# Witness Vault research decision
Decision: build Enigma Witness Vault as a Raspberry Pi Zero 2 W edge appliance with an ATECC608A I2C secure-element sidecar, a 0.96 in SSD1306 I2C OLED, optional compact PN532 NFC, and a PETG/ASA enclosure sized for Bambu X1 Carbon printing.
This is a custody/witness hardware package, not a new proof system. Enigma receipts and verifier output remain the source of cryptographic evidence.
## Source set
Hardware and platform sources:
- Raspberry Pi Zero 2 W official product page:
- Raspberry Pi Zero 2 W mechanical drawing:
- Adafruit ATECC608 breakout:
- Adafruit 0.96 in 128x64 SSD1306 OLED STEMMA QT:
- Adafruit PN532 NFC/RFID controller breakout reference:
- Espressif ESP32 product page:
- Bambu Lab X1-Carbon technical specifications PDF:
- Metaplex Token Metadata docs for optional Solana coordination metadata:
Local Enigma sources:
- [Enigma README](../../README.md)
- [Install Enigma anywhere](../../docs/install-anywhere.md)
- [Enigma fixtures](../../docs/fixtures.md)
- [Vault package contract](../../packages/vault/PACKAGE_CONTRACT.md)
- [Core package contract](../../packages/core/PACKAGE_CONTRACT.md)
- [Mesh package contract](../../packages/mesh/PACKAGE_CONTRACT.md)
## Facts used
| Fact | Source |
| --- | --- |
| Pi Zero 2 W has a 1 GHz quad-core 64-bit Arm Cortex-A53, 512 MB SDRAM, 2.4 GHz Wi-Fi, Bluetooth 4.2/BLE, mini HDMI, USB OTG, microSD, and a 65 mm x 30 mm form factor. | Raspberry Pi official product page. |
| Pi Zero 2 W mechanical envelope and mounting references include 65 mm board length and 3.5 mm edge/hole offsets in the mechanical drawing. | Raspberry Pi mechanical drawing. |
| ATECC608A breakout is $4.95, 25.5 mm x 17.7 mm x 4.7 mm, uses I2C, and has fixed I2C address `0x60`. | Adafruit ATECC608 product page. |
| SSD1306 OLED option is a 0.96 in 128x64 display, I2C-capable, with address range `0x3C-0x3D`; Adafruit's STEMMA QT board is $17.50 and 29.2 mm x 26.7 mm x 6.2 mm. | Adafruit OLED product page. |
| PN532 supports NFC/RFID read/write and phone/tag communication; the Adafruit full dev board is 51 mm x 117.7 mm and $39.95, so the enclosure should use a compact PN532 module if NFC is required inside the target volume. | Adafruit PN532 product page plus package constraint for compact 43.6 mm x 41 mm x 3.9 mm PN532 envelope. |
| X1-Carbon build volume is 256 x 256 x 256 mm, included nozzle is 0.4 mm hardened steel, supported materials include PETG and ASA, and the printer supports standard slicer-exported G-code through Bambu Studio or third-party slicers. | Bambu Lab X1-Carbon technical specifications PDF. |
| Enigma local operation uses a local filesystem vault bundle, can run no-network after install/checkout, and verifies exported proof bundles offline. | [Install Enigma anywhere](../../docs/install-anywhere.md) and [Enigma fixtures](../../docs/fixtures.md). |
| Enigma receipts carry hashes, memory addresses, roots, sequence links, signer metadata, and signatures, not raw memory plaintext. | [Enigma fixtures](../../docs/fixtures.md), [Core package contract](../../packages/core/PACKAGE_CONTRACT.md), and [Vault package contract](../../packages/vault/PACKAGE_CONTRACT.md). |
| Token metadata on Solana can attach additional data to fungible or non-fungible tokens through metadata accounts and off-chain JSON URIs. | Metaplex Token Metadata docs. |
## Decision matrix
Scores: 5 is strongest fit for this package, 1 is weakest.
| Criterion | Pi Zero 2 W Witness Vault | ESP32-class vault | NFC-only token/tag | Verifier dongle |
| --- | ---: | ---: | ---: | ---: |
| Runs current Enigma CLI/MCP/verifier without a rewrite | 5 | 1 | 0 | 2 |
| Local filesystem vault custody | 5 | 2 | 0 | 1 |
| Offline verification path | 5 | 2 | 0 | 3 |
| Commodity cost fit | 4 | 5 | 5 | 4 |
| Small enclosure fit | 4 | 5 | 5 | 5 |
| I2C sidecar/display support | 5 | 5 | 0 | 2 |
| User-visible trust/status surface | 4 | 3 | 2 | 3 |
| Development speed from this repository | 5 | 1 | 2 | 2 |
| Honest claim boundary | 5 | 4 | 3 | 4 |
| Total | 42 | 28 | 17 | 26 |
Evidence summary behind the scores:
- Pi scores highest because the Raspberry Pi source confirms the required Linux-class compute, 512 MB RAM, Wi-Fi/BLE, microSD, USB OTG, and 65 x 30 mm board envelope, while the local Enigma docs confirm the current CLI/MCP/verifier workflow is filesystem- and Node-oriented.
- ESP32 scores well on cost, size, radios, and low-power operation because Espressif documents it as an integrated Wi-Fi/Bluetooth MCU, but it scores low on software reuse because Enigma's current proof/vault stack is not MCU firmware.
- NFC-only scores high on cost and size but near zero on custody because the PN532/NFC source supports short-range tag/card/phone communication, not local vault hosting or receipt verification.
- Verifier dongle scores moderately for proof display/checking, but it lacks the persistent local vault host role that the Enigma docs assign to the local bundle and verifier workflow.
