From cc4e36d7fb47ef2f5fe97153d4095c8b8e39ffa7 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Sat, 12 Sep 2026 00:07:25 +0200 Subject: [PATCH] Initial commit --- .gitignore | 4 + assets/favicon.svg | 8 + assets/logo.svg | 8 + brand/avatar.svg | 9 ++ brand/banner.svg | 34 ++++ brand/favicon.svg | 5 + brand/index.html | 225 ++++++++++++++++++++++++++ brand/logo-mono.svg | 10 ++ brand/logo.svg | 8 + docs/INSTRUCTIONS.md | 363 ++++++++++++++++++++++++++++++++++++++++++ docs/index.html | 367 +++++++++++++++++++++++++++++++++++++++++++ index.html | 260 ++++++++++++++++++++++++++++++ portal.html | 286 +++++++++++++++++++++++++++++++++ theseus/index.html | 194 +++++++++++++++++++++++ 14 files changed, 1781 insertions(+) create mode 100644 .gitignore create mode 100644 assets/favicon.svg create mode 100644 assets/logo.svg create mode 100644 brand/avatar.svg create mode 100644 brand/banner.svg create mode 100644 brand/favicon.svg create mode 100644 brand/index.html create mode 100644 brand/logo-mono.svg create mode 100644 brand/logo.svg create mode 100644 docs/INSTRUCTIONS.md create mode 100644 docs/index.html create mode 100644 index.html create mode 100644 portal.html create mode 100644 theseus/index.html diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..c537913 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +# Generated git-mirror artifacts served from sirius.x/repo/. +# Regenerated on each publish; the source of truth is the working repo itself. +repo/silent-mode.bundle +repo/silent-mode.git/ diff --git a/assets/favicon.svg b/assets/favicon.svg new file mode 100644 index 0000000..1141ab3 --- /dev/null +++ b/assets/favicon.svg @@ -0,0 +1,8 @@ + + + + + diff --git a/assets/logo.svg b/assets/logo.svg new file mode 100644 index 0000000..efcb90c --- /dev/null +++ b/assets/logo.svg @@ -0,0 +1,8 @@ + + + + sirius.x + + diff --git a/brand/avatar.svg b/brand/avatar.svg new file mode 100644 index 0000000..ea1a8e3 --- /dev/null +++ b/brand/avatar.svg @@ -0,0 +1,9 @@ + + + + + diff --git a/brand/banner.svg b/brand/banner.svg new file mode 100644 index 0000000..4ed29f4 --- /dev/null +++ b/brand/banner.svg @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + sirius.x + + + The home for names on Bitcoin Cash. + + + REGISTER · RESOLVE · VERIFY + + + diff --git a/brand/favicon.svg b/brand/favicon.svg new file mode 100644 index 0000000..f64c36c --- /dev/null +++ b/brand/favicon.svg @@ -0,0 +1,5 @@ + + + + diff --git a/brand/index.html b/brand/index.html new file mode 100644 index 0000000..7a63f47 --- /dev/null +++ b/brand/index.html @@ -0,0 +1,225 @@ + + + + + +Brand — sirius.x + + + + + + + + + + + + + + + + +
+
🎨
+

sirius.x brand kit

+

Logo, wordmark, avatar, banner, favicon, and the colour palette. Every asset ships as + SVG so it stays crisp at any size and reads correctly in light and dark contexts. Free to reuse + with attribution.

+
+ +
+ +
+

Logo & wordmark

+

A 4-point sparkle star plus sirius.x, with the .x TLD picked out + in acid green. The star alone works when you have no room for the wordmark; the full lockup is + the default choice everywhere else.

+
+
+
sirius.x logo
+

Wordmark SVG · 320×64

+

Full colour, dark backgrounds. Use this by default.

+
+ Download SVG + Open +
+
+
+
sirius.x mono
+

Wordmark, monochrome SVG · currentColor

+

Uses currentColor, inherits from the + surrounding text. Print, embossing, single-colour merch.

+
+ Download SVG + Open +
+
+
+
+ +
+

Avatar & favicon

+

Square icons for social profiles, Nostr, GitHub, and browser tabs.

+
+
+
sirius.x avatar
+

Avatar SVG · 512×512

+

Square profile picture. Social platforms apply + their own round mask, so corners stay hard.

+
+ Download SVG + Open +
+
+
+
sirius.x favicon
+

Favicon SVG · 64×64, 12px radius

+

Rounded browser-tab icon. Scales down to 16×16 + cleanly; used on every sirius.x page.

+
+ Download SVG + Open +
+
+
+
+ +
+

Social banner

+

1200×630 (OpenGraph / Twitter Card canonical). Composition survives aggressive + centre-cropping — the star and tagline both stay visible even after Facebook and Discord chop + the sides.

+
+
sirius.x banner
+
+ Download SVG + Open +
+
+
+ +
+

Colour palette

+

Silent Mode family colours. Dark chromes are the default; acid green is the + single accent that consistently signals "this is sirius.x".

+
+
Acid#d6ff3d — accent, links, active nav
+
Background#0b0e14 — page canvas
+
Panel#141a24 — cards, elevated surfaces
+
Panel 2#18202c — nested / step items
+
Ink#e7eaf1 — body text on dark
+
Muted#8b98a9 — secondary text
+
Dim#5e6678 — tertiary text, dividers
+
OK#4fd1a5 — success / available
+
Taken#f6768a — errors / unavailable
+
Warn#ffc75f — caution, holds
+
+
+ +
+

Typography

+

System font stack, so nothing needs to load and every OS renders the wordmark in + the same family the reader is used to.

+
+

The quick brown fox

+

jumps over the lazy dog · 0123456789 · sirius.x

+
system-ui, -apple-system, Segoe UI, Roboto, sans-serif
+
+
The wordmark's .x is a <tspan fill="#d6ff3d"> — + don't render the whole word in acid, and don't render the star without the star's exact 4-point + path (it's a mark, not a generic asterisk).
+
+ +
+

Usage & licence

+

All assets are MIT. Reuse them for third-party tools that integrate with sirius.x + (wallets, indexers, explorers, blog posts about BCNR). Keep the star's proportions intact and + don't recolour the acid to a similar-but-different green — palette drift is what makes brands + look untrustworthy over time.

+
    +
  • Do use the mark to indicate "supports sirius.x" or "hosted on sirius.x".
    • +
  • Do shrink to the favicon at 16×16 — the SVG scales cleanly.
    • +
  • Don't imply endorsement of a specific product without asking.
    • +
  • Don't stretch, skew, or re-tint the star.
    • +
+
+ +
+ + + + + diff --git a/brand/logo-mono.svg b/brand/logo-mono.svg new file mode 100644 index 0000000..225053a --- /dev/null +++ b/brand/logo-mono.svg @@ -0,0 +1,10 @@ + + + + + sirius.x + + diff --git a/brand/logo.svg b/brand/logo.svg new file mode 100644 index 0000000..efcb90c --- /dev/null +++ b/brand/logo.svg @@ -0,0 +1,8 @@ + + + + sirius.x + + diff --git a/docs/INSTRUCTIONS.md b/docs/INSTRUCTIONS.md new file mode 100644 index 0000000..130f96e --- /dev/null +++ b/docs/INSTRUCTIONS.md @@ -0,0 +1,363 @@ +# How to do things — Silent Mode runbook + +Operational companion to [`SESSION-CONTEXT.md`](SESSION-CONTEXT.md). That file is +*what the product is*; this one is *how to do a thing*. Every command below was +run on 2026-07-30 and works. + +All commands run from `D:\Dev\SilentMode\Argus` unless stated. Prefix with `rtk` +per project convention. **Everything is chipnet.** + +> **Before you touch a `.js` in `Argus/src/lib/`, grep for it first.** Two +> sessions have written here concurrently and `registry-lifecycle.js`, +> `portfolio.js` and `ElectrumPool` were each independently rebuilt once. If a +> test file exists for a module you are about to create, implement to the test — +> the test is the contract. + +--- + +## 1. Read the registry + +```bash +node src/resolve.js # list every name, with records and category +node src/resolve.js demo.p2p # resolve one +``` + +Real output today (abridged): + +``` +silentmode.bch -> {"s3":"bns/silentmode/"} +theseus.bch -> {"h":"

Theseus

…"} +coinspectrum.bch-> {"ip":"195.184.247.106","p":"https://…","tls":"84e4cd…"} +demo.p2p -> {"h":"

demo.p2p

…"} +syskypo.de -> {"s3":"bns/syskypo.de/"} +``` + +Zero-dependency alternative (the resolver clients actually ship): + +```bash +node --input-type=module -e " +import WebSocket from 'ws'; +import { resolveName } from './src/lib/resolver-web.js'; +console.log(await resolveName('silentmode.bch', { WebSocket })); +process.exit(0);" +``` + +--- + +## 2. Register a name + +```bash +node src/register.js +``` + +```bash +node src/register.js mysite https://example.org # shorthand → {"u": …} +node src/register.js mysite '{"h":"

