Identity / HMR
Genesis of a
Human Root
Every chain of agent accountability begins here: one human, one ceremony, one sealed key. Six phases, fully offline.
Entropy Collection
256 bits from CSPRNG
Collecting cryptographically secure entropy from the operating system. Sources: /dev/urandom, SecRandomCopyBytes, BCryptGenRandom. On hardware with a TPM, additional entropy is mixed.
Key Pair Generation
Ed25519 (Curve25519)
The Ed25519 key pair is generated from the seed. The private key never leaves the sealed storage boundary. All operations are constant-time. Uses ed25519-dalek with ZeroizeOnDrop.
DID Derivation
Multibase base58btc z-prefix
The DID identifier is derived from the public key by multibase-encoding. The DID URI includes the namespace and hmr entity kind.
Document Construction
JCS canonicalization
The DID document is assembled with verification method, authentication relationship, and optional service endpoints. Self-signed with JCS canonical serialization.
Sealed Storage
Platform-specific enclave
The private key is encrypted and stored in platform-specific sealed storage. Secure Enclave on macOS/iOS. Kernel keyring on Linux. Never written to disk in plaintext. Memory zeroized on drop.
DHT Publication
Weave DHT replication
The signed DID document is published to the Weave DHT for global resolution. Replicated across multiple nodes. Publication is optional for fully offline-verifiable identities.