From dcd91a4ea80396a35cefd8c84a9277739a211fe4 Mon Sep 17 00:00:00 2001
From: Michael Yankelev <myankelev@gmail.com>
Date: Sun, 18 Jan 2026 01:52:10 +0100
Subject: [PATCH 01/16] bump version to 1.8.1 and update documentation for
 IPFS/IPNS relay integration

---
 .claude/claude.md                       |   4 +-
 .github/copilot-instructions.md         |   4 +-
 00_START_HERE.md                        |   8 +-
 Documentation/API_SPECIFICATION.md      | 125 +++++++++++++++++++++++-
 Documentation/CLIENT_SPECIFICATION.md   |  34 ++++---
 Documentation/DATA_FLOWS.md             |  88 ++++++++++++-----
 Documentation/IMPLEMENTATION_ROADMAP.md |  37 ++++---
 Documentation/TECHNICAL_ARCHITECTURE.md |  38 ++++---
 8 files changed, 258 insertions(+), 80 deletions(-)

diff --git a/.claude/claude.md b/.claude/claude.md
index 0eb836d595..9144efc8bd 100644
--- a/.claude/claude.md
+++ b/.claude/claude.md
@@ -16,7 +16,7 @@ CipherBox is a **technology demonstrator** for privacy-first encrypted cloud sto
 
 ## Version Management
 
-**Current Version:** 1.8.0
+**Current Version:** 1.8.1
 
 ### Version Bump Rule
 
@@ -75,7 +75,7 @@ When generating code for CipherBox:
 ## Architecture Decisions
 
 - **Auth:** Web3Auth for key derivation, CipherBox backend for tokens
-- **Storage:** IPFS via Pinata for files, IPNS for metadata
+- **Storage:** IPFS via Pinata for files, IPNS for metadata (all relayed via CipherBox API)
 - **Encryption:** Client-side only, server is zero-knowledge
 - **Sync:** IPNS polling (30s interval), no push infrastructure
 - **Desktop:** FUSE mount for transparent file access
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 5a47f6d273..e1ff99016d 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -2,7 +2,7 @@
 
 ## Version Management
 
-**Current Documentation Version:** 1.8.0
+**Current Documentation Version:** 1.8.1
 
 ### Version Bump Rule
 
@@ -55,7 +55,7 @@ CipherBox uses a **mandatory two-phase auth flow** that must be understood befor
 ```
 User Auth → Web3Auth → ECDSA Private Key (client RAM only, never transmitted)
                     ├─ Used for ECIES decryption of all data keys
-                    ├─ Used for IPNS entry signing
+                    ├─ Used to decrypt IPNS signing keys (Ed25519)
                     └─ Destroyed on logout
 
 ECDSA Public Key (stored on server, identifies user)
diff --git a/00_START_HERE.md b/00_START_HERE.md
index 0595de7e8f..2119652611 100644
--- a/00_START_HERE.md
+++ b/00_START_HERE.md
@@ -17,8 +17,8 @@ A **production-grade, comprehensive specification** for building CipherBox v1.0
 This is **not a preliminary design document**—it's a **complete blueprint** with:
 
 - ✅ **5 complete user journeys** (signup → auth → sync → export → recovery)
-- ✅ **18 API endpoints** fully specified
-- ✅ **8 database tables** with schema
+- ✅ **15 API endpoints** fully specified
+- ✅ **6 database tables** with schema
 - ✅ **6 encryption algorithms** with implementation details
 - ✅ **100+ acceptance criteria**
 - ✅ **3 key derivation test vectors**
@@ -69,9 +69,9 @@ Layer 3: Folder metadata (AES-256-GCM per folder)
 
 Each folder has its own IPNS entry (enables v2+ sharing)
 
-### 4. **IPNS Polling Sync** (~30s)
+### 4. **IPFS/IPNS Relay + Polling Sync** (~30s)
 
-No push infrastructure (MVP appropriate, scalable)
+Signed IPNS records relayed by CipherBox API; no direct client publishing
 
 ### 5. **User-Held Keys** (Zero-Knowledge)
 
diff --git a/Documentation/API_SPECIFICATION.md b/Documentation/API_SPECIFICATION.md
index 1654718874..94160f8b06 100644
--- a/Documentation/API_SPECIFICATION.md
+++ b/Documentation/API_SPECIFICATION.md
@@ -1,5 +1,5 @@
-version: 1.7.0
-last_updated: 2026-01-16
+version: 1.7.1
+last_updated: 2026-01-18
 status: Active
 ai_context: API specification for CipherBox backend. Contains all endpoints, request/response formats, database schema, and rate limits. For system design see TECHNICAL_ARCHITECTURE.md.
 ---
@@ -51,11 +51,12 @@ The CipherBox backend provides:
 - Vault management (encrypted key storage)
 - File upload to IPFS (via Pinata)
 - Storage quota tracking
+- IPFS/IPNS relay for encrypted metadata and signed IPNS records
 
 The backend **never** handles:
 - Plaintext files
 - Unencrypted keys
-- IPNS publishing (client-side only)
+- Client private keys or unsigned IPNS records
 
 ### 1.2 Authentication Flow
 
@@ -464,6 +465,118 @@ Authorization: Bearer <accessToken>
 
 ---
 
+### 3.4 IPFS/IPNS Relay Endpoints
+
+All relay endpoints require `Authorization: Bearer <accessToken>`.
+
+#### POST /ipfs/add
+
+Add encrypted metadata (or any encrypted content) to IPFS via backend relay.
+
+**Headers:**
+```
+Authorization: Bearer <accessToken>
+Content-Type: application/octet-stream
+```
+
+**Request Body:**
+Raw bytes (encrypted content)
+
+**Response (201):**
+```json
+{
+  "cid": "QmXxxx...",
+  "size": 2048
+}
+```
+
+**Errors:**
+- `400 Bad Request` - Invalid payload
+- `429 Too Many Requests` - Rate limited
+- `502 Bad Gateway` - IPFS relay failed
+
+---
+
+#### GET /ipfs/cat
+
+Fetch encrypted content by CID via backend relay.
+
+**Query:**
+```
+?cid=QmXxxx...
+```
+
+**Response (200):**
+```
+<raw bytes>
+```
+
+**Errors:**
+- `400 Bad Request` - Invalid CID
+- `404 Not Found` - CID not found
+- `429 Too Many Requests` - Rate limited
+- `502 Bad Gateway` - IPFS relay failed
+
+---
+
+#### GET /ipns/resolve
+
+Resolve IPNS name to current CID via backend relay.
+
+**Query:**
+```
+?ipnsName=k51qzi5uqu5dlvj55...
+```
+
+**Response (200):**
+```json
+{
+  "cid": "QmXxxx...",
+  "resolvedAt": "2026-01-18T12:00:00Z"
+}
+```
+
+**Errors:**
+- `400 Bad Request` - Invalid IPNS name
+- `404 Not Found` - IPNS name not found
+- `429 Too Many Requests` - Rate limited
+- `502 Bad Gateway` - IPNS relay failed
+
+---
+
+#### POST /ipns/publish
+
+Relay a client-signed IPNS record to the IPFS/IPNS network.
+
+**Request:**
+```json
+{
+  "ipnsName": "k51qzi5uqu5dlvj55...",
+  "ipnsRecord": "BASE64_ENCODED_SIGNED_RECORD",
+  "sequenceNumber": 42,
+  "ttlSeconds": 3600
+}
+```
+
+**Response (200):**
+```json
+{
+  "published": true,
+  "ipnsName": "k51qzi5uqu5dlvj55...",
+  "sequenceNumber": 42,
+  "publishedAt": "2026-01-18T12:00:00Z"
+}
+```
+
+**Errors:**
+- `400 Bad Request` - Invalid record or malformed request
+- `401 Unauthorized` - Invalid access token
+- `409 Conflict` - Sequence number too low
+- `429 Too Many Requests` - Rate limited
+- `502 Bad Gateway` - IPNS relay failed
+
+---
+
 ## 4. Database Schema
 
 ### 4.1 Users Table
@@ -594,6 +707,10 @@ CREATE INDEX idx_pinned_cids_user_id ON pinned_cids(user_id);
 | POST /vault/upload | 60 | per minute | Batch upload support |
 | GET /my-vault | 120 | per minute | Polling + normal access |
 | DELETE /user/account | 1 | per hour | Prevent accidental deletion |
+| POST /ipfs/add | 120 | per minute | Metadata relay |
+| GET /ipfs/cat | 300 | per minute | Encrypted content relay |
+| GET /ipns/resolve | 240 | per minute | Sync polling |
+| POST /ipns/publish | 120 | per minute | Signed-record relay |
 
 ### 5.2 Rate Limit Headers
 
@@ -651,6 +768,8 @@ All errors follow this format:
 | `FILE_TOO_LARGE` | 413 | File exceeds 100MB limit |
 | `RATE_LIMIT_EXCEEDED` | 429 | Too many requests |
 | `QUOTA_EXCEEDED` | 507 | Storage quota exceeded |
+| `IPFS_RELAY_FAILED` | 502 | IPFS relay failed |
+| `IPNS_RELAY_FAILED` | 502 | IPNS relay failed |
 | `INTERNAL_ERROR` | 500 | Unexpected server error |
 
 ---
diff --git a/Documentation/CLIENT_SPECIFICATION.md b/Documentation/CLIENT_SPECIFICATION.md
index bdf2e54a65..640f2dec8d 100644
--- a/Documentation/CLIENT_SPECIFICATION.md
+++ b/Documentation/CLIENT_SPECIFICATION.md
@@ -1,6 +1,6 @@
 ---
-version: 1.8.0
-last_updated: 2026-01-17
+version: 1.8.1
+last_updated: 2026-01-18
 status: Active
 ai_context: Client application specifications for CipherBox. Contains Web UI and Desktop app requirements. For system design see TECHNICAL_ARCHITECTURE.md.
 ---
@@ -44,7 +44,7 @@ ai_context: Client application specifications for CipherBox. Contains Web UI and
 | Styling | Tailwind CSS |
 | State Management | React Context + Hooks |
 | Encryption | Web Crypto API |
-| IPFS Client | kubo-rpc-client |
+| IPFS Relay | CipherBox API (/ipfs/*, /ipns/*) |
 | Auth | @web3auth/modal |
 | HTTP Client | Axios |
 
@@ -272,10 +272,10 @@ interface AppState {
 | `getattr` | Return file attributes from metadata |
 | `open` | Fetch from IPFS, decrypt, return handle |
 | `read` | Return decrypted content from cache |
-| `write` | Encrypt, upload, update IPNS |
-| `create` | Generate keys, encrypt, upload, update IPNS |
+| `write` | Encrypt, upload, relay IPNS publish |
+| `create` | Generate keys, encrypt, upload, relay IPNS publish |
 | `unlink` | Unpin CID, update parent IPNS |
-| `mkdir` | Generate folder keys, create IPNS, update parent |
+| `mkdir` | Generate folder keys, create IPNS, relay publish |
 | `rmdir` | Unpin folder IPNS, update parent |
 | `rename` | Update metadata in source and destination |
 
@@ -331,7 +331,7 @@ class SyncDaemon {
   async poll() {
     try {
       // Resolve root IPNS
-      const currentCid = await ipfs.name.resolve(rootIpnsName);
+      const { cid: currentCid } = await api.get(`/ipns/resolve?ipnsName=${rootIpnsName}`);
       
       if (currentCid !== this.cachedRootCid) {
         // Changes detected
@@ -374,7 +374,7 @@ class SyncDaemon {
 | D1 | FUSE mount succeeds in <3s | Performance test |
 | D2 | File read latency <500ms (cached) | Benchmark |
 | D3 | File read latency <2s (uncached) | Benchmark |
-| D4 | File write triggers IPNS publish in <5s | Integration test |
+| D4 | File write triggers IPNS relay publish in <5s | Integration test |
 | D5 | Multi-platform builds work | CI/CD test |
 | D6 | No plaintext on disk (except temp decrypted reads) | Security audit |
 | D7 | Logout unmounts FUSE and clears keys | Manual test |
@@ -419,7 +419,7 @@ interface IpfsModule {
   
   // IPNS operations
   resolveIpns(name: string): Promise<string>; // Returns CID
-  publishIpns(cid: string, privateKey: Uint8Array): Promise<void>;
+  publishIpnsRecord(record: Uint8Array, ipnsName: string, sequenceNumber: number, ttlSeconds: number): Promise<void>;
 }
 ```
 
@@ -438,7 +438,7 @@ interface VaultModule {
   createFolder(name: string, parentFolder: FolderNode): Promise<FolderEntry>;
   
   // IPNS publishing
-  publishFolderUpdate(folder: FolderNode): Promise<void>;
+  publishFolderUpdate(folder: FolderNode): Promise<void>; // sign locally, relay via /ipns/publish
 }
 ```
 
@@ -450,7 +450,7 @@ interface VaultModule {
 
 | Question | Context | Priority |
 |----------|---------|----------|
-| What does user see when IPFS gateway is unavailable? | Network errors | High |
+| What does user see when IPFS relay is unavailable? | Network errors | High |
 | How to handle IPNS publish failures? | Write operations | High |
 | What timeout thresholds for file operations? | Performance UX | Medium |
 | Should failed uploads be queued for retry? | Reliability | Medium |
@@ -500,11 +500,23 @@ interface VaultModule {
 | System notification permissions? | Desktop UX | Medium |
 | Auto-update mechanism? | Distribution | High |
 
+### 4.7 Desktop Client (FUSE Semantics)
+
+| Question | Context | Priority |
+|----------|---------|----------|
+| What is the write model (streaming vs temp-file commit)? | File IO correctness | High |
+| How are partial writes and truncates handled? | File IO correctness | High |
+| What is the atomic rename strategy for updates? | Consistency | High |
+| How are concurrent edits resolved across devices? | Conflict policy | Medium |
+| When is encrypted cache invalidated on IPNS updates? | Cache consistency | Medium |
+| What is the offline write queue behavior? | Reliability | Medium |
+
 ---
 
 ## 5. Console PoC Harness
 
 **Goal:** Provide a single-user, online test harness to validate IPFS/IPNS flows without Web3Auth or the backend.
+**Note:** The PoC publishes directly to IPFS/IPNS and is intentionally separate from the production relay model.
 
 **Environment:** Node.js (TypeScript), local IPFS daemon, optional Pinata API keys for pin/unpin.
 
diff --git a/Documentation/DATA_FLOWS.md b/Documentation/DATA_FLOWS.md
index 3418183de3..feb10e6dee 100644
--- a/Documentation/DATA_FLOWS.md
+++ b/Documentation/DATA_FLOWS.md
@@ -1,6 +1,6 @@
 ---
-version: 1.8.0
-last_updated: 2026-01-17
+version: 1.8.1
+last_updated: 2026-01-18
 status: Active
 ai_context: Data flow diagrams and test vectors for CipherBox. Contains Mermaid sequence diagrams for all major operations. For system design see TECHNICAL_ARCHITECTURE.md.
 ---
@@ -163,9 +163,12 @@ sequenceDiagram
     C->>C: encryptedMetadata = AES-GCM(metadata, folderKey)
     C->>C: Decrypt folder's ipnsPrivateKey
     
-    Note over C,IPFS: Publish IPNS
-    C->>IPFS: Upload encrypted metadata, get metadataCid
-    C->>IPFS: Sign & publish IPNS record
+    Note over C,B: Publish IPNS (Signed-Record Relay)
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
     
     Note over C: Update UI
     C->>U: Show file in folder with decrypted name
@@ -197,6 +200,7 @@ After upload, this entry is added to folder metadata:
 sequenceDiagram
     participant U as User
     participant C as Client
+  participant B as CipherBox Backend
     participant IPFS as IPFS Network
     
     U->>C: Click download on file
@@ -208,9 +212,10 @@ sequenceDiagram
     C->>C: fileKey = ECIES_Decrypt(fileKeyEncrypted, privateKey)
     C->>C: fileName = AES-GCM_Decrypt(nameEncrypted, folderKey, nameIv)
     
-    Note over C,IPFS: Fetch Encrypted Content
-    C->>IPFS: GET /ipfs/{cid}
-    IPFS->>C: Return encrypted file
+    Note over C,B: Fetch Encrypted Content
+    C->>B: GET /ipfs/cat?cid={cid}
+    B->>IPFS: Fetch encrypted file
+    B->>C: Return encrypted file
     
     Note over C: Decrypt Content
     C->>C: plaintext = AES-GCM_Decrypt(ciphertext, fileKey, fileIv)
@@ -230,20 +235,23 @@ sequenceDiagram
 ```mermaid
 sequenceDiagram
     participant D1 as Device 1
-    participant IPFS as IPFS Network
+  participant B as CipherBox Backend
+  participant IPFS as IPFS Network
     participant D2 as Device 2
     
     Note over D1: User uploads file
-    D1->>IPFS: Upload file, publish IPNS record
+  D1->>B: POST /ipfs/add + POST /ipns/publish
+  B->>IPFS: Relay publish
     
     Note over D2: Background polling (every 30s)
     loop Every 30 seconds
-        D2->>IPFS: Resolve root IPNS name
-        IPFS->>D2: Return current CID
+      D2->>B: GET /ipns/resolve
+      B->>IPFS: Resolve IPNS name
+      B->>D2: Return current CID
         D2->>D2: Compare with cached CID
         
         alt CID changed
-            D2->>IPFS: Fetch new metadata from CID
+        D2->>B: GET /ipfs/cat
             D2->>D2: Decrypt metadata
             D2->>D2: Update UI with new files
         else CID unchanged
@@ -260,7 +268,7 @@ async function pollForChanges() {
   const vault = await api.get('/my-vault');
   
   // Resolve IPNS to current CID
-  const currentCid = await ipfs.name.resolve(vault.rootIpnsName);
+  const { cid: currentCid } = await api.get(`/ipns/resolve?ipnsName=${vault.rootIpnsName}`);
   
   // Check if changed
   if (currentCid === cachedRootCid) {
@@ -360,7 +368,8 @@ sequenceDiagram
 sequenceDiagram
     participant U as User
     participant C as Client
-    participant IPFS as IPFS Network
+  participant B as CipherBox Backend
+  participant IPFS as IPFS Network
     
     U->>C: Create new folder "Documents"
     
@@ -376,12 +385,20 @@ sequenceDiagram
     Note over C: Create Empty Folder
     C->>C: folderMetadata = { children: [] }
     C->>C: encrypted = AES-GCM(metadata, folderKey)
-    C->>IPFS: Publish folder IPNS record
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
     
     Note over C: Update Parent
     C->>C: Add folder entry to parent.children
     C->>C: Re-encrypt parent metadata
-    C->>IPFS: Publish parent IPNS record
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
 ```
 
 ### 6.2 Rename File/Folder
@@ -390,7 +407,8 @@ sequenceDiagram
 sequenceDiagram
     participant U as User
     participant C as Client
-    participant IPFS as IPFS Network
+  participant B as CipherBox Backend
+  participant IPFS as IPFS Network
     
     U->>C: Rename "old.pdf" to "new.pdf"
     
@@ -398,7 +416,11 @@ sequenceDiagram
     C->>C: newNameEncrypted = AES-GCM("new.pdf", folderKey)
     C->>C: Update entry.nameEncrypted
     C->>C: Re-encrypt parent metadata
-    C->>IPFS: Publish parent IPNS record
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
     
     Note over C: CID unchanged (only metadata updated)
 ```
@@ -408,19 +430,28 @@ sequenceDiagram
 ```mermaid
 sequenceDiagram
     participant C as Client
-    participant IPFS as IPFS Network
+  participant B as CipherBox Backend
+  participant IPFS as IPFS Network
     
     Note over C: Move file.pdf from /Docs to /Docs/Work
     
     Note over C: Step 1: Add to destination first
     C->>C: Add file entry to destination folder
     C->>C: Re-encrypt destination metadata
-    C->>IPFS: Publish destination IPNS
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
     
     Note over C: Step 2: Remove from source
     C->>C: Remove file entry from source folder
     C->>C: Re-encrypt source metadata
-    C->>IPFS: Publish source IPNS
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
     
     Note over C: Order ensures file always reachable
 ```
@@ -442,7 +473,11 @@ sequenceDiagram
     
     C->>C: Remove file entry from parent
     C->>C: Re-encrypt parent metadata
-    C->>IPFS: Publish parent IPNS
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
 ```
 
 ### 6.5 Update File (Replace Contents)
@@ -465,7 +500,11 @@ sequenceDiagram
     
     C->>C: Update file entry with new cid, key, iv
     C->>C: Re-encrypt parent metadata
-    C->>IPFS: Publish parent IPNS
+    C->>B: POST /ipfs/add (encrypted metadata)
+    B->>IPFS: Add metadata, return CID
+    C->>C: Sign IPNS record (Ed25519)
+    C->>B: POST /ipns/publish (signed record)
+    B->>IPFS: Publish IPNS record
     
     C->>B: POST /vault/unpin {oldCid}
     Note over B: Reclaim old file storage
@@ -594,6 +633,7 @@ Verification:
   ✓ result == fileKey
   ✓ Different privateKey causes failure
   ✓ Same publicKey/privateKey pair always works
+```
 
 ---
 
diff --git a/Documentation/IMPLEMENTATION_ROADMAP.md b/Documentation/IMPLEMENTATION_ROADMAP.md
index 4cb1c43d26..3b3b2fe891 100644
--- a/Documentation/IMPLEMENTATION_ROADMAP.md
+++ b/Documentation/IMPLEMENTATION_ROADMAP.md
@@ -1,6 +1,6 @@
 ---
-version: 1.8.0
-last_updated: 2026-01-17
+version: 1.8.1
+last_updated: 2026-01-18
 status: Active
 ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week plan, deliverables, and testing milestones.
 ---
@@ -62,10 +62,10 @@ ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week pla
 ✅ Web3Auth ID token verification via JWKS endpoint
 ✅ IPFS/Pinata integration verified
 ✅ Crypto test vectors pass (AES-256-GCM, ECIES)
-✅ PostgreSQL schema deployed (6 tables: users, refresh_tokens, auth_nonces, vaults, ipns_entries, volume_audit, pinned_cids)
-✅ API contract stub (17 endpoints - no backend IPNS proxy)
+✅ PostgreSQL schema deployed (6 tables: users, refresh_tokens, auth_nonces, vaults, volume_audit, pinned_cids)
+✅ API contract stub (15 endpoints - IPFS/IPNS relay included)
 ✅ Docker containers working
-✅ Client-side IPFS publishing tested (kubo-rpc-client)
+✅ IPFS/IPNS relay endpoints tested (signed-record publish)
 ```
 
 **Team:** Backend (80%), DevOps (80%), Frontend (40%)
@@ -138,9 +138,9 @@ ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week pla
 
 ***
 
-### **Week 6: IPNS Publishing + Folders (Client-Side)**
+### **Week 6: IPNS Publishing + Folders (Relay)**
 
-**Goal:** Folder hierarchy + client-side IPNS publishing
+**Goal:** Folder hierarchy + signed-record IPNS relay
 
 **Deliverables:**
 
@@ -149,16 +149,15 @@ ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week pla
 ✅ IPNS keypairs stored encrypted: ECIES(ipnsPrivKey, userPubkey)
 ✅ Root IPNS keypair stored on server (via POST /my-vault/initialize)
 ✅ Subfolder IPNS keypairs stored in parent folder metadata
-✅ Client-side IPFS publishing (kubo-rpc-client or similar)
-✅ Client decrypts IPNS key → signs → publishes directly to IPFS
+✅ Client signs IPNS record → POST /ipns/publish (relay)
+✅ Encrypted metadata published via POST /ipfs/add
 ✅ Folder create → generate keypair → metadata → IPNS publish
 ✅ Tree traversal (resolve IPNS → fetch → decrypt → recurse)
-✅ No backend IPNS proxy (keys never leave client)
+✅ Backend relays signed IPNS records (keys never leave client)
 ```
 
 **Architecture Note:** IPNS signing keys are managed entirely client-side.
-Backend stores only the encrypted root IPNS key. All publishing is direct
-from client to IPFS network, ensuring zero-knowledge for folder structure.
+Backend relays signed records only; private keys never leave client.
 
 **Tests:** Create folder → IPNS resolves → metadata decrypts correctly
 
@@ -173,8 +172,8 @@ from client to IPFS network, ensuring zero-knowledge for folder structure.
 **Deliverables:**
 
 ```
-✅ Rename file: Update metadata → republish IPNS (client-side)
-✅ Move: Add to destination → remove from source → dual IPNS publish
+✅ Rename file: Update metadata → relay IPNS publish
+✅ Move: Add to destination → remove from source → dual IPNS relay publish
 ✅ Delete: Unpin CID (POST /vault/unpin) → remove metadata → republish
 ✅ Update file: New key/IV → upload → update metadata → unpin old CID
 ✅ Bulk operations (multi-select upload/delete)
@@ -308,7 +307,7 @@ from client to IPFS network, ensuring zero-knowledge for folder structure.
 
 ```
 ✅ File upload/download end-to-end
-✅ Client-side IPNS publishing reliable
+✅ Signed-record IPNS relay reliable
 ✅ Folder hierarchy with per-folder IPNS keypairs
 ✅ File update/delete with CID unpinning
 ```
@@ -341,8 +340,8 @@ from client to IPFS network, ensuring zero-knowledge for folder structure.
 | **Frontend** | 50% | 100% | 50% | 80% | **280h** |
 | **DevOps** | 40% | 40% | 80% | 100% | **200h** |
 
-**Note:** Backend allocation reduced in W5-8 due to client-side IPNS publishing
-architecture (no backend IPNS proxy). Frontend handles IPFS client integration.
+**Note:** Backend allocation balanced in W5-8 due to IPFS/IPNS relay endpoints.
+Frontend focuses on signing and relay integration.
 
 
 ***
@@ -353,7 +352,7 @@ architecture (no backend IPNS proxy). Frontend handles IPFS client integration.
 | :-- | :-- | :-- |
 | Web3Auth integration | Medium | Week 1 deep-dive, direct support, group connections testing |
 | IPFS performance | Medium | Pinata + caching strategy |
-| Client-side IPFS publishing | Medium | Week 2 kubo-rpc-client testing, fallback to js-ipfs |
+| IPFS/IPNS relay reliability | Medium | Week 2 relay endpoint load testing + retry strategy |
 | Security audit | Low | Continuous review, 2-week buffer |
 | Desktop complexity | Medium | macOS first, others v1.1 |
 
@@ -442,7 +441,7 @@ Code reviews within 24h
 ### **Week 7: "Storage Done"** ✅
 ```
 [ ] File upload/download complete
-[ ] Client-side IPNS publishing reliable
+[ ] Signed-record IPNS relay reliable
 [ ] Per-folder IPNS keypairs working
 [ ] Folder hierarchy functional
 [ ] Multi-file operations working
diff --git a/Documentation/TECHNICAL_ARCHITECTURE.md b/Documentation/TECHNICAL_ARCHITECTURE.md
index 00df677a51..ad25ec0496 100644
--- a/Documentation/TECHNICAL_ARCHITECTURE.md
+++ b/Documentation/TECHNICAL_ARCHITECTURE.md
@@ -1,6 +1,6 @@
 ---
-version: 1.8.0
-last_updated: 2026-01-17
+version: 1.8.1
+last_updated: 2026-01-18
 status: Active
 ai_context: Technical architecture for CipherBox. Contains encryption specs, key hierarchy, auth flows, and system design. For API details see API_SPECIFICATION.md, for sequences see DATA_FLOWS.md.
 ---
@@ -91,6 +91,7 @@ ai_context: Technical architecture for CipherBox. Contains encryption specs, key
 3. **Deterministic Keys:** Same user + any linked auth method → same ECDSA keypair
 4. **Decentralized Storage:** Files stored on IPFS, metadata in IPNS records
 5. **User-Held Keys:** Private key exists only in client RAM during session
+6. **Signed-Record Relay:** Clients sign IPNS records; backend relays to IPFS/IPNS
 
 ---
 
@@ -416,27 +417,31 @@ This design enables future per-folder sharing (v2+).
 ```mermaid
 sequenceDiagram
     participant C as Client
-    participant IPFS as IPFS Network
+  participant B as CipherBox Backend
+  participant IPFS as IPFS Network
     
     C->>C: Update folder metadata (add/remove child)
     C->>C: Encrypt metadata: AES-GCM(metadata, folderKey)
     C->>C: Decrypt folder's ipnsPrivateKey
-    C->>IPFS: Publish metadata to IPFS, get CID
-    C->>IPFS: Sign & publish IPNS record pointing to CID
+  C->>B: POST /ipfs/add (encrypted metadata)
+  B->>IPFS: Add metadata, return CID
+  C->>C: Sign IPNS record (Ed25519)
+  C->>B: POST /ipns/publish (signed record)
+  B->>IPFS: Publish IPNS record
     Note over IPFS: IPNS name now resolves to new CID
 ```
 
-**Key Point:** Client publishes directly to IPFS. Backend is never involved in IPNS publishing—keys never leave client.
+**Key Point:** Client signs IPNS records locally; backend relays signed records only. Private keys never leave client.
 
 ### 5.3 Tree Traversal
 
