# Portable agent end-to-end flow

## What works locally

```text
Markdown brain
  -> canonical bundle with per-file commitments
  -> AES-256-GCM encrypted envelope
  -> content-addressed blob store
  -> X25519-wrapped brain key for current runtime
  -> signed Aeonora constitution
  -> stable local agent ID
  -> migration receipt + fresh brain key
  -> exact Markdown restoration in next runtime profile
```

Run it:

```bash
aeonora-portable init ./brain hermes:local .aeonora/agent
aeonora-portable verify .aeonora/agent
aeonora-portable migrate .aeonora/agent openclaw:local ./restored
npm run eval
```

The current adapter is a filesystem reference adapter. `hermes:local` and `openclaw:local` label runtime profiles; they do not imply real harness integration.

## Required production infrastructure

### Required

1. **Durable encrypted blob storage** — Cloudflare R2, S3, or a pinned IPFS service. Only ciphertext is uploaded.
2. **Chain RPC and deployed registry** — one established low-cost chain first. Stores commitments, controller, lifecycle, and receipts.
3. **Indexer/resolve API** — resolves agent IDs and blob pointers without forcing every client to scan logs.
4. **Harness adapters** — explicit import/export and lifecycle hooks for each tested runtime.
5. **Key authorization** — passkey/WebAuthn session authorization plus offline recovery key.

### Recommended before public use

- KMS/HSM for service signing keys; user brain keys remain client-controlled.
- Multi-region blob replication and deletion/versioning policy.
- Rate limits, abuse controls, metrics, backups, and incident response.
- Independent contract and cryptography audit.

## Key model

- Controller key signs constitution changes and revocation.
- Random brain data key encrypts each snapshot.
- Runtime X25519 key receives a wrapped copy of the current brain key using HKDF-SHA256 domain separation and AES-256-GCM.
- Migration rotates the brain data key and re-encrypts the snapshot.
- Recovery phrase must never be used directly as an encryption key.

Revocation cannot erase plaintext or keys a compromised runtime already copied. Rotation prevents the old runtime from opening future snapshots. Marketing must preserve this distinction.