Part of Revenant · a real, shipped feature
Vigil
Vigil is a keep-alive switch — a branching emergency escalation plan, sealed and unaltered, that fires the moment someone goes quiet. It ships today inside Revenant, the custody-chained OMEMO messenger Amanda built (real phone number, real SMS, every message permanently provable) — not a mockup, not a concept sketch: a working product surface with its own escalation tree, break-glass unlock, and draft/armed lifecycle.
How it works
An escalation tree that fires itself
You set a check-in window. Miss it, and Vigil walks a pre-sealed contact tree — each tier a person, a scripted message, and a timeout — until someone acknowledges or the plan reaches its final, authority-facing step. The plan is sealed before it's needed, so nobody (including a coercer standing over your shoulder) can edit it in the moment.
Unforgeable
Each check-in reveals the next preimage in a Lamport hash chain, signed by a per-device ed25519 key. Only the real operator can produce the next valid beat — seeing every past beat reveals nothing about it.
Unpredictable
An observer watching the network can't distinguish a check-in from ordinary traffic, and can't predict when or where the next one lands — jittered cadence, channel rotation, no fixed "Vigil app" fingerprint.
Equivocation-resistant
Beats — and their absence — anchor to a public log (Rekor). A coercer can't fake liveness without the key, and can't hide going dark: the gap is publicly provable.
Duress-aware
A second hash chain: a duress check-in verifies exactly like a normal one, but silently flags coercion and fires the escalation covertly — the "forced to check in" case, handled without a visible tell.
Interactive sketch, on this page
Explore a variant: proof-of-life by circle, not by tree
This is not Revenant's shipped Vigil — it's a self-contained interactive sketch, built to explore a different shape for the same problem: instead of a linear contact tree, a circle of role-assigned friends (anchor, herald, signal, counsel, chain) who fan out together, and instead of a fixed message, a rule only you know — a phrase, a grid pattern, a spelled acrostic — proves it's really you, under duress or not. Play with it below; nothing here is wired to the real product.
Vigil
A privacy-preserving proof-of-life circle. You see what your people are up to, roughly where, and whether they're okay — and if someone can't check in, their sealed plan fires itself and the circle fans out.
Censorship-heavy. Identities behind handles, location coarsened to a region, duress is covert.
The circle
6 watching each otherSealed plan
On assignment — quiet
Verbal salt
where a check-in becomes proof it's youA check-in isn't a tap or even a voice — a voice can be recorded, coerced, or cloned. It's a rule only you know, run in your head over a fresh grid. You reveal which words, never the rule. The distress version isn't a codeword an interrogator can beat out of you — it's a different rule over the same grid whose answer looks statistically identical to safety.
Memorize a row number and a column number. Read your ROW left-to-right, then your COLUMN top-to-bottom. Two small numbers, one crossing pattern. Your distress rule is a different one over the same grid — here Spell a keyword.
Your Row then column rule highlights these cells. A fresh grid every time; the shape stays yours.
No rule assigned here — just click the words you'd pick, in order, on a fresh grid. That ordered pick is a verbal salt. This is the short version of the same playground the full rule library above is teaching you to reproduce from memory.
Field log
custody-chained · append-onlySealed plan
Each plan is locked to a sha256 seal. What fires is provably the exact plan that was sealed — it returns, unaltered, and acts when you can't.
Proof of life
A check-in is a Lamport reveal signed by your verbal salt. The server stores only your public rule-key — zero knowledge, nothing to steal.
Dead-man's nonce
Minted when a window opens, burned on check-in. Left unburned, the keepalive_lapsed oracle fires the pre-agreed charter — authorization without you.
Fan-out roles
The plan is a phone tree for digital media: each friend holds one signed role — herald, signal, counsel, chain, anchor — executed the moment the nonce lapses.
Wired to the real Vigil guts — grid rules from lib/saltGridAlgorithms.js, speakable ciphers from lib/saltDialect.js (null cipher · Zancig · Cardan grille). Check-in windows, lapse detection, dead-man's-nonce authorization and the role fan-out are modeled on tools/vigil_lite.py. Circle and events are fictional.