Clavis (Latin: the key — the thing cut to fit one lock and no other). The key half of the signing pair: a keypair per entity and a credential per artefact, where a credential carries the alg, the public key, the artefact's SHA-256 digest, the entity's signet snapshot, the moment, and an Ed25519 signature taken over the CANONICAL FORM of all of those rather than over the bytes alone — so a re-labelled author or a moved moment breaks the signature and authorship cannot be forged after the fact. It is SIGNING, NOT SECRECY: nothing is encrypted, nothing is hidden, and a take is not secret — only its authorship must be unforgeable. It implements no cryptography at all; ClavisHost declares the machine (generate · sign · digest) and the browser's own WebCrypto Ed25519 is the reference host. The private key never enters a credential, is never logged, has no serialize path on the surface at all, and is generated non-extractable so the machine itself refuses to hand it out. Key storage is the host's business and this water holds nothing between calls.
Latin clavis (a key), related to claudere (to close, to shut) — the same family that gives 'close' and 'conclude'; a key is, at the root, the thing made to close a particular lock.
The key half of a signing pair — proof of who made a thing, never a secret about what the thing says.