-
Notifications
You must be signed in to change notification settings - Fork 0
Logbook July 2026
Paolo Veronelli edited this page Jul 24, 2026
·
2 revisions
Week of Jul 6th — The project goes public: cardano-aid is renamed to cardano-keri across the Haskell namespace, the Aiken package, and the value-write signing domain, the repository is opened with meeting material kept out of the tree, and the docs site starts deploying to GitHub Pages. The week then turns technical — the identity specs (detached-signature authorization envelope, key-state UTxO, permissionless pre-rotation) are frozen and the org-standard CI shape is restored so tests actually run. The central question, whether BLAKE3 genesis verification can fit a Plutus transaction, is chased from a flat "does not fit" verdict through four optimization rounds to a lane-packed implementation where the whole single-chunk domain fits the mainnet budget.
- Merged docs: GitHub Pages deploy + README refresh #55 — docs deploy to GitHub Pages on main with PR previews; README refreshed for the public repo (closes #53, #54).
- Merged docs: speckit constitution + gitignore #60 —
speckit initwith a filled constitution under.specify/, result symlinks gitignored (closes #59). - Merged docs: add milestones slide deck #64 — technical milestones deck added as a static docs asset and linked from the roadmap.
- Merged docs(spec): detached-signature authorization envelope #61 —
Option A spec: normative CBOR envelope layout, sign-the-digest procedure,
an 11-check threshold-aware Aiken verification contract, and the strict
key_seqfreshness rule (part of #34, spec for #39). - Merged docs(spec): identity key-state UTxO + permissionless pre-rotation #62
— freezes the list-shaped, threshold-capable
KeyState(per-key digests + weights + threshold), itstrie_keyderivation, and versioning story (spec for #24, epic #21).
- Merged docs: add ACDC primer #65 — primer on the credential layer above KERI: SAIDs, edge-chaining, the four-hop vLEI chain, TEL revocation, and how M1/M2 verify a chain on-chain.
- Merged docs(vetting): re-vet the canonical permissionless model #67 — independent re-vet of the current permissionless model, filing finding issues and marking the #24 blockers (closes #15).
- Merged ci: org-standard CI shape #66 — CI was a false green that built artifacts but never ran their tests; now runs unit tests, adds a dev-shell cabal gate and cachix, with a justfile mirroring CI across both planes (closes #56, #57).
- Merged design(68): frozen KeyState/trie_key shape #82 — vLEI-grounded
design discussion freezing the list-shaped, threshold-capable KeyState that
hardens into
trie_keyat inception, plus the Blake3-wall decision (design-only, for #68). - Merged docs: KERI-sovereign identity model #87 — captures the identity model (on-chain checkpoint + witnessed anchoring seal) as a drillable decision record, amended after adversarial validation against keripy source.
- Merged docs: correspondence policy — fraud-proof policing #94 — resolves open thread 4: seal↔native correspondence is required and policed via objective on-chain divergence fraud proofs; freeze on proof, slash knob deferred.
- Merged docs(architecture): System Architecture page with diagrams #86 — a diagram-rich architecture page (Mermaid) presenting the system designed in the recent sessions.
- Merged docs: economics & watcher layer #85 — adds §11: correctness stays on-chain and watcher-agnostic while service becomes an off-chain market, removing the mandatory-signature / liveness-coupling walls.
- Merged chore: blake3-in-Plutus genesis-verification spike #89 — spike for #88: a correct single-chunk BLAKE3 in Aiken / Plutus V3; verdict DOES NOT FIT — even the refined version exceeds mainnet exec units at every representative inception size.
- Merged refactor(spike-88): optimize in-script blake3 #96 — flattens UPLC (4,697 → 2,669 bytes), all nine official vectors still pass; verdict flips to FITS at representative inception sizes.
- Merged spike(plutus): checkpointed multi-tx blake3 #98 — checkpointed multi-transaction BLAKE3 verification of one 1024-byte chunk (#97), reopened to close two acceptance gaps.
- Merged refactor: reduce Aiken BLAKE3 execution cost #101 — a CPS implementation beats the previous repo version and the Aiken-author reference figures at all four measured sizes.
- Merged refactor: lane-packed BLAKE3 #102 — third round: state rows carried as lane-packed integers (four u32 lanes at a 5-byte stride); every input 0–1024 bytes now fits the mainnet per-tx budget.
- Merged chore(spike): bump Aiken to 1.1.23 #103 — bumps the spike toolchain and pins the official release binaries by published SHA-256.
- Merged fix(onchain): restore cage token and AID-ownership invariants #100
— restores the
mpfCagevalidator's security boundary (one confined cage thread, owner-authorized burn, input-authenticated modify) with a withDevnet e2e smoke; security prerequisite for #24/#25/#26/#44 (closes #99). - Merged docs(identity): genesis/registration decision — hybrid #95 —
records the hybrid decision: cryptographic byte binding
blake3(icp) == cesr_aidon-chain for single-chunk inceptions, attested / challengeable projection beyond one chunk; supersedes the "BLAKE3 cannot fit" premise (re-aims #91).
