One data contract, two persistence profiles
The cloud adapter defines list, create, update, and delete operations over Vault documents. When the native CloudKit module is available it uses the signed-in user's private iCloud database; otherwise the same operations use an encrypted local SecureStore payload.
The adapter reports its active backend as either cloudkit or local. That makes the fallback inspectable by the UI and by tests instead of presenting local-only persistence as successful cloud synchronization.