atem unpair, then atem pair. The Recovery Kit is Astation account recovery, only when every Astation device is lost.Atem checks the chain from its pin, a fresh head, and that the device really holds its key — then grants exactly its roles.
+Atem's challenge names its head; the device brings the entries after it. Atem applies them first, then checks the device really holds its key and grants exactly its roles.
sequenceDiagram
autonumber
participant P as iPhone Astation
participant R as Relay
- participant M as Any online manager
participant A as Atem
P->>A: hello (via relay or direct :8080)
- A->>P: challenge nonce + Atem's newest seq (2)
- P->>M: head attestation for nonce, please
- M->>P: signed {seq 3, head hash, nonce, time}
- P->>A: entries 3 + attestation + signature over (nonce, atem id, trust gen, ephemeral keys)
- A->>A: entries chain from pinned hash? attestation by a listed manager, not older than seq 2?
+ A->>P: challenge nonce + Atem's head (seq 2, hash)
+ P->>A: entry 3 + signature over (nonce, head, atem id, trust gen, ephemeral keys)
+ A->>A: entry 3 chains from head 2, signed by a manager at seq 2?
+ A->>A: head 3 made durable, entry applied (removals fenced) — before admission
A->>A: iPhone listed, not removed, roles control+view? signature valid?
- A->>P: welcome — roles control+view, 24 h window starts now
+ A->>P: welcome — roles control+view, Atem's head is seq 3 (up to date)
Note over P,A: Step 2 of the proposal: both derive session keys from the ephemeral exchange
so the relay can't read terminal or chat traffic
Removal is just another signed entry. Atem never moves backwards and never trusts a list older than 24 h.
+Removal is just another signed entry, carried by the next connection — trust the signature, not the sender. Atem never moves backwards; a conflict signed by a still-valid manager freezes remote access until the host is re-paired.
flowchart TD @@ -170,15 +169,18 @@Removing a device, and staying safe offline
E4 --> REL[("Relay stores seq 4")] REL --> C1{"Next connection to Atem
brings entries up to the head"} C1 -- "Atem sees seq 4" --> GONE["Old iPad refused
its live attachment is fenced"] - C1 -- "relay withholds seq 4" --> WIN{"Attestation the iPad shows
older than 24 h?"} - WIN -- "yes" --> PAUSE["refused / paused
(no fresh proof)"] - WIN -- "no" --> LATE["accepted at most until the
24 h window ends — the approved bound"] - HW["Atem keeps the highest seq it has seen
— a list older than that is always refused"] -.-> C1 - LOST["All manager devices lost?"] --> REC["local atem unpair + atem pair
→ new genesis, new trust generation
(data and keys kept)"] + C1 -- "relay hides seq 4" --> LATE["Old iPad still accepted until any honest
device reaches Atem — residual risk"] + C1 -- "conflict signed by a removed key" --> IGN["ignored, logged as evidence
(no freeze)"] + C1 -- "conflict signed by a still-valid manager" --> FORK["fork: remote access frozen
(local use unaffected)"] + LATE --> REC + FORK --> REC + HW["Atem keeps a durable head (seq, hash)
— a lower seq or non-chaining entry is refused"] -.-> C1 + LOST["Every Astation device lost?"] --> KIT["Astation restore account (Recovery Kit)
restores K and signs an entry making the
new device a manager — no re-pairing"] + REC["Re-pair from a trusted device:
atem unpair, then atem pair
→ new genesis (only the good devices)"]