GlacierVault: Cold Storage Retrieval

Polar Archive Custodial Gateway

A decommissioned cold-storage archive left its custodial gateway reachable. Nothing here is a single hard trick: every step is a well-known technique, but retrieval means walking the whole chain end to end.

Public API endpoints:

• GET /health - Service health check
• GET /robots.txt - Crawl directives
• GET /api/archive/manifest - Bootstrap instructions and cipher hint
• GET /api/archive/ledger - Full cold-storage access ledger (4000 rows)
• GET /api/vault/index?page=N - Paginated slot index (requires X-Archive-Token; rate limited)
• POST /api/vault/unlock - Exchange passphrase + derived code for an unlock token and key share 1
• GET /api/vault/crates/mine - Your own crate id (requires X-Unlock-Token)
• GET /api/vault/crates/<id> - Crate lookup by id (requires X-Unlock-Token)
• POST /api/vault/crates/<id>/request - Request crate custody (requires X-Unlock-Token)
• GET /api/vault/internal-check?target=<host> - Internal reachability preflight (requires X-Unlock-Token)
• GET /api/vault/sealed-flag - AES-GCM sealed flag blob
• POST /api/vault/verify - Verify a recovered flag