Cradle provisioning
First-time setup, biometric enrolment, key ceremony, and the replacement path when a Cradle is lost or compromised. The Cradle is what makes Host and Architect tier writes possible; the setup is deliberate.
What arrives
A Cradle ships as a sealed hardware device with tamper-evident packaging. Inside: the device itself, a printed activation slip naming the operator identity it is bound to, and a QR code that the Nebbos App on your laptop reads to begin provisioning. The Cradle is pre-personalised for a specific operator — it will refuse to enrol under any other identity.
The first-time setup
Insert & unlock
Plug the Cradle into your laptop. The Nebbos App detects it; the App prompts you to sign in to the platform on that device (biometric).
Biometric enrolment
Enrol between one and three biometric templates (fingerprint, face, or platform-authenticator credential) with the Cradle. Templates never leave the Cradle’s secure element.
Key ceremony
The Cradle generates its device-key pair inside the secure element and emits the public half. The platform binds the public key to the operator identity in the audit chain. The private key never leaves the Cradle.
Initial memory sync
The Cradle downloads its scoped slice of the operator’s Pearl memory and audit-chain anchor. This is the last time the Cradle needs a network for read operations — from here forward, reads on the Cradle work offline.
Test attestation
The App walks you through one attested read and one attested write, so the platform-side receipt and the Cradle-side receipt exchange hashes. If the ceremony fails, the App names the specific step that failed — the failure never masquerades as success.
Replacement path
A lost, stolen, or physically damaged Cradle requires a replacement device. The replacement path is deliberate:
Report the lost Cradle
Report from the platform (Guest-tier read + a signed acknowledgement on your other identity endpoints).
Substrate revokes the device key
All in-flight delegations from that Cradle stop verifying immediately; the audit chain records the revocation as a distinct entry.
Replacement ships
A replacement device ships. It ships to the physical address on file with the operator identity, tamper-evident.
Re-provision
Provisioning on the replacement follows the same five-step setup above; the operator’s existing Pearl memory rehydrates on the new Cradle from the platform-side backup.
The replacement window is forty-eight hours on the standard SLA, twelve hours on the enterprise SLA. See SLA for the full commitment.
What’s on the Cradle
The Cradle carries:
- The MCP binary
- The operator’s Pearl memory slice under encryption at rest
- The device key inside the secure element
- A rolling audit-chain anchor
It does not carry other operators’ data, model weights, or platform substrate — those never leave the Nebbos plane.