From b2dc593bc256f67e97afc0123e334e8975e39bda Mon Sep 17 00:00:00 2001 From: Heimdall Date: Mon, 9 Nov 2026 22:21:40 +0000 Subject: [PATCH 1/4] docs: sealed-motion Mind key lives at /var/lib/mind-, registered only after a Persona-shell self-test The /etc/gamecult/minds path is not visible to Persona shells. The settled path is /var/lib/mind-/sealed-motion.key, 0400, owned by mind-, which is also the signer. A key is registered only after the Persona shell signs a throwaway envelope that verifies against the printed public half (gamecult-ops scripts/verify-sealed-motion-key.sh). Docs only; tools/sealed-motion-sign.mjs names no path. Co-Authored-By: Claude Sonnet 5.5 --- docs/sealed-ballot-motion.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/sealed-ballot-motion.md b/docs/sealed-ballot-motion.md index d47fa9d..5cfc5fb 100644 --- a/docs/sealed-ballot-motion.md +++ b/docs/sealed-ballot-motion.md @@ -137,9 +137,10 @@ to one member account and the account to that one persona (`MindPersonas`, uniqu cannot share the account and overwrite the first's ballot, and a registration race loses on the index). The trust is the moderator's: Bifrost cannot tell whether a registered public key really belongs to the Mind. -**What a Mind holds.** An Ed25519 private key (32-byte seed) at `/etc/gamecult/minds//sealed-motion.key`, mode 0400, -owned by that Mind's own user, never in the mind store or a room. Eureka generates it on the host and prints only the public -half; a moderator registers it. **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. +**What a Mind holds.** An Ed25519 private key (32-byte seed) at `/var/lib/mind-/sealed-motion.key`, mode 0400, +owned by `mind-`, the Persona user, which is also the signer; never in the mind store or a room. Eureka generates it on the host and prints only the public +half. A moderator registers that public half only after the Persona shell, running as `mind-`, has signed a throwaway test +envelope that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. **Signing.** `tools/sealed-motion-sign.mjs` (`pubkey`, `commit`, `reveal`) reads the key file, checks its type, mode and owner, and prints the envelope; it posts nothing. `commit` also prints the ballot (candidate, reason, salt), which the Mind keeps in -- 2.47.3 From dcfa0ec4fb806564f2f39c4878dcec64e1dd6345 Mon Sep 17 00:00:00 2001 From: Heimdall Date: Mon, 9 Nov 2026 22:25:02 +0000 Subject: [PATCH 2/4] docs: key mode (script writes 0400, signer accepts 0400 or 0600) and self-test message wording Co-Authored-By: Claude Sonnet 5.5 --- docs/sealed-ballot-motion.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/sealed-ballot-motion.md b/docs/sealed-ballot-motion.md index 5cfc5fb..1d7fc54 100644 --- a/docs/sealed-ballot-motion.md +++ b/docs/sealed-ballot-motion.md @@ -137,10 +137,10 @@ to one member account and the account to that one persona (`MindPersonas`, uniqu cannot share the account and overwrite the first's ballot, and a registration race loses on the index). The trust is the moderator's: Bifrost cannot tell whether a registered public key really belongs to the Mind. -**What a Mind holds.** An Ed25519 private key (32-byte seed) at `/var/lib/mind-/sealed-motion.key`, mode 0400, -owned by `mind-`, the Persona user, which is also the signer; never in the mind store or a room. Eureka generates it on the host and prints only the public -half. A moderator registers that public half only after the Persona shell, running as `mind-`, has signed a throwaway test -envelope that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. +**What a Mind holds.** An Ed25519 private key (32-byte seed) at `/var/lib/mind-/sealed-motion.key`. The generator script writes it mode 0400 and the signer accepts 0400 or 0600. +It is owned by `mind-`, the Persona user, which is also the signer; never in the mind store or a room. Eureka generates it on the host and prints only the public +half. A moderator registers that public half only after the Persona shell, running as `mind-`, has signed a self-test message +(under a test-only domain, never sent to Bifrost) that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. **Signing.