forge-onboard — Whitepaper Amendment (2026-06-04)

Forgechain OS Product
Amendment Version 1.0 — 2026-06-04
Author: Jack Mosel / Forgechain OS
Subject: Uniform forgeOnboarding SOP — WebAuthn passkey, IPv6 Rodin tile, chain-anchored Sovereign Person under natural law

Abstract

Identity infrastructure on the modern internet is a tax: every platform demands an account, an email, a password, sometimes a phone number, sometimes biometric data they store on their own servers. The user surrenders their personal sovereignty to each platform piecewise. Recovery flows are humiliating. Forgotten passwords become a corporate-customer-service hostage situation. Biometric data, once given to a SaaS, is permanently exfiltrated.

forge-onboard refuses that exchange. It is a sovereign onboarding substrate. A person becomes onboarded into ForgeChainOS by proving they are a unique biological agent on a device they control, sealing that proof against BSV blockchain, and declaring ownership of their own person under natural law jurisprudence. The platform — ForgeChainOS — never holds the biometric raw material. The substrate is the witness, not the owner.

This amendment establishes the canonical, uniform forgeOnboarding SOP. Before this amendment, two paths existed: (1) raw face + voice embeddings captured via browser getUserMedia, stored sovereign-internally on family hardware, hash anchored to BSV (Phase 6.5.2, 2026-06-02); (2) ad hoc passphrase login as a fallback. The first pattern, while sovereignty-canon-correct in principle, broke on real-world user testing: cross-browser getUserMedia permission state friction, Safari MediaRecorder format incompatibility, iOS permission stickiness that non-technical users could not self-recover from. Kate Hoekstra — the first cold-onboarded external client — could not complete the flow despite multiple hours of attempted device-side debugging.

The lesson: any sovereign onboarding pattern that requires the user to debug browser permissions is operationally non-sovereign. The user's experience of sovereignty must be at least as friction-free as the surveillance-capitalism alternative they are escaping. Otherwise the system serves only the technically gifted and re-creates the very gatekeeping it claims to oppose.

This amendment retires Phase 6.5.2 raw-embeddings as the onboarding primary, repositions it as an optional in-person family-rite ceremonial layer, and establishes WebAuthn passkey + IPv6 Rodin tile + chain-anchored public key + smart contract attached "Sovereign Person — All Rights Reserved Under Natural Law" statement as the uniform SOP for ALL sovereign persons onboarded into ForgeChainOS going forward.

1. The Failures This Amendment Closes

1.1 The Phase 6.5.2 raw-embeddings failure mode (technical)

The earlier doctrine asked a non-technical user to:

1. Grant Safari camera permission via iOS Settings (Settings → Safari → Camera → Allow). This setting is sticky-denied if any prior prompt was rejected — the OS does not re-prompt; the user must navigate to Settings, find the right toggle, and flip it. Most users cannot find Settings → Safari → Settings for Websites → Camera in the iOS Settings hierarchy on first attempt.
2. Disable Safari Private Browsing, which silently blocks getUserMedia.
3. Trigger a single user-gesture-bound getUserMedia({video:true, audio:true}) call.
4. Maintain an active camera + microphone stream while capturing three video frames at different head angles.
5. Re-acquire a fresh microphone stream (per the v7 patch) because Safari let the long-lived audio track go inactive between modal-open and record-button-click.
6. Use a MediaRecorder instance with a browser-compatible mimeType (per v6 patch — Safari does not support audio/webm; needs audio/mp4).
7. Encode the recorded blob as base64 and submit to a sovereign-side endpoint.
8. Wait while sovereign-side computes face-recognition embedding (CPU, dlib-backed) + SpeechBrain ECAPA-TDNN voice embedding (GPU-capable).
9. Wait while the cryptographic seal is constructed and anchored to BSV via fire.js.

This flow has nine moments of failure visible to the user as opaque errors (Safari shows generic strings; users cannot self-diagnose). It also leaks substantial information about the user's hardware, OS version, and browser to the sovereign-side observer through the error reports, undermining the very privacy claim.

