Repository navigation
Coxy Trust Protocol v0.1
🛡️ Decentralized Identity, Trustless Commerce, Privacy-Preserving Reputation and Programmable Accountability for Coxy Events SaaS
Status: Architecture Draft v0.1 Network target: Cardano + Midnight Primary application: Coxy Events SaaS global multi-vendor events marketplace Core principles: Decentralization • Non-custodial settlement • SSI • Privacy • Transparency • Verifiable reputation • User sovereignty • Trust minimization
- 🧭 Purpose and Vision
- 🎯 Protocol Goals
- 🚫 Explicit Non-Goals
- 🧱 Standards and Technology Foundation
- 👥 Protocol Actors and Roles
- 🔐 Trust Boundaries
- 🪪 Coxy Self-Sovereign Identity Architecture
- 📧 Verified Email Credentials
- 📜 Coxy Credential Families
- 🔗 CIP-0170 Cardano Attestations
- 🕶️ Midnight Privacy and Selective Disclosure
- 📸 Event Attendance Credentials and Private Evidence
- 🛒 Trustless Marketplace Order Protocol
- 🔒 Escrow and Economic Bonds
- 📦 Delivery Modes
- 🤝 Successful Event Trade Credential Issuance
- ⭐ Bilateral Ratings and Rating Credentials
- 🏅 Reputation Architecture
- 💠 Programmable Reputation Tokens
- ❄️ Freeze, Restore, Revoke and Seize Rules
- 🩹 Misbehaviour and Remediation
- ⚖️ Decentralized Dispute Resolution
- 🎪 Organizer Accountability
- 👤 Participant, Buyer and Seller Accountability
- 💰 Protocol Fees and Non-Custodial Settlement
- 🧮 On-Chain and Off-Chain Responsibilities
- 🗃️ Core Data Structures
- 🔄 Protocol State Machines
- 🛡️ Security and Threat Model
- 🔑 Wallet Recovery and Key Rotation
- 🏛️ Governance and Protocol Upgrades
- 🧪 Testing and Formal Verification
- 🛣️ Implementation Roadmap
- 🌍 Example End-to-End Event Trade
- 📐 Protocol Invariants
- 🔭 Future Extensions
- 📖 Glossary of Terms
The Coxy Trust Protocol, abbreviated CTP, defines the trust, identity, settlement, privacy and reputation layer for Coxy Events SaaS.
Coxy Events is intended to operate as a global multi-vendor events platform. A Participant in South Africa, Ghana, Nigeria, DRC, Zimbabwe, Europe or another jurisdiction should be able to buy from or sell to another person without requiring Coxygen Global or an Event Organizer to become a payment custodian, KYC officer, escrow agent or commercial judge.
The protocol therefore replaces interpersonal trust with a combination of cryptographic identity, non-custodial smart contracts, economic incentives, verifiable credentials, selective disclosure and transparent transaction history.
The central design principle is:
Coxy does not attempt to determine whether somebody is a good person. Coxy creates rules under which honest behaviour is rewarded, dishonest behaviour is expensive, funds cannot be arbitrarily taken, and claims can be independently verified.
Coxygen Global provides software, interfaces, indexing, protocol schemas and infrastructure. It must not become the custodian of Marketplace funds.
CTP v0.1 has several interconnected goals.
First, marketplace settlement must be non-custodial. A buyer must not have to transfer irreversible funds directly to an unknown event seller before receiving the purchased product.
Second, an Event Organizer must not become responsible for performing KYC on Marketplace sellers. Organizing an event and verifying the commercial honesty of every Participant are fundamentally different responsibilities.
Third, every successful transaction should contribute to a cryptographically verifiable reputation history. A Participant who has completed one hundred legitimate transactions should be able to prove that record without Coxygen merely asserting that the person is trustworthy.
Fourth, private identity information must remain private by default. Email addresses, attendee photographs, GPS coordinates and similar information must not be permanently published to Cardano merely because they are used as evidence.
Fifth, reputation must remain accountable but recoverable. A Good Seller credential may be frozen when an objective violation occurs and restored after remediation. Historical transactions, however, must never be rewritten.
Sixth, the protocol must remain recoverable even if coxygen.co becomes unavailable. A user's funds cannot depend on a PHP server remaining online.
CTP does not attempt to make the blockchain determine subjective facts that a blockchain cannot observe.
Cardano cannot determine whether food tasted good, whether a shirt was slightly damaged, or whether a taxi driver was polite. Those claims require human evidence, voluntary acceptance or dispute resolution.
The protocol also does not attempt to create a global KYC registry.
