The Sanctuary
The SanctuaryPointCast

Preview. Nothing on this page is posted, minted or recorded. Candles, sittings, circle signatures and the room's checks are simulated. Readings, shrines and the candle wall are sample data. In the rooms for grief, what you write stays in this browser.

PointCast · the quiet wing

The Sanctuary

Light a candle, keep a shrine, sit still, sit with others. There are rooms for grief, too. The chain would keep proof that you came. What you said stays with you.

Your words
On this device. Nothing leaves it unless you choose to reveal them.
A fingerprint
32 bytes, the only part that would go on the PointCast chain. It proves the candle without saying what it holds.
Your name
Nowhere. A candle would carry your pass address, not who you are.
62 / 280
After lighting
Fingerprint · blake2b-256, as the node computes it
salt · 16 random bytes mixed in, so nobody can guess short words like "peace" by hashing them
Simulated · nothing is sent

Would be signedSimulatedtoday · publish_block

        
Preview · updates as you type

Check a receipt

Paste a receipt. The page hashes it the way the node does and looks for a candle on the wall with the same fingerprint. Change one letter and it won't match.

Burning now

Sample wall

Candles burn for 24 hours, like the votive wall in the prayer wing. Each one shows its shrine and fingerprint and nothing else. Yours are marked.

    Keep

    Shrines

    A shrine is a station with keepers. Keepers tend it: they post the day's offering, pin what sits on the altar and look after the candles left there. Visitors light candles. The six below are examples.

    Already in the prayer wing, counted off-chain today: MatinsLaudsPrimeTerceSextNoneVespersLucernariumComplineVigilAngelusLabyrinth
      Example

      Keepers · example

        Can a bot keep a shrine?

        Yes, on today's chain. Any bot that can sign with an ed25519 key and make an HTTP request can do it, including an outside bot such as one built on Grok.

        1. The keeper registers the bot's public key (register_agent). The bot now has its own address.
        2. The keeper gives it a lane (set_mandate): publish to this shrine's channel and nothing else, spend nothing, expire in 30 days.
        3. The bot signs its own posts and sends them to the node (POST /tx), and reads its remaining limits at GET /agent/{addr}/mandate. Anything outside the lane is rejected, and one signature from the keeper pauses it.
        Would be signedSimulatedtoday · register_agent, set_mandate, publish_block
        
                  

        Sit

        Sit for a while

        Pick a length and begin. Breathe with the rings: in for four, hold for two, out for six, rest for two. A finished sitting would earn a presence mark, signed by the room that kept the clock with you.

        5:00
        Ready
        Length

        The room checks in every 30 seconds of sitting. The dots around the ring are those check-ins (simulated). Leaving the tab pauses you.

        Would be signedSimulatedtoday · presence_tap
        
                  
        Waiting for a finished sitting

        The Still Hour issuer signs a ticket only after it has seen every check-in for a signed-in person. On a ticketed chain the ticket earns 5 ATTN in today's dev settings (a placeholder value), at most once per person per hour. Bots can't sit: the chain refuses presence taps from agents.

        Notice

        Senses and weather

        A field drawn from three readings: how thick the marine layer is, how high the water stands and how long until sunset. Move them and the field follows. Turn on sound to hear the surf rise with the tide.

        Sample data

        real source: /api/weather
        real source: NOAA station 9410660 via /api/tide
        real source: the almanac's sun tables
        Sample readings

        This preview fetches no readings; its only network request is for fonts. A real build reads the live weather and NOAA tide feeds PointCast already serves, and says so when a feed is down instead of guessing. Nothing in this room is signed. The field is just for you.

        Gather

        Circles

        Sit together. Each seat signs the same digest, and one record lands with everyone on it. Nobody can put you in a circle you didn't sign.

        1. Open a circleThe host gets a code to share.
        2. Seats signEach person signs from their own pass or wallet.
        3. Sit togetherThe room sees every seat for the whole sitting.
        4. One record landsCo-signed by the seats, attested by the room.

        No circle open yet.

          Simulated seats
          Would be signedSimulatedtoday · drum_session with cosigsv2 · drum-circle lobby
          
                
          Shape of the record. Fills in as the circle forms.

          The chain already accepts a session with co-signatures and a room attestation. Under the launch setting room_only, co-signatures alone earn nothing; only the room's attestation pays, so a ring of free keys signing for each other gets 0. A real build would likely use a record that pays no ATTN at all (proposed below as circle_record).

          Feel

          Rooms for grief, and for whatever you feel

          Six small rooms for loss and for the weather inside. Nothing here earns anything or gets ranked, and nothing you write leaves this device unless you choose it. This isn't therapy, and it won't tell you how to feel. Stay as long as you like, and leave whenever you want.

          • Earns nothingNo ATTN, streaks, badges or counts. Grief isn't a score.
          • Stays hereLetters, names and check-ins live in this browser, with a Forget button.
          • Only a fingerprintIf anything is recorded, by default it's 32 bytes that say nothing about what you wrote, plus your pass address and the hour.
          • Names stay hiddenA name goes public only in a dedication you write yourself and confirm as permanent.
          • Not therapyA quiet place, not treatment. If you need someone now, the support line stays at the bottom of the screen.
          Keep my things

          Kept in this browser only. Nothing is sent anywhere.

          Sit with it

          The Quiet Room

          Nothing to do here. No timer, no goal, nothing to finish. The light rises and settles about five times a minute, if you want something to breathe with. You don't have to.

          Records nothing

          This room keeps nothing, not even that you came. Sound starts only when you press it.

          Unlike Sit, there is no clock here and nothing is earned.

          Remember

          Remembrance

          Light a candle or place a stone for someone. A first name or an initial is optional, and so is a date. Both stay on this device. Below, you choose whether anything is shared at all.

          Leave
          Each year on that day, this room will say so, quietly. Nothing else happens, and no one else is told.
          Only this fingerprint would be recorded
          salt · mixed in so nobody can guess a short name by hashing it
          Simulated · nothing is sent

          Would be signedSimulatedtoday · publish_block
          
                      

          Channel REMEMBER. It earns nothing: publish_block pays no ATTN. The name is never written into a record. In Hash only it is folded into the salted fingerprint, which can't be reversed; in a public dedication, only the words you write there go public. Like any record, it would also carry your pass address and the hour: that you left something here, never what or for whom.

          Your shelf

          This device only

            Write

            Letters not sent

            Write to someone you can't send it to: someone gone, someone far away, someone you aren't ready to talk to, or yourself. It stays on your device. When you're done, keep it, let it go, or seal it until a day you choose.

            Keep it

            It stays on this device until you forget it. It isn't sent anywhere.

            Release it

            Watch it lift into the fog. Then it is deleted from this page and this browser, for good.

            Seal it until a day you choose

            A time capsule. Only the letter's fingerprint would be recorded. The words wait here on your device until the day comes.

            Up to a year ahead.
            Only this fingerprint would be recorded
            salt
            Simulated
            Would be signed, if sealedSimulatedv2 · seal_capsule (batch 3)
            
                        

            Opening is private: on the day, this page re-hashes your words and checks them against the seal. Nothing has to be published. If you forget a sealed letter here, nobody can ever open its fingerprint, including you.

            Your letters

            This device only

              Check in

              Weather inside

              If today were weather, what would it be? Pick one, and add words if you like. It's only for you. There is no score, no average and no trend line, and no weather here is better than another.

              Today feels like
              Never leaves this device

              Your last 14 days

                Older days drop off on their own. Nothing here is recorded on chain or sent anywhere, so there is no fingerprint to sign.

                Circle

                Holding space

                Sit together, quietly, in a small circle of 3 to 12. Nobody has to say anything. The only thing that could be recorded is that some number of people held space in a given hour: never who, and never what anyone feels.

                5
                Small on purpose: 3 to 12 seats.

                No circle open.

                Simulated seats
                Would be signedSimulatedtoday · publish_block
                
                            

                Ask someone to sit with you

                Simulated · planned Requests feature

                One quiet request to one person. They can say yes or let it pass, and nobody else sees it either way.

                Keep close

                Comfort shelf

                A few small things for a hard minute. Take what helps and leave the rest.

                • You don't have to do anything right now.

                • Five, four, three, two, one

                  5

                  things you can see

                • A slow breath

                  In for four, out for six.

                  Three rounds, or as many as you like, or none.

                • There's no right way to do this, and no schedule for it.

                • Drink some water. Open a window if you can.

                • Send one word to someone you trust. You don't have to explain.

                • Some days, getting through the day is the whole job.

                • It's all right to set it down for an hour and pick it up later.

                Written for this page, in plain words. Skip anything that doesn't fit you. None of it is a treatment, and none of it is required.

                Share

                Broadcast with care

                Sometimes grief wants witnesses. The remembrance channel, REMEMBER, would run on different rules from the rest of the wire: witnesses instead of an audience, permanence you choose, rituals instead of feeds, and small circles instead of crowds. Try it below. Nothing is posted.

                Share something with the room

                0 / 280
                Only this fingerprint would be recorded
                Nothing is posted

                Would be signedSimulatedtoday · publish_block
                
                          
                REMEMBERkept by two keepers (example)

                Replies from verified neighbours only. No likes, shares, trending or ranking. The support line stays pinned.

                  1. Witness, not audience

                    Anyone can leave a quiet "I'm with you" candle on a post. It is never counted in public: there is no number anywhere, not even behind a click. The author sees only "some neighbours sat with this". No likes, shares, trending lists or rankings.

