engine · people
Your keys and devices, and the proposals the change ceremony puts on the record.
This instance — what it is doing and where secrets are handed in. Rooms — encrypted groups this device is a member of.
About your own keys
A device was added with the recovery paper
If this was you, the paper is used up: replace it below. If it was not you, someone has your paper. Remove that device from the list below, then replace the paper.
Someone's keys changed
The record shows different keys for the people below than this browser saw before. Nothing else on this page works until you have read each change. Accept it only if the person told you about it.
Invitations open with the next release. Until then this page makes no invitation and takes none: a person who is already enrolled keeps their keys here, and a new device of theirs joins them below.
Make a test person
For a throwaway test partner only. Such a person is not vouched for by your key chain and will not be seated once this instance enforces chains. Real invitations return with the guest release. This files the ordinary proposal for a one-time enrolment link: you confirm it below, press Execute — mint the link if it is offered, and hand the link over once. The link is a secret until it is used; send it only to the person it is for.
Add a device
Your phone is not a second person; it is a second key of yours.
On the new browser, open the people page and press Join my keys: type
the first-key code this device shows under Your first key. That
browser then shows a code, as text and as a QR. Paste it here (or read the QR
and paste what it says), check that the short fingerprint below is the one
that browser shows, and press Add: this browser signs one
kernel/key add for your own actor that names your first key, with
the new key's own signature that it joins that first key. Nothing secret
travels: what you carry over is a public key and a signature.
Short fingerprint of the key in the code you pasted.
The new browser shows this same fingerprint beside its code. If the two differ, something changed the code between the screens: stop, and start again on that browser.
Added. The other browser can now take its seat. It finds this public key at the door, opens its own verified session, publishes its own key package, and your rooms seat it the next time you open one.
Your devices
Every key the record knows for your own actor, folded from the same
kernel/key events identity folds — added, rotated, or
revoked, oldest first, excluding a key after it is superseded. Revoking a key
does not remove it from any room it already holds a leaf in — a
revoked key opens no new session and seats no new leaf, but leaves it
already holds keep reading until something removes them, which this list
offers once you revoke.
Keys and chains
A person's keys are in their chain when each was added by a key already in it, back to the first key shown. Whether that first key is the person's is a separate thing, said on the line under each name. A key the host added is shown as not chained. Models and services are keyed by the host and say so. This browser remembers what it saw of a person once it has a first key to go by, and tells you when it changes; it cannot tell you what the host never showed it.
What this does not protect. This page and its code come from the host. A host that serves an altered page can show you any chain it likes and can take what you type, the recovery paper included. The first time you meet a person, this browser can only show you the first key the record has for them: it does not yet know who vouches for them. Check their first-key code with them yourself. This browser cannot see what the host does not show it. A key withdrawn a minute ago, or an invitation taken back, can be hidden from a browser that has not seen it yet. The instance's own daemon holds a seat in every room that holds a call. It is kept from listening by the instance's rules, not by cryptography. Whoever holds your recovery paper can add a device as you. Whoever holds one of your unlocked devices is you until you withdraw it.
Your first key and recovery paper
Take this code to your other device. Paste it into Add a device there, or read the QR; then compare the short fingerprint.
Short fingerprint:
Write this on paper, all of it, and keep the paper where only you can find it. It is shown here once. It is never saved or sent anywhere. Whoever holds it can take over your account, and without it and every device you lose the account.
People and their grants
Every actor the record knows, and the grants each one holds: a capability
directly granted (kernel/capability), a group's own
group-admin for its creator (kernel/group-created,
ruling group-admin), or a subset lent by another actor
(kernel/delegation). The same fold identity's own holds reads
(kernel/identity/src/view.go) — a second reading of it, not a second
source of truth. Newest actor first.
Proposals
Every change that needs a second pair of hands passes through here: someone
proposes, a confirm holder approves, and the proposer executes.
Confirm is all this page does for a proposal — except an invite you proposed,
which it executes the moment it is confirmed, to mint the one-time link.
One-time enrollment link for .
Hand it to them over a channel you trust. It carries the enrollment token, it opens once, and it is shown here once — this page stores it nowhere and cannot show it again.
Board
Every clerk/task and clerk/task-move on the record, folded the way
modules/clerk/src/view.go folds them for the clerk's own read-only view — the board
the confirmed drafts above came from. The clerk itself is door: false (ruling
clerk-shape) and a browser cannot reach it; this is a second reading of the same
facts the record already carries, never a second source of truth. A title and a state are
structural and show once this session reads the record at all; a task's longer description, when
it has one, is a blob in store (rule 7) and shows only when this actor also holds
store-read.
Results
Every kernel/result on the record: what a declared sink did,
and the route it acted under (rule 8, ruling grant-route-and-result).
A result names predicates, never data — nothing here is
personal. Newest first.
| When | Sink | Outcome | Kind | Route | Command | Matched |
|---|