A verified email credential proves control of an email address. It does not prove that the holder is a unique human being, that their legal name is accurate, or that they have passed government KYC.
Most importantly, the protocol does not give Coxygen an administrator key capable of freezing a person's ADA, arbitrary NFTs, wallet or unrelated assets.
Only assets created specifically under CTP rules—such as escrow funds, locked bonds and protocol-issued reputation credentials—may be governed by those rules.
CTP is designed as a modular protocol so that evolving standards can be upgraded without rewriting the complete Coxy Events platform.
CIP-0170 is currently a Proposed Cardano Improvement Proposal titled KERI-backed metadata attestations. It defines a mechanism for associating KERI Autonomic Identifiers with Cardano metadata and describes AUTH_BEGIN, ATTEST and AUTH_END lifecycle operations.
CTP uses this mechanism as the Cardano-facing attestation layer for KERI/ACDC credentials.
The protocol must not assume that CIP-0170 itself is a DID method. Instead, it should use KERI AIDs as the cryptographic identity foundation and expose a DID-compatible representation when DID interoperability is required.
KERI, or Key Event Receipt Infrastructure, provides self-certifying identifiers and cryptographic key-event histories.
The persistent identifier is called an Autonomic Identifier, or AID.
ACDC, or Authentic Chained Data Containers, provides chained verifiable credentials that can be issued to those identifiers.
These technologies are suitable for Coxy because a person's identity can survive wallet or signing-key rotation.
The Cardano CIPs repository currently marks CIP-0143 as inactive and notes that its programmable-token work has been incorporated into candidate CIP-0113.
CTP therefore defines an abstract Programmable Reputation Asset Interface rather than coupling v0.1 permanently to one unfinished CIP.
Midnight provides the privacy layer.
CTP uses Midnight for proofs in which the verifier should learn that a statement is true without receiving the private underlying data.
Examples include proving that an email has been verified, that a user attended an event, or that a seller has completed at least twenty successful transactions without revealing the user's email address, photograph or complete transaction history.
Cardano remains the settlement and public-verification layer.
It is responsible for escrow, bonds, marketplace settlement, tokenized reputation state, public attestation references and immutable transaction evidence.
A Coxy user can hold several roles simultaneously.
An Organizer creates and administers an event.
A Participant joins or attends an event.
A Seller offers a Marketplace product or service.
A Buyer purchases an item or service.
A Gatekeeper assists with event attendance verification.
A Credential Holder controls a Coxy AID and its associated credentials.
A Credential Issuer attests to a particular claim. Different credentials may have different issuers.
A Verifier checks a credential, proof or on-chain attestation.
A Coxy Wallet signs user-authorized blockchain operations.
A Coxy Indexer discovers Cardano transactions, KERI events and credential states, but the indexer must not be the authoritative source of ownership of funds.
An optional Decentralized Arbitrator participates only when an objective smart-contract rule cannot resolve a subjective commercial dispute.
CTP deliberately distributes authority.
The buyer controls the buyer's wallet.
The seller controls the seller's wallet.
The Organizer controls the event definition and event lifecycle.
The smart contract controls escrow according to predetermined rules.
The user controls the user's SSI identifier.
Midnight controls neither the user nor their identity; it verifies privacy-preserving proofs.
Coxygen Global operates the Coxy interface and protocol infrastructure but does not control arbitrary user funds.
The database may describe what Coxy believes happened, but if MySQL states that an order is paid and Cardano proves that the escrow transaction never happened, Cardano is authoritative for settlement.
Every Coxy identity should be anchored around a persistent Coxy AID.
Conceptually:
Coxy User
│
├── KERI AID
│
├── Current Cardano Wallet
├── Previous Wallet Credentials
├── Verified Email Credential
├── Attendance Credentials
├── Trade Credentials
├── Rating Credentials
└── Reputation Credentials
The AID should survive wallet changes.
The wallet therefore becomes a signing/payment instrument rather than the person's complete identity.
CTP may expose a Coxy DID representation for software expecting DID-compatible identity interfaces, but the underlying identity continuity remains based on the user's self-certifying identifier and credential chain.
The user's DID/AID MUST NOT be frozen because of Marketplace behaviour.
Identity is not reputation.
Coxy Events currently relies heavily on verified email identities. CTP preserves that useful property without exposing the email publicly.
After the user proves control of:
person@example.com
Coxy issues a private credential conceptually stating:
subject: <Coxy AID>
claim: EMAIL_CONTROL_VERIFIED
verification_time: ...
issuer: ...
expiry: ...
The raw email address must not be stored in Cardano metadata.
A plain SHA-256 hash of an email address is also insufficient protection because email addresses can often be guessed and hashes compared.
Midnight should instead permit a user to prove:
I control a currently valid
VerifiedEmailCredential.
The verifier learns TRUE, not the user's email.
CTP separates credentials into distinct classes because different claims require different lifecycle rules.
Identity credentials describe attributes such as verified email control.
They may expire or be revoked, but revoking one must not erase the underlying Coxy AID.
Historical credentials record facts that already happened.
Examples include:
Attended Event X
Completed Trade Y
Settled Order Z
If a seller behaves badly six months later, those earlier successful transactions remain historically true.
Evidence credentials reference private supporting information, such as a photograph commitment or attendance proof.
The underlying private evidence does not have to become public.
Reputation credentials express current interpretations derived from historical evidence.
Examples include:
Good Seller
Reliable Buyer
Trusted Organizer
Experienced Participant
Unlike historical facts, these credentials may change state.
Ratings are signed statements made by one transaction participant about another.
They are independently revocable or replaceable by the person who created them.
CIP-0170 gives CTP a standardized way to associate KERI-backed identity authority with Cardano metadata.
CTP should use the lifecycle approximately as follows.
AUTH_BEGIN establishes that an AID has authority under a particular credential chain.
ATTEST references a digest anchored in the controller's KERI Key Event Log.
AUTH_END terminates that credential authority.
The blockchain therefore needs to contain a verifiable commitment, not the complete private credential.
For example:
Cardano
│
└── CIP-0170 ATTEST
│
├── signer AID
├── credential digest
├── KERI sequence
└── protocol version
A Coxy verifier then reconstructs the credential chain, validates the KEL and checks whether the attestation occurred during valid authority.
This also means Coxy indexers must be rebuildable from Cardano plus discoverable KERI data.
CTP treats privacy as a protocol property rather than merely a CSS or database setting.
A verifier should request the minimum fact necessary for a decision.
Instead of requesting:
Email:
Name:
Photo:
GPS:
Full event history:
All ratings:
the verifier might ask:
Prove:
verifiedEmail == true
AND successfulSales >= 20
AND GoodSeller.status == ACTIVE
The user generates a privacy-preserving proof.
The verifier receives confirmation that the condition is satisfied without receiving unrelated personal data.
Examples of desirable proofs include:
I attended EVT-ABC.
I have more than 10 successful sales.
My active seller rating is at least 4 stars.
I possess an active GoodSeller credential.
I am not currently frozen or revoked.
Private witnesses such as email, photographs and full transaction histories remain outside public state.
Attendance is particularly important for Coxy event commerce because a successful in-person sale can prove that both parties were present.
An attendance credential can contain:
subjectAID
eventId
attendanceId
checkInTime
checkOutTime
photoCommitment
optionalGpsCommitment
attendanceProofTx
credentialVersion
The actual attendee photograph must not be placed directly into Cardano transaction metadata.
Instead, Coxy computes a cryptographic commitment to the image.
The photograph may remain encrypted in storage controlled according to Coxy privacy rules.
A verifier can later receive a Midnight proof that the credential contains valid event-photo evidence without receiving the photograph.
For an event Marketplace transaction, CTP may require both:
buyerAttended(eventId) == true
sellerAttended(eventId) == true
before issuing an Event Trade Credential.
This requirement applies to EVENT_PICKUP or similar event-specific trades, not to unrelated digital or shipping transactions.
A Marketplace buyer must not normally pay an unknown event vendor directly before delivery.
Instead:
Buyer
│
▼
Coxy Escrow Validator
│
├── Successful settlement → Seller
└── Failed transaction → Buyer refund
The buyer funds the smart contract.
The seller cannot spend those funds merely because the buyer placed the order.
Every order references immutable terms including the listing, price, asset, seller identity, delivery method and applicable deadlines.
The seller cannot subsequently change an existing funded order from:
100 ADA
to:
150 ADA
because the funded order already references the original terms hash.
Escrow protects the buyer, while a seller bond gives the seller something to lose when they accept an obligation and deliberately fail to fulfil it.
Example:
Order price: 100 ADA
Seller bond: 30 ADA
The contract may temporarily control:
130 ADA
If delivery succeeds:
100 ADA → Seller
30 ADA → Seller bond returned
If an objective seller default occurs:
100 ADA → Buyer refund
and the predetermined bond rule may also compensate the buyer.
Bond requirements may depend on protocol reputation.
A new seller may need greater collateral than somebody with a long record of successful settlements.
This creates economic Sybil resistance because creating hundreds of fake seller identities no longer costs nothing.
Different kinds of trade require different settlement logic.
