fix(identity): key the device-seed cache by account (spec 9.3) + zeroize handoff buffers

Audit blocker: the Minister-derived seed was adopted into the single
un-keyed localStorage slot, silently clobbering any pre-existing local
random-seed identity on the next Minister login and letting accounts
sharing a browser overwrite each other's seeds.

- Adoption now writes ONLY an account-scoped slot
  (deforum_device_seed_b64:<userNullifierHash> - the nullifier hash is a
  stable 1:1 stand-in for the Minister sub, which never reaches the
  client). The legacy un-keyed slot is never an adoption target, so a
  pre-existing local seed stays intact and restorable.
- vault.ts owns slot resolution: reads and generic writes use the scoped
  slot only when the session is scoped AND that slot exists, else the
  legacy slot - byte-identical behavior when no fragment ever arrived.
  The root layout pins the scope on every full page load.
- device.ts routes through the vault store (drops its duplicate key
  handling).
- New fail-closed branch: a fragment with no signed-in account scope
  derives nothing (never writes the shared legacy slot).
- Best-effort zeroization of the decoded mix secret, per-app secret, and
  derived seed buffers after use.
- Tests: non-clobber of a pre-existing legacy seed, distinct slots for
  two accounts in one browser, deterministic re-derivation across page
  loads, and the null-scope fail-closed path; golden vector unchanged.

Author: AtHeartEngineer

src/lib/client/device.ts

@@ -5,13 +5,15 @@
 // identity) read the SAME seed from here, so a member's anon proofs are against
 // the very commitment they joined with.
 //
-// localStorage is the store (mirrors the join page's original inline handling).
-// @ministryofmany/identity's generateDeviceSeed is lazy-imported so the Semaphore
-// identity graph never loads at module eval (client-only, like the proof helpers).
+// The store is vault.ts (localStorage, resolved per-account per anon-identity
+// spec 9.3: a Minister-derived seed lives in an account-scoped slot, a local/
+// random one in the legacy un-keyed slot). @ministryofmany/identity's
+// generateDeviceSeed is lazy-imported so the Semaphore identity graph never
+// loads at module eval (client-only, like the proof helpers).
 
 import { ministerAnonSeedSettled } from './minister-anon';
+import { hasSeed, persistSeed, readSeed } from './vault';
 
-const SEED_KEY = 'deforum_device_seed_b64';
 const DEVICE_ID_KEY = 'deforum_device_id';
 
 function assertBrowser(fn: string): void {
@@ -29,22 +31,19 @@ export async function loadOrCreateDeviceSeed(): Promise<Uint8Array> {
 	// a locally-generated seed can never race the Minister-derived one
 	// (minister-anon.ts). Resolves immediately when no handoff is in flight.
 	await ministerAnonSeedSettled();
-	const existing = localStorage.getItem(SEED_KEY);
-	if (existing) {
-		return Uint8Array.from(atob(existing), (c) => c.charCodeAt(0));
-	}
+	const existing = readSeed();
+	if (existing) return existing;
 	const { generateDeviceSeed } = await import('@ministryofmany/identity');
 	const seed = generateDeviceSeed();
-	localStorage.setItem(SEED_KEY, btoa(String.fromCharCode(...seed)));
+	persistSeed(seed);
 	return seed;
 }
 
 /** True if a device seed has already been created in this browser. A member who
  *  joined on THIS device has one; without it the anon tier cannot prove (the
  *  derived commitment would not match the snapshot leaf). */
 export function hasDeviceSeed(): boolean {
-	if (typeof localStorage === 'undefined') return false;
-	return localStorage.getItem(SEED_KEY) !== null;
+	return hasSeed();
 }
 
 /** Load the stable per-device id, generating + persisting one on first use. */

src/lib/client/minister-anon.ts

@@ -14,16 +14,20 @@
 //   2. Validates the captured value with the SDK's extractMinisterAppSecret
 //      (injected synthetic location, scrub already done), mixes in Deforum's
 //      own MINISTER_ANON_RP_MIX_SECRET via deriveDeviceSeedFromMinister (HKDF,
-//      spec 9.2), and persists the result as THE device seed - the same
-//      localStorage slot the existing chain reads (vault.ts / device.ts), so
+//      spec 9.2), and persists the result as THE device seed for the signed-in
+//      ACCOUNT - an account-scoped localStorage slot (spec 9.3, vault.ts), so
+//      it never overwrites a pre-existing local/random seed in the legacy
+//      un-keyed slot and accounts sharing a browser never clobber each other.
+//      The chain (vault.ts / device.ts) resolves the same slot on read, so
 //      deriveIdentity(seed, subforumId) and everything downstream is untouched.
 //
 // FAIL-CLOSED everywhere (spec 8.3): no fragment, a malformed fragment, an
-// unset/short mix secret, or any error leaves the existing locally-generated
-// seed behavior byte-identical. Login always succeeds; only the anonymous
-// identity fails to derive. Nothing here (secret, seed) ever leaves the browser.
+// unset/short mix secret, a missing account scope, or any error leaves the
+// existing locally-generated seed behavior byte-identical. Login always
+// succeeds; only the anonymous identity fails to derive. Nothing here (secret,
+// seed) ever leaves the browser.
 
-import { readSeed, persistSeed } from './vault';
+import { persistScopedSeed, setSeedScope } from './vault';
 
 // Mirrors MINISTER_ANON_PARAM in @ministryofmany/identity - duplicated because
 // the capture phase must run synchronously, before the lazy SDK import resolves.
@@ -51,49 +55,64 @@ function hexToBytes(hex: string): Uint8Array | null {
 	return out;
 }
 
-function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
-	if (a.byteLength !== b.byteLength) return false;
-	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
-	return true;
-}
-
-async function adopt(raw: string, rpMixHex: string | null): Promise<void> {
+async function adopt(raw: string, rpMixHex: string | null, scope: string | null): Promise<void> {
 	const mix = rpMixHex === null ? null : hexToBytes(rpMixHex);
 	if (mix === null || mix.byteLength < MIX_MIN_BYTES) {
 		// FAIL CLOSED: the fragment arrived but the RP mix secret is not
 		// provisioned (or too short). No anonymous identity is derived; the
 		// existing seed behavior stands. Surfaced so the operator can see the
 		// misconfiguration - never logs any secret value.
+		mix?.fill(0);
 		console.warn(
 			'minister-anon: a minister_anon fragment arrived but MINISTER_ANON_RP_MIX_SECRET is unset or shorter than 32 bytes; anonymous identity NOT derived (fail-closed)'
 		);
 		return;
 	}
+	if (scope === null) {
+		// FAIL CLOSED: a fragment arrived with no signed-in account to scope the
+		// seed to (should be impossible - the OIDC callback sets the session
+		// cookie before its 3xx). Never write the shared legacy slot (spec 9.3).
+		mix.fill(0);
+		console.warn(
+			'minister-anon: a minister_anon fragment arrived without a signed-in account to scope the seed to; anonymous identity NOT derived (fail-closed)'
+		);
+		return;
+	}
 
