✶ The lamplit loom · identity and wiring

KeyWeaver

Every machine holds a key; every key can be woven. Delegate access with a signature, wire any two machines together over a network you own, and let the loom keep your services running.

Join the weave Meet the threads

a delegation, wholegrant → connect · nothing else

$ keyweaver grant ada --network atelier \
    --node loom-01 --can ssh,deploy --ttl 7d
  bundle written · ada.kwb

# ada, on her machine; no account anywhere
$ keyweaver connect --bundle ada.kwb
  capability verified offline
  wired into atelier · loom-01 reachable

Hand someone a key · they just connect

01The threads

Access is a key you sign, not a row in someone's database.

A person is a keypair; a machine is a keypair. To let someone in, you sign a capability: this holder, these nodes, these actions, this long. Any node can check it alone, offline, with nothing but its own public-key material.

Identity: One Ed25519 keypair per person and per machine
Grant: A signed capability with a scope and an expiry
Verify: Offline and stateless; no phone-home, ever
Offboard: TTLs are short by design; leaving is as clean as joining

02The wiring

Any two machines that should meet, meet.

Once two parties hold identities and a capability, the loom pulls the thread through: an encrypted WireGuard path between them, over a network you control end to end. The person on the other side runs one command.

Transport: WireGuard; an encrypted path, node to node
First contact: One token or one bundle; after that it reconnects itself
Coordinator: The enroll and relay control plane; run your own
The daemon: Holds the thread through sleep and reboot

03The pattern

Declare the pattern; kpm keeps it.

Services are declared in one TOML file and handed to kpm. It runs them, restarts them by policy, health-checks them, and keeps the logs; foreground while you develop, detached when you ship.

kpm.tomlkpm apply · done

[[processes]]
name = "api"
command = "node"
args = ["server.js"]

[processes.restart_policy]
type = "on-failure"
max_retries = 5

[processes.health_check]
type = "http"
url = "http://localhost:8090"
interval = "5s"

Also on the loom · groups · dependency order · log ledger · a daemon

04Kept in your hands

The cloth belongs to whoever wove it.

Keys are generated on your machines and stay there. What the loom learns is written to a local ledger; what it syncs, it encrypts before it leaves the house.

Accounts: None; identity is a key you generate
Coordinator: Self-hosted if you like; the network is yours either way
Ledger: One SQLite ledger on device, in .kpm
Sync: A zero-knowledge depot; the server sees ciphertext only

05Join the weave

The loom is still being strung; the first threads go to those who ask. Say the word, and a build will find you the night it ships.

Ask for an early thread Why a loom