Encrypt credential submissions with per-request JWE keys

[rgarcia]

summary

• encrypt the complete CredentialForm.onSubmit payload before fetch using jose compact JWE (ECDH-ES+A256KW with P-256, A256GCM). authenticate the key ID, collection request ID, immutable item ID, and rendered version; bound envelope/plaintext sizes and preserve field validation.
• generate a fresh keypair per request. expose only the public key, wrap the private PKCS#8 key with AES-256-GCM under a required server-only environment key, and provide a PrivateKeyProtector boundary for production KMS/HSM integration.
• decrypt only on the collection handler path and keep the existing plaintext Kernel SDK PATCH, including immutable identity and optimistic version checks. preserve fragment bearer, same-origin, expiry/revocation, no-store/no-referrer, and one-time completion. clear wrapped private material only after confirmed completion; retain it after failed or uncertain writes. serialize local submissions/store mutations.
• document setup, the passive request-body capture threat model, retry/reconciliation behavior, and production requirements. disable SDK logging, avoid echoing field values in PATCH responses, add CI, and commit the Bun lockfile for reproducibility.

all changes are confined to this example. no Kernel API or @onkernel/vault-react changes.

validation

• bun install --frozen-lockfile
• bun run typecheck
• bun run test — 24 tests, 173 assertions; real form-to-handler encryption, exact SDK forwarding, wrong/tampered keys/envelopes/bindings, size/field/lifecycle/origin checks, wrapped-key persistence/cleanup, concurrency, and uncertain outcomes.
• NEXT_TELEMETRY_DISABLED=1 bun run build
• production Chromium smoke test against the local mock flow: ciphertext-only PATCH, successful completion, wrapped-key cleanup, fragment removal, and blocked replay.
• inspected the production client build: wrapping key value/configuration absent.
• reviewed the complete diff for scope, sensitive-data leakage, and consistency.

review gate

CI passed on ac1ccbb. Bugbot was explicitly requested but reported that it is disabled for this repository. The required Bugbot review is blocked until it is enabled; this PR has not received a green Bugbot result.

boundaries and caveats

this protects submitted values from passive browser-to-backend HTTP-body capture, not from the trusted frontend, decrypt-and-forward handler, or Kernel. active script/key replacement and in-process instrumentation remain outside the guarantee. safe GET responses still include displayable non-sensitive saved values.

the file store/environment wrapping key are local-demo implementations. production needs KMS/HSM-equivalent wrapping, transactional storage/distributed claims, key rotation/retention, capture exclusions, and explicit uncertain-outcome reconciliation. there is no distributed transaction or exactly-once delivery claim. clearing current wrapped material does not erase backups or guarantee JavaScript memory zeroization. no live Kernel vault was modified during validation.

[rgarcia]

@cursor review

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.