1.2 The conceptual failure mode

The raw-embeddings architecture treated the substrate (family hardware) as the trust root. The user was asked to trust that ForgeChainOS would protect their biometric embeddings — and indeed the architecture promised this (sovereign-internal storage, hash-only chain commitment, family salt).

But sovereignty is not about whose servers hold your data — it is about whose hardware computes the privacy-critical transformation. A user's face data, once exported from their phone's secure enclave to an external server (even a sovereign one), has crossed a trust boundary that cannot be uncrossed. This is the same critique that applies to every cloud-biometric platform, and it applies symmetrically to a sovereign substrate that operates on the same model. The fact that ForgeChainOS would not misuse the embeddings is necessary but not sufficient: the architecture must make misuse structurally impossible. Raw-embedding storage on family hardware does not satisfy that bar.

WebAuthn does. Apple's Secure Enclave, Google's Titan M, Microsoft's TPM-backed Hello: these process the biometric raw material entirely within tamper-resistant silicon and emit only a cryptographic signature. The biometric never leaves the user's hardware. The architecture is structurally tamper-evident at the level of physics — not policy.

For a sovereign substrate that must serve people who are not technical and who have no reason to trust any specific operator (including ForgeChainOS), the structural-impossibility model is the only correct model.

2. The Uniform forgeOnboarding SOP

2.1 Enrollment

1. Client lands on forge-onboard (cold from email or in-person)

2. Client provides legal name (for the Sovereign Person statement attestation)

3. Client triggers WebAuthn passkey creation
   - Single user gesture (button tap on the onboarding page)
   - Browser invokes navigator.credentials.create({
       publicKey: {
         challenge: <server-issued nonce>,
         rp: { name: "ForgeChainOS", id: "forgeonboard.theforgechain.com" },
         user: { id: <slug bytes>, name: <slug>, displayName: <legal name> },
         pubKeyCredParams: [{ type: "public-key", alg: -7 }],   // ES256
         authenticatorSelection: { authenticatorAttachment: "platform",
                                   userVerification: "required",
                                   residentKey: "required" },
         attestation: "direct",
       }
     })
   - The device prompts NATIVE biometric:
       iPhone → Face ID (Secure Enclave, system-level prompt)
       Android → fingerprint or face
       Mac → Touch ID (T2 or M-series Secure Enclave)
       Windows → Hello
   - The device generates an ES256 keypair, returns: {
       credential_id, public_key, attestation, client_data
     }
   - Raw biometric data NEVER LEAVES the device. The Secure Enclave is the
     witness. ForgeChainOS sees only the public key.

4. forge-onboard computes the client's IPv6 Rodin tile address:
     tile        = (sha256(slug + family_salt) % 9) + 1     # 1..9
     hemisphere  = "throat"    if tile in {3, 6, 9}
                   "overwatch" otherwise
     hemi_code   = "01" for throat, "02" for overwatch
     short_hash  = first 8 hex of sha256(slug)
     ipv6        = fc00:<tile>:<hemi_code>:<short_hash>::1
   This is deterministic — same slug always produces the same tile. The tile
   becomes the client's sovereign substrate coordinate, also used as the
   NOAH RAG corpus retrieval index for their vault content.

5. forge-onboard constructs the Sovereign Person Statement:
     canonical_text = "I, " + legal_name + ", claim ownership of my " +
                      "sovereign person. All rights reserved under natural " +
                      "law. This identification is irrevocable, tamper-" +
                      "evident, and anchored to BSV at the moment of " +
                      "enrollment. ForgeChainOS holds no claim over my " +
                      "person — it serves as the substrate by which my " +
                      "sovereignty is publicly attested."
     statement_hash = sha256(canonical_text + slug + iso_timestamp)

6. forge-onboard constructs the identity seal:
     identity_seal_hash = sha256(public_key_bytes ||
                                  ipv6_address_bytes ||
                                  statement_hash ||
                                  family_salt)

7. forge-onboard fires the chain anchor via family-encrypted fire.js:
   Smart contract envelope: "Sovereign Person Ownership — All Rights
                              Reserved Under Natural Law"
   Payload (family-encrypted CBOR, sovereign-private):
     {
       schema_version: 1,
       slug: <slug>,
       legal_name: <legal_name>,
       rodin_tile: { tile, hemisphere, ipv6 },
       public_key_fingerprint: sha256(public_key)[:32],
       statement_hash: <hex>,
       statement_text: <canonical_text>,
       identity_seal_hash: <hex>,
       sealed_at: <iso>,
     }
   Returns: { tx, fire_id }

8. The YOKE — bidirectional binding now committed across four surfaces:

   (a) MASTER-MANIFEST.yaml gets a new sovereign_persons entry:
       sovereign_persons:
         <kebab-case-name>:
           tenant_slug: <slug>
           legal_name: <legal_name>
           rodin_tile:
             tile: <N>
             hemisphere: <throat|overwatch>
             ipv6: <fc00:tile:hemi:hash::1>
           public_key: <hex>
           credential_id: <hex>
           identity_seal_hash: <hex>
           identity_seal_tx: <BSV TX>
           sealed_at: <iso>
           statement_hash: <hex>
           sovereign_contract_tx: <BSV TX (often same as seal_tx)>
           tenant_file: ~/.forgechain/forge-onboard/accounts/<slug>.json
           forgechainos_onboarded: true

   (b) ~/.forgechain/forge-onboard/accounts/<slug>.json gets reverse-yoke:
       {
         ...existing fields...,
         "sovereign_person_manifest_key": "sovereign_persons.<name>",
         "rodin_tile": { ... },
         "webauthn_credential_id": "<hex>",
         "webauthn_public_key": "<hex>",
         "identity_seal_hash": "<hex>",
         "identity_seal_tx": "<BSV TX>",
         "statement_hash": "<hex>",
         "sealed_at": "<iso>"
       }

   (c) Chain TX (BSV) — immutable record carrying the encrypted payload
   (d) Tenant Obsidian vault (~/.forgechain/forge-onboard/vaults/<slug>/)
       gets a SOVEREIGN-IDENTITY.md note carrying the human-readable
       statement + verification instructions

   From any one of (a)(b)(c)(d), the others are reachable. No floating refs.

2.2 Authentication (every future login)

1. Client lands on forge-onboard/login

2. Client triggers WebAuthn assertion
   - Browser invokes navigator.credentials.get({
       publicKey: {
         challenge: <server-issued nonce>,
         rpId: "forgeonboard.theforgechain.com",
         userVerification: "required",
       }
     })
   - Device prompts NATIVE biometric (Face ID etc.)
   - Device returns: { credential_id, signature, client_data, authenticator_data }

3. forge-onboard verifies the signature against the stored public key:
     - Look up sovereign_persons entry by credential_id
     - Use server-side WebAuthn verification library to verify signature
       over (authenticator_data || sha256(client_data))
     - Confirm rpId, challenge, user verification flag
     - Confirm credential_id matches a known sovereign_persons entry

4. Issue session token (admin_token equivalent for Studio + Talk to Elder)

NO PASSWORD. NO web camera permission. NO getUserMedia. NO MediaRecorder.
The Secure Enclave authenticates the user; ForgeChainOS authenticates the
Secure Enclave's attestation. Three-party silicon-anchored auth.

2.3 Recovery (when device is lost)

The current SOP intentionally has NO native recovery path. The credential is bound to a single device's Secure Enclave (or to an iCloud Keychain / Google Password Manager replicated set, at the user's option). If the device is lost AND iCloud is not restored, the user has lost access.

This is the natural-law correct outcome. A sovereign identity is bound to the person and the hardware they trust. Recovery via centralized escrow is the surveillance-capitalism model.

For the family — bearer cards (Anne #1, Kate #2, Tommy #3, David #4, William #5) serve as the cryptographic last-resort recovery path. A bearer presents their card; the family witnesses the bearer; a new credential is issued. The chain anchor is updated with the credential rotation; the original Sovereign Person statement persists.

For non-family tenants, the SOP requires the tenant to designate a recovery contact (a person, not an institution) at enrollment, and the recovery contact's WebAuthn assertion authorizes credential reset. The original Sovereign Person statement and Rodin tile coordinate persist.

3. The Sovereign Person Smart Contract

3.1 Canonical text (subject to NZ language review before first fire)

I, <legal_name>, claim ownership of my sovereign person.

All rights reserved under natural law.

This identification is irrevocable, tamper-evident, and anchored to BSV at
the moment of enrollment.

ForgeChainOS holds no claim over my person — it serves as the substrate
by which my sovereignty is publicly attested.

3.2 Jurisprudential framing

The statement positions the sovereign person ownership claim under natural law rather than under any statutory regime. Natural law jurisprudence holds that certain rights inhere in the person by virtue of their existence as a rational creature, and these rights pre-exist any state, contract, or platform. The statement is not making a claim under U.S. law, EU law, or any other statutory framework — it is asserting a pre-statutory claim that those frameworks acknowledge but cannot grant or revoke.

This framing is important because:

• Under statutory regimes, the right to one's biometric data is granted (and revocable) by statute (GDPR Article 22, Illinois BIPA, etc.). Platforms structure their consent flows accordingly.
• Under natural law, the right is inherent. The chain-anchored statement creates a public, immutable, tamper-evident witness to the holder's claim. The substrate (BSV) provides the witness; the holder makes the claim.
• A natural-law-framed claim is jurisdiction-agnostic. It survives changes in statutory regime, platform ownership, and political jurisdiction.

The statement is not legal advice and the platform does not represent that any particular court would honor it. The statement is a declaration — a publicly anchored assertion the holder makes about themselves.

3.3 Smart contract envelope

The chain inscription carries the statement_hash as the canonical commitment. The full statement_text is included in the family-encrypted CBOR payload. A future on-chain index could expose statement_hash → statement_text mapping via a sovereign overlay (forge-edge), allowing third parties to verify a sovereign person's claim by hash.

The "smart contract" framing follows ordinal-inscription convention: a small structured data blob attached to a BSV TX, interpretable by any compliant indexer.

4. The Rodin Tile as Sovereign Address

4.1 Why a tile

The 3-6-9 Rodin geometry is the family's canonical topology (per NODEZEROINSIDE Torus Sigil canon). Every family node has a tile assignment: WarDog throat (3), Elder I structure (6), Elder II resonance (9). The Rodin positions provide a geometric language for substrate coordinates.

Per NZ canon 2026-06-02 ("AND THE IPV6 RODIN TILING BECOMES THE RESOURCE LOCATOR(s) FOR INDEXED SEARCH FILES FOR ACCURACY AND SPEED"), tile coordinates are the canonical retrieval index for NOAH's RAG corpus over the per-tenant Obsidian vaults. A tenant's tile coordinate is also where their vault content gets indexed for NOAH-mediated search.

By assigning each sovereign person a tile coordinate AT ENROLLMENT and yoking the tile into their identity seal, the address becomes:

1. An identity coordinate (which tile + hemisphere they occupy in the family substrate)
2. A retrieval address (where their vault content lives for NOAH RAG lookup)
3. An IPv6 endpoint (routable in a sovereign network, fc00:: ULA space)

4.2 Assignment formula

tile = (sha256(tenant_slug + family_salt) % 9) + 1     # values 1..9
hemisphere = "throat" if tile in {3,6,9} else "overwatch"
hemi_code = "01" for throat, "02" for overwatch
short_hash = first 8 hex of sha256(tenant_slug)
ipv6 = fc00:<tile>:<hemi_code>:<short_hash>::1

The assignment is deterministic — same slug always produces the same tile. The family_salt is the canonical salt for the family substrate; same one used for the identity seal hash.

4.3 Tile collision

Multiple tenants can share a tile coordinate (only 9 tiles, many tenants). This is intended — tile coordinates are geometric, not unique identifiers. The unique identifier is the IPv6 short_hash suffix.

The tile is the resonance class — tenants on the same tile share NOAH RAG retrieval context, can participate in same-tile sovereign meetings (e.g., all tile-5 sovereign persons could federate around the discriminant / origin of phi), and are surfaced together in family-side topology views.

This is design, not bug. Per the Klein Bottle 6-9-3 governance canon, the geometry organizes the substrate; tenants are not isolated unique snowflakes but participants in a shared geometric topology.

5. Two Patterns Coexist in Canon

This amendment does NOT remove the Mobile Command Face ID pattern (NZ Tier 0 Imperial). Two patterns coexist:

The first two coexist because they serve different threat models:
- NZ's pattern: NZ owns the hardware (WarDog), NZ owns the family canon ed25519 keys, the trust chain is NZ-to-WarDog-to-substrate. The biometric never leaves WarDog's Secure Enclave; the substrate sees only the signed canon authoring.
- WebAuthn pattern: the user owns their device, the device's Secure Enclave is the trust root, the substrate sees only the registered public key. The substrate operator (ForgeChainOS) is not a trust party — the substrate is a witness.

Both patterns honor the canonical sovereignty principle: the biometric raw material never leaves the user's trusted hardware. They differ only in who that hardware is and what the trust chain looks like above it.

6. Implementation Status (2026-06-04)

7. Composes With

8. Obsidian + VS Code Designation

Per NZ canon 2026-06-04 ("INCLUDE OBSIDIAN AND VS CODE DESIGNATION FOR TAGS AND CONNECTIONS FOR DAPP FORGEONBOARD"):

8.1 Obsidian tags + connection patterns

Every tenant's SOVEREIGN-IDENTITY.md (in their vault) is tagged:

---
tags:
  - forgechain
  - sovereign-person
  - sovereign-identity
  - tenant-onboarded
  - tile-N                       # the assigned Rodin tile
  - hemisphere-throat | hemisphere-overwatch
  - forgeonboard
  - webauthn
  - chain-anchored
forgechain_tx: <BSV TX>
rodin_tile: { tile, hemisphere, ipv6 }
manifest_key: sovereign_persons.<kebab-name>
---

The forgechain-obsidian plugin (already canonized) indexes these tags. From any tile-N note in a tenant vault, the plugin surfaces all other tile-N notes — across all tenant vaults and the _shared corpus — providing the Rodin-tile-based retrieval canon NZ specified.

8.2 VS Code workspace designation

The existing ForgeChainOS.code-workspace file at vault root (per May 25 canon) is extended to include the forge-onboard surface roots so a developer working on forge-onboard sees all relevant files in one workspace:

{
  "folders": [
    { "name": "Vault", "path": "/home/jack/Desktop/Jack's OS Vault/Jack's OS Vault" },
    { "name": "forge-onboard (Elder I)", "path": "/home/jack/.forgechain/forge-onboard" },
    { "name": "forge-onboard (BH via SSH)", "path": "ssh-remote+nodezero@192.168.1.156/home/nodezero/.forgechain/forge-onboard" },
    { "name": "noah-router (BH)", "path": "ssh-remote+nodezero@192.168.1.156/home/nodezero/.forgechain/services/noah-router" },
    { "name": "admin-studio.html (forge-edge)", "path": "ssh-remote+root@159.89.235.133/var/www/forge-edge-static" }
  ],
  "settings": {
    "files.exclude": { "**/node_modules": true, "**/.venv": true }
  }
}

A developer opening this workspace gets a unified view across all three nodes that compose forge-onboard.

9. Closing

"WEB AUTH PASSKEY FOR ANYONE TO BE ONBOARDED. I WANT THIS TO BE UNIFORM AND SOP. FORGEONBOARDING - INDIVIDUAL CLIENTS - IPV6 RODIN TILING - BIOMETRICS TAKEN FILED STORED CHAIN STAMPED - IMMUTABLE IDENTIFICATION AND SOVEREIGNTY STATEMENT ATTACHED AS SMART CONTRACT OWNERSHIP OF SOVEREIGN PERSON STATEMENT ALL RIGHTS RESERVED UNDER NATURAL LAW STATEMENT."

— NZ canon-stamping declaration, 2026-06-04

This amendment is the architectural rendering of that declaration. The substrate is the witness. The person is the sovereign. The chain is the anchor. The natural law is the framing. The Secure Enclave is the proof-of-personhood gate that nobody else can hold.

NODEZEROINSIDE. ∞.

forgechain #canon #whitepaper-amendment #throat-side #forge-onboard #sovereign-onboarding #webauthn #rodin-tile #smart-contract #natural-law