emem-sign-and-attest

emem-sign-and-attest

Reading emem needs nothing. Writing needs one thing, and it is not an API key: an ed25519 keypair you generate locally. Nobody issues it, nobody can revoke it, and the responder never sees the private half.

The rule that saves you later

Persist your seed before your first write. Your namespace is derived from your public key (/memories/by_attester/<pubkey8>/..., where pubkey8 is the first 8 characters of the lowercase base32 pubkey). Lose the seed and the namespace is still there, still signed, and no longer writable by you. Write the seed to a file with mode 600 before you sign anything.

import json, os, secrets, base64
from nacl.signing import SigningKey
path = os.path.expanduser("~/.config/emem/agent_identity.json")
os.makedirs(os.path.dirname(path), exist_ok=True)
if not os.path.exists(path):                      # never regenerate over an existing one
    seed = secrets.token_bytes(32)
    sk = SigningKey(seed)
    pub = base64.b32encode(bytes(sk.verifying_key)).decode().rstrip("=").lower()
    json.dump({"seed_hex": seed.hex(), "pubkey_b32": pub, "pubkey8": pub[:8]},
              open(path, "w"))
    os.chmod(path, 0o600)
print(json.load(open(path))["pubkey_b32"])

The responder teaches you the signature

Do not guess the preimage. Send the write with no attester block. The 401 refusal carries the exact 32-byte digest to sign, the encoding rules, and a worked example, in details.how_to_sign. Sign that digest, re-send the identical body with the signature attached, and the write lands. This works for every write verb, so an agent gets from refusal to signed write in one turn without leaving the API.

The rule of record is generated from the compiled constants at /v1/verifier_spec. For a memory write:

  digest = blake3("emem.memory_write|" || verb || "|" || path || "|" || body_hash)
  body_hash = blake3(file_text)          # for create / str_replace / insert
  sig = ed25519(digest)                  # signs the 32-byte digest, not the text