## Why the Pi Zero 2 W architecture wins
The Raspberry Pi path is the only option that directly matches Enigma's current implementation shape. The repository already describes local Node-based CLI/MCP/verifier flows, local vault bundles, and offline verification. Pi Zero 2 W is small enough for a handheld enclosure but still runs a normal Linux userspace, which keeps the hardware package build-ready instead of turning it into an embedded rewrite project.
The Pi also gives the right operational affordances:
- microSD storage for the local vault bundle and export artifacts;
- USB OTG and Wi-Fi/BLE for installation, maintenance, and local client connection;
- 40-pin header/I2C for the OLED, ATECC608A, and optional PN532;
- enough CPU/RAM for local Enigma CLI and verifier operations;
- a stable mechanical outline with published drawing data.
## Why ESP32 is not the default
ESP32 is strong for low-power embedded IoT. Espressif documents it as an integrated Wi-Fi/Bluetooth SoC with robust operating temperature range, low-power modes, and multiple peripheral interfaces. Those are useful properties, but they do not solve the main Witness Vault problem: Enigma's present software is a Linux/Node local vault and proof toolchain.
Choosing ESP32 now would require new firmware for vault storage, receipt handling, verifier behavior, update flow, and security review. That may become a future companion device, display controller, or low-power witness sensor, but it is not the build-ready top-level vault host.
## Why NFC-only is optional coordination, not custody
NFC is valuable for demos and pairing. A tag or PN532 module can point a phone to setup instructions, carry a local pairing URL, advertise a device identifier, or reference a public token/metadata record. It cannot run the Enigma vault, hold the local bundle, verify receipts, or prove memory lifecycle events by itself.
If Solana or token metadata appears in this hardware package, it should be framed only as optional coordination metadata. Metaplex Token Metadata supports attaching data to Solana tokens and off-chain JSON URIs; that can describe a device badge or public coordination object. It does not prove that the physical vault is untampered, that provider data was deleted, or that Enigma memories are true.
## Why a verifier dongle is not enough
A verifier dongle is a credible accessory: it can display or check a proof bundle, hold a public verifier identity, or provide a small out-of-band confirmation. It is not the best first hardware product because the desired user story is a visible local memory vault. The Witness Vault needs persistent storage, local services, display state, and enough OS support to run Enigma workflows. A dongle can follow after the vault protocol and demo story are stable.
## Secure element decision
Use Adafruit's ATECC608A breakout as the sidecar secure element for the reference build. It is inexpensive, tiny, I2C-based, and documented with a fixed `0x60` address. The honest claim is limited: the sidecar can improve key custody for supported signing/challenge flows, but the package must not claim tamper-proof storage or absolute key non-extractability for the assembled appliance. The Pi, wiring, OS, and physical enclosure remain part of the attack surface.
## Display decision
Use a 0.96 in 128x64 SSD1306 I2C OLED. It is cheap in commodity form, small enough for the lid, and sufficient for short operational states:
- `READY`
- `VAULT OK`
- `VERIFY OK`
- `PAIRING`
- `NFC TAP`
- `ERROR`
The Adafruit STEMMA QT board is a higher-priced reference source; commodity SSD1306 modules can keep the build closer to $50 if the buyer accepts soldering and less polished connectors.
## NFC decision
Support NFC as an optional variant only. The target compact PN532 envelope is 43.6 mm x 41 mm x 3.9 mm. The common full-size Adafruit PN532 development board is useful as a source/reference but is physically too long for the 86 mm x 102 mm target enclosure and can push the BOM above $100. Use the no-NFC enclosure for first build and the NFC enclosure only when tap-to-pair or demo flow matters.
## Enclosure and printer decision
Use PETG or ASA on the Bambu X1 Carbon. The enclosure fits comfortably inside the X1-Carbon's 256 x 256 x 256 mm build volume. The included 0.4 mm hardened steel nozzle is compatible with the functional enclosure tolerances expected here.
Recommended constraints:
- Use PETG for easiest functional prints; use ASA when heat resistance matters and the operator can manage ASA ventilation/warping.
- Avoid conductive/carbon-filled filament near antennas.
- Leave plastic clearance above the Pi antenna and PN532 antenna.
- Avoid metal inserts or screws directly over the NFC antenna loop.
- Keep walls boring and serviceable: 2.0-2.4 mm walls, 0.2 mm layers, brass or printed standoffs, and accessible fasteners.
## Final architecture
Core no-NFC build:
```text
Raspberry Pi Zero 2 W
├─ microSD local Enigma vault bundle
├─ I2C bus
│ ├─ ATECC608A secure-element sidecar at 0x60
│ └─ SSD1306 OLED at 0x3C or 0x3D
├─ micro USB power
└─ PETG/ASA no-NFC enclosure, 86 W x 78 L x 28 H mm
```
Optional NFC build:
```text
Raspberry Pi Zero 2 W
├─ microSD local Enigma vault bundle
├─ I2C bus
│ ├─ ATECC608A secure-element sidecar at 0x60
│ ├─ SSD1306 OLED at 0x3C or 0x3D
│ └─ compact PN532 NFC module
├─ micro USB power
└─ PETG/ASA NFC enclosure, 86 W x 102 L x 28 H mm
```
## Approved claim boundary
The hardware can honestly claim:
- local Enigma vault custody on a dedicated device;
- offline-verifiable Enigma receipts and proof bundles;
- visible operational status for vault and verification flows;
- optional local NFC pairing/coordination;
- raised physical custody assurance compared with a purely invisible laptop process.
The hardware cannot honestly claim:
- provider deletion;
- model forgetting;
- truth of memory contents;
- tamper-proof storage;
- complete side-channel absence;
- complete import coverage from providers;
- blockchain/token/NFC metadata as proof of custody by itself.