# Enigma Witness Vault Assembly

This guide builds the Raspberry Pi Zero 2 W Enigma Witness Vault appliance: a small custody/witness node with an ATECC608A secure-element sidecar, a 0.96 in SSD1306 OLED, and an optional PN532 NFC module. The enclosure is sized for commodity parts and Bambu X1 Carbon printing.

Important honesty boundary: this hardware can improve local custody, key isolation, operator visibility, and witness assurance. It does not prove provider deletion, model forgetting, truth of memories, tamper-proof storage, or complete side-channel absence.

## Parts and tools

Core parts:

- Raspberry Pi Zero 2 W with 40-pin header.
- microSD card, 16 GB or larger, high-endurance preferred.
- ATECC608A I2C secure-element breakout, 25.5 x 17.7 x 4.7 mm, fixed I2C address `0x60`.
- 0.96 in 128 x 64 SSD1306 I2C OLED, usually `0x3C` or `0x3D`.
- USB power supply or host USB cable appropriate to the selected power mode.
- PETG or ASA filament. Avoid conductive or carbon-filled filament near Wi-Fi/BLE/NFC antennas.

Optional parts:

- Compact PN532 NFC module, envelope about 43.6 x 41 x 3.9 mm.
- Momentary buttons for operator controls.
- JST-SH/JST-PH or similar internal cable disconnects.
- Adhesive-backed Kapton, thin foam tape, or nylon washers for electrical isolation.

Fasteners and inserts:

- M2.5 screws for Raspberry Pi mounting, typically 6-8 mm depending on standoff height.
- M2 or M2.5 screws for OLED, ATECC, and PN532 carrier features depending on your CAD variant.
- Heat-set inserts matching the printed bosses. Use brass inserts only in plastic bosses; keep loose metal away from antennas and PCB pads.
- Small zip ties or printed cable combs for strain relief.

Tools:

- Bambu X1 Carbon or equivalent printer with 0.4 mm nozzle.
- Soldering iron for headers, heat-set inserts, and optional button leads.
- Small Phillips driver, flush cutters, tweezers.
- Multimeter for continuity and 3.3 V checks.

## Print preparation / print prep

Print the enclosure variant that matches the build:

- NFC-capable enclosure: 86 W x 102 L x 28 H mm.
- No-NFC enclosure: 86 W x 78 L x 28 H mm.

Recommended Bambu X1 Carbon setup, matching `cad/bambu_profile_notes.md`:

- Export/import separate STL parts: base tub, lid, cable clamp, optional button plungers, and optional NFC blank.
- Material: PETG for easiest durable printing; ASA if the unit may see warmer environments and you have ventilation/fume handling.
- Avoid PLA for unattended warm enclosures; it can creep around bosses and cable strain relief.
- Avoid carbon-filled, metal-filled, conductive, or ESD filament near Wi-Fi/BLE and NFC antenna regions.
- Nozzle: 0.4 mm hardened nozzle.
- Layer height: 0.20 mm for general prints; 0.16 mm for cleaner OLED/button edges.
- Walls: 4 wall loops for base and lid; 3 is acceptable for first fit checks.
- Top/bottom: 5 top and 5 bottom shells.
- Infill: 15-25% gyroid or grid. Boss strength comes more from wall count than high infill.
- Seam: rear or nearest rear connector side, keeping the front OLED/NFC area clean.
- Supports: normally none for the base open-side up, lid, cable clamp, or buttons. If Bambu Studio proposes dense support inside the electronics cavity, re-check orientation before accepting it.
- Orientation: base tub open-side up, lid exterior/top face up for best outside finish, cable clamp flat on its broad face, buttons caps up with brim only if needed, NFC blank flat.

Before printing:

1. Confirm you selected the NFC or no-NFC body length.
2. Confirm the Pi mount is in the lower-left internal position. For the NFC body, the Pi reference origin is `[10.5, 64]`; the Pi board is 65 x 30 mm, with mounting holes at offsets `[3.5, 3.5]`, `[61.5, 3.5]`, `[3.5, 26.5]`, and `[61.5, 26.5]`.
3. Confirm the OLED window matches your OLED board, not just the glass size. Many 0.96 in modules have different PCB widths.
4. Confirm the ATECC breakout has clearance for solder joints and cable bend radius.
5. For PN532, keep plastic above the antenna thin and non-conductive. Do not bury the antenna under metal screws, carbon-filled material, or a battery pack.

Post-print checks:

- Remove strings and support fragments from vents, bosses, button holes, rear connector slots, cable clamp channel, and lid lip.
- Test-fit every PCB before installing inserts.
- Test-fit the cable clamp and lid without electronics.
- Verify the lid seats without pinching wires.
- Check that USB, microSD, HDMI/service access if used, and any service buttons are reachable through the intended openings.

## Heat-set inserts and screws / inserts/screws

Install inserts before electronics:

1. Set the iron to the insert manufacturer's PETG/ASA range. Start low; overheated bosses deform quickly.
2. Press each insert straight down until it is flush with the boss top.
3. Let the part cool fully before test-threading screws.
4. Remove any raised plastic lip that would hold a PCB crooked.

