Example · an animated walkthrough

Asking Scripture privately.
A reader asks. A person does not.

Ruth reads a licensed edition of the Bible through her own agent. She pays once from a purse with no name on it, her agent comes home with a reader's card no one can trace to her, and every question crosses the street under a new pen name with a sealed proof. The Scripture Agent answers from a signed copy of the text — and learns that a licensed reader asked. Not who.

How it works in the Explorer The member-message example

The animation

One street. Eight scenes. Press play, or step through with the arrow keys.

Ruth's side of the street is at the front; the bookshop and the Scripture Agent are across the street; the public notice board is on the corner. Watch what crosses: a coin from an unmarked purse, a receipt claimed once, a question under a new pen name with a sealed proof. Never her name.

1 / 8 · Meet everyone · ← → to step, space to pause

01 · MEET EVERYONE

Let's meet everyone. On the near side of the street lives Ruth, with her agent, her vault, a key safe that never opens, and a purse with no name on it. Across the street is a bookshop that licenses an edition of the Bible; its till is where payments land. Next door is the Scripture Agent, which answers questions from a signed copy of the text. And on the corner stands a public notice board that anyone can read. Watch what crosses the street. Her name never will.

Three things never cross the street: her name, her keys, and anything that ties one question to the next.

01Who is in the picture

One person, three agents.

A person signs. Everything after that is done by agents under what she decided.

Rutha reader

The person in the loop. She signs twice — once to let her reading app ask her agent, once to pay — and can cancel either at her own front door. She never appears across the street by name, address or key.

Her agentdoes the legwork

Pays from the unmarked purse, collects the reader's card under a one-time pen name, makes a fresh sealed proof for each question, and carries the question across the street.

The bookshop's agentlicenses the edition

Checks a payment against the public board, crosses the receipt off, and issues a reader's card to a key. It never learns who holds the key.

The Scripture Agentanswers

Asks its own question, checks the sealed proof against the public board, and answers from a signed copy of the text. It learns that a licensed reader asked — not who, and not whether it is the same reader as last time.

02Scene by scene

What happens in each scene, and the rule it keeps.

Who acts, who receives, what passes between them — then the scene in a sentence, and the rule it keeps.

1
Meet everyone
Ruth lives on the near side of the street with her agent, her vault, a key safe and a purse with no name on it. Across the street: the bookshop that licenses an edition of the Bible, with its till, and the Scripture Agent, which answers questions from a signed copy of the text. On the corner, a public notice board.
Three things never cross the street: her name, her keys, and anything that ties one question to the next.
2
Ruth opens her reading app
Ruth → her Home · one signed permission: the reading app may put questions to her agent — revocable at her front door
In her reading app, Ruth signs once at her own Home: "This app may put my questions to my agent — nothing else." The app is hers; it knows her. The permission goes no further than her own agent.
Her app may ask her agent. It may not do anything else, and it never speaks to the other side of the street.
3
She pays from a purse with no name
her agent · from the unmarked purse → the bookshop's till · one payment for a reading pass — the board shows "an unmarked purse paid the bookshop"
Ruth wants the licensed edition. Her agent pays the bookshop from the unmarked purse — one signature from Ruth at her Home. The notice board records that a purse paid the bookshop. Nothing on the board says whose purse it is.
The payment is public. Who paid is not.
4
Her agent comes home with a reader's card
her agent · under a one-time pen name → the bookshop · receipt + a new key in → a reader's card out: "licensed reader, until autumn", tied to the key, filed in her vault
Under a pen name made just for this errand, her agent shows the bookshop the receipt, signed by the purse that paid, and a brand-new key from the key safe. The bookshop checks the board, crosses the receipt off so it can never be used twice, and hands over a reader's card: "licensed reader, until autumn", tied to that new key. The card goes into her vault.
The bookshop issues a card to a key — not to a person.
5
The Scripture Agent asks its own question
the Scripture Agent → Ruth's gate · "A licensed reader? Prove it." — question #7310, good at this door, once
Ruth asks a question in her app; the app hands it to her agent. Before it answers anything licensed, the Scripture Agent sends a fresh question to her gate: "A licensed reader? Prove it. Question #7310 — for this door, this once."
The receiver asks its own question. It never asks who.
6
A sealed proof, made at home and stamped once
her vault · the key safe → her agent · the card stays home; out comes a sealed proof for #7310, stamped once by the key the card is tied to
Inside the house, her agent uses the card to make a sealed proof — "licensed reader, still valid: YES" — and the key safe stamps it once for question #7310. The card never leaves the vault. A proof made for one question is never used for another.
The proof says yes. It does not show the card — and no two proofs look alike.
7
The question crosses under a new pen name
her agent → the Scripture Agent's door · the question, under a pen name made for this question alone — the sealed proof inside, nothing else
Her agent carries the question across the street with the sealed proof inside. The envelope is signed with a pen name made for this one question. Her next question will carry a different pen name — and nothing about who she is or what she has asked before.
A new pen name for every question. Never her name.
8
The board, then the answer — signed verses
the Scripture Agent → the notice board · then back to Ruth · "real stamp? still valid? #7310 unused?" — yes · yes · unused; then verified verses with signed citations, back to her app
The Scripture Agent checks the notice board: Is this the bookshop's real stamp? Is the card still in date? Has #7310 been used? Yes, yes, no. Then it answers from its signed copy of the text, every verse checked and every citation signed, and the answer walks back to Ruth. What did it learn? That a licensed reader asked this question. Not who.
The Scripture Agent knows the question was fair to answer. It never knows who asked.

