latest

internal/vault/management.go

@@ -218,7 +218,7 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 			return nil, fmt.Errorf("failed to get next derivation index: %w", err)
 		}
 
-		// Derive the long-term key
+		// Derive the long-term key using the actual derivation index
 		ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
 		if err != nil {
 			return nil, fmt.Errorf("failed to derive long-term key: %w", err)
@@ -233,6 +233,7 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 		secret.Debug("Wrote long-term public key", "path", ltPubKeyPath)
 
 		// Compute public key hash from index 0 (same for all vaults with this mnemonic)
+		// This is used to identify which vaults belong to the same mnemonic family
 		identity0, err := agehd.DeriveIdentity(mnemonic, 0)
 		if err != nil {
 			return nil, fmt.Errorf("failed to derive identity for index 0: %w", err)