The CAD insert bosses are modeled around approximately 3.2 mm bores and 4.8 mm OD inserts. Measure your inserts before heating them in; if your hardware differs, adjust the CAD parameters or reprint rather than melting oversize inserts into undersize bosses.

Screw guidance:

- Use nylon washers where a screw head could touch exposed pads.
- Tighten only until the board cannot rattle. Do not bow the Pi, OLED, ATECC, or PN532 PCB.
- If a printed boss strips, replace it with the next insert size or reprint the part. Do not rely on loose screws inside an appliance.

## Board placement: Pi/OLED/ATECC/optional PN532 placement

### Raspberry Pi Zero 2 W

Place the Pi in the lower-left mount with the USB/power side aligned to the service opening defined by the CAD. The Pi Zero 2 W board is 65 x 30 mm and includes Wi-Fi/BLE, microSD, USB OTG, and a 40-pin GPIO header.

Assembly order:

1. Install the Pi on standoffs first.
2. Verify the microSD card can be inserted and removed without removing the Pi.
3. Verify at least one USB path is accessible for first boot and service recovery.
4. Route I2C wires away from the antenna end where practical.

### OLED

Mount the 0.96 in SSD1306 OLED behind the front window:

1. Dry-fit the OLED so the active glass is centered in the window.
2. Add a thin non-conductive spacer or foam strip only if needed to prevent rattle.
3. Secure with screws or the printed retainer. Do not press on the glass.
4. Route the 4-wire I2C harness along the side channel and strain-relieve it before it reaches the Pi header.

### ATECC608A sidecar

Mount the ATECC608A breakout near the Pi I2C header area, leaving space to inspect its solder joints. It shares the I2C bus with the OLED and uses fixed address `0x60`.

Recommended treatment:

- Keep the sidecar visible or service-accessible; it is part of the custody story and should be inspectable.
- Do not pot the board for normal builds. Potting makes inspection and repair harder and can imply tamper-proofing the device does not provide.
- Use short I2C leads, twisted SDA/GND and SCL/GND pairs if the route is long, and avoid running the harness parallel to power leads for the full enclosure length.

### Optional PN532 NFC

Use the longer 86 x 102 x 28 mm enclosure variant for PN532.

Placement:

1. Put the PN532 antenna under the NFC-marked top surface, with the antenna face parallel to the lid.
2. Keep screws, inserts, copper tape, batteries, and carbon-filled filament away from the antenna field.
3. Leave a small air/plastic gap above the antenna. Thin PETG/ASA is preferred.
4. Use a removable connector if the PN532 is attached to the lid, so the lid can be opened without tearing wires.

If NFC range is poor, first remove nearby metal and re-test before changing software settings.

## Cable routing and cable strain relief

The enclosure should be serviceable without desoldering.

- Use color-consistent wiring: red for 3.3 V or 5 V as applicable, black for ground, blue/green or white/yellow for I2C/SPI signals.
- Label removable connectors if two harnesses share the same pitch.
- Leave a small service loop at the lid, but not enough slack to cross the Pi antenna or fan/vent openings.
- Anchor harnesses within 20-30 mm of the Pi header and again near lid-mounted devices.
- Use printed cable combs, zip ties through printed saddles, or a small adhesive tie mount. Do not let strain land on solder pads.
- Keep the microSD card path clear.
- Keep button wires away from sharp screw tips.

Before closing the lid, tug each harness gently. The connector or strain-relief point should take the load, not the solder joint.

## Service access

The finished vault should support routine service without destructive disassembly:

- microSD card reachable for re-image or forensic capture.
- USB data/power reachable for first boot, USB gadget Ethernet, and emergency shell access.
- Lid removable without unplugging the Pi header, or with a clearly marked lid harness disconnect.
- ATECC608A visible enough to confirm the sidecar is present and connected.
- OLED removable from the inside without scraping the display window.
- PN532 removable or disconnectable if installed in the lid.

Do not hide the only recovery path behind permanent adhesive.

## Power-on and final test

Perform these checks before declaring the build ready:

1. With power disconnected, check continuity from all ground points to Pi ground.
2. Confirm no continuity between 3.3 V and ground.
3. Confirm ATECC and OLED VCC are wired to 3.3 V, not 5 V.
4. Confirm optional PN532 voltage mode matches the wiring plan before connecting it.
5. Insert the prepared microSD card.
6. Power the Pi from the selected power input with the lid still open.
7. Confirm the Pi boots and is reachable through the chosen service path: Wi-Fi, wired USB gadget Ethernet, or direct console.
8. Confirm the OLED lights and shows the expected boot/status state, if the status daemon is installed.
9. Confirm the ATECC sidecar is detected at I2C address `0x60`.
10. If PN532 is installed, confirm it detects a test tag at the intended lid location.
11. Close the lid while watching the display and service connection. If either drops, reopen and find the pinched or loose harness.
12. Repeat a short boot test after the enclosure is fully screwed together.

Final handling notes:

- Mark the enclosure with the device ID or inventory label, not secret material.
- Record which optional modules are installed.
- Record the power mode and network mode used for the demo or deployment.
- If the unit will be shipped, remove or lock down credentials and pack it so buttons cannot be held during transit.