Feature 10
On this device hub
Returning stewards manage ownership, pins, and shortcuts—no accounts.
About this feature
Why it matters
After create, stewards need a control center for what they own on this device—not a lecture on key storage. The hub surfaces the next action (save ownership, attest, revoke, live proof).
Design decisions
Status dot - floating trust indicator; tap opens On this device hub sheet. Inbox - action rows, badge, live-proof overlays when the tab is visible. Saved objects - Open controls, Open scan, relabel/remove. Pinned scans - public bookmarks only (hc_device_pins). Search - inline in hub; filters local rows only. Backup import - decrypt .hcbackup.json into hc_wallet. Focus mode - hide intro sections.
Shell micro-features (compact list on features hub): cross-tab managing banner, resolver tab sync toggle, opt-in browser alerts + sw-live-proof.mjs (live proof only), PWA install on steward pages, ownership custody notices, child-object backup gate on /created/, ephemeral manifesto update at #update-status. User guides: /help/#device-shell.
Safety · privacy · security
Control stays in browser storage; pins never hold signing material. Search is client-side over data you already saved. Cross-tab managing and card-disabled alerts use resolver-confirmed polls — never wallet cache alone. Browser alerts and OS push (hosted tier) are live proof only — never for passive scan alerts, cross-tab custody nudges, or scan histories.
Limits
Not cloud sync or multi-device accounts. Browser profile sync (Safari/Chrome) may copy saved ownership incompletely - prefer explicit save per machine. No directory search for other people’s cards. Status dot is shell chrome, not the live-control protocol — see live control for in-person control proof.
Advanced: signing keys & browser storage
Signing material per tab lives in sessionStorage (hc_created). Save ownership on this device copies control to localStorage (hc_wallet). Cross-tab presence stores public metadata only—never private keys.
Future directions
Optional activity log on device, clearer multi-tab control handoff, federated read - still no operator custody of owner keys.