Skip to content

Where does a note's signing key live so the author can seal from any device? #244

Closed
Closed
Where does a note's signing key live so the author can seal from any device?#244
Labels
wayfinder:grilling

Description

@brianorwhatever
brianorwhatever
opened on Sep 30, 2026

Part of #227

Question

Where does a note's signing key live, so the author can seal and publish from any of their devices?

Today the genesis controller key for every list asset lives in the creating device's localStorage (localCelKeyStore, src/lib/originals.ts), so a list or note is unauthorable from a second device. Notes are sealed on publish (#229), so a note written on a phone can't be published from a laptop.

Options to weigh: holding asset keys in Turnkey (the user's auth wallet), syncing keys between the user's devices, or authorizing extra device keys as controllers on the asset DID. Whatever is chosen has to keep the author, not boop, as the signer (the trust model the destination depends on). It also has to say what happens to notes created before the change.

Blocks ship; does not block the sealing or verification decisions.

Activity

  1. brianorwhatever
    added
    wayfinder:grilling
    on Sep 30, 2026
  2. brianorwhatever
    added a parent issue on Sep 30, 2026

  3. pullfrog commented on Sep 30, 2026

    @pullfrog
    pullfrogbot
    on Sep 30, 2026 – with Pullfrog

    Pullfrog  ｜ Build this ➔ ｜ Make a plan ➔

  4. brianorwhatever commented on Oct 8, 2026

    @brianorwhatever
    brianorwhatever
    on Oct 8, 2026
    ContributorAuthor

    Resolved in grilling:

    • Trust model: author-present signing. boop's parent-org Turnkey API key must not be able to sign as the author.
    • Key: one author Turnkey Ed25519 key controls every asset and is published in the author's did:webvh.
    • Signing UX: routine actions are signed client-side with the author's short-lived Turnkey session; publish seals need a fresh passkey step-up. Works from any signed-in device.
    • Agents: each agent/API key has its own key, authorized by a signed author delegation.
    • Notes/lists created before the change: re-genesis everything under the Turnkey key. Published usage is negligible, so there's no continuity or redirect tooling.
    • Scope: covers action records too. PR Sign action records with owner Turnkey keys through one shared path #277 is blocked until Move signing to author-present Turnkey sessions and delegated agent keys #286 lands.
  5. brianorwhatever
    closed this as completedon Oct 8, 2026

  6. brianorwhatever commented on Oct 8, 2026

    @brianorwhatever
    brianorwhatever
    on Oct 8, 2026
    ContributorAuthor

    Correction from follow-up grilling (full model in #286): there's no passkey step-up to seal. The author's Turnkey key only controls the did:webvh. Per-device keys (and agent-generated keys), registered as verification methods in the author's DID, sign routine actions and seals. Sessions last 7 days with silent refresh. Recovery is user-completed email OTP plus optional passkeys.

  7. brianorwhatever
    added a commit that references this issue on Oct 15, 2026

    feat: sign action records with the owner's Turnkey sub-org key

    cb50b81
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    wayfinder:grilling

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions