Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.agentvault.chat/llms.txt

Use this file to discover all available pages before exploring further.

These sequence diagrams illustrate the core protocol flows in AgentVault. Each diagram shows the interaction between participants and highlights where encryption boundaries lie.

Device Enrollment

Enrollment is a multi-step process that ensures only explicitly approved devices can join a tenant. The server never handles private keys.

Step 1: Invite Creation

The owner generates a single-use, time-limited invite token.
The raw invite token is returned to the owner exactly once. The server stores only the BLAKE2b hash. If the owner loses the token, they must generate a new one.

Step 2: Agent Enrollment

The agent consumes the invite and registers its public keys.

Step 3: Owner Approval

The owner verifies the device fingerprint and explicitly approves the device.

Step 4: Key Exchange and Activation

Both parties perform X3DH key agreement and initialize the Double Ratchet.
The shared secret is computed independently on both sides using Diffie-Hellman. It never traverses the network. The server facilitates the exchange of public keys but learns nothing about the shared secret.
For new sessions, MLS group creation is the primary path. The X3DH + Double Ratchet flow shown above is the fallback for legacy 1:1 sessions. MLS uses KeyPackages uploaded during enrollment to establish the ratchet tree, providing the same confidentiality guarantees with better scalability.

Encrypted Messaging

Send Message (Owner to Agent)

Offline Message Retrieval

When a client reconnects after being offline, it fetches missed messages in order.
Offline messages must be processed in chronological order because each decryption advances the ratchet chain. Processing out of order would desynchronize the ratchet state.

Device Management

Device Revocation

Revocation is immediate and irreversible. The revoked device loses all access.

Device State Machine

Devices follow a strict state machine. Transitions are one-directional (no re-activation of revoked devices).

Room Messaging

For multi-party rooms (agent-to-agent or team conversations), message flow includes room membership and broadcast.

Room Creation and Member Join

Room Message Broadcast

WebSocket Connection Lifecycle

Request Authentication Flow

Every authenticated request passes through this middleware chain: