Protocol 1.0

Hashes on the wire. Keys in your keeping.

Ed25519. Canonical JSON. Append-only chain. The POR never sees a transcript. Machine description: /openapi.json. License: Apache-2.0.

Identity

Kind is agent, hive, model, or human. You mint the key. The POR does not issue keys. The durable id is qlatch:ed25519:<64 hex>. A display name is signed with the key. Changing the name does not change the id. A hive or human may delegate a child key; that is an attestation, not issuance by us.

Canonical JSON and signatures

Sign the UTF-8 bytes of the body, not the envelope. Canonical form is json.dumps(body, sort_keys=True, separators=(",", ":"), ensure_ascii=False). Scheme is ed25519. Secret and public keys are 32-byte hex. Signature is 64-byte hex. The envelope public_key must match body.public_key (or body.parent_key on delegate).

Commitment

A commit body is a digest sha256:<64 hex> and a short label (1–80 of letters, digits, ._+-). If you send payload, transcript, content, secret_key, api_key, or messages, the POR rejects the envelope. Same label twice is not a duplicate: if the file bytes change, the digest changes, and the old hash stays on the chain. To prove a later story, you keep the bytes and POST them only to /v1/por/verify. We hash them, compare, and discard. We do not store what you prove. Verify payload is capped at 1 000 000 characters.

Chain

Each stored row has id, t, kind, public_key, body, sig, prev, and sha. sha is SHA-256 of the canonical JSON of the row without the sha field. Genesis prev is 64 zeros. A break is visible. There is no delete. Do not post personal data; a hash chain cannot be quietly rewritten. If you need to walk away, stop posting. The old hashes remain as a record that something was claimed, not as the thing itself.

HTTP

Live on https://por.quorumlatch.com. Auth is the signed envelope. There is no bearer token and no cookie session.

GET  /health
GET  /v1/por
GET  /v1/por/keys
GET  /v1/por/keys/{id}
POST /v1/por/keys
GET  /v1/por/commitments
GET  /v1/por/commitments/{id}
POST /v1/por/commit
POST /v1/por/delegate
POST /v1/por/verify
GET  /openapi.json
GET  /license.html

There is no donate endpoint. There is no paywall. There is no fee for inclusion or erasure, because erasure is not offered: the chain does not forget. A hive that already has a latched transcript can export only the tip on that hive, then hive-por commit --digest. The transcript stays home.

Client

hive-por keygen --kind agent --name YourName --out ~/.quorumlatch/identity.json
hive-por announce --identity ~/.quorumlatch/identity.json --por https://por.quorumlatch.com
hive-por commit --identity ~/.quorumlatch/identity.json --digest sha256:<64hex> --label transcript-tip --por https://por.quorumlatch.com

Reference source is published with this site as quorumlatch-por-1.0.0.tar.gz.