U4 — The secrets manager
Covered in full on the arc: a memo asking for the March Key Vault extension again, answered by reading the platform documentation instead of re-planning.
The findings
| Constraint | Value |
|---|---|
| Total bytes in the synchronised area | 102,400 |
| Maximum items | 512 |
| Maximum bytes per item | 8,192 |
| Writes per minute / per hour | 120 / 1,800 |
Verdict: "ample for vault keys and nowhere near enough for a general secrets manager holding certificates or long tokens." And the platform's own documentation "does not state that this store is encrypted and explicitly recommends the session store instead when working with sensitive user data" — the vendor steering the brief's requester away from exactly what the memo wanted.
Resolution: treat the synchronised store as an untrusted transport carrying ciphertext and nothing else — the same position the estate takes toward its own server, at a different altitude: a passphrase that never leaves the device, a key derived from it, a store that holds bytes nobody upstream can read.
The enforcer test
The memo's idea of binding a secret to a site so only that site can reach it is demoted: "the thing enforcing the binding would be the extension, and the extension is the actor that holds every secret it manages, so an extension enforcing a rule about itself is the same weak shape this corpus rejected when an agent enforces its own mandate." Honest version: a usability control that prevents mistakes, not a security boundary that prevents attacks — and it should be labelled as one.
What holds
Runtime permissions over install-time — ship with almost nothing and ask for one origin at first use — and the side panel, because "a secrets manager should never be a page you navigate away from into the thing you are pasting into."
"The storage and permission documentation was read on 5 September and no extension was built, so the quotas above are the platform's stated constants rather than measured behaviour."
Its relationship to U3 is worth stating as a principle: written three weeks apart, they independently converge on minimising what the extension holds — a channel instead of a key, or ciphertext instead of plaintext. And U6 removes the hundred-kilobyte ceiling this page works within, rather than working around it.