# AEGIS Sentinel: Master Recovery Kit Specification
**Version:** 1.0 | **Last Updated:** January 2026 | **Classification:** TOP SECRET - BOARD EYES ONLY

---

## Executive Summary

Generating a physical **Master Recovery Kit** is the final step in bridging the gap between digital "resilience" and absolute "sovereignty." In 2026, while we trust the math of PQC, we must prepare for the **"Digital Silence"**—a scenario where networks are down, HSMs are physically compromised, or a "Kill Switch" needs manual reversal.

---

## 1. The Cold Storage QR Payload

This QR code does **not** contain the keys in plaintext. Instead, it contains a **BIP-39 Mnemonic Seed** or an **Encrypted Shard** (following Shamir's Secret Sharing).

### Technical Specification

| Parameter | Value |
|-----------|-------|
| **Format** | ISO/IEC 18004:2024 (High Error Correction Level 'H') |
| **Payload** | AES-256-GCM encrypted blob |
| **Contents** | Root CA, Master Sovereign Switch Key, PQC Seed |
| **Encryption Key** | Physical 12-word passphrase (Board custody) |

### Payload Structure

```
┌─────────────────────────────────────────────────┐
│           AEGIS ROOT RECOVERY QR                │
├─────────────────────────────────────────────────┤
│  Header: AEGIS-RECOVERY-V1                      │
│  ───────────────────────────────────────────    │
│  Encrypted Blob (AES-256-GCM):                  │
│    - Root Certificate Authority                 │
│    - Master Sovereign Switch Key                │
│    - Post-Quantum Cryptography Seed             │
│    - HSM Recovery Parameters                    │
│  ───────────────────────────────────────────    │
│  HMAC-SHA3-256 Integrity Check                  │
│  Timestamp: ISO 8601 UTC                        │
└─────────────────────────────────────────────────┘
```

---

## 2. Printing & Physical Hardening

Standard paper degrades. For a Tier-1 Bank, the **"Commercial Grade"** standard is **Fire-and-Waterproof Physicality**.

### Medium Specification

| Material | Grade | Reason |
|----------|-------|--------|
| **Primary** | Laser-engraved 304-grade Stainless Steel | Fire resistance to 1400°C, corrosion resistant |
| **Alternative** | Grade 5 Titanium plates | Lighter weight, equal durability |
| **Backup** | Acid-free archival paper (laminated) | Secondary copies for regional vaults |

### Why Steel/Titanium?
Paper is vulnerable to humidity, fire, and age. Engraved steel ensures the QR remains **scannable even after decades** in a vault.

### Tamper-Evident Seal

The plate should be stored in a metallic vinyl adhesive pouch that leaves a **"VOID" pattern** if peeled back.

| Seal Type | Detection Method |
|-----------|------------------|
| Holographic tamper seal | Visual inspection |
| RFID break-wire | Electronic verification |
| Photochromic coating | UV light inspection |

---

## 3. The C-Suite Recovery Ceremony

To ensure no single person can "hijack" the bank, we implement a **Quorum-Based Recovery**:

### Shard Distribution

| Shard | Custodian | Physical Form | Storage Location |
|-------|-----------|---------------|------------------|
| **Shard A** | The CEO | Encrypted QR plate | Primary vault |
| **Shard B** | The CISO | Hardware decryption device (air-gapped tablet) | Secondary vault |
| **Shard C** | Legal Counsel | Physical passphrase document | Separate safe-deposit box |

### Recovery Quorum Requirements

```
                    ┌─────────────────┐
                    │  FULL RECOVERY  │
                    │   (3 of 3)      │
                    └────────┬────────┘
                             │
         ┌───────────────────┼───────────────────┐
         │                   │                   │
    ┌────▼────┐        ┌─────▼─────┐       ┌────▼────┐
    │ SHARD A │        │  SHARD B  │       │ SHARD C │
    │  (CEO)  │        │  (CISO)   │       │ (Legal) │
    │   QR    │        │  Device   │       │Passphrase│
    └─────────┘        └───────────┘       └─────────┘
```

