Memory Vault One.
The next Enigma appliance after Witness Vault: one physical Pi 5/NVMe box for local encrypted AI memory bundles, cache/index locality, proof verification, device identity, status UI, and optional tap-to-pair.
Decision: keep the $50-$100 Witness Vault as the proof/custody object. Build Memory Vault One / Memory Node next as the SanDisk-inspired locality-cache prototype. Use a boxed N100/N150 appliance for Enterprise Memory Gateway demos when reliability beats custom form factor.
Honest boundary: this is custody, proof, locality, and governed gateway infrastructure. It is not a compute accelerator, not resistant to physical compromise, not an HSM by default, and does not prove events inside closed providers or changes to model weights.
SanDisk-informed ladder
Pi Zero 2 W proof/custody object with secure-element sidecar, OLED, local receipts, and visible status.
$53-$99Pi 5 + NVMe locality-cache prototype for encrypted memory bundles, indexes, and offline verification.
$210-$450N100/N150/edge appliance with TPM, NVMe, governed policy boundary, minimized SIEM export, and witness checkpoints.
$550-$1,200+Build choices
| Option | Use when | Cost | Decision |
|---|---|---|---|
| Pi 5 + Argon NVMe core | You need one impressive locality-cache prototype quickly. | $225-$450 | Best first Memory Vault One / Memory Node build. |
| Fully printed Pi 5 stack | You want full physical design control. | $210-$420 | Do after thermal/core fit is proven. |
| N100/N150 mini appliance | You need governed gateway/indexing reliability for demos or pilots. | $220-$650 | Best low-support Enterprise Memory Gateway path. |
| CM5 custom carrier | You have validated demand and frozen requirements. | $2.5k-$25k+ prototype program; $250-$700 small-batch unit | Manufacturing path, not first buy. |
First buy list
Raspberry Pi 5 8GB, Argon NEO/ONE M.2 NVMe case, official 1TB Pi SSD, 27W USB-C PSU.
$300-$380 class before optionsATECC608A sidecar, OLED or e-paper display, checkpoint button, light pipe, tamper-evident labels.
Device identity, not physical-compromise resistanceCompact PN532 only if tap-to-pair matters; YubiKey/Nitrokey as admin key; UPS only after thermal and shutdown testing.
Avoid feature creepMechanical rules
- Use PETG for fit checks; ASA-CF for pilot shells; PAHT-CF only for heat-loaded brackets or ducts.
- Preserve Pi 5 Active Cooler airflow. Do not create a sealed quiet box.
- For official M.2 HAT+, install Active Cooler before the HAT and design around 2230/2242 SSDs.
- Put NFC behind non-metal plastic; keep it away from batteries, heatsinks, metal inserts, and ground planes.
- Do not rehouse certified mini appliances or NAS boxes for aesthetics. Use a printed cradle/fascia and keep vendor cooling/certifications intact.