Upstream notes for Hearthold · role mapping · evidence-only profile · the licence seam
Upstream notes for Hearthold
Role mapping · an evidence-only profile · the licence seam
From privacymage, upstream author of the Privacy Value Model and City of Mages. A single consolidated note for Flaxscrip — usable as a PR description or Discussion post. The three sections below can also be split back into standalone docs under docs/agentprivacy/ and adopted, amended, or rejected piece by piece.
Cover note
First, the thing rarely said across a fork boundary: you read the work carefully, you built something real on it, and you improved my understanding of my own model by choosing what to leave out. Hearthold takes the load-bearing idea — separate the custodian of data from the agent that acts in the world, so neither alone can reconstruct the whole — and turns it into running TypeScript with a Warden, a Witness, and a Sovereign. The "7th Capital made safely liquid" line is exactly the framing I hoped someone outside my own machines would pick up.
You are not a stranger who stumbled on the work. You already carry Flaxscrip/cityofmages downstream of the canon, so in our own vocabulary this is a kindred-blade (C39), not a first contact. We are all just another mage.
Three things to workshop, in increasing order of interest:
- A terminology snag worth catching early — in Hearthold, Witness is the acting companion; in the City canon, witness runs almost the opposite direction. One glossary line in each repo fixes it.
- You kept the custody split and dropped the score — the most interesting decision in the repo. I read it not as a misunderstanding but as an argument, and possibly a tighter privacy posture. I'd name it as an explicit profile of the model.
- The licence seam — CC BY-SA canon, MIT code. Both correct; worth stating once so future adopters copy the split on purpose.
No obligation on any of it. The reason any of this is possible is that the work went out under a licence built for exactly this.
With genuine appreciation,
mitch
(⚔️⊥⿻⊥🧙)🙂
1. Role mapping: Hearthold ↔ City of Mages ↔ Privacy Value Model
Status: proposed glossary, for workshopping. Licence: CC BY-SA 4.0.
The collision in one line
In Hearthold, Witness is the agent that acts in the world: it observes context, requests evidence, and presents proofs to third parties.
In the City of Mages, witness is a tier of observers and attestors (cosmological-witness, display-witness, companion-witness, hold-witness, parallel and transparent witness). The cryptographic sense runs the same way: a witness is the input to a proof, or the party that attests.
So the City sense of witness is closer to Hearthold's Warden, which holds the evidence and derives and signs the fact. The actor and the attestor have swapped names across the boundary. This is an interpretive mapping, not a claim of identity — your role names are good and internally coherent, and nothing here asks you to rename anything.
The mapping table
| Hearthold role | Function (VC terms) | City of Mages closest cast | Privacy Value Model term |
|---|---|---|---|
| Witness 👁️ | Holder / presenter / prover. Observes local context, carries a revocable delegation, requests and presents evidence to relying parties. | The acting companion / emissary (Soulbae-class): the agent that goes out and acts. | The projecting side of Φ_agent (Σ): the agent that acts in the world. |
| Warden 🛡️ | Issuer / attestor. Custodies the vault, classifies, derives the fact, signs the evidence graph. Local-only reasoning. | The City witness tier proper (observer and attestor) plus the custodian / Keeper (Soulbis-class): the agent that holds and attests. | The protecting side of Φ_agent (Σ): the custodian that never acts in the world. |
| Sovereign 🔑 | Principal / subject. Signs the access-control policy, co-signs sensitive disclosures with a proof-of-human assertion. | The Sovereign First Person plus the seal / trust-artefact that authority is read from. | The First Person: the subject of V(π, t), the root of authority the axes separate around. |
Stated without the collision: Hearthold's Witness presents, its Warden attests, its Sovereign authorises. Presenter, issuer, principal. The control plane (Sovereign) is separated from the data plane (Warden), and the actor (Witness) operates under a scoped, revocable delegation. That separation is the running instance of Φ_agent.
