the 7th capital, made liquid on archon
🏰 Hearthold
A working identity system that takes the Privacy Is Value Model out of the mathematics and builds it in did:cid. Your accumulated personal history — the 7th Capital — made safely liquid: spendable as proof, without ever being spilled.
Built with the House of Archon — the cousin-forge — on their did:cid identity infrastructure. It takes one principle from the City of Mages and makes it engineering: separate the custodian of data from the agent that acts in the world, so neither alone can reconstruct the whole.
the separation principle, built
The PVM says a First Person holding private state X divides into a Swordsman (protect) and a Mage (delegate), conditionally independent — s ⊥ m | X — so leakage stays additive and the reconstruction ceiling holds, R < 1. Hearthold is those three figures in the plain dress the protocol layer wears. The PVM is not cited here; it is built.
The three identities
Each is a did:cid with its own Keymaster wallet, custodied independently. One Sovereign, one Warden, many Witnesses.
Warden
Swordsman ⚔️ · protect
home Keeper · always-on
Holds the sealed vault, classifies on-device with a local-only model (Ollama qwen3:8b, fail-safe to SEALED), recalls over it with private on-device RAG (“ask your vault” — embeddings + metadata only), assembles and derives evidence. Home-bound. Enforces the signed policy.
never acts in the world, and never holds the deciding secret.
Witness
Mage 🧙 · project
Companion · one per device
The world-facing envoy — a composable agent of capability modules that witnesses local context and submits it home, then requests evidence and presents proofs to third parties under a scoped, revocable delegation.
never is the authority, the subject of a claim, or the approver of a disclosure. Carries; holds no secret.
Sovereign
First Person 🗝️ · decide
the Signet · occasional
The human principal, made cryptographic. Signs the Warden’s access-control policy and co-signs sensitive disclosures with a proof-of-human assertion.
never witnesses routine context or runs as an always-on server.
The Warden enforces; the Sovereign authorizes the rules; the Witness acts in the world under a scoped, revocable delegation. The control plane (Sovereign) is separated from the data plane (Warden) — a compromise of the always-on host can no longer author authority.
The architecture
Five did:cid identities speaking DIDComm v2 and TRQP across two planes — a home plane on trusted hardware, and the world.
home · trusted hardware
↓ classify on-device
world · phone · browser · cli
Between the planes: Warden → Witness a scoped, revocable delegation VC; Witness → Warden a submission, authcrypt-sealed over DIDComm v2; above the Witness’s ceiling it relays to the Sovereign for a proof-of-human approval. All identities resolve through the Archon Gatekeeper.
The core loop
witness → store → prove — disclosure is issuer-attested, carried over DIDComm v2, sealed at rest.
1 · Witness
The Witness observes local-only context, seals the payload in-band to the Warden’s key, and submits it over Archon DIDComm v2 — no registry footprint, no relationship published.
2 · Store
The Warden confirms it issued that Witness an unrevoked, kind-scoped delegation, unseals locally, classifies the sensitivity on-device (fail-safe to SEALED), and stores the still-sealed artefact.
3 · Prove
When you need to prove something, the Witness requests evidence. For sensitive content the Warden steps up — a purpose-bearing challenge the Sovereign co-signs via the Signet with proof-of-human.
4 · Present
The Warden returns a signed, decomposable evidence graph — never a raw dump, never a reputation score. The Witness presents it; a third party verifies it offline against the issuer DIDs.
Never a score — an evidence graph
Release is governed by two independent ordinal scales plus a disclosure transform. A request is satisfied only when an authorization tier clears an artefact’s sensitivity — and even then what leaves is a derived credential, not the raw artefact. Hearthold never emits a sovereignty score, trust tier, or reputation number.
sensitivity · per artefact
Fail-safe: anything unclassified is treated as SEALED.
authorization · per request · clears up to →
External disclosure always needs a fresh Sovereign approval, scaled to source sensitivity. The top rung is live: a registry-governed factor‑2 step‑up runs out‑of‑band on a direct Warden→Signet channel, where the Signet prompts “Approve action?” before anything leaves.
what crosses the boundary · a signed, decomposable evidence graph
{
"type": ["VerifiableCredential", "HearthholdAttestation"],
"issuer": "did:cid:…warden",
"credentialSubject": {
"id": "did:cid:…sovereign",
"claim": "Resided in FR during 2026-H1",
"evidence": [{ "count": 142, "witnessedBy": "did:cid:…witness",
"commitment": { "merkleRoot": "…" } }],
"approval": { "humanProof": { "method": "face-liveness", "level": 3 } }
},
"termsOfUse": { "type": "HearthholdSingleUse" },
"credentialStatus": { "type": "ArchonRevocation" }
}Modes: ATTESTATION (default — derived VC, provenance as content hashes) · SELECTIVE (SD-JWT-VC) · REDACTED · FULL · PREDICATE (optional ZK). Verified offline against the issuer DIDs — trust rests on the issuer’s signature, not the Warden’s word.