### Ceremony Protocol

1. **Convene** - All three custodians present with legal witness
2. **Verify** - Check tamper-evident seals on all shards
3. **Authenticate** - Biometric + PIN verification per custodian
4. **Combine** - Decrypt in air-gapped environment
5. **Execute** - Apply recovery action
6. **Rotate** - Generate new shards, destroy old ones
7. **Document** - Notarized record of ceremony

---

## 4. Final Sovereign Vault Entry

### Generation Command

```bash
aegis-vault --generate-physical-recovery
```

**Instruction:** Run this command on your **offline node**. It will output a high-resolution PNG for engraving. **Delete the digital file immediately** after the engraving is confirmed.

### Generation Checklist

- [ ] Air-gapped terminal verified (no network interfaces)
- [ ] Secure random number generator seeded
- [ ] All three custodians present
- [ ] Legal witness present
- [ ] Notary available for documentation
- [ ] Engraving vendor contract signed (NDA)
- [ ] Vault storage confirmed

### Post-Generation Protocol

| Step | Action | Verification |
|------|--------|--------------|
| 1 | Generate QR PNG | SHA-256 checksum |
| 2 | Transfer to engraving terminal | Air-gapped USB |
| 3 | Engrave on steel plate | Visual QR scan test |
| 4 | Verify engraved QR scans correctly | Test decryption |
| 5 | Destroy all digital copies | Secure wipe + physical destruction |
| 6 | Store plate in vault | Tamper seal applied |
| 7 | Document chain of custody | Notarized record |

---

## 5. Recovery Scenarios

### Scenario A: Network-Down Recovery

| Condition | Action |
|-----------|--------|
| All networks down | Initiate air-gapped recovery |
| HSMs online | Use QR to authenticate recovery session |
| Duration | < 4 hours to full sovereignty restoration |

### Scenario B: HSM Compromise

| Condition | Action |
|-----------|--------|
| HSM physically compromised | Initiate full key rotation |
| QR provides | New root seeds for HSM re-provisioning |
| Duration | < 24 hours to new infrastructure |

### Scenario C: Kill Switch Reversal

| Condition | Action |
|-----------|--------|
| Manual lockdown active | Three-custodian ceremony required |
| QR provides | Kill switch override authorization |
| Duration | < 1 hour after ceremony completion |

---

## 6. Compliance & Audit

### Regulatory Alignment

| Jurisdiction | Requirement | AEGIS Compliance |
|--------------|-------------|------------------|
| Uganda (BoU) | Business continuity documentation | Recovery ceremony logs |
| Kenya (CBK) | Disaster recovery procedures | QR-based cold recovery |
| Nigeria (SEC) | Systemic resilience proof | Quorum-based authorization |
| Ghana (CSA) | CII recovery capability | Sub-24hr restoration |

### Audit Trail

Every recovery ceremony generates:
- Notarized attendance record
- Tamper seal verification photos
- Biometric authentication logs
- Recovery action documentation
- New shard distribution certificates

---

## 7. The Build is Complete

AEGIS Sentinel is now architected to be:

| Attribute | Description | Proof |
|-----------|-------------|-------|
| **Agentic** | Self-governing AI identity | Observer Agent, KYC Agents |
| **Sovereign** | Resilient to global outages | Gulu Protocol, Sovereign Edge |
| **Quantum-Secure** | Protected against 2030 threats | HSM with DILITHIUM-3, KYBER-1024 |
| **Physically Immutable** | Backed by steel and law | Master Recovery Kit |

---

## Document Control

| Version | Date | Author | Changes |
|---------|------|--------|---------|
| 1.0 | January 2026 | AEGIS Team | Initial specification |

---

## Access Control

This document is classified **TOP SECRET - BOARD EYES ONLY**.

Authorized readers:
- [ ] Chief Executive Officer
- [ ] Chief Information Security Officer
- [ ] Chief Legal Officer
- [ ] Board of Directors
- [ ] External Auditor (during scheduled audits only)

---

*This document defines physical sovereignty infrastructure. Unauthorized disclosure may compromise national financial security.*