Membership & the /claim Flow

Church of Malware (CoM) is the community around Syn_OS. This page explains how a Discord membership tier becomes usable on an installed, churchofmalware-profile Syn_OS image — GRIMOIRE member-tier perks and authenticated world-server multiplayer.

This is not the same system as building Syn_OS from source with a Church key (a separate git-crypt/GPG process for unlocking member-gated crates at build time). This page is about runtime membership recognition on a machine you already have installed.

How it works

Component	Runs where	Holds a signing secret?
/claim Discord command	Church of Malware Discord (bot, delivered over the Gateway — no public URL to reach)	No — delivers an already-signed token, never signs one itself
synos-claim	Installed on member-profile images at /usr/bin/synos-claim	No — a secret-free install client
synos-member-token verify crate	Shared Rust library	No — verifies only, never signs

Tokens are signed offline, ahead of time, with an Ed25519 key that never touches a networked host. The Discord bot only ever delivers a token it was handed; it never has the ability to mint one itself.

The flow

1. Get your token. Run /claim in the Church of Malware Discord. The bot reads your current guild roles, resolves your tier, looks up your pre-signed token, and DMs you a ready-to-run command:

   synos-claim --import <token>

   If you’re eligible but your token hasn’t been minted yet (you just joined or were just promoted), the bot tells you to retry after the next nightly refresh instead of leaving you stuck.

2. Install it. Run that command on your installed image. --import does a structural + expiry sanity check (no network call), then installs the token to ~/.config/synos/member-token.jwt (0600, atomic write-then-rename).

3. It gets consumed automatically. Two things read the token, both through the same shared verifier:

   • GRIMOIRE’s member-edition path grants perks once, at first-player-creation.
   • The world server’s connect-auth path gates authenticated multiplayer sessions.

   Both verify the Ed25519 signature — and the device binding — before trusting anything in the token.

Freshness

Tokens are minted in a nightly batch that re-pulls the Discord roster, and are valid for 90 days. A new membership, promotion, or removal shows up the next time you run /claim after that night’s refresh — there’s no live endpoint that can be unreachable, so the only wait is for the next nightly run to catch up with Discord.

Role → tier

Discord role	Effect
(none / not in the server)	Public baseline — same as a non-member image
Member	Starting perks, GRIMOIRE member-tier XP bonuses
Officer / Contributor	+ member tools, exclusive labs
Admin / Clergy	+ exclusive contracts, prestige badge

Tier is cryptographically derived from a signed token, not a locally-edited config file — a user can’t self-grant a higher tier by editing local state.

Related

• GRIMOIRE Guide → Factions
• Curtain Capability Tokens →