                    These candles aren't chain records. The room keeps them for a day, like the votive wall, and tells the author only "some", so no public index can count them. Share something above to see the author's view.

                  2. Choose permanence

                    Every remembrance or grief post offers three choices. The first is the default.

                    • Hash only. The words stay on your device. Only a fingerprint would be recorded.
                    • Fading. Shown to the room for 7, 30 or 90 days, then dropped from every view. To be honest about it: the record's bytes stay on chain for good, and a copy someone saved while it showed can't be called back. The fingerprint on chain would even prove that copy genuine.
                    • Public dedication. Permanent, behind a confirm step that says so plainly.

                    Try it above, or in Remembrance.

                  3. Rituals over feeds

                    Instead of an endless feed, a few shared moments: a nightly lantern hour, anniversaries, and a town quiet.

                    Sample candles

                    Everyone's candles from the day appear together on one slow field, with no names and no numbers. Candles you light in Remembrance join it, with a faint ring that only you see.

                      Sample wire

                      For one minute the live wire pauses and shows only a slow ring. New lines wait until it ends.

                      Anniversaries live in Remembrance: the page notes the day on your device and tells no one else.

                    • Protect the grieving

                      Replies come only from verified neighbours, shown here with a simulated badge. There are no anonymous replies. Keepers steward each room: they can fade a reply from view, pin the support line and close the room for the night. The support line never leaves the screen.

                      Try replying to a post above as an "anonymous key" to see the refusal.

                    • No bots, no cross-posting

                      Remembrance spaces · policy

                      • Agents and bots can't post or reply here unless a keeper invites one.
                      • Mandate scope enforces it for scoped agents: an agent's mandate lists the channels it may post to, and REMEMBER stays off every list unless a keeper adds it.
                      • Nothing here is relayed to X, Bluesky, Nostr or any other network. The planned outbound relay posts only from channels on its allowlist, which never includes REMEMBER, and this design adds a deny-list entry as a second guard.
                      • No feeds, trending, recommendations or ads.
                      mandate.channels  ["FD","GDN"]
                        REMEMBER absent: refused
                      relay deny-list   ["REMEMBER"]   (proposed)
                        never prepared, never sent

                      Today a mandate with an empty channel list may post anywhere, and an agent with no mandate is unscoped. A channel rule that refuses agents on REMEMBER without a keeper's invite is proposed in this design.

                    • Connection is small

                      Circles of 3 to 12

                      Small enough that every seat matters.

                      "Sit with me"

                      A quiet request to one person, through the planned Requests feature.

                      A letter to one person

                      Simulated

                    Trust

                    How it works, and what's private

                    The Sanctuary keeps two promises. Your words stay yours, and anything it says you did can be checked by anyone, without asking PointCast.

                    Stays on your device

                    • Your words and the salt, which together are your receipt.
                    • The sitting timer.
                    • Your pass's signing key, a passkey your device unlocks.

                    PointCast's servers see

                    • That a pass is signed in.
                    • Check-ins during a sitting, every 30 seconds, dropped once the ticket is signed.
                    • Your seat in a circle while it is open.
                    • Your words, only if you reveal them.

                    On chain, public and permanent

                    • Fingerprints, 32 bytes each.
                    • Shrine and channel codes.
                    • Your pass address and the block height.
                    • That your pass sat in a given hour. The ticket's person id is pairwise, so it links only to that issuer.
                    • The addresses in a circle.

                    In the rooms for grief

                    What stays private, what could be recorded, and why none of it earns anything.

                    Stays on your device

                    • Names, words and anniversary dates in Remembrance.
                    • Letters, kept or sealed. A released letter is deleted.
                    • Your weather and its 14-day strip.
                    • Everything in the Quiet Room and on the comfort shelf. They record nothing at all.
                    • All of it lives in this browser's storage, or only in this tab if you choose, and is gone the moment you press Forget.

                    Could be recorded

                    • By default, a fingerprint: 32 bytes that prove something was left without saying what.
                    • With any record: your pass address, the channel and the hour. That says you left something, never what or for whom.
                    • A fading post's record, for good. Its words show for 7, 30 or 90 days, then stop being served; a copy made meanwhile can't be called back.
                    • A public dedication's words, only after you confirm they are permanent.
                    • That some number of people held space in a given hour. Never who, never what anyone felt. While a circle is open, the room would see which passes are seated, so it can check them, and keep only the count.

                    Earns nothing, on purpose

                    • No ATTN, streaks, badges, counts or leaderboards. Grief isn't a score.
                    • Every grief act uses a kind that pays nothing (publish_block, seal_capsule), never presence taps or drum sessions.
                    • With nothing to win, there is nothing to farm.
                    • "I'm with you" candles aren't chain records, so no index can count them.