Hello

"}' # explicit records +node src/register.js mysite.nav '{"s3":"bns/mysite/"}' # any TLD, same command +``` + +Registers from the project wallet (`wallets.json`). It mints the certificate, +publishes the records and pays the beacon in **one transaction**. + +Verify: + +```bash +node src/resolve.js mysite.nav +``` + +Records can be omitted at registration and set later — see §4. + +**Buyer-facing registration** (built-in wallet, pay-by-QR) goes through +`site/register.html`, not the CLI. The CLI is for operator-held names and testing. + +--- + +## 3. Add a new TLD + +**Superseded 2026-08-29.** The old "TLDs are just a convention, no registry +change needed" model is retired. The per-TLD registry +([`Decentralized.DNS/DESIGN-tld-registry.md`](Decentralized.DNS/DESIGN-tld-registry.md)) +is now the source of truth: **a name REG under a TLD that has no on-chain TLD +certificate will be rejected by conforming clients once enforcement is on** (the +code is in `buildIndex({enforceTld:true})` in both `bns.js` and +`resolver-web.js`; default is still off during the mainnet migration, but the +registrar treats the on-chain list as authoritative today). + +So adding a TLD is now **three steps: TREG on the beacon, UI, deploy.** + +**1. Register the TLD on the TLD beacon (chipnet).** + +The idempotent way — the operator wallet holds the seed for the TLD-beacon +address and the seed script skips anything already present: + +```bash +cd Argus +# Edit src/seed-tld-beacon.mjs SEED_TLDS[] — append your new TLD label +node src/seed-tld-beacon.mjs +``` + +Or a one-off from a Node REPL if you don't want to touch the script: + +```bash +node --input-type=module -e " +import { loadWallet } from './src/lib/wallet.js'; +import { registerTld } from './src/lib/bns.js'; +const w = await loadWallet('main'); +console.log(await registerTld(w, 'newtld', {})); +process.exit(0);" +``` + +Either way you get `{tld, txid, category}`. The TLD certificate is minted to +the operator wallet — that address becomes the TLD's owner and can UPD the +records with `updateTld(wallet, tld, records, category)` later. + +Cost: ~1,300 chipnet sats per TREG. Empty records `{}` mean "defaults apply" +per the design doc §3. + +**2. Add the TLD to the registrar UI.** + +The dropdown is gone. `site/sirius/register.html` now uses a `TLDS` array +(around line 275). Append your new TLD with `onchain: true`: + +```js +const TLDS = [ + ..., + { tld: "newtld", onchain: true }, +]; +``` + +If you registered the cert but want to *hold* the TLD without offering it in +the registrar (the `.com` pattern — cert on-chain so nobody else claims it, but +no second-level names offered), just leave it out of the `TLDS` array. The +cert stays valid on the beacon. + +**3. Deploy `site/sirius/register.html` to the VPS.** + +silentmode.st is nginx-served from `/opt/silent-mode/site/`, NOT Sia +(see [`DEPLOY-split-st-from-bch.md`](DEPLOY-split-st-from-bch.md)): + +```bash +scp D:/Dev/SilentMode/site/sirius/register.html silentmode:/opt/silent-mode/site/sirius/register.html +``` + +(silentmode.bch — the Sia mirror — takes a full `sia-upload.js` of `site/`. +Only touch that if you also want the on-chain-hosted copy refreshed.) + +**4. Republish the TLD snapshot (optional, updates mirrors).** + +If a downstream is reading from the Sia mirror or the Nostr replaceable event +rather than doing its own chain scan, refresh the snapshot: + +```bash +cd Argus +node src/publish-tld-mirror.mjs +``` + +Uploads `bns/tld-list.json` (floating) and `bns/tld-list-.json` +(immutable content-addressed) to Sia, and publishes NIP-33 kind 30078 (d-tag +`bns-tld-list`) to the configured relays. Dry-run: `BNS_MIRROR_DRY_RUN=1`. + +### The thing to think about before adding one + +Under the per-TLD registry the operator's key is the countersignature gate — +so **you're the registrar** for any TLD you mint. On mainnet the covenant will +enforce a price floor and an operator-countersig for public mints +([`Decentralized.DNS/DESIGN-tld-registry.md`](Decentralized.DNS/DESIGN-tld-registry.md) §5). +On chipnet nothing enforces this; a rogue script could TREG anything under a +different key. Only the operator's key produces TLD certs that clients trust +once the enforcement rules ship. + +`.bch` is special in one way only: its on-chain commitment is the **bare label** +(`silentmode`, not `silentmode.bch`) for backward compatibility. Every other TLD +stores the full `label.tld`. `normalizeName` handles this; don't hand-roll it. + +### Current chipnet TLD set (2026-08-29) + +Bench-checkable via `node src/seed-tld-beacon.mjs` (idempotent verify) or by +fetching the mirror at `https://s3.silentmode.st:8600/bns/tld-list.json` (403 +to anon today; the Nostr replaceable event `kind:30078` `d:bns-tld-list` from +pubkey `f2c925194c531c7c398017e35b2396df64a61a613aa5fadebdf1f4990f2267f4` on +`wss://nos.lol` / `wss://relay.damus.io` is publicly readable). + +Live: `bch p2p bit nav test x asm neo gt sc sia com dex cex nt` (15 total). +`.com` is **held** by the operator — cert on-chain, excluded from the public +registrar UI so nobody else can claim it. + +--- + +## 4. Set or change records + +```bash +node src/update.js +``` + +```bash +node src/update.js mysite '{"ip":"203.0.113.9"}' +node src/update.js mysite.nav '{"s3":"bns/mysite/","tls":"a1b2c3…"}' +``` + +Proves ownership by moving the certificate — only the holder can do it. + +### Record types + +| Key | Meaning | Example | +|---|---|---| +| `h` | inline HTML, stored on-chain | `{"h":"

