CRE8 should store public keys, permissions, lineage, revocations, provenance, and events—but never retain long-lived Author private keys.

The five receiving devices should receive one-time enrollment claims, not plaintext private keys. Each receiving device generates its assigned keypair locally, returns only the public key, and displays or exports the private key once. Email can deliver a claim link, but should never contain the private key itself.


                    CRE8 Owner Surface
             Human login, policy, audit, alerts
                           |
                           v
+---------------------------------------------------------+
|                 CRE8 PHP Monolith                       |
|                                                         |
|  Owner authentication     Key enrollment coordinator   |
|  Request verifier         Permission evaluator          |
|  Key lifecycle manager    Provenance/event writer       |
|  Alert evaluator          HTML/API handlers             |
+-----------------------+---------------------------------+
                        |
                        v
                    PostgreSQL
       Owners, public keys, policies, lineage, events

One-time enrollment claim pages
        |
        +--> Generate assigned private key locally
        +--> Register only its public key with CRE8

Author API
        |
        +--> Fixed-format signed requests
        +--> No Owner session or password accepted