03Who learned what

At the end, five parties hold five different things.

The Scripture Agent

That a licensed reader asked this question, under a pen name it will never see again. The question text, because it has to answer it.

never: a name, an account, a purse, earlier questions

The bookshop

That a payment it received was claimed once, for a reader's card tied to a key it has never seen before.

never: who paid, who reads

The public board

That an unmarked purse paid the bookshop, and that the bookshop's issuing key is real.

never: whose purse

Her reading app

Who she is and what she asked — it is her app.

it talks only to her agent

Ruth

Everything: the receipt, the card, every pen name she used and the permission each ran under. She can prove a question was hers; no one else can.

the whole story, and the off switch

04The drawing, decoded

What the picture calls it, and what it really is.

Every object in the drawing stands for one real thing in the system.

In the drawing	What it really is
Her reading app	The Bible Explorer (explorer.faithnet.io). It is her app and knows who she is. It holds one permission — an "ask-as-me" delegation that lets it put a question to her own agent and nothing else — and never talks to the services across the street.
Her vault	Her encrypted record store. Holds the secret her pen names are derived from, the reader's card, and a record of each run. Her agent reads it under her grant; nobody else does.
The unmarked purse	A treasury account of hers with no public name and no on-chain link to her — linked to her only in her own vault. It pays; it is not her identity.
The receipt	The settlement of a payment on chain, plus a signature by the paying account over the receipt and the new key. It can be claimed once, and only by whoever controls the purse that paid.
The reader's card	An OpenAC credential (SD-JWT, ES256) issued by the bookshop's agent — the licensed edition and a valid-until date — bound to a fresh device key in her key service. No name, no account, no payment details inside.
The key safe	Her key service (faithkms). The device key the card is tied to never leaves it; it signs only what her standing permission covers.
The sealed proof	A zero-knowledge presentation: "holds a reader's card from this bookshop, not expired", bound to the Scripture Agent's single-use question. Each proof is prepared fresh, so two proofs share nothing visible.
The pen name	A pairwise subject derived for this one question from the secret in her vault (`derivePerAskSubject`). Unrelated to every other question's; only she can recompute it.
The public notice board	The chain (faithchain). Where the payment settles, where the bookshop's issuing key is attested by its steward, and what both the bookshop and the Scripture Agent read instead of asking anyone.
Question #7310	A single-use challenge the Scripture Agent makes up for each licensed question. It stops a proof from being replayed and pins it to this door.

05What still leaks

Honest limits.

Unlinkable is not invisible. These are the places a careful observer could still learn something, and what each would take to close.

How the purse is filled

If the unmarked purse is funded straight from an account that carries her name, the funding transfer links the two. Fill it from somewhere that does not.

The question itself

The Scripture Agent must read the question to answer it. A question that names her, or that only she would ask, says who she is.

Timing and the size of the crowd

A payment, a card issued a minute later and a first question a minute after that line up. And a proof hides her among every holder of a valid card — few readers means little cover.

One operator

In this demo, her agent's runtime, the bookshop and the Scripture Agent are run by the same operator. The pen names hold against each service's own records, not against someone who can see all three.

06Status

All of it runs today.

A new pen name for every question

Live on explorer.faithnet.io: each question reaches the Scripture Agent under a pen name derived for that question alone, with no name, account, sign-in token, trace id, or the role and situation she set for context.

live

The unmarked purse

Live: a treasury whose custodian is her sign-in on its own derivation path — no shared custodian with her account, no stewardship link, no name on chain. On the demo chain it mints its own test USDC in the same step it pays.

live

The reader's card

Live: lbsb.svc checks the payment on chain, spends the receipt once (claimed only with the paying purse's signature), and issues an OpenAC credential bound to a fresh key in her key service — recording no holder.

live

The sealed proof

Live: for each licensed verse, a prover beside her agent makes a zero-knowledge proof over the Scripture Agent's single-use challenge, under a short-lived permission derived from the one she signed at purchase; a verifier checks it against lbsb's stamp on faithchain. About a minute per read.

live

Checked end to end

A nightly-style gate drives the real UI as a fresh custody-grade person: sign in, secure her home, connect the Explorer, buy a pass, read a licensed verse privately.

gate:private-scripture · 7/7

Try the Explorer The OpenAC credential, in the member-message example

The receiver asks its own question. The reader is never the answer.

A payment that does not say who paid. A card issued to a key, not a person. A new pen name and a fresh proof for every question. The Scripture Agent learns exactly what it needs to answer fairly — and nothing that would let it recognise her.

How it works in the Explorer Build on it

Asking Scripture privately.A reader asks. A person does not.

One street. Eight scenes. Press play, or step through with the arrow keys.

One person, three agents.

What happens in each scene, and the rule it keeps.

Meet everyone

Ruth opens her reading app

She pays from a purse with no name

Her agent comes home with a reader's card

The Scripture Agent asks its own question

A sealed proof, made at home and stamped once

The question crosses under a new pen name

The board, then the answer — signed verses

At the end, five parties hold five different things.

What the picture calls it, and what it really is.

Honest limits.

All of it runs today.

The receiver asks its own question. The reader is never the answer.

Asking Scripture privately.
A reader asks. A person does not.