Technical Reference
Accountability evidence and key custody
Masterplan records non-identifying, cryptographically verifiable evidence of bounded actions. A valid signature and complete chain show which key signed an exact statement and whether stored evidence changed. They do not prove legal compliance or physical deletion outside controlled systems.
Four separate trust domains
| Role | Private-key custody | Purpose |
|---|---|---|
| instance | Protected Server secret, shared only through encrypted HA replication and included only in encrypted verified Server recovery | Signs automatic ledger records and durable records of verified privileged actions |
| root_passkey | Windows Hello, hardware key or another WebAuthn authenticator | Authorises one exact privileged action. Root receives no exportable Server signing key and is not automatically the legal controller |
| controller | Controller-controlled workstation or hardware device, never Server or Desktop | Signs controller trust declarations and controller-specific accountability statements |
| processor | Desktop operating-system credential store, never Server or controller custody | Signs supported Desktop publication, conversion, erasure and processor receipts |
Even if one organisation performs both controller and processor work, it uses separate entity identifiers, keys and declarations. Controller and processor private keys are excluded from Server backups, bundles, summaries, logs and diagnostics.
Commissioning and registration
- The Server management TUI creates the instance Ed25519 key exactly once after explicit confirmation. Later verification never regenerates a missing or mismatched key.
- Root registers a passkey. Important WebAuthn challenges bind the exact action, proposed fingerprint, role, entity, instance, expiry and nonce.
- The controller key is created outside Server and Desktop with the controller-custody utility or a hardware workflow. Its public fingerprint is verified independently.
- Server verifies controller proof of possession, then root separately authorises activation with its passkey. The instance-signed record distinguishes every step.
- The controller signs and installs its initial trust declaration. Controller-specific governance and privacy publication remains blocked until this succeeds.
- Desktop creates the processor key for an already declared processor identity. Processor proof and root authorisation follow the same separated ceremony.
Unknown or private-key fields, replay, expiry, changed action digests, wrong role, wrong entity, wrong instance and activation without root approval are rejected.
Rotation, revocation and recovery
Routine controller and processor rotation requires proof from old and new keys. Lost or compromised replacement requires root passkey authorisation and an explicit identity continuity record. Revocation blocks new statements while historical public keys and verification records remain. Instance rotation creates continuity before retirement and switches all HA nodes consistently. Root replacement revokes affected sessions.
Private evidence repository
The local signed ledger remains authoritative. Optional automatic archival is disabled by default and uses a repository-scoped Fine-grained GitHub personal access token entered through the masked Server TUI. Evidence-Public is never an automatic target. Manual staging and controller signing remain available without a Server token.
Privacy boundary
Evidence may contain random instance, entity, chain, event, subject, request, package, key and credential references, bounded reason codes, timestamps and cryptographic digests. It must not contain names, email addresses, tasks, schedules, free-form explanations, secrets, private keys, raw participant identifiers, application backups or Git credentials.
Each deployment has its own controller and generated privacy notice. Providers, countries, transfers, enabled features and retention are declared for that deployment and are not inferred by the software.
Continue to the Security Model for the wider credential boundary.