harden: veil credential units, CSPRNG secrets, persist signing key (E1) #9

Merged

PerishFire merged 1 commit from e1 into main 2026-07-17 07:24:10 +00:00

Conversation 0 Commits 1 Files changed 8 +186 -46

PerishFire commented 2026-07-17 07:21:40 +00:00

Owner

Copy link

No description provided.

PerishFire added 1 commit 2026-07-17 07:21:40 +00:00

harden: veil credential units, CSPRNG secrets, persist signing key (E1) ... 55414a4ce2

Consumes keel 0.1.15. Pass/Rescue/Renew/Invite (and gate Token/Session)
are veiled off the wire — closes the confirmed self-mint bypass. Invite
issuance becomes a /invite ceremony with a server-CSPRNG code. wild()
draws 256 bits from getrandom. The ES256 key is genesis-born and
persisted, not ephemeral. Act 5 proves no credential is wire-authorable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PerishFire merged commit 56c1468c41 into main 2026-07-17 07:24:10 +00:00

PerishFire deleted branch e1 2026-07-17 07:24:11 +00:00

PerishFire referenced this pull request from a commit 2026-07-17 07:24:12 +00:00

harden: veil credential units, CSPRNG secrets, persist signing key (E1) (#9)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

PerishLab/ensign!9

No description provided.