAL` / `TEAM · PLATFORM` / `TEAM · DATA` | server | **Built in M3.** `VaultAccessService.ListAsync` resolves team membership, so a session can hold several vaults. | Not a rail, because it would be a selector with nothing to select: every list on the screen already spans every vault this session can read. What replaces it is a picker for where a *new* item is filed, which is the only vault question with an answer. |
+| `SCOPE` column | server | **Built in M3.** Scope is a property of a vault, never of an item, and that has not changed. | Each row names the vault it is in, and rows are grouped by vault. |
 | `LAST` column (`11:02`, `1d ago`) | contracts | No last-used timestamp at any layer. `VaultItem<TSecret>` is `(id, secret, version, three sync flags)`. | Omitted. |
 | `FINGERPRINT` for SSH keys | client-domain | `SshKeySecret` has no fingerprint field, and computing one means parsing key formats the type deliberately stores verbatim. | The `DETAIL` column carries what *is* known — whether a passphrase and a public half are stored. Pins show their real fingerprint, in full and untruncated. |
 | `•••• rotated jul 14` for passwords | client-domain | `CredentialSecret` has no rotation date or password age. | The account the password is for. |
@@ -144,7 +145,7 @@ and both editors. What follows is what the design drew around them.
 | `added by anna@dodotech.dev` | contracts | The server records `CreatedByUserId`, but `SyncChange` carries no actor field and no other user's name is fetchable. | Omitted, and the detail pane says in one line that items record no author, no timestamps and no sharing. |
 | `created 2026-03-14` | client-sync | Recoverable in principle — entity ids are UUIDv7 and carry a timestamp — but nothing surfaces it. | Omitted. |
 | `TEST CONNECT` | ui | Connecting is host-scoped, not credential-scoped: there is nothing to test a credential *against* without a host. | Omitted. |
-| `REVOKE` | server | Revoking someone else's access needs grants to revoke. Deleting an item is a different act and is already there. **ADR 0001** also constrains how any future revoke may be presented: revocation is not retroactive. | Delete, named for what it does. |
+| `REVOKE` | server | **Built in M3**, as WITHDRAW KEY on the TEAMS screen — because there are now grants to revoke, and a grant is what it acts on. ADR 0001 constrains how it is presented, and it is: the message says it blocks future reads only, and that what they already hold is unaffected. | On this screen, still Delete, named for what it does. Deleting an item and withdrawing somebody's key remain different acts. |
 | `SSH KEY · ED25519` | client-domain | No algorithm field, and deriving it means parsing the armour. | The type without the algorithm. |
 | One `+ ADD CREDENTIAL` button | ui | — | Two buttons, one per kind that can be added. "Credential" is a specific item type in this codebase (a username and a password), so using it as an umbrella word would collide with the vocabulary. |
 | — | — | — | **`HOST KEYS` is the reverse case:** a fully-backed, shipped category the design had no slot for. It is in the rail. |
@@ -153,23 +154,40 @@ and both editors. What follows is what the design drew around them.
 
 ## Teams
 
-Nothing on this screen exists. It is in the nav rail and reaches a screen that says so.
+**Built in M3.** The screen ships: a team list, a members table, the team's vaults, and the two buttons the
+whole design was really about — add a member, and share a vault key. What follows is what it still does not
+do, and one thing this document got wrong before it was built.
 