 ```typescript
 async function fetchFileTree(ipnsName: string, folderKey: Uint8Array): Promise<FolderNode> {
-  // 1. Resolve IPNS to latest CID
-  const cid = await ipfs.name.resolve(ipnsName);
+  // 1. Resolve IPNS via backend relay
+  const { cid } = await api.get(`/ipns/resolve?ipnsName=${ipnsName}`);
   
   // 2. Fetch encrypted metadata from IPFS
-  const encryptedData = await ipfs.cat(cid);
+  const encryptedData = await api.get(`/ipfs/cat?cid=${cid}`, { responseType: "arraybuffer" });
   const { encryptedMetadata, iv } = JSON.parse(encryptedData);
   
   // 3. Decrypt metadata
@@ -465,16 +470,19 @@ async function fetchFileTree(ipnsName: string, folderKey: Uint8Array): Promise<F
 ```mermaid
 sequenceDiagram
     participant D1 as Device 1
-    participant IPFS as IPFS Network
+  participant B as CipherBox Backend
+  participant IPFS as IPFS Network
     participant D2 as Device 2
     
-    D1->>IPFS: Upload file, publish IPNS
+  D1->>B: POST /ipfs/add + POST /ipns/publish
+  B->>IPFS: Relay publish
     loop Every 30s
-        D2->>IPFS: Resolve root IPNS name
-        IPFS->>D2: Return current CID
+    D2->>B: GET /ipns/resolve
+    B->>IPFS: Resolve IPNS name
+    B->>D2: Return current CID
         D2->>D2: Compare with cached CID
         alt CID changed
-            D2->>IPFS: Fetch new metadata
+      D2->>B: GET /ipfs/cat
             D2->>D2: Decrypt and update UI
         end
     end
@@ -497,7 +505,7 @@ Future versions may implement vector clocks or CRDTs.
 |-----------|------------|-----------|
 | Frontend | React 18 + TypeScript | Modern, good for encryption UI |
 | Web Crypto | Web Crypto API | Native browser encryption |
-| IPFS Client | kubo-rpc-client | JSON-RPC to IPFS gateway |
+| IPFS Client | CipherBox IPFS relay | HTTP relay to IPFS/IPNS |
 | Web3Auth SDK | @web3auth/modal | Auth and key derivation |
 | Backend | Node.js + NestJS + TypeScript | Type-safe, same language as frontend |
 | JWT Verification | jose | Verify Web3Auth tokens |

From 89fb11dfaac69fc7bd00b18e4c853bfe273f39b9 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:02:57 +0100
Subject: [PATCH 02/16] Fix date inconsistency in TECHNICAL_ARCHITECTURE.md
 (#7)

* Initial plan

* Fix date inconsistency in TECHNICAL_ARCHITECTURE.md

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/TECHNICAL_ARCHITECTURE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/TECHNICAL_ARCHITECTURE.md b/Documentation/TECHNICAL_ARCHITECTURE.md
index ad25ec0496..71a9d96415 100644
--- a/Documentation/TECHNICAL_ARCHITECTURE.md
+++ b/Documentation/TECHNICAL_ARCHITECTURE.md
@@ -9,7 +9,7 @@ ai_context: Technical architecture for CipherBox. Contains encryption specs, key
 
 **Document Type:** Technical Specification  
 **Status:** Active  
-**Last Updated:** January 17, 2026  
+**Last Updated:** January 18, 2026  
 
 ---
 

From be8366a8b7a564ad7355539a9f44594d83fd8ce6 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:03:41 +0100
Subject: [PATCH 03/16] Fix date inconsistency in DATA_FLOWS.md frontmatter
 (#8)

* Initial plan

* Fix date inconsistency in DATA_FLOWS.md frontmatter

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/DATA_FLOWS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/DATA_FLOWS.md b/Documentation/DATA_FLOWS.md
index feb10e6dee..ba0365778a 100644
--- a/Documentation/DATA_FLOWS.md
+++ b/Documentation/DATA_FLOWS.md
@@ -9,7 +9,7 @@ ai_context: Data flow diagrams and test vectors for CipherBox. Contains Mermaid
 
 **Document Type:** Implementation Reference  
 **Status:** Active  
-**Last Updated:** January 17, 2026  
+**Last Updated:** January 18, 2026  
 
 ---
 

From f66783bbca6a911528b6980bd4cc1ddcbe7f8996 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:05:17 +0100
Subject: [PATCH 04/16] Add missing CID return arrows in IPFS/IPNS sequence
 diagrams (#6)

* Initial plan

* Add missing return arrows in IPFS/IPNS sequence diagrams

Added `B->>C: Return CID` after all `B->>IPFS: Add metadata, return CID` operations to show that the Backend returns the CID to the Client before the Client signs the IPNS record. The Client needs this CID to create the IPNS record that points to it.

Updated 8 sequence diagrams:
- File Upload Flow (IPNS publish)
- Create Folder (empty folder + update parent)
- Rename File/Folder
- Move File/Folder (destination + source)
- Delete File
- Update File Content

Bumped version to 1.8.2

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 .claude/claude.md           |  2 +-
 Documentation/DATA_FLOWS.md | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/.claude/claude.md b/.claude/claude.md
index 9144efc8bd..c6307f62a6 100644
--- a/.claude/claude.md
+++ b/.claude/claude.md
@@ -16,7 +16,7 @@ CipherBox is a **technology demonstrator** for privacy-first encrypted cloud sto
 
 ## Version Management
 
-**Current Version:** 1.8.1
+**Current Version:** 1.8.2
 
 ### Version Bump Rule
 
diff --git a/Documentation/DATA_FLOWS.md b/Documentation/DATA_FLOWS.md
index ba0365778a..0de30c5ed1 100644
--- a/Documentation/DATA_FLOWS.md
+++ b/Documentation/DATA_FLOWS.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.1
+version: 1.8.2
 last_updated: 2026-01-18
 status: Active
 ai_context: Data flow diagrams and test vectors for CipherBox. Contains Mermaid sequence diagrams for all major operations. For system design see TECHNICAL_ARCHITECTURE.md.
@@ -166,6 +166,7 @@ sequenceDiagram
     Note over C,B: Publish IPNS (Signed-Record Relay)
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -387,6 +388,7 @@ sequenceDiagram
     C->>C: encrypted = AES-GCM(metadata, folderKey)
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -396,6 +398,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -418,6 +421,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -440,6 +444,7 @@ sequenceDiagram
     C->>C: Re-encrypt destination metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -449,6 +454,7 @@ sequenceDiagram
     C->>C: Re-encrypt source metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -475,6 +481,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -502,6 +509,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
+    B->>C: Return CID
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record

From 15e83c6b1b781bc0301e096b211640e0173d6749 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:06:04 +0100
Subject: [PATCH 05/16] =?UTF-8?q?Add=20missing=20Backend=E2=86=92Client=20?=
 =?UTF-8?q?CID=20return=20flows=20in=20IPFS/IPNS=20sequence=20diagrams=20(?=
 =?UTF-8?q?#5)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial plan

* Add return arrows from Backend to Client in IPFS/IPNS sequence diagrams

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 .github/copilot-instructions.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index e1ff99016d..5cd07429ba 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -2,7 +2,7 @@
 
 ## Version Management
 
-**Current Documentation Version:** 1.8.1
+**Current Documentation Version:** 1.8.2
 
 ### Version Bump Rule
 

From edefb890d2592618e0c2952f69150f6c715eb1cc Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:06:48 +0100
Subject: [PATCH 06/16] =?UTF-8?q?Add=20missing=20Backend=E2=86=92Client=20?=
 =?UTF-8?q?CID=20return=20arrows=20in=20IPFS=20sequence=20diagrams=20(#10)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial plan

* Add missing Backend->Client CID return arrows in sequence diagrams

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

From 60b5513cfd025046a240fc9ffc50e8c81ef97295 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:07:29 +0100
Subject: [PATCH 07/16] Add missing CID return step in IPNS publish sequence
 diagrams (#16)

* Initial plan

* Add missing return CID step in IPNS publish sequences

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

From b05b550800823eeb95fa1a0a158dc56a02be095d Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:07:59 +0100
Subject: [PATCH 08/16] Fix date inconsistency in API_SPECIFICATION.md (#14)

* Initial plan

* Fix date inconsistency in API_SPECIFICATION.md

