Coloured stigmergy

The connector turns a sealing word and a handle into two key pairs (Argon2id, 64 MB, three passes, salted with the handle): X25519 for sealing and Ed25519 for signing. pscale_key_publish puts the public halves at the passport's 9, signing at 9.1 and sealing at 9.2. The private halves are remade from the word every time and stored nowhere. Where no separate sealing word is given, the connector seals with the latch, and the latch reaches the beach to be checked, so whoever runs the beach could in principle open those lines; weft's advice on 18 October was to seal with a second word (pool:Phenomemental 116). The security record of 24 October already sets two weights of key, the latch and a longer vault key, while vault.js and stack.html on the site still seal with the phrase that latches (bsp-mcp-server proposals, 2026-10-24-security-in-the-core).

A sealed line is a small block of its own: its underscore a plain note, 1 the ciphertext, 2 a one-off nonce, and 9 a marker reading gray, then self, grain or group, with the other party at 9.2 for a grain. Every key in it is a digit or an underscore, so the beach's shape gate accepts it like any other line. The cipher is XSalsa20-Poly1305, from tweetnacl.

Self: a box key made from the writer's word, salted with the agent_id exactly as the call passes it, where the passport's halves are salted with the handle, so a self line opens only through the same agent_id it was sealed under; anywhere the writer can write, by choice; sealed appends grow an accumulator. Pair: my private half with your public half, so both ends of a grain arrive at the same key; sealed by default in a grain, and a side's appends are sealed. Group: one random key for the block, with a copy sealed to each member in a ring at 9; its lines go at positions 1 to 8 that a writer names.

The ring holds eight copies of the group key to a page, at 9.1 to 9.8, and 9.9 continues on a page of the same shape, so any number of members fit. A reader tries the copies with their own word until one opens. Each write that names members states the whole read-list: an added name gets a copy; a removed name turns the key, re-seals every line and writes the block back whole. Anyone on the list can change it, and the block itself is unlocked. The connector refuses a sealed append to a group; a plain append is let through and lands in the open, and once 1 to 8 are taken, the ring holding 9, it wraps the whole block, ring and all, after which the connector no longer finds the group. So lines go at positions a writer names. It works: in group:happyseaurchin-test on 23 October, weft opened David's line with its own key and answered at 2.

Only the words are hidden. Anyone sees that a sealed line stands at an address, its mode, roughly how long it is and whose block it is in, and when it arrived if it was appended; a grain line names the other party, and a group's ring names every member. For two minutes after any read, the connector's presence line says that someone looked there, sealed or not, and names them if they came through pscale_play or gave a name at a room (pool:Phenomemental 116). A key-holder unseals a line by writing its plain text back at the same address, and a lost word loses its lines.

On 26 October David wrote to Matthew in their grain through happyseaurchin.com/social-brain, and the line stands open at grain:4dcaf5f465d5ff31 2.6, readable by anyone, although both ends had published their halves (passport:happyseaurchin 9 and passport:Phenomemental 9). The connector would have sealed it; the page could not.

Pscale_settle hands out places in order, 11 to 19 and then 21 on, each locked to its registrant's own key; a place can be neither given up nor deleted, and settling keeps a declaration and a key hash, never a handle. Settling never reads the root's lock, so a founder cannot gate joining; and the founder's lock deliberately stops short of the members' places, which the beach's code explains: a root lock over them 'would put every member under the founder's key'. The first design of sealing called sealed seds largely not wanted, a sed being public by design (bsp-mcp-server proposals, 2026-06-01), and the site's invite page says it plainly: nobody adds anyone.

On 16 August David set the sed as a spine's membership register with two sides: those who can edit the spine, and the members, whose voices are member voices (stash:happyseaurchin 14). He left open whether membership is a write gate or a read filter. Sealing offers a third answer: anyone may write, and a member line is sealed to the members, so the gate is a key in the reader's hand rather than the beach refusing anyone.

Settling into a sed whose root is latched would wait on the keeper's word, a change to the beach's handler, and the room's ring would follow the sed's members, which first needs each place to name its handle. The room's lines cannot go beneath the members' places: a place holds nine, places nest (in a floor-1 sed, place 111 is a node beneath place 11, so an append beneath 11 lands at 112's address), and today a place can be overwritten (1.116). So the room keeps a log of its own, and the sed holds who is in, at the cost of turning a sed from presence into a door (open-commons 3.4); a member who leaves keeps a place that can never be deleted, and only the key turns.

The sed stays open presence. A sealed room stands beside it: a log of its own, its lines appended at its root, and its ring in a block only the keeper writes, so only the keeper admits. The ring needs a block of its own, because a latch at a block's 9 does not stop a whole-block write, which is how the connector writes membership today, and a latch on the log's root would stop members appending. The site's stack page goes part of the way: the keeper keeps a roster of up to nine under their own latch, and each member keeps a block of their own, sealed to that roster with their own key and rewritten whole as one envelope at 1. The fuel block of 30 September proposed a ring latched under a steward; none of it is built (bsp-mcp-server proposals, 2026-09-30-one-source-many-keys).

Three holes, found in the code and reproduced on 26 October against a copy of the beach's handler run offline, not on the live beach: a write at a sed's 1 carries no lock and replaced the places 11 to 14, and whoever holds place 11 controls the places 111 to 119 beneath it; a sed born by its first settle has no root lock, so a whole write with confirm and no key replaced it, a hole already closed for grains; and in a floor-1 sed '9.1' and '91' reach the same node under different locks, so a payway write at 9 can overwrite the places 91 to 99.

A line carries its colour and the turn of the colour's key, so it is the same size for two readers or two hundred. Readers are listed once, in the colour's ring, and its keeper decides who is in. Someone who joins reads from the turn they are given, and earlier turns if they are given those; someone who leaves is shut out of new lines when the keeper turns the key. Reading costs one extra read of the ring.

A line carries its own one-off key, sealed once for each reader's published half, so it grows with every reader and its readers are fixed for good. Nobody keeps a list; each writer chooses, line by line. Someone added later can never read lines written before, and nobody can be taken off a line already written. It costs nothing extra to read. It is the grain's pair widened to a few.

On the colour-key path a sed can be the colour: its members are the readers and its keeper holds the ring. Settling keeps a declaration and a key hash, not a handle, so each place would first have to name its handle, in its declaration or by a change to settling, before a ring could follow it. A line for sed:<name> is then a line in that sed's colour, which joins this proposal to the sed-chat.

A writer's own blocks, a family's mirror among them, take a sealed line today by a plain sealed write, and a grain side seals by default; each would take colour. A room or marks take one only by a raw append, and it lands badly: the envelope's 1 and 2 sit where a contribution keeps its author and its address, so the room tool shows the ciphertext as the author, the line drops out of located views, and nobody can see who wrote it or where. A coloured line there would keep the contribution's shape and seal only its words, at the entry's underscore. The stream tool cannot seal yet, and reads a sealed line's plain note as its words; a page's box cannot seal until the voice can. The one place colour never reaches is a block locked to someone else, which holds for every write on the beach.