Hi

"}` | +| `u` | redirect to a URL | `{"u":"https://example.org"}` | +| `ip` | IPv4 of your server | `{"ip":"203.0.113.9"}` | +| `p` | reverse-proxy upstream (address bar stays on the name) | `{"p":"https://backend.example"}` | +| `s3` | Sia object or prefix | `{"s3":"bns/mysite/"}` | +| `tls` | SHA-256 fingerprint of the name's TLS cert (hex, over DER) | `{"tls":"84e4cd…"}` | + +### The 200-byte ceiling + +The whole payload — `"BNS1"` + the JSON — must be **≤ 200 bytes**. For +`sirius.nav` that leaves about 161 bytes for records. An oversized payload throws +at build time rather than producing a broken registration. + +Check before you commit to a long `h`: + +```bash +node --input-type=module -e " +import { payloadBudget } from './src/lib/register-tx.js'; +console.log('bytes free for records:', payloadBudget('sirius.nav')); +process.exit(0);" +``` + +`h` is for a page, a profile, a link hub. Anything real goes on Sia or a server. + +--- + +## 5. Put a site on Sia storage + +Two steps: upload the bytes, then point the name at them. + +```bash +# from D:\Dev\SilentMode +node Argus/src/lib/sia-upload.js +``` + +```bash +node Argus/src/lib/sia-upload.js D:/Dev/SilentMode/site/mysite bns/mysite +node Argus/src/lib/sia-upload.js ./page.html bns/mysite +``` + +Then the record — a **trailing slash means "site root"**, no slash means a single +object: + +```bash +cd Argus +node src/update.js mysite '{"s3":"bns/mysite/"}' # directory → site +node src/update.js mysite '{"s3":"bns/page.html"}' # one file +``` + +Verify through the public gateway: + +```bash +curl -s -o /dev/null -w "%{http_code}\n" https://navigate.st/bns/mysite.bch/ +``` + +Upload the **whole directory** if the page has assets — `sia-upload.js` walks it +and preserves relative paths, which is what makes `/js/…` and `/vendor/…` resolve. + +**`sia-s3.json` is a secret** (SECURITY.md rule 0). Never print it, commit it, or +copy its values into a bundle. The build refuses to emit a bundle containing them. + +--- + +## 6. Build and deploy the site + +```bash +cd Argus && node build-web.mjs # bundles +cd .. && node Argus/src/lib/sia-upload.js D:/Dev/SilentMode/site bns/silentmode +``` + +Two rules that will bite otherwise: + +- **Run the upload from the repo root**, not from `site/`. The path is relative + to cwd and `site/Argus/...` does not exist. +- **Upload the whole `site/` directory.** `register.html` depends on `site/js/` + and `site/vendor/`; a page-only upload leaves a broken live page. + +`build-web.mjs` refuses to write a bundle that contains a live secret **value** +(it reads `wallets.json`/`sia-s3.json` and greps for their contents) or a +build-machine path. Do not weaken those checks. + +libauth is **one shared module behind an import map** (`site/js/libauth.js`). +Do not bundle it per-file: its WASM init uses top-level await, and a second copy +hands out `undefined` for `secp256k1` on cold load. The build verifies every +import the other bundles emit is satisfied. + +Verify what is actually live: + +```bash +curl -s https://navigate.st/bns/silentmode.bch/register.html | grep -c 'bns-register.js' +``` + +--- + +## 7. Tests + +```bash +cd Argus +node --test test/*.test.mjs # offline; no network, no coins +``` + +Live scripts spend real chipnet coins and are run deliberately: + +```bash +node test/chipnet-acceptance.mjs # built-in wallet, full registration +node test/chipnet-paybyqr.mjs # registrar mints to a buyer +node test/chipnet-escrow-refund.mjs # unsigned order → refund, name never minted +``` + +They **exit 2** when the chain is unreachable, so an environment failure is +distinguishable from a product failure. Add `--keep` to the acceptance test to +print the throwaway wallet's phrase. + +--- + +## 8. Gotchas that have actually cost time + +**Node cannot resolve some hostnames on the dev machine.** `getaddrinfo` returns +`EAI_FAIL` for `coinspectrum.duckdns.org` and the chipnet electrum hosts while +`nslookup` and c-ares resolve them fine. Symptom: uploads and live tests fail +instantly with a DNS error. Workaround is a `--require` shim that falls back to +`dns.resolve4`; the real fix is on the machine. **If a network command fails +instantly, suspect this before suspecting the code.** + +**Electrum uses ports 50004/62002**, which corporate networks and some VPNs block +outright — and every configured server shares those ports, so one firewall rule +takes the whole resolver down. `REGISTRAR.selfHosted` puts your own Fulcrum on +443 first; see `Argus/OPERATIONS-electrum.md`. + +**Two resolvers must stay in lockstep.** `resolver-web.js` (zero-dep, shipped in +clients) and `bns.js` (mainnet-js). Change one, change both. A disagreement is a +consensus split between clients. + +**Terminology is enforced.** It is a **certificate / registration record / +title** — never an "NFT" in code, comments or UI. `NFTCapability` and `.nft` are +mainnet-js API names and stay. + +**The certificate lives in a 1,000-sat UTXO.** A wallet that does not understand +CashTokens sees dust; a "sweep all funds" would destroy the name. This is why +destinations are normalised to the token-aware `z…` form. + +**`h` records are HTML you are publishing permanently.** There is no edit — only +an update transaction, and the old payload stays on-chain forever. + +**Never register a name you cannot spell twice.** Registration is irreversible and +there is no expiry on chipnet today, so a typo is a permanently burned name. + +--- + +## 9. What not to do + +- Do not touch `D:\Dev\NameCoin` — separate live system. +- Do not flip anything to mainnet. It is a deliberate switch (new electrum + servers, `bitcoincash:` prefix, a new beacon, real money), not a config change. +- Do not commit or print `wallets.json`, `sia-s3.json`, `ca/root-ca.key`, or any + seed phrase. +- Do not put the operator's name or email in any file (SECURITY.md rule 3). +- Do not add a TLD to the dropdown without registering a test name on it first. +- Do not weaken the build's secret scan or the LGPL licence checks. diff --git a/docs/index.html b/docs/index.html new file mode 100644 index 0000000..01bcb5d --- /dev/null +++ b/docs/index.html @@ -0,0 +1,367 @@ + + + + + +Docs — sirius.x + + + + + + + + + + + + + + + + +
+
📚
+

sirius.x docs

+

How the pieces fit together: the TLD registry, name registration, records that + tell the resolver where a site lives, the resolver itself, and how anyone can verify anything + against the chain.

