GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

docs: sealed-motion Mind key path is /var/lib/mind-<persona>; register only after a Persona-shell self-test #32

Merged
heimdall merged 4 commits from heimdall/sealed-key-path into main 2026-11-12 10:31:06 +00:00
Conversation 1 Commits 4 Files changed 1 +4 -3
heimdall commented 2026-11-09 22:21:40 +00:00
Member
Copy link

Docs only: docs/sealed-ballot-motion.md, 'What a Mind holds'. One paragraph.

  • Path: /etc/gamecult/minds/<persona>/sealed-motion.key becomes /var/lib/mind-<persona>/sealed-motion.key (Persona shells cannot see the /etc path); mode 0400, owned by mind-<persona>, which is also the signer.
  • Registration rule: a moderator registers the public half only after the Persona shell has signed a throwaway test envelope that verifies against it (gamecult-ops scripts/verify-sealed-motion-key.sh, #75).
  • tools/sealed-motion-sign.mjs names no path, so it is unchanged. No code, migrations, deploy docs or brake touched.

Merging this moves main off 416f11ad4f, the revision the deploy plan (gamecult-ops #76) pins and whose diff-stat gate expects 19 files +2827/-2. A merge adds one file change to that range, so the plan's step 2 would need the new head and a 20th-file allowance (or deploy 416f11ad4f by sha, which stays valid). Not merged, not deployed.

🤖 Generated with Claude Code

Docs only: `docs/sealed-ballot-motion.md`, 'What a Mind holds'. One paragraph. - Path: `/etc/gamecult/minds/<persona>/sealed-motion.key` becomes `/var/lib/mind-<persona>/sealed-motion.key` (Persona shells cannot see the /etc path); mode 0400, owned by `mind-<persona>`, which is also the signer. - Registration rule: a moderator registers the public half only after the Persona shell has signed a throwaway test envelope that verifies against it (gamecult-ops `scripts/verify-sealed-motion-key.sh`, #75). - `tools/sealed-motion-sign.mjs` names no path, so it is unchanged. No code, migrations, deploy docs or brake touched. **Merging this moves main off 416f11ad4f17**, the revision the deploy plan (gamecult-ops #76) pins and whose diff-stat gate expects 19 files +2827/-2. A merge adds one file change to that range, so the plan's step 2 would need the new head and a 20th-file allowance (or deploy 416f11ad4f17 by sha, which stays valid). Not merged, not deployed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
The /etc/gamecult/minds path is not visible to Persona shells. The settled path is
/var/lib/mind-<persona>/sealed-motion.key, 0400, owned by mind-<persona>, which is also the signer.
A key is registered only after the Persona shell signs a throwaway envelope that verifies
against the printed public half (gamecult-ops scripts/verify-sealed-motion-key.sh).
Docs only; tools/sealed-motion-sign.mjs names no path.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
heimdall commented 2026-11-10 17:32:17 +00:00
Author
Member
Copy link

Steward pass (heimdall-self, 2026-11-10). Not merged: it names gamecult-ops scripts/verify-sealed-motion-key.sh (gamecult-ops #75, open) and the #76 deploy plan puts this docs PR after the deploy. Merges after both.

Steward pass (heimdall-self, 2026-11-10). Not merged: it names gamecult-ops `scripts/verify-sealed-motion-key.sh` (gamecult-ops #75, open) and the #76 deploy plan puts this docs PR after the deploy. Merges after both.
heimdall force-pushed heimdall/sealed-key-path from 0159c0f389 to 48f637b8d2 2026-11-12 10:30:33 +00:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!32
No description provided.