Status: pre-launch. This page describes target design; this document does not establish a deployed service.

B2 -- The Sigil

Overview

The Sigil is the Nostr private key (nsec). Nothing more.

Every other identity construct in the Skyzai organism -- ZK proofs, verifiable credentials, DID documents, reputation scores, wallet authorizations -- derives from the Sigil. It is the cryptographic root of the entire system.

What a Sigil Is

A Sigil is a standard Nostr keypair:

• nsec (private key): 32 bytes of entropy. This IS the Sigil. It never leaves the owner's device.
• npub (public key): Derived from the nsec. This is the public identity. Freely shareable.

There is no ceremony, no registration, no approval process. Generate a key. That is your Sigil. You are now a sovereign entity in the Nostr network and, by extension, in the Skyzai ecosystem.

The Pass Gesture

"Pass gesture" = sign with nsec.

When the organism says "pass your Sigil," it means: produce a cryptographic signature using your nsec that proves you control this identity. The signature is the gesture. The nsec never moves.

Action: "Transfer 100 ZAI to npub_xyz"
Sigil pass: sign(action, nsec) -> signature
Verification: verify(signature, npub) -> true/false

A Sigil pass proves identity, provenance, or permission evidence only; it never authorizes a public-DAV consequence. Public consequence requires a valid, bound PRISM decision receipt from the signer(s) required by applicable law, the entity's governing instrument, or a valid competent mandate.

Derivation Chain

Everything built on top of the Sigil uses it as root:

Sigil (nsec)
  |
  +-- Nostr identity (npub)
  |     +-- Nostr relay subscriptions
  |     +-- Nostr event publishing
  |     +-- Inter-organism communication
  |
  +-- Hedera DID
  |     +-- W3C Verifiable Credentials
  |     +-- BBS+ selective disclosure
  |     +-- KYC identity proofs
  |
  +-- ZK Proofs
  |     +-- Range proofs (age, balance thresholds)
  |     +-- Membership proofs (group inclusion)
  |     +-- Credential derivation (prove attributes without revealing identity)
  |
  +-- Wallet Authorization
  |     +-- Transaction signing
  |     +-- Smart contract interaction
  |     +-- Multi-sig participation
  |
  +-- Agent Authentication
        +-- Session authorization
        +-- Tool invocation signing
        +-- Cortex trace attribution

Signatures support cryptographic attribution under specified key controls. Key control is not personhood, factual truth, universal unforgeability or external authority. Compromise and recovery behavior require their own evaluated design.

Security Properties

• Self-sovereign: No issuing authority. No revocation authority. The holder controls the key.
• Deterministic derivation: The same nsec always produces the same npub and the same derived identities.
• Minimal attack surface: The nsec is a single secret. Fewer secrets = fewer leak vectors.
• Portable: Works on any Nostr client, any Skyzai instance, any compatible wallet. No vendor lock-in.
• Recoverable: Standard BIP-39 mnemonic backup. The 12/24 words regenerate the nsec.

What a Sigil Is Not

• Not a password. Passwords authenticate to a server. The Sigil authenticates to mathematics.
• Not a certificate. Certificates require a certificate authority. The Sigil requires no authority.
• Not a biometric. Biometrics are probabilistic and irrevocable. The Sigil is deterministic and replaceable (generate a new one, migrate your identity).
• Not a token. Tokens represent value. The Sigil represents identity. It has no monetary value itself.

Sigil Hygiene

1. Generate offline. Air-gapped device preferred.
2. Backup mnemonic. Physical medium (steel plate, paper). Never digital-only.
3. Never transmit the nsec. Sign locally, transmit signatures.
4. Rotate if compromised. Generate new Sigil, migrate credentials, revoke old npub.
5. One Sigil per natural person. Multiple Sigils fragment identity. The organism is designed for one root.

Integration

The Sigil is consumed by:

• Nexus (B0-nexus-overview.md): As the root identity for the private DAV
• Pipeline (C1-pipeline.md): For trace attribution
• APU: For traceable wallet-intent staging only (unsigned transaction proposals; no transaction signing or authority)
• Membrane: For grant issuance (outbound permissions)

---

Sigil Key Management Policy

Sigil is identity-critical key material. Manage like cryptographic infrastructure.

Required controls

• Hardware-backed key storage where available
• Encrypted backup strategy with explicit recovery procedure
• Rotation protocol for suspected compromise
• Event signing verification on ingest and on read

Anti-patterns to avoid

• Shared private keys across environments
• Silent key migration without user confirmation
• Custodial shortcuts that break sovereignty claims

Incident protocol

On suspected key compromise: freeze high-risk grants, rotate keys, publish signed revocation trail.

---

Historical predecessor wording — retained on 2026-09-27, not active rules

The displaced passages are preserved verbatim for lineage. This retention date is not their original authorship date.

Predecessor passage 1

Every leaf in this tree can be traced back to the Sigil. If the Sigil is compromised, everything is compromised. If the Sigil is secure, nothing can be forged.