Steward console

Mint a consequence, sign it with your own key, and watch it decide.

01

Connect

Point at an admission service. The console asks it what it can prove and shows only that — if it cannot see the service, it says so rather than showing a confident zero.

02

Hold your key

The steward key is generated in this browser and stays in this browser. Only the public half and your signatures ever cross the wire.

Your private key never touches our servers. If we held it, we could bind boundaries in your name — and “only a named human grants authority” would be marketing. So there is no code path here that transmits it.
The honest cost: a key we cannot hold is a key we cannot recover. If you are the sole steward and you lose this key, your namespace is unrecoverable — amending a charter needs a quorum of the current stewards, and there would be nobody left who can act. We will not add a back door, because a back door is us holding the key. Charter with a quorum (2-of-3) instead; backing up the seed is a distant second best.
03

Claim a namespace

A namespace is a wall. Genesis is a first claim, self-signed by the stewards it names — and a name already claimed cannot be taken. We are the registrar; we hold no steward key, so we can enforce your charter and never forge it.

04

Mint a consequence

Take a boundary pack, or write it in plain language. Either way you get a dead object — a name, not a permission. Lumen will refuse to compile a sentence it cannot fully express, because a dropped clause would widen the boundary beyond what you asked for.

05

Bind it — the authority event

Everything above this line proposes. This is the moment a named human makes it law, and it happens on your machine, with your key, under your hand. It cannot be automated away without destroying the product.

06

Put it to the boundary

Propose a consequence and watch it decide. An ACCEPT returns a receipt anyone can verify with a public key alone — and a REFUSE is signed too, because an honest denial is also a proof.

No decisions yet — nothing has been put to a boundary.

authority_effect: 0. Nothing here governs a real mutation yet. A boundary decides and traces, and it blocks nothing until a steward deliberately flips enforcement on the system it guards — a separate, human act.

Known gap, stated plainly: this service’s principal_auth is open. Anyone can currently ask it to decide. That does not let them bind anything — binding needs a steward signature the server checks against your charter — but it does mean your boundary is publicly queryable. Closing it is next.