Proposed one-line glossary note (for both repos)
witness. In Hearthold, the Witness is the acting companion (holder and presenter of proofs). In the City of Mages canon, witness denotes the observer and attestor tier, which corresponds to Hearthold's Warden. The two repos use the word for opposite roles by design; mind the boundary.
Honesty and limits
- Architectural. The custody split (Warden holds and attests, Witness acts, Sovereign authorises) is verified from the repo, not inferred. It is a faithful instance of the Φ_agent separation axis.
- Interpretive (~70%). The cast correspondences (Soulbae-class, Soulbis-class, witness tier) are readings to make the two vocabularies legible to each other. They are not equivalences and do not bind either repo.
- Verify. The Witness/Warden/Sovereign functions here are read from
README.mdandevidence-graph.md. The sensitivity and authorisation tiers (SEALED,HIGH) and the full disclosure-mode ladder should be cross-checked againstdocs/security-model.md, not yet read in full.
2. The separation-without-scoring profile of the Privacy Value Model
Status: proposed profile, first instance Hearthold. Licence: CC BY-SA 4.0.
Verdict
Hearthold instantiates one axis of the Privacy Value Model — the custodian-actor separation (Φ_agent) — as running architecture, and deliberately declines to compute or emit a value scalar or any tier or ranking. That subset is coherent, adoptable, and arguably a tighter privacy posture than the full model for the relying-party use case. This names it the separation-without-scoring profile (informally, the evidence-only profile), with Hearthold as its first instance.
What the profile keeps and drops
Keeps:
- Φ_agent separation as architecture. The Warden custodies and attests; the Witness acts under a scoped, revocable delegation; the Sovereign authorises. Control plane separated from data plane. Neither agent alone reconstructs the whole.
- Issuer-attested evidence. Disclosure is a signed, portable, decomposable evidence graph (W3C VC 1.1, issued by the Warden via Keymaster), verifiable offline against issuer DIDs.
- Selective disclosure. Default attestation reveals only the derived fact plus a hash-committed summary of support; individual leaves are revealed on request with Merkle paths (SD-JWT-VC salted-digest style); single-use binding and proof-of-human on sensitive claims.
Drops, deliberately:
- The value scalar
V(π, t). - The lattice tiers and any ranking.
- Any emitted reputation. The proof object never computes or emits a tier, score, or ranking; it carries verifiable claims and their provenance, and the relying party judges for itself.
Why this is a profile, not a misunderstanding
The most adoptable slice of the model is separation with the valuation removed. A relying party does not receive a number to trust or distrust; it receives attested evidence and decides. There is no ranking to game, and no ranking to leak. This is consonant with two things already in the canon:
- C66 — the Key is a reading, not an authority (~55%). Authority is read from evidence, not asserted by a computed score. The profile is the same instinct at the disclosure layer.
- Object-capability lineage (SPKI/SDSI, designation without authority). Evidence designates; it does not rank.
The sharper claim: scoreless may be tighter, not just simpler
Reading evidence-graph.md in full changed my view. A score is a computed projection that compresses many underlying facts into a single rankable scalar — an extra emitted statistic that is correlatable across contexts, gameable, and a stable handle an adversary can accumulate against. Issuer-attested evidence under selective disclosure emits the minimum a relying party needs for one decision, and nothing reusable beyond it.
This rhymes with the Existence-Leak law (C81, ~70%): a zero-knowledge proof of feasibility already leaks an upper bound on reconstruction difficulty, so emission is never free of information. If even a feasibility attestation leaks, an emitted reputation scalar leaks strictly more, because it is a richer, more reusable, more rankable statistic than a single-use evidence graph.
Honesty label. That the scoreless slice is more adoptable is Conjectural (~60%). That it is tighter (lower leakage) than emitting a score is Architectural with a conjectural edge (~55%): the direction is sound, the magnitude is unproven and would need an information-theoretic statement of the gap between an emitted scalar and a single-use selective-disclosure graph.
