Ask Scripture through your own agent — without being named

When you ask a question, the Scripture Agent answers it from a signed corpus. It never learns your name or your account. It sees only a pseudonym your own agent made for it. This page shows how that works, step by step — and how you pay for a licensed edition and read it, again without being named.

Prefer to watch? The animated walkthrough tells the same story as a town.

1 · Asking

From your question to a verified answer, under a pseudonym

Five parties take part. The green dashed line is the privacy boundary: your name, your account and your sign-in token stay on its left. The Scripture Agent works only from what crosses it.

1. Connect. You click Connect in the Explorer and sign in at your Home (www.faithnet.me), with your passkey, Google or wallet. The Explorer never sees that credential.
2. Your Home gives the Explorer an “ask-as-me” wire. This is a delegation signed by your agent's account. It lets the Explorer do one thing: put a question to your own agent (harness.ask). It lasts 30 days, and you can revoke it at your Home.
3. You ask a question in the Explorer's Ask box.
4. The Explorer signs the ask with its own key (an AKCS delegate key, never yours) over the exact question, the destination and the moment. It sends the ask, wrapped in your wire, to your agent.
5. Your agent checks it on chain. It checks that the wire is yours (ERC-1271 against your account), that it hasn't been revoked, that it is inside its time window and allows only asking, and that this signed ask is used just once.
6. Your agent makes a pseudonym for this one ask. The Scripture Agent's card says it accepts pseudonymous askers. So your agent derives usr_… = HKDF-SHA256(your secret, “scripture.faithnet.io”, a fresh random nonce). The secret is a random 32-byte value kept in your own vault (identity.pairwise-secret). Every ask gets a new usr_…, so the Scripture Agent cannot tell that two questions came from the same person. Nobody can work back from one to you without your secret.
7. Only the question and the pseudonym cross. No sign-in token, no wire, no account address, no name and no Home address. The Scripture Agent refuses a pseudonymous ask that arrives carrying any credential, so your agent cannot leak one by mistake.
8. The Scripture Agent answers from a signed corpus. It resolves each passage it uses from the corpus and checks the verse text against the publisher's signed commitment. It grades whether the text really supports its use and composes the answer from verified text only. Passages that fail verification are shown, not hidden. Each citation is signed by the service's content-signer key, a delegate whose authority traces back to the service's own account. The citation names its reader only as urn:scripture:reader.
9. The answer comes back to you through your agent and the Explorer. Verify citation re-checks any verse live.

Who learns what

2 · Paying and reading licensed text

A reader's pass that no one can trace to you

Licensed editions (such as lbsb) are read with a private reader pass. You pay once from a purse with no name, the publisher's agent issues an anonymous credential to a fresh key of yours, and every verse you open after that is read under a new pen name with a zero-knowledge proof. The green line is the same boundary as above.

1. You choose to buy a pass (1 test USDC, 30 days). The Explorer sends you to your own Home; it is told only that a pass exists and until when.
2. Your purse pays. The purse is a treasury whose custodian is derived from your sign-in on its own path, so on chain it shares nothing with your account: no common custodian, no stewardship link, no name. Only a note in your own vault ties it to you. On this test chain it fills itself in the same step, so no named account ever funds it.
3. Your agent collects the pass without naming you. It makes a brand-new key in your key service (a key your agent can use only when you have allowed it) and gives the publisher's agent three things: the receipt, the new key, and the purse's signature over both. The signature proves the claim comes from whoever paid, so someone who only saw the public payment cannot claim it.
4. The publisher issues a reader's card to the key. lbsb.svc checks the payment on chain, crosses the receipt off so it can never be used twice, and issues an OpenAC anonymous credential — “licensed reader, valid until day N” — bound to the new key, signed by its issuing key in its key service. Its records keep the receipt and the key's fingerprint, never you. The card goes into your vault, with a standing permission signed by you that lets your agent present it — only to the Scripture Agent, only on the days the pass covers.
5. Each licensed verse is a fresh proof. Your agent takes a single-use challenge from the Scripture Agent and a prover beside your agent makes a zero-knowledge proof: a valid reader's card from lbsb.svc, still valid today. Your key signs it only under a short-lived permission derived for exactly this read. It travels under a pen name made for this read alone. No two proofs share anything visible.
6. The Scripture Agent checks and answers. It verifies the proof against the publisher's stamp on faithchain (its signature and its live attestation), spends the challenge once, and reads the verse from the signed corpus.

Who learns what