Week of Jul 13th — With BLAKE3 proven to fit, the focus shifts to freezing the checkpoint's on-chain shape and starting to build it. Midweek settles the checkpoint contention model (a sovereign per-AID UTxO over an MPFS trie) and freezes the weighted CheckpointDatumV1 wire contract with byte-for-byte Haskell/Aiken parity. The week then turns the ratified convict/freeze divergence-enforcement policy into real spend paths proven against the keripy reference, corrects the witness-rotation model to KERI's actual incoming-set rule, and lands the first registration-path validator.
- Merged design(onchain): checkpoint contention model #104 — resolves #92 (open thread 8): the decision record and validator-shape sketch selecting the sovereign per-AID UTxO checkpoint over an MPFS trie; unblocks the #24 re-cut.
- Merged design(identity): freeze weighted CheckpointDatumV1 and CBOR boundary #105 — freezes the schema-support layer #24 will consume: the e-native checkpoint (standard Blake3 AIDs register as-is), KERI-faithful pre-rotation with an explicit next pair and dual-threshold advance, and byte + verdict parity across Haskell and Aiken (resolves #68, absorbs #77/#79/#81).
- Merged docs(106): convict/freeze divergence enforcement #107 — documents the ratified enforcement policy across the identity model, trust docs, roadmap, and deck: the three-mode table (fork → convict/burn, behind → freeze, ahead → preventively mitigated).
- Merged feat(identity): convict/freeze divergence-enforcement spend paths #111 — the validator-free schema-support layer for on-chain enforcement of KERI↔Cardano divergence, proven against the keripy reference and mirrored byte-for-byte and verdict-for-verdict across Haskell and Aiken; convict evidence now requires witness receipts (anti-fork) (resolves #106).
- Merged docs: publish Identity on Cardano presentation and article #112 — publishes the 13-slide "Identity on Cardano" presentation and the deeper "Self-Certifying Identities on Cardano" article, cross-linked in the docs tree.
- Merged docs: correct witness-rotation model #113 — drops the two-seal handoff for KERI's actual rule: a witness change carries only the br/ba/bt delta, validated against the incoming set at the new threshold.
- Merged feat(onchain): registration path — icp admission and checkpoint genesis #119
— first child of epic #24: the registration transaction layer over the
frozen #68 schema, with a parameter-free single-tx hash-proof mint binding
blake3(said_blank) == cesr_aid(part of #114).
Week of Jul 20th — The enforcement lifecycle comes together and is then torn back to its ratified form. Monday wires freeze, conviction, and fixed-bond enforcement onto the advance path; the rest of the week reverses conviction from permanent identity retirement to penalty-plus-record and redesigns registration and freeze as permissionless bonded state machines. In parallel the whole M1 lifecycle is proved in Lean — first 17 theorems, then 21 under the new "burn axiom" — before a compliance audit gives the pipeline a GO.
- Merged feat(onchain): advance path — dual-threshold rotation #120 — teaches the checkpoint to follow KERI key rotations safely: incoming-set witness validation under a dual threshold, so the mirror advances only on a provably genuine rotation (closes #115).
- Merged feat(onchain): wire freeze, conviction, and fixed-bond enforcement #121 — binds Freeze and Convict evidence to the complete signed KERI event with EE0–EE9 offset checks and routes conviction deposits and freeze bonds.
- Merged docs: unwind conviction terminality #122 — reverses the tombstone / mint-once terminality invariant: Cardano mirrors KERI and does not permanently kill an identity; conviction is penalty + record, with Pawel's review folded in.
- Merged feat(onchain): add the bonded freeze state machine #125 — reopens #116 under the operator-ratified permissionless freeze-bond design (armed freeze, bond claim, deadlines, deposit routing).
- Merged lean: M1 lifecycle model + 17 theorems #126 — a standalone
Lean 4 formalization of the M1 checkpoint lifecycle as a transition system,
with all 17 ratified-invariant theorems proved, zero
sorry, axioms clean (#124). - Opened feat(onchain): add checkpoint close and safe consumer resolution #123 — planning checkpoint (spec / plan / tasks + PR-life gate); implementation blocked on owner Q-013 (closes #117).
- Merged burn axiom: convict burns, reap reclaims #128 — the burn axiom
across model and docs: everything not spendable is burnt; deletes the
tombstone, convict burns to absent releasing the escrow, adds the REAPING
state; 21 Lean theorems proved, zero
sorry(#127). - Merged audit(129): compliance matrix + the five ruled fixes #130 — a 47-row compliance audit of the merged validator against the design of record: 33 compliant, 9 planned, 5 unplanned found / ruled / fixed on-branch; GO for the pipeline.
- Merged feat(onchain): make registration permissionless and bonded #131 — reopens #114 under the operator-ratified permissionless-registration design, authenticating inception events from the KEL (closes #114).
- Opened feat(onchain): make advance a permissionless projection #132 — makes the mirror advance a public projection: anyone can submit the rotation event, no operator key or extra signature, with the oversized validator split into a checkpoint state machine plus two observers to fit reference-script limits.