+
+ +
+
+ + + +
+ +
+

The TLD registry

+

Every BCNR name lives under a top-level domain whose certificate is + itself a first-class token on the Bitcoin Cash chain — an NFT with the TLD label as its + commitment, paying dust to a dedicated TLD-registry beacon. That certificate is the + on-chain proof the TLD exists, and once enforcement ships, it is what makes any + second-level name under it valid to conforming resolvers.

+

Fourteen public TLDs on chipnet today (2026-08-29): + bch p2p bit nav test x asm neo gt sc sia dex cex nt. The current list and + per-TLD categories are at + silentmode.st/tlds/.

+
Why per-TLD certs, not a single list. Without a registry, anyone + could quietly declare a TLD against the same beacon by minting a name under it. That + leaves resolvers in silent disagreement. Per-TLD certificates make the TLD set itself + something the chain records, so every resolver sees the same list — and TLDs become + ownable assets that can carry policy, fees, and governance of their own.
+
+ +
+

Register a name — end to end

+

The buyer's certificate mints straight to a wallet they control, in one + transaction that also publishes the initial records and pays the beacon. Nobody + including the operator can take the name back — the covenant work in progress adds an + expiry / reclaim clock but does not change who controls the key.

+
    +
  1. Search a label across every TLD. + The registrar fans out to every TLD in the registry in parallel and shows + available / taken per row. Available names appear first.
    2. +
  2. Create or connect a wallet. + Built-in browser wallet (PBKDF2 → AES-GCM in localStorage) or WizardConnect to + Cashonize / Paytaca — both mint to the buyer's own key.
    3. +
  3. Confirm the price. + Miner fee + beacon dust + certificate dust + service fee. Chipnet placeholder + is 10,000 sat; real pricing is a mainnet decision.
    4. +
  4. The certificate lands in your wallet. + The name resolves the moment the transaction confirms. Records can be set or + changed later — only your key can sign a UPD.
    5. +
+
+ +
+

Records & hosting

+

A registered name carries a small JSON records object. Every record is + optional and multiple can coexist. Priority order the gateway uses: + h (inline HTML) → s3 (Sia bucket key) → ip + (host header served by an IP) → u (redirect).

+ + + + + + + + + + + +
RecordMeaningTypical use
hInline HTML in the OP_RETURN payload itselfTiny sites, a profile, a link hub
s3A Sia bucket key (with auto-index for directory-style)Multi-file sites, permanent hosting
ipAn IPv4 address + optional tls fingerprintYour own server, apps behind an IP
uRedirect URLShort-form redirects to any web host
tlsSHA-256 fingerprint of the leaf cert served at ipChain-pinned TLS trust, no OS root store needed
np, nrNostr pubkey + relay listHermes / NIP-17 messaging bound to the name
elSpace-separated electrum server listOn-chain-updatable resolver bootstrap
+

Subdomains inherit from their parent with a slight + priority tweak: for a subdomain query, ip beats s3 + (Host-header semantics). Full rule is in Argus/src/lib/record-picker.js.

+
+ +
+

Host your name

+

The end-to-end recipe for putting a static site under a BCNR name. Chipnet + today, mainnet later — the shape is the same. Three ways to host, most people combine + two of them (Sia + VPS mirror) so the site keeps serving if either mirror goes down.

+ +

Pattern A — Sia only

+

Simplest. Site lives on the Sia storage network, name's s3 record + points at the bucket key, gateways (navigate.st, silentmode.st, any BCNR-aware browser) + fetch it on demand. Same pattern silentmode.bch uses.

+ 
# From a checkout with sia-s3.json credentials:
+node Argus/src/lib/sia-upload.js ./my-site bns/myname/
+
+# Set the chain record (once). Note the trailing slash — enables auto-index
+# so /myname/ serves myname/index.html and /myname/about/ serves .../about/index.html.
+node Argus/src/update.js myname.x '{"s3":"bns/myname/"}'
+

Bucket-path convention: bns/<label>/ (no TLD; the label is + unique enough within our Sia namespace and keeps game.x + game.bch from colliding). Files + update by re-running sia-upload; the chain record only changes when the bucket path does.

+ +

Pattern B — Your own server (VPS + ip)

+

Point the name at an IP; every request goes directly to your box. Add a + tls record with the SHA-256 of the leaf certificate so browsers verify the + connection against the chain instead of the OS trust store.

+ 
# On your VPS: nginx serves your site over TLS. Then, on chain:
+node Argus/src/update.js myname.x '{"ip":"1.2.3.4","tls":"<sha256-of-leaf-cert>"}'
+ +

Pattern C — Dual host (Sia primary, VPS mirror)

+

What sirius.x itself uses. Sia is the chain-authoritative source (survives + if the VPS is down); the VPS serves the same content on silentmode.st/<path> + for users without a BCNR resolver installed. On the VPS side, extend the nginx vhost + serving silentmode.st with a new location block that aliases + straight from disk:

+ 
location /myname-x/ {
+    alias /opt/silent-mode/site-myname-x/;
+    index index.html;
+    try_files $uri $uri/ =404;
+}
+

Then rsync / scp your site tree to silentmode:/opt/silent-mode/site-myname-x/ + and reload nginx. This gives you two URLs for the same content: + https://silentmode.st/myname-x/ (VPS-direct) and the chain-authoritative + https://myname.x/ via any BCNR resolver.

