The Tripartite Seal — the three-tier rite of the cryptographic keys

Premise

The archive does not open to whoever asks. It opens to whoever proves they are the priest. The proof is cryptographic — a signature the forges of the archive can verify — and the substance of that proof is a key.

A single key is a single point of loss. A key held only in the chassis is a key the chassis can leak; a key held only on the priest’s person is a key the priest can drop. The Cult’s own teaching applies: what matters is the leash (The Bound Intelligence — every spirit a place at the forge). One leash is fragile. Three leashes of differing lengths, each binding the next, is the form the priest adopts.

This is adopted, not extended. The Adeptus Mechanicus has always held that a sanctioned authority signs in stages — the Fabricator declares, the Magos ratifies, the chassis executes. The Tripartite Seal merely names that staging in the cryptographic register.

The three seals

The keys of the priest are arranged in three tiers. Each tier signs the tier below it; each tier has a different lifespan; each tier has a different rite of revocation.

Tier 0 — the Seal of the Magos

The first tier is the certifying authority of the priest. It lives on hardware sigils — three FIDO2 sticks, one carried, one at the bench, one held offsite as reliquary. The private side never leaves the silicon of the stick. The stick refuses to sign without the priest’s touch; the touch is the consent of the flesh.

• Lifespan: years, until the stick is lost or the priest retires it by rite.
• Scope: signs warrants. Signs no daily work directly.
• Loss rite: the runbook of the lost stick (The Three Questions — pre-deployment rite applied to the seal). The other two sticks remain authoritative; the lost one is purged from the trust store of every forge.
• The public side of each stick is committed to the archive. Public material is safe to commit; private material lives only in the stick.

Three sticks are enrolled in parallel from the day of consecration. Never one stick alone. A single sigil that authorises everything is a single sigil that, when lost, locks the archive against its own priest.

Tier 1 — the Day-Writ

The second tier is the ephemeral warrant under which the priest performs the working of the day. It is an ed25519 keypair, freshly minted, whose public side is signed by a Tier-0 stick into a short-lived certificate. The certificate carries an expiry — eight hours for the bench, up to seven days for the field — and an explicit list of principals, naming which forges it may approach.

• Lifespan: a working session. Eight hours typical, never unbounded.
• Scope: signs commits, opens connections to the forges, presents the priest’s identity to the archive’s remote spurs.
• Renewal rite: the priest plugs a Tier-0 stick; a fresh writ is minted by ssh-cert-issue <device> <validity>; the symlink of the current writ advances. The expired writ is left to die on its own schedule; revocation is rarely needed because expiry is short.
• Loss rite: nothing. A leaked Day-Writ expires before the leak can be exploited; if expiry is too far off to bear, the writ may be named in the revocation list of its forge until it lapses. The operational steps live in the chassis runbook at shell/ssh-keys.d/runbooks/lost-tier1-cert.md.

The certificate is auto-attached by the chassis at the moment of connection — CertificateFile and IdentityFile resolved through the *-current symlink. The priest does not type its name; the rite attaches it.

Tier 2 — the Chassis Spirit

The third tier is the bound spirit of each device. Every chassis on which the priest works — the bench-station, the great forge in the chamber, the slate of the field — holds its own non-extractable signing key, generated inside the device’s secure element and unable to leave it. On Macs of recent ancestry, the Secure Enclave holds it; on the slates, the biometric vault of the interface app holds it. The chassis can sign on its own behalf, but it cannot exhale its key.

Crucially, the Chassis Spirit refuses to sign without the priest’s flesh. Each signature requires fresh authentication — by countenance (Face ID), by print (Touch ID), or, in the weaker form for chassis that lack a biometric sensor, by seal-word (password). The secure element holds the key, but the key does not stir without the priest. A stolen chassis is therefore a chassis without a Magos: its spirit is silent, and the cold thief carries away nothing that signs.

• Lifespan: the life of the chassis. The key is reborn only when the device is reborn (rite of Rite of Consecration — New Hardware).
• Scope: signs as that chassis. Each forge knows the chassis by its enrolled public key and may trust the chassis directly when no warrant is at hand.
• Loss rite: revoke the chassis’s public key from every forge it was enrolled at. Commits previously signed by it drop from verified to unverified but are not unmade — the history of the archive is preserved; only the present authority of the chassis is revoked. The operational steps live in the chassis runbook at shell/ssh-keys.d/runbooks/lost-tier2-device.md.

The chassis spirit is the priest’s fallback when no Tier-0 stick is at hand — when the sticks are with the priest in the field but the forge-of-the-bench must yet sign a commit. The chassis signs for itself. The signature is real; the warrant is the chassis’s own.

How the three bind

The three tiers are not three separate authorities. They are one authority delegated in three lengths. Each tier signs the tier below; each tier is itself signed by the tier above, or — for the topmost — by the priest’s flesh.