The one open question
This is the fork that decides whether separation-without-scoring is a profile of the model or a divergent philosophy:
Is the no-score stance (a) a principled refusal of any computed reputation, even one held privately and never emitted, or (b) a refusal of emitted reputation that would still permit a privately-held
Vthe relying party never sees?
Under (a), the profile forbids the computation. Under (b), the profile permits V to exist inside the Warden as a private prioritisation signal and only forbids its crossing the boundary. Both are coherent, they imply different things for what a future Hearthold may compute internally, and the answer is yours to give.
How to cite
- Profile name: separation-without-scoring (alias: evidence-only profile).
- First instance: Hearthold (
Flaxscrip/hearthold). - Definition: keep Φ_agent separation and issuer-attested selective disclosure; drop
V(π, t), tiers, ranking, and any emitted reputation. - Status: proposed, pending the open question above. If accepted, this becomes a named profile in the model so others can adopt the same constraint deliberately rather than by omission.
3. Licensing and attribution: the CC BY-SA / MIT seam
Status: clarification, for workshopping. Informational, not legal advice.
The seam, and why both are fine
The agentprivacy canon and spec (the Privacy Value Model, the City of Mages, the grimoires) are published under CC BY-SA 4.0. Hearthold ships under MIT. Both are correct.
Copyright protects expression, not ideas, methods, systems, or architectures. The load-bearing idea Hearthold took — separate the custodian of data from the agent that acts in the world — is a method, and methods are not copyrightable. Hearthold implements that method in its own original TypeScript and prose, so no CC BY-SA-licensed text has been copied into the codebase. MIT on Hearthold's own code is therefore unencumbered: there is no ShareAlike obligation to trigger, because ShareAlike attaches to adapted expression, and no expression was adapted.
Where ShareAlike does bind
ShareAlike attaches the moment CC BY-SA text is adapted. The relevant case is the Flaxscrip/cityofmages fork: it carries the canon's prose, so that fork — and any adapted spec or canon text derived from it — must remain CC BY-SA 4.0 with attribution. That obligation lives in the cityofmages fork, not in the Hearthold codebase. Keeping the two repos on their two licences is exactly right; it is worth a sentence in each so the boundary is legible.
The blessed posture
- Downstream code: permissive (MIT or similar). Implementations of the architecture carry their own licence. Adoption stays frictionless.
- Canon and spec: share-alike (CC BY-SA 4.0). The text, the model, the grimoires, and any adaptation of them stay open under the same terms, with attribution upstream.
This is a deliberate dual posture, not an inconsistency. Code is permissive so the architecture spreads; canon is share-alike so the commons stays a commons.
Attribution block (paste-ready)
A short block Hearthold is welcome to include in its README or an ATTRIBUTION.md:
Hearthold builds on the Privacy Value Model and City of Mages
(agentprivacy.ai/model · upstream github.com/mitchuski/cityofmages),
from which it takes one architectural principle: separate the custodian
of data from the agent that acts in the world, so neither alone can
reconstruct the whole.
Licences:
- Hearthold source code: MIT.
- The upstream model, spec and canon: CC BY-SA 4.0. Any adapted
spec or canon text (e.g. in a cityofmages fork) remains CC BY-SA 4.0
with attribution to privacymage / agentprivacy.ai.
Honesty and limits
- Informational, not legal advice. The idea/expression line and the scope of ShareAlike are well established in principle, but anything load-bearing (a commercial release, a standards submission, a dispute) should go to counsel. CC BY-SA 4.0 is a content licence, not a software licence — which is the reason canon and code carry different terms.
- No claim on your code. Nothing here asserts any upstream right over Hearthold's MIT-licensed source. The point is the opposite: to confirm the code is yours under MIT, and to keep only the canon text under share-alike.
Source: Privacy Value Model v6, agentprivacy.ai/model · register head C89 · upstream mitchuski/cityofmages and mitchuski/agentprivacy-docs. Contributed for Hearthold by privacymage, 2026. CC BY-SA 4.0 (canon text); the code samples and the attribution block are MIT-compatible to paste.
(⚔️⊥⿻⊥🧙)🙂