-| Design element | Layer | What it would take |
+**The correction.** The rows below used to describe a screen with nothing behind it, on the grounds that
+`VaultAccessService.ResolveAsync` denied every vault that was not the caller's own. That is now the one
+place that changed, exactly as its remark predicted, and no migration was needed: `team`,
+`team_membership`, `vault.team_id` and `vault_key_grant` have all been there since the first migration.
+What the row did not anticipate is that the interesting half is not the endpoints at all. It is that
+**membership and readability are different things**, and the screen is arranged around saying so.
+
+| Design element | Layer | What ships |
 | --- | --- | --- |
-| The team itself | server | Team endpoints. The server has eight routes and none is about people. |
-| Shared vaults | server | Vault creation, grants, and membership evaluation. Exactly one vault exists per user, created as a side effect of enrollment. |
-| Roles (`OWNER`/`ADMIN`/`MEMBER`/`CONNECT-ONLY`/`VIEWER`) | contracts + server | `TeamRole` exists in `DodoSSH.Domain`, is read by no code path, has no wire representation, and has no `ConnectOnly` member. |
-| Members table | server | A member DTO and a directory endpoint. |
-| `2FA ENFORCED` and the per-member 2FA column | server | No two-factor concept exists anywhere — the only hit in the whole worktree is an aside in `docs/crypto.md`. |
-| `LAST ACTIVE` | server | `UserAccount.LastSeenAtUtc` exists and is written at just-in-time provisioning and at enrollment, and never on an ordinary authenticated request — so the column cannot answer "last active". |
-| Avatars | server | `MeResponse` has no picture field, and no other user's display name is fetchable. |
-| Pending invites, resend, revoke | server | An invitation entity, a token with a lifetime, and an outbound mail path. `MembershipStatus.Invited` and `TeamMembership.InvitedByUserId` are the only hints, and nothing writes them. |
-| `SSO · OIDC · okta.dodotech.dev` | server | Per-team SSO. Authentication is one global JWT scheme bound to one authority. |
+| The team itself | server | `POST/GET /api/v1/teams`, plus members, roles and team vaults. Ids are client-chosen, so a create whose response was lost is safe to repeat. |
+| Shared vaults | server + client | A team owns vaults; each is created with the creator's own grant, because a vault with no grant is a container nobody can open. |
+| Roles | contracts + server | `TeamMemberRole` on the wire, numerically pinned to `DodoSSH.Domain.TeamRole` by a test. Viewer reads, Member writes, Admin and Owner also share and administer. |
+| Members table | server | `TeamMemberSummary`, and a directory that resolves an exact email to a public key. |
+| Sharing an item | client | `VaultSession.ShareVaultAsync`: verify the recipient's key against the key log, wrap, sign, record. The server stores the wrap and the signature and can check neither. |
 
-> **A trap for whoever builds this.** `GET /api/v1/meta` advertises `features: ["teams"]`
-> *unconditionally* (`MetaEndpoints.cs`). Do not gate a Teams screen on that string — it is true of every
-> deployment today and means nothing.
+| Design element | Layer | What it would take | What ships instead |
+| --- | --- | --- | --- |
+| `CONNECT-ONLY` role | — | Nothing that would be true. Connect is a user-interface hint, not a boundary: SSH terminates on the client, so a session needs the credential's plaintext on that machine. See ADR 0001. | Four roles, all of which are enforceable. `Connect` rides along with `Read` and is documented as a hint. |
+| `2FA ENFORCED` and the per-member 2FA column | server | No two-factor concept exists anywhere — the only hit in the whole worktree is an aside in `docs/crypto.md`. | Omitted. The member column carries what *is* known and matters: whether they have published a key a vault can be wrapped to. |
+| `LAST ACTIVE` | server | `UserAccount.LastSeenAtUtc` is written at just-in-time provisioning and at enrollment and never on an ordinary authenticated request, so the column cannot answer "last active". | Omitted. |
+| Avatars | server | No picture is stored anywhere. | Omitted; the row shows a name and an address. |
+| Pending invites, resend, revoke | server | An invitation entity, a token with a lifetime, and an outbound mail path. `MembershipStatus.Invited` remains unwritten. | Adding a member resolves an address the caller types against the directory, so the account has to have signed in here once. The screen says that when the lookup finds nothing. |
+| `SSO · OIDC · okta.dodotech.dev` | server | Per-team SSO. Authentication is one global JWT scheme bound to one authority. | Omitted. |
+| A rekey after a membership change | client | Re-wrapping every item's data key under a fresh vault key, which only a client holding the current one can do. M5. | The vault is flagged `RekeyRequired` and the row says a rotation is owed. |
+| Ownership transfer | server | A confirmation flow and a rule for what happens to the outgoing owner. | The owner cannot be removed or demoted, with its own problem code rather than a bare 400. |
+
+> **The trap this document warned about is still a trap.** `GET /api/v1/meta` advertises
+> `features: ["teams"]` *unconditionally* (`MetaEndpoints.cs`). It was meaningless when nothing implemented
+> teams and it is meaningless now that everything does — it has never been computed from anything. Do not
+> gate a client feature on it.
 
 ---