How it works
Circuits & compiled twins
A circuit is a cryptographic identity embodied as a compiled binary. The twin is the prover/verifier pair that makes one-shot authority possible without a reusable secret vault.
A circuit carries its own config, entropy, and policy. Identity travels with the artifact, identified by a handle and by the SHA-256 of the binary, rather than sitting in a credential vault that becomes a breach target.
The compiled twin is the dual of that identity used at the gate: the prover produces challenge/response material; the verifier (local binary or registry) accepts or rejects. Possessing a prover host is not the same as possessing authority for a specific request, the envelope still has to bind method, endpoint, body, policy, tau, and nonce.
Revocation does not require rotating secrets across every workload. Deactivating the handle in Control stops new envelopes for that identity. Rotating means minting a successor binary and activating it through the registry lifecycle.
Mechanism claims
Identity is compiled into the circuit binary (there is no vault of reusable secrets to steal).ShippingConfig, entropy, and policy travel with the artifact; the handle resolves to the active binary.Holds under the reference architecture
Revocation is one registry state change on the circuit handle, not a rotation campaign across every workload.ShippingDeactivating a handle stops new envelopes for that identity at the control plane.Holds under the reference architecture