What 0.0.1 holds

Records

Encrypted in the browser, before anything is sent

Each revision of a record is sealed under a key used once and bound to its company, record, revision and key. The server keeps the sealed body in the company's own TessariDB vault and never holds a key that opens it.

What a record can carry
Part	What 0.0.1 does
record types	eleven built in, and types a company defines with the roles that may use each
fields	fifteen field types in named sections, added freely to any record
one-time codes	TOTP codes (RFC 6238) shown with the seconds left
SSH keys	Ed25519 keys generated or imported in OpenSSH's formats, with their fingerprints
files	encrypted in 64 KiB chunks up to 256 MiB, refused if a chunk is reordered, dropped or added

A database record opened in the browser: kind, host, port, database, username and a hidden password, each with a copy button — A record as its author's browser opens it. The server holds only its type and a sealed body.

Sharing

Exactly the readers named

A record is shared with a member, a team, a department or the whole company; each share is written in one transaction with the record key wrapped to that member's or group's key.
A browser wraps a key only to a key the company owner's signature chain vouches for, so the server cannot add a reader by writing a row.
Removing a share stops the member at their next request, and the next revision is sealed under a new record key.
A member leaving the company marks every key and record they could open for rotation.

The members page: the owner's key fingerprint, a member who has not set an unlock password yet, and the owner whose key is vouched for — Members and their keys. A record is wrapped only to a key an owner or admin has vouched for.

Recovery

An owner can hand a member's keys back, and the member sees it

The unlock password is not the sign-in password, and nobody at the server can reset it. Each member's keys are escrowed to the company recovery key, which only owners hold. A member who forgot the unlock password asks with a one-time key their browser makes, reads a code to the owner, and sets a new unlock password once the owner has handed their keys back.

An admin, another company, the platform admin and the store's administrator are refused. Every read of a member's escrowed keys is shown to that member.

Sign-in

Own sign-in, an OpenID Connect issuer, or a passkey

A password and a TOTP code, with attempts backed off per address and per network, never locking the account.
Any OpenID Connect issuer by discovery, with PKCE, state, nonce, iss and the ID token checked.
Passkeys (Web Authentication Level 3, user verification required), used to sign in without naming an account first.

The first unlock: setting an unlock password of at least 12 characters, separate from the sign-in password — The first time an owner opens the company: the unlock password, which the vault cannot reset.

Trail

Every change, with who, what, to whom, when and why

Every admin change and every read of a sealed record is recorded in the same transaction as the act, so an act whose record cannot be written does not happen. A chain over each company's events shows where a row was altered.