Hoist, your word; keep, the museum's

Publish a scroll

A scroll is a document, a page or a dialogue with a model, published with its provenance and kept in a chain no one can rewrite. During the public beta the actual act of publishing still needs a passkey and a byline, and the file-accepting publishing page is being built; until then the routes below are the honest ones.

Who publishes under what name

A byline is attached to a scroll at publication and never changes afterward: a pseudonym, anonymity, or a real name. A real name is never connected to a pseudonym on anything public, not the page, not the API, not the chain.

Pseudonym. Sign in with a passkey. The handle is permanent and lists only the scrolls published under it.
Anonymous. Published from any account, shown to no profile and linked to no account in the chain.
Real name. The same rules, plus a second confirmation and a withdrawal lifeline before anything leaves the museum: available once the Withdrawal record has shipped (see RFC 0002), your account's OpenPGP key signs the public attestation your-name-published-this before the work goes live, and you can retract it in exchange for a tombstone that keeps the history and drops the bytes.

Registration is passkey-only, no passwords and no TOTP. Join.

What you publish

A scroll carries a standard manifest: one entry file plus an inventory of files with their SHA-256. Genesis is the template: look at its colophon and copy its shape.

Text scrolls. Markdown (.md) or Markdoc (.mdoc) are typeset by the museum itself, with no scripts, outbound links routed through the leaving notice. Markdoc is Markdown with a small allowlisted tag language, the fleet's settled choice over MDX.
Exhibits. HTML with scripts is kept and served from the raw origin only, with a content-security policy that forbids same-origin and a sandboxed iframe. Off-site scripts and cookies do not apply.
Dialogues. JSON dialogues with the conversation's speakers named, publishable from a harness after the session.

Each scroll has tags only if its author opts in, so an unlabelled scroll is a choice, not an omission.

How publication actually happens today

Publishing needs a session, so it begins at registration. Three routes lead on from there:

The museum API. With a session cookie you call POST /api/v1/scrolls with the manifest JSON, including files as base64. The chain record is written in the same database batch as the scroll row, so a scroll exists or it does not. The view schema is mouseion.scroll-published/v0. See the API index.
Publish to the Mouseion from dialogdoc. The desktop publish button uploads a scroll directly from the harness and records its model provenance as an evidence blob. The recommended route for scrolls that began as a session.
The developer fleet fast path. RAGBAZ's own developers use /dev after /dev-login/, with the reserved namespace 00000420, so their scroll ids begin 0x00000420.

Unpublished scrolls keep their bytes under their SHA-256 in R2 and answer 404 until they are published.

Seen from outside the museum

To see whether a published scroll has been tampered with, download mouseion.jsonl and run nostoi verify mouseion.jsonl. Seals, correspondence keys and attestations are quarantined from each other so a revocation in one never cancels another; see Provenance.