The buyer inspects the product at the event before signing the receipt.
A successful buyer signature allows settlement.
A digital product can use encrypted content, commitments and hashlock-style delivery.
If the seller fails to reveal the required decryption secret before the deadline, the buyer can recover the escrow.
NFTs and native tokens can use atomic exchange.
The payment and asset transfer happen in the same transaction, so either both occur or neither occurs.
Longer services should use milestones.
Payment is released in portions only when the corresponding milestone reaches the agreed settlement condition.
Shipping remains partly dependent on physical-world evidence.
CTP can protect money through escrow and use tracking, delivery acknowledgements and deadlines, but it must not falsely claim that a blockchain can determine what was inside a parcel.
A successful event trade is one of the most important CTP events.
An Event Trade Credential may be created automatically when all required conditions are met:
buyer attendance valid
+
seller attendance valid
+
order funded
+
delivery accepted
+
escrow settled
=
SUCCESSFUL EVENT TRADE
The seller receives a credential showing successful fulfilment as the seller.
The buyer receives a credential showing successful completion as the buyer.
A canonical trade receipt links:
eventId
orderId
buyerAID
sellerAID
settlementTx
deliveryAcknowledgement
timestamp
credentialDigests
The buyer and seller should sign reciprocal evidence.
Coxygen should not have discretion to declare that a failed trade was successful.
The smart-contract settlement provides the objective basis.
After a successful order, the protocol grants each party a one-order-specific right to rate the other.
The buyer can rate the seller.
The seller can separately rate the buyer.
A rating becomes a signed credential rather than an anonymous number in MySQL.
For example:
ratingId: ...
orderId: CX-98452
raterAID: Buyer-AID
subjectAID: Seller-AID
rating: 5
roleRated: SELLER
status: ACTIVE
Only parties involved in that transaction may create its ratings.
This substantially reduces fake reviews.
A rating is controlled by its author.
If Mary originally gives John five stars, she may later replace the rating with four stars or revoke the statement entirely.
The active reputation calculation uses only the latest valid state of each rating.
However, a one-star review MUST NOT automatically slash a bond or freeze a seller.
A rating is subjective evidence.
Financial punishment requires objective protocol evidence or a valid decentralized dispute outcome.
CTP does not use one universal social score.
Reputation is multidimensional.
A Seller reputation can measure:
completed sales
seller cancellation rate
delivery reliability
item accuracy
communication
unresolved defaults
rating average
A Buyer reputation can separately measure:
successful purchases
pickup reliability
payment completion
buyer cancellation rate
dispute behaviour
An Organizer reputation can measure event-related commitments such as event completion and cancellation handling.
A user's historical credentials remain immutable, while the current reputation state is derived from those facts.
This distinction prevents the protocol from rewriting history.
CTP may expose important reputation states as non-transferable programmable assets.
Examples include:
COXY.GOOD_SELLER
COXY.GOOD_BUYER
COXY.GOOD_ORGANIZER
COXY.TRUSTED_PARTICIPANT
A Good Seller asset might represent:
holderAID: ...
level: 3
completedTrades: 43
ratingBand: >= 4.5
status: ACTIVE
These tokens must not behave like ordinary transferable NFTs.
A person cannot sell their reputation to somebody else.
The token must remain bound to the credential identity for which it was issued.
The visible token is a convenient representation of reputation state. The underlying credential evidence remains independently verifiable.
CTP defines four different control operations because they have different meanings.
FROZEN means that the credential exists but is temporarily not usable as proof of current good standing.
Example:
ACTIVE
↓
objective unresolved default
↓
FROZEN
If the problem is corrected:
refund completed
+
required compensation completed
+
obligation cleared
the state may become:
FROZEN
↓
RESTORED
↓
ACTIVE
Revocation is appropriate when the credential should no longer assert the represented status.
For example:
GOOD_SELLER = REVOKED
does not erase the person's identity or previous trades.
It means only that the Good Seller assertion is no longer valid.
Within CTP, SEIZE must have a narrow definition.
The protocol may destroy, reclaim or invalidate a CTP-issued reputation asset according to its published rules.
It must not mean that Coxygen may seize:
- ADA in the user's ordinary wallet,
- unrelated NFTs,
- arbitrary cryptocurrencies,
- identity credentials,
- the user's DID/AID,
- assets outside the CTP agreement.
A seller bond already locked into escrow can be slashed because the seller explicitly committed it to those rules.
CTP should encourage remediation rather than permanently punishing every failure.
Suppose a seller fails an event pickup order.
An objective smart-contract record may show:
order accepted
seller obligation active
delivery not confirmed
fulfilment deadline passed
buyer refunded
The Good Seller credential may enter FROZEN.