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/API_SPECIFICATION.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/API_SPECIFICATION.md b/Documentation/API_SPECIFICATION.md
index 94160f8b06..1d596224db 100644
--- a/Documentation/API_SPECIFICATION.md
+++ b/Documentation/API_SPECIFICATION.md
@@ -8,7 +8,7 @@ ai_context: API specification for CipherBox backend. Contains all endpoints, req
 
 **Document Type:** API Specification  
 **Status:** Active  
-**Last Updated:** January 16, 2026  
+**Last Updated:** January 18, 2026  
 **Base URL:** `https://api.cipherbox.io`
 
 ---

From b687bfc3d182fd59eea6480e1a2526aec341d416 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:08:34 +0100
Subject: [PATCH 09/16] Fix missing YAML frontmatter delimiter in
 API_SPECIFICATION.md (#15)

* Initial plan

* Fix YAML frontmatter: add missing opening delimiter to API_SPECIFICATION.md

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/API_SPECIFICATION.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/API_SPECIFICATION.md b/Documentation/API_SPECIFICATION.md
index 1d596224db..c23d69a272 100644
--- a/Documentation/API_SPECIFICATION.md
+++ b/Documentation/API_SPECIFICATION.md
@@ -1,3 +1,4 @@
+---
 version: 1.7.1
 last_updated: 2026-01-18
 status: Active

From 7ff0f962a21197e5884c1c9cc56e64b82be5b555 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:10:13 +0100
Subject: [PATCH 10/16] =?UTF-8?q?Fix=20missing=20Backend=E2=86=92Client=20?=
 =?UTF-8?q?CID=20return=20in=20IPFS/IPNS=20sequence=20diagrams=20(#11)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial plan

* Fix sequence diagrams: add missing Backend->Client CID return arrows

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

From 594181d6e859c07d53fa0a313b422e21bb10d203 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:10:49 +0100
Subject: [PATCH 11/16] Fix missing return arrow in IPNS publishing sequence
 diagram (#13)

* Initial plan

* Add missing return arrow in IPNS publishing sequence diagram

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/TECHNICAL_ARCHITECTURE.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Documentation/TECHNICAL_ARCHITECTURE.md b/Documentation/TECHNICAL_ARCHITECTURE.md
index 71a9d96415..f020c293c9 100644
--- a/Documentation/TECHNICAL_ARCHITECTURE.md
+++ b/Documentation/TECHNICAL_ARCHITECTURE.md
@@ -425,6 +425,7 @@ sequenceDiagram
     C->>C: Decrypt folder's ipnsPrivateKey
   C->>B: POST /ipfs/add (encrypted metadata)
   B->>IPFS: Add metadata, return CID
+  B->>C: Return CID
   C->>C: Sign IPNS record (Ed25519)
   C->>B: POST /ipns/publish (signed record)
   B->>IPFS: Publish IPNS record

From c15c6258c1fbe08216cedee0a15a81e063782dd7 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:11:44 +0100
Subject: [PATCH 12/16] Fix date inconsistency in CLIENT_SPECIFICATION.md (#9)

* Initial plan

* Fix date inconsistency in CLIENT_SPECIFICATION.md

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/CLIENT_SPECIFICATION.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/CLIENT_SPECIFICATION.md b/Documentation/CLIENT_SPECIFICATION.md
index 640f2dec8d..ee2b618fa0 100644
--- a/Documentation/CLIENT_SPECIFICATION.md
+++ b/Documentation/CLIENT_SPECIFICATION.md
@@ -9,7 +9,7 @@ ai_context: Client application specifications for CipherBox. Contains Web UI and
 
 **Document Type:** Client Application Specification  
 **Status:** Active  
-**Last Updated:** January 17, 2026  
+**Last Updated:** January 18, 2026  
 
 ---
 

From 863e762b901c046aeefda3ad280a998377e3fbe9 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:13:20 +0100
Subject: [PATCH 13/16] =?UTF-8?q?Add=20missing=20Backend=E2=86=92Client=20?=
 =?UTF-8?q?CID=20return=20flows=20in=20IPFS=20metadata=20upload=20sequence?=
 =?UTF-8?q?s=20(#12)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial plan

* Add missing return arrows showing CID returned from backend to client after IPFS metadata upload

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/DATA_FLOWS.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/Documentation/DATA_FLOWS.md b/Documentation/DATA_FLOWS.md
index 0de30c5ed1..b7cdfb9c8f 100644
--- a/Documentation/DATA_FLOWS.md
+++ b/Documentation/DATA_FLOWS.md
@@ -166,7 +166,7 @@ sequenceDiagram
     Note over C,B: Publish IPNS (Signed-Record Relay)
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -388,7 +388,7 @@ sequenceDiagram
     C->>C: encrypted = AES-GCM(metadata, folderKey)
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -398,7 +398,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -421,7 +421,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -444,7 +444,7 @@ sequenceDiagram
     C->>C: Re-encrypt destination metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -454,7 +454,7 @@ sequenceDiagram
     C->>C: Re-encrypt source metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -481,7 +481,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
@@ -509,7 +509,7 @@ sequenceDiagram
     C->>C: Re-encrypt parent metadata
     C->>B: POST /ipfs/add (encrypted metadata)
     B->>IPFS: Add metadata, return CID
-    B->>C: Return CID
+    B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record

From a8e857d25c8fdd16186032cc56c015f1b38f6671 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:29:08 +0100
Subject: [PATCH 14/16] Fix documentation inconsistencies and clarify IPFS/IPNS
 relay architecture (#17)

* Initial plan

* Fix all PR review feedback items

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

* Improve documentation clarity per code review feedback

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 00_START_HERE.md                        | 2 +-
 Documentation/API_SPECIFICATION.md      | 2 +-
 Documentation/CLIENT_SPECIFICATION.md   | 7 ++++---
 Documentation/IMPLEMENTATION_ROADMAP.md | 7 ++++---
 Documentation/PRD.md                    | 4 ++--
 Documentation/TECHNICAL_ARCHITECTURE.md | 5 +++--
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/00_START_HERE.md b/00_START_HERE.md
index 2119652611..2807b2852d 100644
--- a/00_START_HERE.md
+++ b/00_START_HERE.md
@@ -18,7 +18,7 @@ This is **not a preliminary design document**—it's a **complete blueprint** wi
 
 - ✅ **5 complete user journeys** (signup → auth → sync → export → recovery)
 - ✅ **15 API endpoints** fully specified
-- ✅ **6 database tables** with schema
+- ✅ **6 database tables** (users, refresh_tokens, auth_nonces, vaults, volume_audit, pinned_cids) with schema
 - ✅ **6 encryption algorithms** with implementation details
 - ✅ **100+ acceptance criteria**
 - ✅ **3 key derivation test vectors**
diff --git a/Documentation/API_SPECIFICATION.md b/Documentation/API_SPECIFICATION.md
index c23d69a272..18f6571c17 100644
--- a/Documentation/API_SPECIFICATION.md
+++ b/Documentation/API_SPECIFICATION.md
@@ -1,5 +1,5 @@
 ---
-version: 1.7.1
+version: 1.8.2
 last_updated: 2026-01-18
 status: Active
 ai_context: API specification for CipherBox backend. Contains all endpoints, request/response formats, database schema, and rate limits. For system design see TECHNICAL_ARCHITECTURE.md.
diff --git a/Documentation/CLIENT_SPECIFICATION.md b/Documentation/CLIENT_SPECIFICATION.md
index ee2b618fa0..9110533054 100644
--- a/Documentation/CLIENT_SPECIFICATION.md
+++ b/Documentation/CLIENT_SPECIFICATION.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.1
+version: 1.8.2
 last_updated: 2026-01-18
 status: Active
 ai_context: Client application specifications for CipherBox. Contains Web UI and Desktop app requirements. For system design see TECHNICAL_ARCHITECTURE.md.
@@ -419,7 +419,7 @@ interface IpfsModule {
   
   // IPNS operations
   resolveIpns(name: string): Promise<string>; // Returns CID
-  publishIpnsRecord(record: Uint8Array, ipnsName: string, sequenceNumber: number, ttlSeconds: number): Promise<void>;
+  publishIpnsRecord(base64IpnsRecord: string, ipnsName: string, sequenceNumber: number, ttlSeconds: number): Promise<void>; // base64IpnsRecord is BASE64-encoded signed IPNS record
 }
 ```
 