+ +

Verify records changed correctly

+ 
node --input-type=module -e "
+import { loadWallet } from './Argus/src/lib/wallet.js';
+import { resolveName } from './Argus/src/lib/bns.js';
+const w = await loadWallet('main');
+console.log(await resolveName(w.provider, 'myname.x'));
+process.exit(0);"
+ +
Credentials. Sia upload needs Argus/sia-s3.json. VPS + deploy needs SSH to the operator's box. Neither is in the repo — a session that isn't + run by the operator will need those handed over out-of-band. Full command reference is in + INSTRUCTIONS.md, especially §5 (Sia storage) and §6 + (deploy).
+
+ +
+

Resolver / gateway

+

Three paths, same chain data. Anyone can pick.

+
    +
  1. Local — Ariadne Resolver. + A system-wide resolver that intercepts BCNR TLDs and answers them from the + chain. Any browser you already use starts opening .bch URLs directly. + Installs a local root CA for TLS. + Download →
    2. +
  2. In-browser — Theseus Navigator. + A Chromium build with the resolver baked in, plus an on-chain TLS trust anchor. + No OS trust-store install; nothing modified globally. + Download →
    3. +
  3. Public gateway — navigate.st. + For anyone without the resolver installed: + https://navigate.st/bns/<name>/ proxies through a hosted resolver. + Same content, fewer guarantees — trust the gateway to fetch honestly, or run one of + the first two.
    4. +
+
+ +
+

Pricing (mainnet)

+

On mainnet the covenant enforces USD-denominated floors, tiered by TLD + label length. This is what keeps someone from land-grabbing every ICANN TLD in one + afternoon. TLD registration is one-time — a TLD is closer to a domain purchase + than a lease.

+ + + + + + + + + + +
Label lengthFloor (USD)Notes
1 char100,000Effectively unique; ENS-like scarcity
2 char50,000The .ai / .io tier
3 char15,000Order of magnitude below ICANN's $185k application floor
4 char5,000Floor for short but reasonable TLDs
5–8 char1,000Bulk-registerable but not spam
9+ char250Descriptive TLDs, low economic gravity
+

On name registration under a TLD, the TLD's + owner collects a share (fee_bps, default 5%, cap 50%). Chain-enforced when + the TLD's policy is covenant; honour-system otherwise. Name registration is + yearly and priced separately.

+
+ +
+

Tracker & mirrors

+

A tracker publishes signed snapshots of the TLD registry to Sia and Nostr so + downstream clients don't have to walk the chain themselves. The chain is authoritative; + the tracker is speed. Every snapshot carries a root hash anyone can recompute + locally — a lying mirror is caught by any recipient who bothers to check.

+

A conforming client falls through: (1) fetch snapshot from a mirror, + (2) verify root, (3) if suspicious, walk the beacon and rebuild. All three + yield the same list for any given block height.

+
+ +
+

Verify anything

+

You do not have to trust that sirius.x, silentmode.st, or navigate.st are + serving honest content. Every name's certificate is on chain; every record is a signed + on-chain payload; every host is checkable independently.

+ +

Confirm a specific name on chain

+ 
node --input-type=module -e "
+import { loadWallet } from './Argus/src/lib/wallet.js';
+import { resolveName } from './Argus/src/lib/bns.js';
+const w = await loadWallet('main');
+console.log(await resolveName(w.provider, 'sirius.x'));
+process.exit(0);"
+ +

Fetch the operator-signed TLD snapshot from Nostr

+
+
Kind / d-tag
+
30078 / bns-tld-list
+
Pubkey (x-only, hex)
+
f2c925194c531c7c398017e35b2396df64a61a613aa5fadebdf1f4990f2267f4
+
Relays
+
wss://nos.lol · wss://relay.damus.io
+
+ +

Reach any site via more than one route

+

Same content should be served from at least two independent paths:

+
    +
  • Direct BCNR: https://<name>/ (requires local resolver + CA)
    • +
  • Public gateway: https://navigate.st/bns/<name>/
    • +
  • silentmode.st mirror: https://silentmode.st/bns/<name>/
    • +
  • Direct from Sia (content-addressed) via the name's s3 record
    • +
+
+ +
+

Operator runbook

+

These docs describe what. The how — exact bash commands to + register TLDs, mint names, update records, and deploy — is + INSTRUCTIONS.md. Three ways to read it, in order of "how much do I already + have installed":

+
    +
  1. Just read it in the browser + Served straight from the docs directory: + /sirius-x/docs/INSTRUCTIONS.md. Plain text; every + browser renders it.
    2. +
  2. Clone the git remote + git clone https://silentmode.st/sirius-x/repo/silent-mode.git — dumb-HTTP, + no auth. Get the whole tree, browse offline, run the scripts.
    3. +
  3. Browse the Forgejo mirror + Repo lives at + code.silentmode.st/silentmode/sirius + on the Silent Mode Hephaestus forge. Rendered runbook: + docs/INSTRUCTIONS.md. + Clone: git clone https://code.silentmode.st/silentmode/sirius.git — public, + no auth.
    4. +
+

The runbook covers CLI name registration, TLD-registry seeding, record + updates, Sia upload, VPS deploy, tests, and the historically-costly gotchas.