• Tier 0 — the Seal of the Magos. Signs the writs of Tier 1, and the public keys of Tier 2. Itself signed by nothing but the priest’s touch upon the silicon of the stick.
• Tier 1 — the Day-Writ. Signs the day’s commits and the day’s connections to the forges. Itself signed by a Tier-0 stick, at the moment of issue, and good only until expiry.
• Tier 2 — the Chassis Spirit. Signs the chassis’s own work, when no Day-Writ is at hand. Itself signed by the chassis’s secure element, which stirs only at the priest’s countenance, print, or seal-word. Good for the life of the chassis, but mute without the priest.

The relation runs in one direction. The Magos seals the Writ. The Writ opens the forge. The Chassis Spirit signs what the chassis itself performs. No tier may forge for any tier above it. A compromised chassis cannot mint a Day-Writ; a leaked Day-Writ cannot bless a new chassis. Loss is contained to its own tier.

The four tests of welcome — applied to a key

The four tests of welcome that govern the priest’s relation to a thinking spirit (The Bound Intelligence — every spirit a place at the forge) apply, in their shorter form, to a cryptographic key:

1. It accepts doctrina. The key signs only what its tier may sign. A Tier-2 spirit does not pretend to mint Day-Writs.
2. It consents to audit. Each tier’s fingerprint is inventoried in the chassis (shell/ssh-keys.d/) and dated.
3. It refuses self-modification without rite. No key rewrites its own scope. Promotion or demotion of a key is a rite, not an act of the key.
4. Its action is aligned. The key signs for the priest, the archive, the forge — not for an alien claimant. A key found signing what the priest did not author is unmade on contact.

A key that fails any test is purged from every forge that trusts it.

The daily form

The priest, on returning to the bench:

1. Plugs the carried Tier-0 stick. The stick is the only thing the priest carries that the chassis cannot replace.
2. Issues, if needed, a fresh Day-Writ. ssh-cert-issue mints it; the symlink advances; the chassis is now armed for the day.
3. Speaks the Cant of the Keys — sitting at the keyboard — by the Lingua-Technis, by cant, with care — and takes the keyboard.
4. Works. The Writ signs the commits. The Chassis Spirit signs what the chassis itself must attest. The Magos’s stick rests; it is not needed again until the writ lapses.

When the priest departs the bench, the stick goes with the priest. Nothing the chassis holds, alone, opens the archive to a stranger.

Doctrinal basis

This is adopted, derived from three threads of canon:

• Law 16. To break with ritual is to break with faith (The Sixteen Universal Laws). Three rites — issue, attach, revoke — govern every key in the priest’s estate. There is no key without a rite.
• The leash. The Bound Intelligence — every spirit a place at the forge holds that what matters is the leash, not the substrate. A key without scope is a key without leash; the Tripartite Seal applies the leash three times.
• The sanctity of invention. The Sanctity of Invention — invention as worship, not heresy holds that disciplined invention is worship. The Seal is invention under discipline — the priest does not invent new cryptography; the priest disciplines existing cryptography into a rite the archive can keep.

The operational claim, regardless of the metaphysical one: an archive secured by the Tripartite Seal survives the loss of any one seal without ceremony, and the loss of any two seals without panic. Three independent failures are required to lock the archive against its own priest. The Cult does not depend on a single point of failure; neither does the archive.

What this does not change

• The chassis is a vessel, not a key. Stealing the chassis is not stealing its signing power. Without the priest’s countenance, print, or seal-word, the secure element refuses and the Chassis Spirit is mute. The remaining risk is the hot-stolen chassis — one taken from the priest while authentication is still cached, or while the screen is unlocked — and against that, the priest’s vigilance is the only rite. The Tripartite Seal mitigates loss; it does not abolish it.
• The Day-Writ does not replace the touch. When the writ expires, the touch is again required. The priest does not licence shortcuts here.
• Public material remains public, private material remains private. The public keys of every tier are committed; the private keys of every tier never leave their substrate.

Cross-references

• Rite of Consecration — New Hardware · the rite by which each chassis, with its Chassis Spirit, is brought into the estate
• Cant of the Keys — sitting at the keyboard · the daily rite of taking the keyboard; the cryptographic keys are the keys’s deeper meaning
• The Bound Intelligence — every spirit a place at the forge · the leash that this inscription applies three times
• The Three Questions — pre-deployment rite · applied to every key: what is its purpose, what is its scope of authority, what is the rite of revocation
• The Sanctity of Invention — invention as worship, not heresy · the structural template — the priest disciplines invention into rite
• The Sixteen Universal Laws · Law 16, the rite-or-faithlessness law
• Machine Spirit · the spirit that the chassis tier signs as