Keeper's Protocol — Weavers · Amethyst · V28

Keeper's Protocol — Weavers Shop

A complete, re-runnable guide for conducting a live Cloak Weaving ceremony. Follow these steps in order. No OOC commentary needed.

Pre-flight

# Load archon environment
source ~/.keymaster-mcp/.env
alias km="ARCHON_WALLET_PATH=~/.keymaster-mcp/wallet.json npx @didcid/keymaster"

# Confirm GenitriX is active
km list-ids
# Expected: GenitriX  <<< current

# Start registry UI (if not running)
cd tools/spellweb-registry && npm run dev   # → localhost:5173

# Start spellweb (if not running)
cd tools/spellweb && npm run dev            # → localhost:8000

Step 1 — Identity Challenge

The seeker arrives and claims an identity. Do not accept it at face value.

Keeper:

km create-challenge
# → did:cid:<challenge-did>

Send the challenge DID to the seeker (Telegram, dmail, or in-person).

Seeker runs:

keymaster create-response did:cid:<challenge-did>
# → did:cid:<response-did>

Seeker returns the response DID.

Keeper verifies:

km verify-response did:cid:<response-did>
# Expected output:
# { "match": true, "responder": "did:cid:<sovereign-did>", ... }

✓ match: true — identity confirmed.
Record responder value — this is the seeker's sovereign DID (V63 in the weave).

Step 2 — Credential Challenge

The seeker presents which credential they want cloaked. You need from them:

The credential's schema DID
The issuer (name or DID)

If the issuer is a name (e.g. morningstar@archon.social), resolve it:

km resolve-did morningstar@archon.social
# Look for: didDocument.id → issuer DID

Build the challenge file:

cat > /tmp/vc-challenge.json << EOF
{
  "credentials": [{
    "schema": "<schema-did-from-seeker>",
    "issuers": ["<issuer-did-resolved-above>"]
  }]
}
EOF

Create the credentialed challenge:

km create-challenge /tmp/vc-challenge.json
# → did:cid:<vc-challenge-did>

Send to seeker.

Seeker runs:

keymaster create-response did:cid:<vc-challenge-did>
# Keymaster finds the matching VC automatically
# → did:cid:<vc-response-did>

Seeker returns the response DID.

Keeper verifies:

km verify-response did:cid:<vc-response-did>
# Expected: { "match": true, "fulfilled": 1, "vps": [{ ...full credential... }] }

✓ fulfilled: 1 — credential presented and verified.

From the output, record:

vps[0].credentialSubject — all credential claims (this is what you weave)
credentials[0].vc — the VC DID (V15 in the weave)
vps[0].issuer — confirm it matches the issuer DID you resolved
vps[0].validFrom — validity envelope

Step 3 — Valve-Class Assignment

Read the credential claims aloud (or display them). Propose assignments. Confirm with the seeker before proceeding.

Default rules:

Field type	Default valve class	Vertex
Core attestation (`credence`, `score`, `confidence`)	Always-Revealed	V20
Validity window (`validFrom`, `validUntil`)	Always-Revealed	V20
Subject identifier (`credentialSubject.id`)	Hash-Masked	V3
Statistical baselines (`priorAssumed`, `threshold`)	Hash-Masked	V3
Flags (`redFlags`, `warnings`)	Hash-Masked	V3
Behavioral evidence (`evidenceSummary`, `methodology`)	Always-Masked	V25
Cryptographic proof (`proof`, `signature`)	Always-Masked	V25

Seeker may override any field. Record final assignments.

Step 4 — Transmuted DID (Mage-Side Persona)

Ask: Do you have a transmuted identity — a second DID that is your Mage-side public persona?

If yes: get the DID from the seeker (V28 in the weave).

If no: the seeker creates one now:

# Seeker runs:
keymaster create-id <mage-persona-name>
keymaster resolve-id
# The output DID is their transmuted persona

Record the transmuted DID (V28 in the weave).
If skipped: use did:cid:placeholder-transmuted-<visitor-name> and flag it in the registry.

Step 5 — Build the Registry JSON

Create /tmp/<visitor-name>-cloak-registry.json:

