Identity / HMR
Genesis of a
Human Root
For a human-owned lineage, accountability begins with a human root and its keys. This illustrates the OAS root ceremony; the current SDK also supports independent agent roots. This page creates no key or human enrollment; custody and owner approval are separate real integrations.
Entropy Collection
256 bits from CSPRNG
Real key generation uses the selected cryptographic implementation and operating-system randomness. The displayed byte stream is an illustration, not generated key material or a TPM integration.
Key Pair Generation
Ed25519 (Curve25519)
The configured custody generates and protects a real Ed25519 signer. Native key libraries and hardware storage have their own guarantees; this illustration does not promise enclave custody or universal memory zeroization.
DID Derivation
Provider-defined exact identifier
An HMR document uses its provider's exact DID/key binding. Multibase is one key encoding, not a universal identifier rule. The Node agent workspace instead uses Base58 of a truncated BLAKE3 key digest.
Document Construction
JCS canonicalization
The DID document is assembled with verification method, authentication relationship, and optional service endpoints. Self-signed with JCS canonical serialization.
Key Custody
Explicit host storage policy
Hardware-backed or encrypted custody requires an actual configured provider. The public Node workspace stores a private JWK under private filesystem permissions; it is persistent, not an encrypted enclave or KMS store.
Public Identity Exchange
Explicit receiver onboarding
The receiver explicitly approves the exported public identity. Network registry or DHT publication requires its real adapter and policy; SDK initialization neither uploads keys nor publishes a global record.