Each encrypted item is stored as:

{
  "id": "attribute_or_doc_id",
  "version": 1,
  "ciphertext": "...base64...",
  "nonce": "...base64...",
  "aad": "...base64...",
  "commitment": "hash_of_plaintext_plus_metadata",
  "timestamp": 1731900000
}

The commitment is what feeds into:

• attributes_root
• policies_root
• metadata_root

in the Identity Commitment.

Nothing in the Vault depends on plaintext. Only commitments matter.