passes tests now!

internal/vault/vault.go

@@ -84,6 +84,17 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
 		}
 
+		// Verify that the derived key matches the stored public key hash
+		derivedPubKeyHash := ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+		if derivedPubKeyHash != metadata.PublicKeyHash {
+			secret.Debug("Derived public key hash does not match stored hash",
+				"vault_name", v.Name,
+				"derived_hash", derivedPubKeyHash,
+				"stored_hash", metadata.PublicKeyHash,
+				"derivation_index", metadata.DerivationIndex)
+			return nil, fmt.Errorf("derived public key does not match vault: mnemonic may be incorrect")
+		}
+
 		secret.DebugWith("Successfully derived long-term key from mnemonic",
 			slog.String("vault_name", v.Name),
 			slog.String("public_key", ltIdentity.Recipient().String()),