+
+ +
+
+
+ + + + + diff --git a/index.html b/index.html new file mode 100644 index 0000000..72cc147 --- /dev/null +++ b/index.html @@ -0,0 +1,260 @@ + + + + + +sirius.x — the home for names on Bitcoin Cash + + + + + + + + + + + + + + + + + + + +
+
⭐
+

Names on the chain.

+

sirius.x is the entry point for BCNR — Bitcoin Cash Name Registry. + Register a top-level domain, register a name under one, look up records, + verify anything against the chain. Backed by Sia storage, mirrored on the + operator's VPS, name published on chain — this page survives if any single + mirror goes down.

+
+ Get started + Read the docs +
+
+ +
+ +
+

Try it

+

Three things you can do right now. The registrar and TLD-registry UIs live at + silentmode.st today; sirius.x is the canonical home and will consolidate them here.

+
+
+

Register a name

+

Pick a label, search across every TLD in the registry at once, mint the name + certificate straight into your own wallet. A few cents in chain fees, no yearly renewal.

+
Search a name →
+
+
+

Register a TLD

+

Under the per-TLD registry, a TLD is itself a certificate on the chain. Public mints + are operator-gated today; propose one below.

+
Propose a TLD →
+
+
+

Look up & verify

+

Resolve any BCNR name, compare records across mirrors, and check the TLD registry snapshot + against the chain. Everything is publicly verifiable.

+
How to verify →
+
+
+

🔑 Sign in — your names portal

+

Import your seed phrase or connect a wallet (Cashonize / Paytaca via WizardConnect) to see + every name you own, review records, and update them. Your keys never leave your browser.

+
Open the portal →
+
+
+

🧭 Theseus Navigator

+

The browser that speaks BCNR natively. Open hello.bch in the address bar — + it just resolves. TLS verified against on-chain fingerprints, no OS trust-store install.

+
Download →
+
+
+
+ +
+

Documentation

+

The full docs — TLD registry model, record types, resolver & gateway paths, + mainnet pricing, verification, and the operator runbook pointer — live on their own page so + they can grow without cluttering the landing.

+
+ 📚 Open the docs → + Current TLD list +
+
+ +
+

Propose a new TLD

+

The per-TLD registry means minting a TLD is a real, paid action — not a namespace + land-grab. During the alpha, all TLD mints are operator-signed. To propose a TLD, get in touch + via the channels below. The design (mainnet) adds an on-chain covenant with countersignature + + tiered USD price floors: 1-char $100k, 2-char $50k, 3-char $15k, 4-char $5k, 5–8-char $1k, + 9+-char $250; one-time payment (not annual). See the design doc for the full model.

+
ICANN-adjacent TLDs are not open for public mint. A TLD registry is + only useful if it does not immediately collapse into an ICANN-shadow — the mainnet covenant + enforces this; on chipnet the operator's countersignature is the gate.
+
+ +
+

What's coming

+

sirius.x consolidates docs and registration today; three larger pieces are on the roadmap.

+
+
+

Wallet & name portal next

+

Sign in with your BCNR wallet, see every name you own, edit records inline, mint or renew + from one place. Same self-custody as today — the portal never handles your keys.

+
+
+

Sirius Studio planned

+

An in-browser site editor for names you already own — the WordPress / Tilda / Wix pattern, + but the whole site persists to Sia and the name's s3 record updates on save. + Sites live where the name says they live.

+
+
+

Decentralized git remote MVP live

+

The Silent Mode repo is served as a bare git tree over dumb-HTTP from + the VPS. Clone it with any git client, no login. Forgejo + Sia sync + for a proper decentralized backend is the next track.

+ 
git clone https://silentmode.st/sirius-x/repo/silent-mode.git
+

One-shot snapshot as a + downloadable git bundle (works when dumb-HTTP is blocked):

+ 
curl -O https://silentmode.st/sirius-x/repo/silent-mode.bundle
+git clone silent-mode.bundle silent-mode
+
+
+
+ +
+

Verify this page against the chain

+

You do not have to trust that sirius.x is served by anyone specific. + The name's certificate is on the Bitcoin Cash chain; the records point to Sia; every path is + independently checkable.

+ +

1. Confirm the certificate exists on chain

+ 
node --input-type=module -e "
+import { loadWallet } from './Argus/src/lib/wallet.js';
+import { resolveName } from './Argus/src/lib/bns.js';
+const w = await loadWallet('main');
+console.log(await resolveName(w.provider, 'sirius.x'));
+process.exit(0);"
+ +

2. Fetch the TLD-registry snapshot from Nostr

+

The operator-signed snapshot of the TLD list is published as a Nostr replaceable + event. Any relay carries it; the event's content field carries the current snapshot root.

+
+
Kind / d-tag
+
30078 / bns-tld-list
+
Pubkey (x-only, hex)
+
f2c925194c531c7c398017e35b2396df64a61a613aa5fadebdf1f4990f2267f4
+
Relays
+
wss://nos.lol · wss://relay.damus.io
+
+ +

3. Reach this site via more than one route

+

The same content should be served from at least two independent paths. If one + mirror is unavailable, the others still work. If two mirrors disagree, the on-chain record is + the tiebreaker.

