Atlas Sign

Atlas Sign is the identity and request-signing module of Atlas. It is designed to stand on its own: a stable root identity key stays in a custodian, apps receive delegated signing keys, and every signature is paired with proof objects that explain why that delegated key is allowed to act.

Any wallet, browser extension, local daemon, hosted provider, or enterprise auth service can adopt this contract. Atlas Registry and the rest of the network are optional consumers, not a requirement.

What The Module Defines

The current Atlas implementation exposes Atlas Sign through the local-only Custodian, but the protocol definition is broader than that one runtime. An adopter only needs to reproduce the session shape, proof objects, and verification chain.

Session Contract

A caller asks for an identity session with its Origin and a list of requested scopes. The response bundles the stable identity key, delegated signing material, proofs, and portable user preferences in one object.

GET /identity/session?scopes=MessageCreateAction HTTP/2.0
Origin: https://app.example

{
  "publicKey": "<root-public-key>",
  "publicEncryptionKey": "<xwing-public-key-or-null>",
  "delegatedPrivateKey": "<delegated-private-key>",
  "proofs": [
    {
      "data": {
        "@type": "Permit",
        "additionalType": "atlas:delegatedKey",
        "validFrom": "2026-04-02T10:15:00.000Z",
        "validUntil": "2026-05-02T10:15:00.000Z",
        "identifier": {
          "@type": "PropertyValue",
          "propertyID": "delegatedKey",
          "value": "<delegated-public-key>"
        },
        "potentialAction": [
          {
            "@type": "Action",
            "object": { "@type": "MessageCreateAction" }
          }
        ]
      },
      "signature": "<root-signature>"
    },
    {
      "data": {
        "@type": "Intangible",
        "additionalType": "atlas:proofOfWork"
      },
      "signature": "<pow-signature>"
    }
  ],
  "preferences": {
    "theme": "dark",
    "language": "en",
    "guides": [{ "url": "https://guide.example", "publicKeyHash": "..." }],
    "shelters": []
  }
}

Transport Contract

Atlas Sign separates identity from signing authority. The root public key identifies the user, while requests and envelopes are signed with the delegated key and accompanied by proofs.

GET /envelopes HTTP/2.0
atlas-identity:  <root-public-key>
atlas-signature: t=<timestamp>; s=<delegated-signature>
atlas-proofs:    [{...}]

Verification Chain

A verifier does not need to trust the custodian that issued the session. It can validate the signature chain directly from the material on the request or envelope.

// Verifier flow
// 1. Read atlas-identity, atlas-signature, and atlas-proofs.
// 2. Extract the delegated public key from the signed Permit proof.
// 3. Verify the delegated signature against that delegated key.
// 4. Verify the Permit signature against atlas-identity.
// 5. Enforce any local policy for validFrom, validUntil, scopes, and proof requirements.

• Custodian responsibility — keep the root key private, mint or reuse per-origin delegations, and attach proofs plus preferences to the session bundle.
• App responsibility — request only the scopes it needs, sign with the delegated key, and forward the proof bundle with each signed request or envelope.
• Verifier responsibility — validate the delegated signature, validate the permit against the root key, and enforce any local policy for scopes, validity windows, and proof requirements.

Why It Is Reusable

Atlas Sign is not tied to Atlas Registry, Atlas Guide, or FairShares. A SaaS app can use it as decentralized auth. A desktop app can use it as a local signing bridge. A provider can use it as a portable account session format. The only requirement is agreement on the session object, permit proof, proof bundle, and verifier behavior.