How Headless Self-Asserting Identity Works
When an autonomous agent initializes sovseal (via@sovseal/sdk, @sovseal/mcp-server, or the CLI), it self-asserts a local project identity:
- Token Generation: sovseal generates an anonymous UUID project key prefixed with
sov_proj_(e.g.sov_proj_00000000-0000-4000-8000-000000000000). - Key Custody: The client derives a local Data Encryption Key (DEK) stored securely in the local environment (e.g. OS keychain or encrypted file store).
- 0-RTT Local Memory: All memory operations (
store,recall,search) run locally at 0-RTT latency. - Ciphertext Sync: If optional cloud replication is enabled, memories are synced as zero-knowledge ciphertext blobs — readable by no one else, including the server.
4-Command Terminal Bootstrap
For agents running in CI/CD pipelines, Docker containers, or background cron workers:Transitioning to Paid Tiers (sov_live_)
If your autonomous agent requires multi-region replication or team sharing:
- You can upgrade the project in the dashboard to issue a
sov_live_production API key. - The server stores only a SHA-256 hash of the
sov_live_key, preserving the zero-knowledge security boundary.