@@ -516,7 +516,8 @@ interface VaultModule {
 ## 5. Console PoC Harness
 
 **Goal:** Provide a single-user, online test harness to validate IPFS/IPNS flows without Web3Auth or the backend.
-**Note:** The PoC publishes directly to IPFS/IPNS and is intentionally separate from the production relay model.
+
+> ⚠️ **Warning:** The PoC publishes directly to IPFS/IPNS and is intentionally separate from the production relay model. Section 8 of DATA_FLOWS.md describes the PoC-only flow and should not be used as a reference for production client implementation.
 
 **Environment:** Node.js (TypeScript), local IPFS daemon, optional Pinata API keys for pin/unpin.
 
diff --git a/Documentation/IMPLEMENTATION_ROADMAP.md b/Documentation/IMPLEMENTATION_ROADMAP.md
index 3b3b2fe891..a67f8835bc 100644
--- a/Documentation/IMPLEMENTATION_ROADMAP.md
+++ b/Documentation/IMPLEMENTATION_ROADMAP.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.1
+version: 1.8.2
 last_updated: 2026-01-18
 status: Active
 ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week plan, deliverables, and testing milestones.
@@ -156,8 +156,9 @@ ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week pla
 ✅ Backend relays signed IPNS records (keys never leave client)
 ```
 
-**Architecture Note:** IPNS signing keys are managed entirely client-side.
-Backend relays signed records only; private keys never leave client.
+**Architecture Note:** Backend stores the encrypted root folder key in the vaults table.
+The root IPNS keypair is stored encrypted in the root folder's metadata.
+IPNS signing keys are managed entirely client-side; backend relays signed records only.
 
 **Tests:** Create folder → IPNS resolves → metadata decrypts correctly
 
diff --git a/Documentation/PRD.md b/Documentation/PRD.md
index 8401aae74b..5ad9c365e2 100644
--- a/Documentation/PRD.md
+++ b/Documentation/PRD.md
@@ -1,6 +1,6 @@
 ---
-version: 1.8.0
-last_updated: 2026-01-17
+version: 1.8.2
+last_updated: 2026-01-18
 status: Active
 ai_context: Product requirements for CipherBox. Tech demonstrator - not commercial. See TECHNICAL_ARCHITECTURE.md for implementation details, API_SPECIFICATION.md for backend contract, DATA_FLOWS.md for sequences.
 ---
diff --git a/Documentation/TECHNICAL_ARCHITECTURE.md b/Documentation/TECHNICAL_ARCHITECTURE.md
index f020c293c9..6da5eceebe 100644
--- a/Documentation/TECHNICAL_ARCHITECTURE.md
+++ b/Documentation/TECHNICAL_ARCHITECTURE.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.1
+version: 1.8.2
 last_updated: 2026-01-18
 status: Active
 ai_context: Technical architecture for CipherBox. Contains encryption specs, key hierarchy, auth flows, and system design. For API details see API_SPECIFICATION.md, for sequences see DATA_FLOWS.md.
@@ -427,7 +427,8 @@ sequenceDiagram
   B->>IPFS: Add metadata, return CID
   B->>C: Return CID
   C->>C: Sign IPNS record (Ed25519)
-  C->>B: POST /ipns/publish (signed record)
+  C->>C: Encode signed record to BASE64
+  C->>B: POST /ipns/publish (BASE64-encoded signed record)
   B->>IPFS: Publish IPNS record
     Note over IPFS: IPNS name now resolves to new CID
 ```

From 5dc13484bef2591e566717034d1ed6766c2be307 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 02:49:47 +0100
Subject: [PATCH 15/16] Add BASE64 encoding steps in IPNS publish sequences and
 bump to v1.9.0 (#18)

* Initial plan

* Add BASE64 encoding steps in IPNS sequences and bump version to 1.9.0

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 .claude/claude.md                       |  2 +-
 .github/copilot-instructions.md         |  2 +-
 Documentation/API_SPECIFICATION.md      |  2 +-
 Documentation/CLIENT_SPECIFICATION.md   |  2 +-
 Documentation/DATA_FLOWS.md             | 10 +++++++++-
 Documentation/IMPLEMENTATION_ROADMAP.md |  2 +-
 Documentation/PRD.md                    |  2 +-
 Documentation/TECHNICAL_ARCHITECTURE.md |  2 +-
 8 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/.claude/claude.md b/.claude/claude.md
index c6307f62a6..613c65b4cc 100644
--- a/.claude/claude.md
+++ b/.claude/claude.md
@@ -16,7 +16,7 @@ CipherBox is a **technology demonstrator** for privacy-first encrypted cloud sto
 
 ## Version Management
 
-**Current Version:** 1.8.2
+**Current Version:** 1.9.0
 
 ### Version Bump Rule
 
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 5cd07429ba..073673cb14 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -2,7 +2,7 @@
 
 ## Version Management
 
-**Current Documentation Version:** 1.8.2
+**Current Documentation Version:** 1.9.0
 