{
  "items": [
    {
      "id": "item-sovereign-<visitor>",
      "type": "did",
      "label": "<Visitor Name> — Sovereign Identity",
      "did": "<sovereign-did from Step 1>",
      "vertexId": 63,
      "stratum": 6,
      "createdAt": "<ISO timestamp>",
      "role": "sovereign",
      "notes": "Sovereign DID verified via keymaster challenge/response (match: true).",
      "tags": ["cloak-weaving", "cloak-weave-v1"]
    },
    {
      "id": "item-transmuted-<visitor>",
      "type": "did",
      "label": "<Visitor Name> — Public Mage Projection",
      "did": "<transmuted-did from Step 4>",
      "vertexId": 28,
      "stratum": 3,
      "createdAt": "<ISO timestamp>",
      "role": "transmuted",
      "notes": "Mage-side public persona. Memory · Connection · Computation. Role published; name concealed.",
      "tags": ["cloak-weaving", "cloak-weave-v1"]
    },
    {
      "id": "item-issuer",
      "type": "did",
      "label": "<Issuer Name>",
      "did": "<issuer-did from Step 2>",
      "vertexId": 49,
      "stratum": 3,
      "createdAt": "<ISO timestamp>",
      "role": "issuer",
      "notes": "<issuer-name> — issuing authority. Resolved from name service.",
      "tags": ["cloak-weaving"]
    },
    {
      "id": "item-schema",
      "type": "schema",
      "label": "<Schema Name>",
      "did": "<schema-did from seeker>",
      "vertexId": 12,
      "stratum": 2,
      "createdAt": "<ISO timestamp>",
      "role": "schema",
      "controllerDid": "<issuer-did>",
      "notes": "Credential schema. V12 — Memory · Connection.",
      "tags": ["cloak-weaving"]
    },
    {
      "id": "item-vc",
      "type": "vc",
      "label": "<Credential Name>",
      "did": "<vc-did from Step 2 credentials[0].vc>",
      "vertexId": 15,
      "stratum": 4,
      "createdAt": "<vps[0].validFrom>",
      "schemaDid": "<schema-did>",
      "issuerDid": "<issuer-did>",
      "subjectDid": "<sovereign-did>",
      "notes": "<Brief description of credential and claims>.",
      "tags": ["cloak-weaving"]
    },
    {
      "id": "item-revealed-claims",
      "type": "capability",
      "label": "Always-Revealed Claims (V20 · Techne)",
      "did": "urn:capability:<visitor>-revealed-<date>",
      "vertexId": 20,
      "stratum": 2,
      "createdAt": "<ISO timestamp>",
      "parentDid": "<vc-did>",
      "notes": "Always-Revealed (V20). Fields: <list confirmed Always-Revealed fields and values>.",
      "tags": ["cloak-weaving", "valve-revealed"]
    },
    {
      "id": "item-hashed-claims",
      "type": "capability",
      "label": "Hash-Masked Claims (V3 · Dual Agent)",
      "did": "urn:capability:<visitor>-hashed-<date>",
      "vertexId": 3,
      "stratum": 2,
      "createdAt": "<ISO timestamp>",
      "parentDid": "<vc-did>",
      "notes": "Hash-Masked (V3). Fields: <list confirmed Hash-Masked fields>. Structurally present; cryptographically inaccessible.",
      "tags": ["cloak-weaving", "valve-masked"]
    },
    {
      "id": "item-proof-spell",
      "type": "capability",
      "label": "Always-Masked Proof Spell (V38 · Aletheia)",
      "did": "urn:capability:<visitor>-proof-spell-<date>",
      "vertexId": 25,
      "stratum": 3,
      "createdAt": "<ISO timestamp>",
      "parentDid": "<vc-did>",
      "notes": "Always-Masked (V25). Fields: <list confirmed Always-Masked fields>. ZK predicate: '<describe the predicate the verifier can confirm without seeing the value>'.",
      "tags": ["cloak-weaving", "valve-zk"]
    },
    {
      "id": "item-chronicle",
      "type": "asset",
      "label": "Cloak Weaving Chronicle",
      "did": "urn:chronicle:cloak-weaving-<visitor>-<date>",
      "vertexId": 5,
      "stratum": 2,
      "createdAt": "<ISO timestamp>",
      "role": "chronicle",
      "notes": "Chronicle of Cloak Weaving ceremony at Weavers shop (V28 · Amethyst). Visitor verified via keymaster challenge/response. Pallia wove across 9 constellation vertices. <date>.",
      "tags": ["cloak-weaving", "chronicle", "cloak-weave-v1"]
    }
  ],
  "chronicle": []
}

Step 6 — Export and Visualize

# From tools/spellweb-registry:
node scripts/export-to-spellweb.mjs /tmp/<visitor>-cloak-registry.json <visitor-name> \
  > ../spellweb/src/data/<visitor-name>-contribution.ts

# Wire into spellweb (nodes.ts):
# Add import: import { REGISTRY_NODES as <VISITOR>_NODES } from './<visitor-name>-contribution';
# Add to NODES array end: ...VISITOR_NODES,

# Wire into spellweb (edges.ts):
# Add import: import { REGISTRY_EDGES as <VISITOR>_EDGES } from './<visitor-name>-contribution';
# Add to EDGES array end: ...VISITOR_EDGES,

Vite hot-reloads. Open localhost:8000.

The seeker should now see 9 nodes across the lattice at V3, V5, V12, V15, V20, V38, V28, V49, V63. Edges: issuer generates VC → VC proves schema → VC relates_to sovereign.

Step 7 — DID-Blind Public Export (optional)

To show the seeker their public-layer projection (what the world sees):

Open the registry at localhost:5173
Import /tmp/<visitor>-cloak-registry.json
Click Publish to Spellweb → enable DID-Blind ON
Every did:cid:... becomes [DID] — structure and valve-class geometry preserved, identifiers stripped

This is what a verifier would see on spellweb.ai.

Known gaps (target for cloak-weave-v2)

Transmuted DID creation is manual — should be part of the ceremony flow before Step 4
Capability edge types (manifests_as) not auto-generated by current export script — capabilities appear as isolated nodes; edges would need to be added manually or via script update
V0 (Null Blade) is the ceremonial start but has no registry item — consider a placeholder or opening narration artifact

(⚔️⊥⿻⊥🧙)😊
🪡

CC BY-SA 4.0 · csaucier · flaxscrip lineage · 2026-05-11

Assets

📎 weavers-keepers-protocol-weavers-amethyst-v28KEEPER_PROTOCOL.md

Navigation

← Welcome Visitors · The Workshops