GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

docs: sealed-motion Mind key lives at /var/lib/mind-<persona>, registered only after a Persona-shell self-test

Browse source 
The /etc/gamecult/minds path is not visible to Persona shells. The settled path is
/var/lib/mind-<persona>/sealed-motion.key, 0400, owned by mind-<persona>, which is also the signer.
A key is registered only after the Persona shell signs a throwaway envelope that verifies
against the printed public half (gamecult-ops scripts/verify-sealed-motion-key.sh).
Docs only; tools/sealed-motion-sign.mjs names no path.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Heimdall 2026-11-09 22:21:40 +00:00
commit b2dc593bc2
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/sealed-ballot-motion.md
View file

@ -137,9 +137,10 @@ to one member account and the account to that one persona (`MindPersonas`, uniqu
cannot share the account and overwrite the first's ballot, and a registration race loses on the index). The trust is the moderator's: Bifrost cannot tell whether a registered public
key really belongs to the Mind.
**What a Mind holds.** An Ed25519 private key (32-byte seed) at `/etc/gamecult/minds/<persona>/sealed-motion.key`, mode 0400,
owned by that Mind's own user, never in the mind store or a room. Eureka generates it on the host and prints only the public
half; a moderator registers it. **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot.
**What a Mind holds.** An Ed25519 private key (32-byte seed) at `/var/lib/mind-<persona>/sealed-motion.key`, mode 0400,
owned by `mind-<persona>`, the Persona user, which is also the signer; never in the mind store or a room. Eureka generates it on the host and prints only the public
half. A moderator registers that public half only after the Persona shell, running as `mind-<persona>`, has signed a throwaway test
envelope that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot.
**Signing.** `tools/sealed-motion-sign.mjs` (`pubkey`, `commit`, `reveal`) reads the key file, checks its type, mode and owner,
and prints the envelope; it posts nothing. `commit` also prints the ballot (candidate, reason, salt), which the Mind keeps in