An end-to-end encrypted vault API for credentials, passwords, notes and custom sensitive records. Cerberus manages encrypted storage, organization and resource permissions; Heimdall handles identity, and authorized clients encrypt/decrypt locally.
Status: foundation infrastructure and all 55 business use cases implemented. Independent protocol review is explicitly deferred for development and remains required before release. See development review deferral and foundation status.
- Distinct Cerberus accounts and vault profiles integrated with Heimdall identity.
- Named custom/template records, nested folders and multi-profile collections.
- Read-only/read/write collection sharing and explicit software secret grants.
- Client-held keys, one-time refreshable recovery and profile-specific protection.
- Latest-edit synchronization and configurable offline renewal: initially 24 hours, editable or disabled.
- Recoverable 30-day trash/account closure, immediate purge, privacy export and operational health.
All approved capabilities are required for the first release; the project owner is the beta user.
- Build the Flutter or other client applications in this repository.
- Decrypt vault content on the server or replace Heimdall identity.
- Add another external runtime application service.
- Promise immediate remote revocation on disconnected clients or retract copies already made.
Start with the initial context, then the normative formal requirements.
| Document | What it contains |
|---|---|
| Brainstorm | Original source notes, preserved unchanged. |
| Project Overview | Scope, audience and success criteria. |
| Technology Stack | Initial choices and full library assessment. |
| Workflow | Approved delivery gates and unattended authorization rules. |
| Business Rules | BR-01 through BR-29 and domain relationships. |
| Vision Document | Features and product constraints. |
| System Requirements Document | Requirements, data model, interfaces and authorization. |
| Use Case Specification Document | All use cases, main flows and alternative flows. |
| Development Workflow Document | Normative stage gates and Definition of Done. |
| Testing Specification Document | Unit/functional coverage and commands. |
| Technology Stack Document | Single technology/version policy source. |
| Operations & Infrastructure Document | Scaffold, configuration, CI, health, retention and restore controls. |
| Folder creation API | Current access, encrypted content, owned parent/profile scope and atomic metadata. |
| Software access API | Explicit owned target grants, native software-key binding and exact revoked reactivation. |
The develop branch contains the .NET 10 solution; main holds only the specifications until the
first release. Use an SDK accepted by global.json and a Docker-compatible runtime for functional
tests. Starting the development host requires
explicit database, Heimdall and operational configuration; no production defaults are supplied.
The container is a development artifact, not a release-ready vault API.
See operational settings, the nonsecret
configuration example,
Heimdall contracts, health probes and operational grants
and restore runbook.
Copy the reviewed nonsecret settings into the host's appsettings.json or supply named
CERBERUS_... environment keys, which take precedence over Cerberus:Property values.
Supply all credentials and identity scope separately through protected configuration.
Registration requires an independent durable CERBERUS_REGISTRATION_FINGERPRINT_KEY;
preserve it across replicas, restores and routine identity-signing-key rotation.
From the repository root:
dotnet restore src/ArturRios.Cerberus.sln
dotnet build src/ArturRios.Cerberus.sln --no-restore
dotnet run --project src/Presentation/ArturRios.Cerberus.WebApi -- --validate-configuration
dotnet run --project src/Presentation/ArturRios.Cerberus.WebApi -- --migrate
dotnet run --project src/Presentation/ArturRios.Cerberus.WebApiClone the repository with git clone https://git.techcraftsmen.net/artur-rios/cerberus-api.git.
Track delivery on the public Cerberus API project. Each use case has one issue; the foundation issue comes first. Every milestone depends on Foundation, with dependencies only on earlier milestones. Counts below are updated as issues close; GitHub milestone pages show live progress. No due dates or labels were assigned.
| Milestone | Delivers | Depends on | Issues | Status |
|---|---|---|---|---|
| M-01 — Foundation | Scaffold, persistence, identity adapters, tests, CI and safe operational primitives. | — | 1 | 1 / 1 closed |
| M-02 — Account identity and vault protection | Register/login, manage account details and protect/recover the vault. | M-01 | 9 | 9 / 9 closed |
| M-03 — Organized vault | Manage profiles, custom records, nested folders and collection membership. | M-01, M-02 | 26 | 26 / 26 closed |
| M-04 — Controlled sharing and software secrets | Share selected collections and serve explicitly granted software ciphertext. | M-01, M-02, M-03 | 6 | 6 / 6 closed |
| M-05 — Offline synchronization | Apply configurable renewal, incremental access changes and deterministic offline edits. | M-01, M-02, M-03, M-04 | 5 | 5 / 5 closed |
| M-06 — Recoverable deletion and beta operations | Deliver account closure/erasure, trash restoration/expiry, privacy export and operational health. | M-01, M-02, M-03, M-04, M-05 | 9 | 9 / 9 closed |
| Issue | Work | Spec | Status |
|---|---|---|---|
| #1 | Project scaffold and initial infrastructure | Operations & Infrastructure | Done |
| Issue | Work | Spec | Status |
|---|---|---|---|
| #2 | UC-01 — Register account | Use Case Specification | Done |
| #3 | UC-02 — Authenticate | Use Case Specification | Done |
| #4 | UC-03 — Get account | Use Case Specification | Done |
| #5 | UC-04 — Update account | Use Case Specification | Done |
| #6 | UC-05 — Update identity details | Use Case Specification | Done |
| #39 | UC-38 — Initialize vault protection | Use Case Specification | Done |
| #40 | UC-39 — Change vault protection | Use Case Specification | Done |
| #41 | UC-40 — Recover vault access | Use Case Specification | Done |
| #42 | UC-41 — Refresh recovery key | Use Case Specification | Done |
| Issue | Work | Spec | Status |
|---|---|---|---|
| #10 | UC-09 — Create profile | Use Case Specification | Done |
| #11 | UC-10 — List profiles | Use Case Specification | Done |
| #12 | UC-11 — Get profile | Use Case Specification | Done |
| #13 | UC-12 — Update profile | Use Case Specification | Done |
| #14 | UC-13 — Delete profile | Use Case Specification | Done |
| #15 | UC-14 — Set profile associations | Use Case Specification | Done |
| #16 | UC-15 — Open profile access | Use Case Specification | Done |
| #17 | UC-16 — Create record | Use Case Specification | Done |
| #18 | UC-17 — List records | Use Case Specification | Done |
| #19 | UC-18 — Get record | Use Case Specification | Done |
| #20 | UC-19 — Update record | Use Case Specification | Done |
| #21 | UC-20 — Delete record | Use Case Specification | Done |
| #22 | UC-21 — Move record | Use Case Specification | Done |
| #23 | UC-22 — Permanently delete record | Use Case Specification | Done |
| #24 | UC-23 — Create folder | Use Case Specification | Done |
| #25 | UC-24 — List folders | Use Case Specification | Done |
| #26 | UC-25 — Get folder | Use Case Specification | Done |
| #27 | UC-26 — Update folder | Use Case Specification | Done |
| #28 | UC-27 — Delete folder | Use Case Specification | Done |
| #29 | UC-28 — Move folder | Use Case Specification | Done |
| #30 | UC-29 — Create collection | Use Case Specification | Done |
| #31 | UC-30 — List collections | Use Case Specification | Done |
| #32 | UC-31 — Get collection | Use Case Specification | Done |
| #33 | UC-32 — Update collection | Use Case Specification | Done |
| #34 | UC-33 — Delete collection | Use Case Specification | Done |
| #35 | UC-34 — Set collection membership | Use Case Specification | Done |
| Issue | Work | Spec | Status |
|---|---|---|---|
| #36 | UC-35 — Grant collection access | Use Case Specification | Done |
| #37 | UC-36 — Change collection access | Use Case Specification | Done |
| #38 | UC-37 — Revoke collection access | Use Case Specification | Done |
| #43 | UC-42 — Grant software access | Use Case Specification | Done |
| #44 | UC-43 — Retrieve software secrets | Use Case Specification | Done |
| #45 | UC-44 — Revoke software access | Use Case Specification | Done |
| Issue | Work | Spec | Status |
|---|---|---|---|
| #46 | UC-45 — Get offline policy | Use Case Specification | Done |
| #47 | UC-46 — Set offline policy | Use Case Specification | Done |
| #48 | UC-47 — Renew offline authorization | Use Case Specification | Done |
| #49 | UC-48 — Download synchronization changes | Use Case Specification | Done |
| #50 | UC-49 — Upload offline edits | Use Case Specification | Done |
| Issue | Work | Spec | Status |
|---|---|---|---|
| #7 | UC-06 — Request account closure | Use Case Specification | Done |
| #8 | UC-07 — Cancel account closure | Use Case Specification | Done |
| #9 | UC-08 — Permanently delete account | Use Case Specification | Done |
| #51 | UC-50 — List trash | Use Case Specification | Done |
| #52 | UC-51 — Restore trash entry | Use Case Specification | Done |
| #53 | UC-52 — Empty trash | Use Case Specification | Done |
| #54 | UC-53 — Expire retained deletions | Use Case Specification | Done |
| #55 | UC-54 — Export account data | Use Case Specification | Done |
| #56 | UC-55 — Check API health | Use Case Specification | Done |
Notable changes in each release are recorded in CHANGELOG.md.
Building from source, running the tests, the delivery workflow and its review gates, the branching model and the release process are described in CONTRIBUTING.md.
The GitHub repository is a read-only mirror for the real, open-source code of cerberus-api. Its home is Forgejo, at https://git.techcraftsmen.net/artur-rios/cerberus-api. If you want to contribute, e-mail me at arturdev@duck.com.