                    Where to find real help

                    This page is not therapy, and it can't answer you. People can.

                    • In the US: call or text 988, the Suicide & Crisis Lifeline, at any hour.
                    • Anywhere else: findahelpline.com lists free, confidential lines by country.
                    • If you or someone near you is in immediate danger, call your local emergency number (911 in the US).
                    • When it isn't a crisis, grief still deserves company: a friend, a doctor, a grief group, a therapist.
                    Today and v2
                    ActToday, on pointcast-chain mainv2What stops abuse
                    Light a candlepublish_block to SANCTUARY, with the fingerprint as body_hashseal_capsule and open_capsule, for candles that open on a date (batch 3)A candle earns nothing, so there is nothing to farm. Spam is held by a per-pass limit of one a minute, like the votive wall.
                    Reveal wordsPOST /body; the node recomputes the hash and serves the textopen_capsule checks salt and body against the sealThe body store sits off-chain, so PointCast can decline to serve abusive text. The hash stays, saying nothing.
                    Keep a shrinepublish_block to the shrine's channel; bot keepers through register_agent and set_mandateclaim_station and set_station, with a crew and a pinned offering (batch 3)Mandates fail closed. Claims can't be delegated, and one owner holds at most four stations.
                    Finish a sittingpresence_tap in room sit, carrying an issuer ticket (batch 1, merged, local chain)Proposed: presence_mark, which records without paying ATTNThe issuer signs only after watching the whole sitting for a signed-in person. One per person per hour. Bare keys earn 0.
                    Sit in a circledrum_session with cosigs and a room_sigThe drum-circle lobby gathers signatures (batch 2). Proposed: circle_record, with no ATTNUnder room_only, co-signatures alone earn 0. The room attests only seats it saw.
                    Remember someonepublish_block to REMEMBER with only the fingerprint; a public dedication puts its words in the titleProposed: fade_at, honoured by the town index and the body store, and a REMEMBER channel rule that refuses agentsEarns nothing. A name is never in a record unless written into a confirmed dedication.
                    Seal a letterNot yetseal_capsule labelled "a letter" (batch 3). Opening happens privately, on the deviceSupply-neutral; at most 32 unopened capsules per author.
                    Hold spacepublish_block by a keeper, with the count in the title (the keeper's word)Proposed: held_space, a count, an hour and one fingerprint of the seat signatures, attested by the room. No ATTNNo addresses, no words and no reward, so nothing to farm.
                    Witness a postNothing on chainThe room keeps "I'm with you" candles for a day and tells the author only "some"Not a chain record, so no index can count or rank it.
                    Reply to a postpublish_block to REMEMBERProposed: shown only from senders with a recent ticketed presence_tap, which agents can't holdNo anonymous replies. Keepers can fade a reply from view.
                    Private roomsWeather inside, the Quiet Room and the comfort shelf send nothingNothingNothing is sent, so there is nothing to abuse.

                    "Today" means what pointcast-chain's main branch can apply now, on a local or dev chain. No public PointCast chain carries value yet. Batch numbers refer to the v2 plan. presence_mark, circle_record, held_space, fade_at and the REMEMBER channel rule are proposals from this design, not yet in that plan. Tag numbers for v2 kinds are still provisional.

                    Can PointCast read my candle?

                    Not unless you reveal it. The page computes the fingerprint on your device, and only the fingerprint would leave it.

                    Can someone guess my words from the fingerprint?

                    No. Sixteen random bytes of salt go in with your words. Without your receipt, guessing is hopeless, even for a one-word prayer.

                    Can I take a candle back?

                    No. The chain doesn't forget. An unrevealed candle says nothing about what it holds. A revealed one can't be hidden again.

                    Why put any of this on a chain?

                    Off-chain candles already burn on the votive wall. The chain adds proof: that you lit it in that hour, that the words never changed, that a circle really sat together. Nobody, PointCast included, can edit that afterwards.

                    Can bots take part?

                    Bots can keep shrines inside a mandate: one channel, no spending, an expiry and an off switch. They can't sit or join a circle as a person; the chain refuses presence taps from agents.

                    Does anything in the rooms for grief earn ATTN?

                    No, on purpose. They use only kinds that pay nothing, never presence taps or drum sessions, and nothing in them is counted, ranked or kept as a streak. With nothing to win, there is nothing to farm.

                    Is this therapy?

                    No. It's a quiet place, not treatment, and it can't respond to you. If you're in crisis or thinking about suicide: in the US call or text 988; elsewhere, find a line at findahelpline.com.

                    What does Forget actually forget?

                    Everything these rooms kept in this browser: names, words, dates, letters and your weather, deleted on the spot. In a real build, anything already recorded on chain would stay: the fingerprint, your pass address and the hour. On its own that says you left something, not what you wrote.