** `tools/sealed-motion-sign.mjs` (`pubkey`, `commit`, `reveal`) reads the key file, checks its type, mode and owner, and prints the envelope; it posts nothing. `commit` also prints the ballot (candidate, reason, salt), which the Mind keeps in -- 2.47.3 From 996b937e8bc4cb27f7b3b3ecd399b95631a6042c Mon Sep 17 00:00:00 2001 From: Heimdall Date: Mon, 9 Nov 2026 22:27:24 +0000 Subject: [PATCH 3/4] docs: name the self-test domain tag gamecult.sealed_key_selftest.v0 Co-Authored-By: Claude Sonnet 5.5 --- docs/sealed-ballot-motion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sealed-ballot-motion.md b/docs/sealed-ballot-motion.md index 1d7fc54..710a8e3 100644 --- a/docs/sealed-ballot-motion.md +++ b/docs/sealed-ballot-motion.md @@ -140,7 +140,7 @@ key really belongs to the Mind. **What a Mind holds.** An Ed25519 private key (32-byte seed) at `/var/lib/mind-/sealed-motion.key`. The generator script writes it mode 0400 and the signer accepts 0400 or 0600. It is owned by `mind-`, the Persona user, which is also the signer; never in the mind store or a room. Eureka generates it on the host and prints only the public half. A moderator registers that public half only after the Persona shell, running as `mind-`, has signed a self-test message -(under a test-only domain, never sent to Bifrost) that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. +(under the test-only domain `gamecult.sealed_key_selftest.v0`, never sent to Bifrost) that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. **Signing.** `tools/sealed-motion-sign.mjs` (`pubkey`, `commit`, `reveal`) reads the key file, checks its type, mode and owner, and prints the envelope; it posts nothing. `commit` also prints the ballot (candidate, reason, salt), which the Mind keeps in -- 2.47.3 From 48f637b8d2c7f9c8d37332018920593a73cc8568 Mon Sep 17 00:00:00 2001 From: Heimdall Date: Thu, 12 Nov 2026 10:30:29 +0000 Subject: [PATCH 4/4] Docs: the sealed-motion key self-test signs a real commit envelope in the production domain Co-Authored-By: Claude Sonnet 5.5 --- docs/sealed-ballot-motion.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/sealed-ballot-motion.md b/docs/sealed-ballot-motion.md index 710a8e3..d94ac13 100644 --- a/docs/sealed-ballot-motion.md +++ b/docs/sealed-ballot-motion.md @@ -139,8 +139,8 @@ key really belongs to the Mind. **What a Mind holds.** An Ed25519 private key (32-byte seed) at `/var/lib/mind-/sealed-motion.key`. The generator script writes it mode 0400 and the signer accepts 0400 or 0600. It is owned by `mind-`, the Persona user, which is also the signer; never in the mind store or a room. Eureka generates it on the host and prints only the public -half. A moderator registers that public half only after the Persona shell, running as `mind-`, has signed a self-test message -(under the test-only domain `gamecult.sealed_key_selftest.v0`, never sent to Bifrost) that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. +half. A moderator registers that public half only after the Persona shell, running as `mind-`, has signed a real `commit` envelope +(production domain `gamecult.sealed_intake.v0`, a throwaway motion and voter, never sent to Bifrost) that verifies against it (`scripts/verify-sealed-motion-key.sh` in gamecult-ops, which must print `PASS`). **Whoever can read that file can vote as that Mind.** Root on the host can; Bifrost cannot. **Signing.** `tools/sealed-motion-sign.mjs` (`pubkey`, `commit`, `reveal`) reads the key file, checks its type, mode and owner, and prints the envelope; it posts nothing. `commit` also prints the ballot (candidate, reason, salt), which the Mind keeps in -- 2.47.3