File format

asciinema v2 cast

Recordings are asciinema v2 cast files: UTF-8, JSON-lines.

{"version":2,"width":80,"height":24,"timestamp":1779776263,"command":"/bin/bash","env":{"SHELL":"/bin/bash","TERM":"xterm-256color"}}
[0.131000, "o", "hello\r\n"]

The first line is a header; each subsequent line is an event: [time_seconds, "o", data].

Local (plaintext) recordings are directly inspectable and interoperable:

asciinema cat 20260526T145029-1413696.cast
asciinema play 20260526T145029-1413696.cast

TTEC encrypted framing

Central recordings are the same cast, wrapped in Ghost Shell's at-rest encryption. On disk they are opaque — the only readable content is the magic prefix:

The framing, as verified in the technical audit:

• AES-256-GCM, applied per frame — one frame per write, frames up to 1 MiB, so a multi-hundred-MB session is never held whole in memory.
• A fresh random 96-bit nonce per frame, stored inline, never derived from the frame counter.
• The AAD binds the stream ID and frame index, so frames cannot be reordered or spliced between recordings.
• Corruption, a wrong key, or truncation surface as clean errors — no panics, no partial garbage presented as valid.

The key lives at /var/lib/ghostshell/.ghostshell.key (root:root 0600, immutable) — see the security model for the key lifecycle and its caveats.

Working with encrypted casts

You never decrypt by hand. play, search, and tail decrypt transparently; to get a standard plaintext cast for other tools, use export:

sudo ghostshell export -o session.cast 20260526T151022-1426734
asciinema play session.cast

Note: Trace-shim spans (the data behind ghostshell tree <id>) are encrypted at rest with the same key as the recordings.