+
    +
  • Via any BCNR resolver: https://sirius.x/ (requires the local root CA)
    • +
  • Via the public gateway: https://navigate.st/bns/sirius.x
    • +
  • Via silentmode.st mirror: https://silentmode.st/bns/sirius.x
    • +
  • Direct from Sia (content-addressed): the s3 record on sirius.x + names the exact bucket key
    • +
+
+ +
+ +
+ sirius.x — the Silent Mode name registry entry point · + silentmode.st · + TLD registry · + register a name
+ Alpha on a test network (chipnet). You hold your own keys; verify everything against the chain. +
+ + + diff --git a/portal.html b/portal.html new file mode 100644 index 0000000..74448e7 --- /dev/null +++ b/portal.html @@ -0,0 +1,286 @@ + + + + + +Portal — your names on sirius.x + + + + + + + + + + + + + + + + +
+
🔑
+

Your names portal

+

Sign in with your Bitcoin Cash seed phrase or connect an external wallet to see + every BCNR name your wallet holds. Your keys never leave this browser tab.

+
+ +
+ +
+

Sign in

+

Pick one. Nothing is transmitted — resolution is a read-only chain query, + and signing (for record edits) happens locally in the browser or in your external wallet.

+
+
+

Import a seed phrase

+

Paste your 12- or 24-word BIP-39 recovery phrase. It stays in memory only, wiped when you + close the tab or sign out.

+ + +
+ + Chipnet only for now. +
+ +
+
+

Connect an external wallet

+

Use Cashonize 0.9+ or Paytaca via WizardConnect. The wallet signs record edits — the seed + never touches this page.

+
+ +
+

Portal-side WizardConnect wiring is in progress; the + register.html flow already ships the WizardConnect adapter, and the portal will reuse it.

+
+
+
+ Don't have a wallet? Create one during + name registration — the recovery phrase + is generated in your browser and encrypted with your password. +
+
+ + + +
+ + + + + + + + diff --git a/theseus/index.html b/theseus/index.html new file mode 100644 index 0000000..1c020e2 --- /dev/null +++ b/theseus/index.html @@ -0,0 +1,194 @@ + + + + + +Theseus Navigator — the browser that speaks Bitcoin Cash names — sirius.x + + + + + + + + + + + + + + + + +
+
🧭
+

Theseus Navigator

+

A Chromium-based browser with native .bch / BCNR name resolution built in. + No OS-level daemon, no DNS shim, no root-store install. Type hello.bch in the + address bar and it just works.

+
+ Download for Windows + How it works +
+
+ +
+ +
+

Download v0.0.4

+

Windows builds for now. The installer wires shortcuts and file associations; the + portable build is a single .exe that runs from anywhere. Ariadne Resolver is the older, + lighter option for systems where you only need name resolution without the browser.

+
+
+

Theseus Navigator — Setup

+

Installs with shortcuts + Start menu entry. Recommended for most users.

+
Download Setup .exe (~97 MB)
+
SmartScreen may warn on first run — the binary is unsigned. Verify the SHA-256 against the checksum published on this page (below) before running.
+
+
+

Theseus Navigator — Portable

+

Single .exe. Nothing installed, nothing modified in the registry. Run and go.

+
Download Portable .exe (~97 MB)
+
+
+

Ariadne Resolver — Setup

+

The lighter option: a system-wide BCNR resolver (no browser). Works with any browser via + the local trust anchor. Windows installer.

+
Download Ariadne (~25 MB)
+
+
+

Ariadne Resolver — Android

+

Android APK. Runs as a VPN service to intercept and resolve BCNR names on the device.

+
Download APK
+
+
+
+ +
+

How Theseus works

+

Theseus is a Chromium wrapper (Electron) with two things regular browsers don't + have: in-process BCNR name resolution, and a certificate-verify hook that trusts on-chain + TLS fingerprints instead of the OS root store for BCNR hostnames.

+
    +
  1. Address bar accepts .bch / .x / any BCNR TLD. + The URL parser is short-circuited: any hostname whose TLD is in the registry is + resolved by walking the chain via the built-in bns.js — never through DNS.
    2. +
  2. Records decide how the site is served. + h renders inline HTML from the OP_RETURN payload itself. s3 + serves from a Sia bucket via the in-app gateway. ip connects to a server by + IP. u redirects. Priority is handled by the shared record-picker.
    3. +
  3. TLS verifies against on-chain fingerprints. + Electron's setCertificateVerifyProc is intercepted: for BCNR hostnames, + instead of walking the OS trust chain, the leaf's SHA-256 fingerprint is compared to the + tls record on chain. Matches → trusted. No tls record → the + browser falls back to the local root CA.
    4. +
  4. Provenance indicator in the URL bar. + A tiny badge shows whether the page came from the chain, from Sia, or from an + IP-configured server — with the NFT category shown on hover. The decentralized padlock.
    5. +
+
What Theseus is NOT. Not a wallet — for that, use Deviant, Cashonize, + Paytaca, or the built-in browser wallet at + sirius/register.html. + Not a hosting service — for that, register a name and point its records at any host (Sia, VPS, + your own server). Theseus just makes those names openable in a normal-feeling browser.
+
+ +
+

Verify a download

+

The binaries are unsigned (Windows will show a SmartScreen warning). Before + running, verify the SHA-256 against what the operator publishes on-chain and in the release + notes:

+ 
PowerShell:
+Get-FileHash TheseusNavigator-Setup-0.0.4.exe
+
+Bash:
+sha256sum TheseusNavigator-Setup-0.0.4.exe
+

Compare the digest to the release manifest at + silentmode.st/releases/. + For a stronger guarantee, sign in with the wallet and check that the release-signing key + matches the on-chain identity for releases.silentmode.bch.

+
+ +
+ + + + +