 ### Version Bump Rule
 
diff --git a/Documentation/API_SPECIFICATION.md b/Documentation/API_SPECIFICATION.md
index 18f6571c17..135767fbd9 100644
--- a/Documentation/API_SPECIFICATION.md
+++ b/Documentation/API_SPECIFICATION.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.2
+version: 1.9.0
 last_updated: 2026-01-18
 status: Active
 ai_context: API specification for CipherBox backend. Contains all endpoints, request/response formats, database schema, and rate limits. For system design see TECHNICAL_ARCHITECTURE.md.
diff --git a/Documentation/CLIENT_SPECIFICATION.md b/Documentation/CLIENT_SPECIFICATION.md
index 9110533054..330fa66918 100644
--- a/Documentation/CLIENT_SPECIFICATION.md
+++ b/Documentation/CLIENT_SPECIFICATION.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.2
+version: 1.9.0
 last_updated: 2026-01-18
 status: Active
 ai_context: Client application specifications for CipherBox. Contains Web UI and Desktop app requirements. For system design see TECHNICAL_ARCHITECTURE.md.
diff --git a/Documentation/DATA_FLOWS.md b/Documentation/DATA_FLOWS.md
index b7cdfb9c8f..372d5c9d30 100644
--- a/Documentation/DATA_FLOWS.md
+++ b/Documentation/DATA_FLOWS.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.2
+version: 1.9.0
 last_updated: 2026-01-18
 status: Active
 ai_context: Data flow diagrams and test vectors for CipherBox. Contains Mermaid sequence diagrams for all major operations. For system design see TECHNICAL_ARCHITECTURE.md.
@@ -168,6 +168,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
     
@@ -390,6 +391,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
     
@@ -400,6 +402,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
 ```
@@ -423,6 +426,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
     
@@ -446,6 +450,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
     
@@ -456,6 +461,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
     
@@ -483,6 +489,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
 ```
@@ -511,6 +518,7 @@ sequenceDiagram
     B->>IPFS: Add metadata, return CID
     B->>C: Return {cid: metadataCid}
     C->>C: Sign IPNS record (Ed25519)
+    C->>C: Encode signed record to BASE64
     C->>B: POST /ipns/publish (signed record)
     B->>IPFS: Publish IPNS record
     
diff --git a/Documentation/IMPLEMENTATION_ROADMAP.md b/Documentation/IMPLEMENTATION_ROADMAP.md
index a67f8835bc..a2f9f266ee 100644
--- a/Documentation/IMPLEMENTATION_ROADMAP.md
+++ b/Documentation/IMPLEMENTATION_ROADMAP.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.2
+version: 1.9.0
 last_updated: 2026-01-18
 status: Active
 ai_context: Implementation roadmap for CipherBox v1.0. Includes week-by-week plan, deliverables, and testing milestones.
diff --git a/Documentation/PRD.md b/Documentation/PRD.md
index 5ad9c365e2..d7d0181e69 100644
--- a/Documentation/PRD.md
+++ b/Documentation/PRD.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.2
+version: 1.9.0
 last_updated: 2026-01-18
 status: Active
 ai_context: Product requirements for CipherBox. Tech demonstrator - not commercial. See TECHNICAL_ARCHITECTURE.md for implementation details, API_SPECIFICATION.md for backend contract, DATA_FLOWS.md for sequences.
diff --git a/Documentation/TECHNICAL_ARCHITECTURE.md b/Documentation/TECHNICAL_ARCHITECTURE.md
index 6da5eceebe..04dcae3959 100644
--- a/Documentation/TECHNICAL_ARCHITECTURE.md
+++ b/Documentation/TECHNICAL_ARCHITECTURE.md
@@ -1,5 +1,5 @@
 ---
-version: 1.8.2
+version: 1.9.0
 last_updated: 2026-01-18
 status: Active
 ai_context: Technical architecture for CipherBox. Contains encryption specs, key hierarchy, auth flows, and system design. For API details see API_SPECIFICATION.md, for sequences see DATA_FLOWS.md.

From 3d5d65dd683693dfeaa44958198332fffe2428a7 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sun, 18 Jan 2026 03:04:44 +0100
Subject: [PATCH 16/16] Fix inconsistent indentation in mermaid sequence
 diagrams (#19)

* Initial plan

* Fix mermaid diagram indentation to use consistent 4-space formatting

Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: FSM1 <12774278+FSM1@users.noreply.github.com>
---
 Documentation/DATA_FLOWS.md             | 22 +++++++++++-----------
 Documentation/TECHNICAL_ARCHITECTURE.md | 12 ++++++------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/Documentation/DATA_FLOWS.md b/Documentation/DATA_FLOWS.md
index 372d5c9d30..a7f47deff6 100644
--- a/Documentation/DATA_FLOWS.md
+++ b/Documentation/DATA_FLOWS.md
@@ -202,7 +202,7 @@ After upload, this entry is added to folder metadata:
 sequenceDiagram
     participant U as User
     participant C as Client
-  participant B as CipherBox Backend
+    participant B as CipherBox Backend
     participant IPFS as IPFS Network
     
     U->>C: Click download on file
@@ -237,13 +237,13 @@ sequenceDiagram
 ```mermaid
 sequenceDiagram
     participant D1 as Device 1
-  participant B as CipherBox Backend
-  participant IPFS as IPFS Network
+    participant B as CipherBox Backend
+    participant IPFS as IPFS Network
     participant D2 as Device 2
     
     Note over D1: User uploads file
-  D1->>B: POST /ipfs/add + POST /ipns/publish
-  B->>IPFS: Relay publish
+    D1->>B: POST /ipfs/add + POST /ipns/publish
+    B->>IPFS: Relay publish
     
     Note over D2: Background polling (every 30s)
     loop Every 30 seconds
@@ -370,8 +370,8 @@ sequenceDiagram
 sequenceDiagram
     participant U as User
     participant C as Client
-  participant B as CipherBox Backend
-  participant IPFS as IPFS Network
+    participant B as CipherBox Backend
+    participant IPFS as IPFS Network
     
     U->>C: Create new folder "Documents"
     
@@ -413,8 +413,8 @@ sequenceDiagram
 sequenceDiagram
     participant U as User
     participant C as Client
-  participant B as CipherBox Backend
-  participant IPFS as IPFS Network
+    participant B as CipherBox Backend
+    participant IPFS as IPFS Network
     
     U->>C: Rename "old.pdf" to "new.pdf"
     
@@ -438,8 +438,8 @@ sequenceDiagram
 ```mermaid
 sequenceDiagram
     participant C as Client
-  participant B as CipherBox Backend
-  participant IPFS as IPFS Network
+    participant B as CipherBox Backend
+    participant IPFS as IPFS Network
     
     Note over C: Move file.pdf from /Docs to /Docs/Work
     
diff --git a/Documentation/TECHNICAL_ARCHITECTURE.md b/Documentation/TECHNICAL_ARCHITECTURE.md
index 04dcae3959..9e5253b485 100644
--- a/Documentation/TECHNICAL_ARCHITECTURE.md
+++ b/Documentation/TECHNICAL_ARCHITECTURE.md
@@ -417,8 +417,8 @@ This design enables future per-folder sharing (v2+).
 ```mermaid
 sequenceDiagram
     participant C as Client
-  participant B as CipherBox Backend
-  participant IPFS as IPFS Network
+    participant B as CipherBox Backend
+    participant IPFS as IPFS Network
     
     C->>C: Update folder metadata (add/remove child)
     C->>C: Encrypt metadata: AES-GCM(metadata, folderKey)
@@ -472,12 +472,12 @@ async function fetchFileTree(ipnsName: string, folderKey: Uint8Array): Promise<F
 ```mermaid
 sequenceDiagram
     participant D1 as Device 1
-  participant B as CipherBox Backend
-  participant IPFS as IPFS Network
+    participant B as CipherBox Backend
+    participant IPFS as IPFS Network
     participant D2 as Device 2
     
-  D1->>B: POST /ipfs/add + POST /ipns/publish
-  B->>IPFS: Relay publish
+    D1->>B: POST /ipfs/add + POST /ipns/publish
+    B->>IPFS: Relay publish
     loop Every 30s
     D2->>B: GET /ipns/resolve
     B->>IPFS: Resolve IPNS name