-	const { extractMinisterAppSecret, deriveDeviceSeedFromMinister } =
-		await import('@ministryofmany/identity');
-
-	// Re-run the SDK's validator over the captured value (the real URL was
-	// already scrubbed): a synthetic location keeps grammar + decoding in the
-	// SDK, so Deforum never re-implements them.
-	const synthetic = new URLSearchParams();
-	synthetic.set(PARAM, raw);
-	const appSecret = extractMinisterAppSecret({
-		location: { pathname: '', search: '', hash: `#${synthetic.toString()}` },
-		scrub: false
-	});
-	if (appSecret === null) return; // malformed / unknown version: fail closed (spec 8.3)
-
-	const seed = await deriveDeviceSeedFromMinister(appSecret, mix);
-
-	// The Minister-derived seed IS the device seed from here on (deterministic:
-	// the same user + app + mix secret always re-derives it, which is exactly
-	// what makes the anonymous identity recoverable after storage loss). A
-	// differing pre-handoff local seed is replaced per spec 9.3; the Settings
-	// vault remains the backup/restore surface for it.
-	const existing = readSeed();
-	if (existing !== null && bytesEqual(existing, seed)) return;
-	persistSeed(seed);
+	let appSecret: Uint8Array | null = null;
+	let seed: Uint8Array | null = null;
+	try {
+		const { extractMinisterAppSecret, deriveDeviceSeedFromMinister } =
+			await import('@ministryofmany/identity');
+
+		// Re-run the SDK's validator over the captured value (the real URL was
+		// already scrubbed): a synthetic location keeps grammar + decoding in the
+		// SDK, so Deforum never re-implements them.
+		const synthetic = new URLSearchParams();
+		synthetic.set(PARAM, raw);
+		appSecret = extractMinisterAppSecret({
+			location: { pathname: '', search: '', hash: `#${synthetic.toString()}` },
+			scrub: false
+		});
+		if (appSecret === null) return; // malformed / unknown version: fail closed (spec 8.3)
+
+		seed = await deriveDeviceSeedFromMinister(appSecret, mix);
+
+		// The Minister-derived seed IS this account's device seed from here on
+		// (deterministic: the same user + app + mix secret always re-derives it,
+		// which is exactly what makes the anonymous identity recoverable after
+		// storage loss - so an idempotent overwrite of the scoped slot is safe).
+		// It lands in the ACCOUNT-SCOPED slot only (spec 9.3): a pre-existing
+		// local/random seed in the legacy slot stays intact, and the Settings
+		// vault remains the backup/restore surface.
+		persistScopedSeed(seed);
+	} finally {
+		// Best-effort zeroization: JS cannot scrub every copy (the b64 string in
+		// localStorage IS the cache), but the working buffers need not linger.
+		mix.fill(0);
+		appSecret?.fill(0);
+		seed?.fill(0);
+	}
 }
 
 /**
@@ -103,12 +122,20 @@ async function adopt(raw: string, rpMixHex: string | null): Promise<void> {
  * any JS navigation (spec finding S3).
  *
  * `rpMixHex` is MINISTER_ANON_RP_MIX_SECRET as delivered by the layout server
- * load (null when unset/invalid or signed out). The heavy work (SDK import,
- * HKDF) runs async after the synchronous scrub; ministerAnonSeedSettled()
- * exposes its completion.
+ * load (null when unset/invalid or signed out). `seedScope` is the signed-in
+ * account's stable seed-scope key (the user-nullifier hash, null when signed
+ * out): it is pinned on EVERY call - fragment or not - so the seed store
+ * resolves this account's scoped slot (spec 9.3) on every page load, and a
+ * fragment can never adopt into the shared legacy slot. The heavy work (SDK
+ * import, HKDF) runs async after the synchronous scrub;
+ * ministerAnonSeedSettled() exposes its completion.
  */
-export function captureMinisterAnonFragment(rpMixHex: string | null): void {
+export function captureMinisterAnonFragment(
+	rpMixHex: string | null,
+	seedScope: string | null
+): void {
 	if (typeof window === 'undefined') return;
+	setSeedScope(seedScope);
 	const hash = window.location.hash;
 	if (hash === '' || hash === '#') return;
 
@@ -127,7 +154,7 @@ export function captureMinisterAnonFragment(rpMixHex: string | null): void {
 		window.location.pathname + window.location.search + (rest ? `#${rest}` : '')
 	);
 
-	pending = adopt(raw, rpMixHex).catch((e: unknown) => {
+	pending = adopt(raw, rpMixHex, seedScope).catch((e: unknown) => {
 		// Fail closed on ANY error (SDK import failure, WebCrypto absence,
 		// storage rejection): the existing behavior stands, login is unaffected.
 		// SDK error messages are static - no secret material can land in logs.