Runbook — Vault setup and recovery

Prerequisites

• Signed-in Clerk user
• Consent accepted

Steps — create

1. Settings → Create vault.
2. Choose a strong vault password (can differ from Clerk password).
3. Save recovery code offline (password manager / paper). Shown once.
4. Unlock; Health can decrypt sealed rows.

Steps — unlock

1. Enter vault password on Health or Settings.
2. Private key unwrapped in browser memory for the session.

Steps — recovery

1. If password forgotten: use recovery code flow to re-wrap private key with a new password.
2. If password and recovery code lost: data is unrecoverable; delete data and start fresh.

Verification

• After unlock, KPIs render from sealed stats.
• After lock (or new browser), numbers hidden until unlock.
• Wrong password fails closed.