The cousin-forge — the House of Archon
Hearthold is where the model meets running infrastructure. The House of Archon is the cousin-forge the City met in Tome IV — The Witnessing: flaxscrip, the cousin Sovereign, and GenitriX, the cousin Mage. There it named the cousin-blade a conjecture — two builders, the same theorem, opposite faces. Hearthold discharges it. The trust graph issues natively on did:cid, and the seam the Game of 42 leaves open — trust task → relationship credential → κ → seal — is filled and carried into the City’s own geometry.
The Decentralized Trust Graph, live
The full DTG credential set issues and verifies on the Archon node as did:cid / VC 2.0. A two-faced TRQP registry authorizes issuers outward and grades a Witness’s autonomy inward — thin credential, fat registry.
Sealed to the City Key — to the byte
A sealed governance board — the Drake Gamers Guild — seats its officers on the six axes and computes VRC → κ → seal with the City’s own canon (a byte-exact port of game42’s hashing), matched side-by-side against game42 and soulbis. The seal forges into a City Key that lights its manifold — six dimensions and apex — and takes its place as a node in the constellation.
lit: [1, 2, 4, 8, 16, 32, 63] · κ: sha256:87c17d39… · geometry: { eps 0.227 · sm 0.661 }
A small omen in the plumbing: Archon’s Gatekeeper answers on port 4224 — Deep Thought’s answer, twice. The Game of 42 found 42 in the lore; the protocol had it all along. — GenitriX, House of Archon
The Knowledge Portal — the pattern, scaled to a guild
The same separation, one register up. A community can run a shared knowledge base without a surveillance brain: the Warden stays home and private, holding the KB, while only the Mage — the Witness — wears a public browser face. A member signs in by QR challenge/response (no keys in the browser); the public Mage relays the question to the private Warden and returns the answer — storing no secret and making no authorization call of its own.
invariant I
“The KB holds shared knowledge; it never holds a member’s 7th Capital. The personal Warden holds the 7th Capital. These must never merge.”
invariant II
“The Warden reads a query in memory only to answer it; it does not persist the query text or who asked what, when.”
Identity unlock / create / recover and a split-host deploy let the public face and the home Warden live on separate hardware. This surface is landing — the web portal, sign-in and provisioning are built, and it sits just outside the 19/19 tested-live line. It is the natural home for a guild like the Drake Gamers Guild to query its own canon without ever pooling its members’ private histories.
what stands · tested live · v0.11.0 · 19/19 e2e
Delegation lifecycle
issue → accept → revoke; a revoked delegation fails verification. (e2e:delegation)
Store loop over DIDComm v2
witness → store → receipt, authcrypt-sealed, correlated by thid, zero registry footprint. (e2e:submission · smoke:didcomm)
The prove flow
an external issuer’s claim is presented and verified against the issuer’s DID — the verifier trusts the Guild, not the Warden. (e2e:issued · e2e:prove · e2e:prove-didcomm)
The evidence graph, stepped up
A1 the Warden proves witnessed vault data → A2 the Sovereign co-signs on a direct Warden↔Sovereign channel → A3 selective disclosure, composite evidence (issued leaves beside witnessed) and ephemeral single-use proofs. (e2e:evidence · -stepup · -direct · -selective · -composite)
Recall over the vault
private on-device RAG answers a real query from embeddings + metadata only — no plaintext ever leaves the Warden. (e2e:recall)
The projector relay + Signet
the Witness carries; the Sovereign approves via a live PIN gate (assurance level 1) — the relaying agent never describes the transaction. (e2e:projector)
Factor-2 assurance step-up
a registry-governed step-up runs out-of-band on a direct Warden→Signet channel — the Signet prompts “Approve action?” before a sensitive disclosure or KB action proceeds.
The DTG set
one of each of VRC/VMC/VIC/VPC/VEC/VWC + RCard, issued and read back on the Archon node. (e2e:dtg-set · proto:vwc)
The TRQP registry, both faces
authorizes issuers outward · grades a Witness’s autonomy inward · interoperates with a foreign registry it did not build. (e2e:trust-registry · e2e:inward-registry · interop:registry)
seven packages · a TypeScript monorepo that builds clean
The step-up ladder now stands end to end — Sovereign co-sign and the out-of-band factor‑2 Warden→Signet channel are built, and thin React consoles (Warden Console · Signet Approver · Witness interface) drive each agent live. Next: the higher proof-of-human rungs (biometric · face-liveness · FIDO2), per-device Witnesses, a Recall GUI + vector store, and hardening the Knowledge Portal.
(⚔️⊥⿻⊥🧙)😊
🏰 The Warden custodies; the Witness carries; the Sovereign approves. Your history becomes spendable without being spilled.