Player Accounts

The current realm stores player accounts as event streams keyed by did:key. SSH public-key registration and password registration work. A full moderation and trust console does not.

Public-key registration

The SSH daemon accepts a public key, derives its did:key, and looks for an account stream. A new key enters registration and chooses a local username. Returning keys resolve to the same account.

ssh -p 2222 [email protected]

The username is local presentation. The DID contains the Ed25519 public key through multicodec and base58btc; it is not the obsolete did:archi:<hash> form.

Password registration

A player can connect with a desired username and use new as the SSH password to enter the registration flow. The realm generates an Ed25519 keypair, encrypts the seed under a password-derived key, and stores the password with bcrypt.

The key-export and password-revocation modules exist, but the /export meta-command currently conflicts with the journal export route. Do not promise key migration through the TUI until that dispatch conflict is resolved.

Invitations and rate limits

Archipelago.Identity.InviteToken issues and consumes single-use tokens in the event store. Registration checks them when :invite_gating is enabled. SSH connection, registration, guest-count, and invitation rate limits are backed by ETS.

The /invite admin response currently generates a display token without storing it through InviteToken.issue/1. Keep invite gating disabled or issue tokens through the identity API until those paths are joined.

Capabilities

Capabilities, signed minting, delegation, attenuation, revocation, and writ materialization are implemented as domain libraries. Connection mode checks enforce :write, :author_scripts, and :realm_admin.

The account login path does not yet load a player’s capability bag into the TUI connection. There are no working watch> grant, watch> revoke, watch> trust, watch> kick, watch> ban, or watch> who handlers in the current admin dispatcher. Older documentation showing those commands described the design, not the branch.

Until moderation and capability assignment are wired, expose a realm only to people who understand that it is a developer preview. Network-level controls and database intervention are not substitutes for an in-world moderation surface.