Architecture
Public developer tools with explicit identity, authority, permission and presentation boundaries.
Open developer core
The published TypeScript SDK 0.7.2 supplies local persistent keys/trust, current identity verification, OATS evidence scoring, canonical Glyph and live characters. Starter 0.5.2 runs the actual loopback HTTP flow. Separate OIDC 0.2.0 provides a real issuer for registered relying parties. No centralized service or Life account is required for the local identity/avatar path.
| Boundary | Responsibility |
|---|---|
| Signer | Authorized private-key custody and proof signing |
| Receiver | Explicit public-key trust, issued challenge, current root/revocation policy and atomic replay consumption |
| Application | Operation/tenant permission and requested action |
| Browser avatar | Live presentation from the host's authorized state channel; no identity authority |
| OIDC host | Signing/cookie custody, durable provider storage, consent interaction and registered issuer/client trust |
Approved self-rooted agents and owned identities use explicit current policies. A local root has no invented human owner; an owner-bound integration checks the actual person/org authority. Identity does not automatically mint credentials, run a worker or publish a profile.
Protocol and integration layers
OAS supplies DID/documents/crypto/lineage/attestations; ACT supplies signed scoped capabilities; Arsenal supplies broker/credential/policy contracts; AEGIS supplies verification/key/delegation/policy modules. The older facade composes real configured clients. Other language SDKs and adapters retain independent APIs and versions.
LifeID/WorkOS authenticates humans and organizations for Life integrations. Blinds brokers credentials; Genesis KMS protects customer secrets. Optional anchor adapters, including EAS configured on Base, require verifier-owned trust and deployment policy; no automatic Sigil migration is implied.
Start with the quickstart, verification, avatars and production boundaries. The published package reference records actual package exports, versions, declaration hashes and integration limits. Published libraries and a configured hosted deployment are separate things.