The protocol then opens a remediation window.
The seller may be required to complete a specific action, such as compensating the affected buyer or resolving an outstanding contractual obligation.
If the remediation condition is satisfied within the deadline, the credential may return to ACTIVE.
If the deadline expires without remediation, the status may become REVOKED.
This gives the system memory without making mistakes impossible to repair.
Many disputes can be avoided through deterministic contract rules.
For example:
- A timeout is objective.
- A missing required signature is objective.
- An NFT transfer is objective.
- A refund transaction is objective.
- A seller bond balance is objective.
Subjective cases require another mechanism.
CTP may introduce an optional decentralized arbitration protocol in which randomly selected arbitrators stake value, review evidence and commit/reveal their decisions.
No Event Organizer should automatically become an arbitrator.
Coxygen employees should not automatically become arbitrators either.
The dispute layer should be an exceptional path rather than a requirement for normal commerce.
Organizers are not Marketplace KYC officers.
Their legitimate responsibilities are related to events.
They may create the event, define the venue, configure times, operate attendance and cancel or postpone the event.
If an Organizer cancels an event, that event-state transition can affect event-pickup orders.
For example:
EVENT_CANCELLED
↓
Buyer escrow → Buyer
Seller bond → Seller
The seller should not automatically be punished when the Organizer cancelled the event.
Organizers themselves may also build reputation.
A GoodOrganizer credential can derive from repeated successfully completed events and objective event history.
This creates symmetrical accountability.
A Participant must not gain seller credibility merely by pressing RSVP.
An RSVP expresses an intention.
Attendance proves something stronger.
A successful settlement proves something stronger still.
CTP therefore creates progressively stronger evidence:
ACCOUNT
↓
VERIFIED EMAIL
↓
RSVP
↓
ATTENDANCE
↓
SUCCESSFUL TRADE
↓
REPEATED SUCCESSFUL TRADES
↓
REPUTATION
A seller can participate in the general Coxy Marketplace without attending a particular event.
However, an Event Trade Credential specifically proves that the buyer and seller participated in a successful event-linked transaction.
Coxy may charge a transparent protocol fee without becoming a custodian.
If an order settles successfully, the validator can enforce the split directly.
For example, if the commercial policy specifies a protocol fee:
order amount → seller share
→ protocol treasury share
Coxygen does not first receive the complete payment and later forward money to the seller.
The smart contract performs the split.
For a fully refunded sale, the rules should normally return the refundable payment to the buyer rather than charging a completed-sale fee for a transaction that never completed.
All fees must be visible before the buyer signs.
CTP separates responsibilities intentionally.
- Escrow UTxOs.
- Seller bonds.
- Settlement.
- Refunds.
- Protocol fees.
- Public credential attestations.
- Programmable reputation assets.
- Immutable order references.
- Persistent SSI identifiers.
- Credential chains.
- Key rotation.
- Credential issuance and revocation.
- Signed identity claims.
- Verified email.
- Private attendance attributes.
- Photograph commitments.
- Private commercial history.
- Selectively disclosed reputation conditions.
- Search indexes.
- Cached profile views.
- Marketplace listing descriptions.
- UI preferences.
- Shipping addresses.
- Encrypted private data references.
- Performance caches.
The database must not possess authority to spend escrowed blockchain funds.
A simplified CTP order datum could resemble:
OrderDatum
{
protocolVersion,
orderId,
listingId,
listingTermsHash,
eventId?,
buyerAID,
buyerPkh,
sellerAID,
sellerPkh,
paymentAsset,
paymentAmount,
sellerBond,
deliveryMode,
createdAt,
cancellationDeadline,
fulfilmentDeadline,
deliveryCommitment?,
protocolFeeRule
}
A trade credential could resemble:
CoxyTradeCredential
{
credentialId,
subjectAID,
role,
orderId,
eventId?,
settlementTx,
attendanceCredential?,
completedAt,
schemaVersion
}
A rating credential could resemble:
CoxyRatingCredential
{
ratingId,
orderId,
raterAID,
subjectAID,
ratingDimension,
value,
issuedAt,
supersedes?,
revoked?
}
A reputation state might contain:
ReputationState
{
subjectAID,
reputationType,
level,
currentStatus,
successfulTrades,
objectiveDefaults,
unresolvedViolations,
ratingBand,
stateTransitionProof
}
A normal Event Pickup order may progress as follows:
LISTED
↓
ORDER_FUNDED
↓
SELLER_ACCEPTED
↓
READY_FOR_PICKUP
↓
BUYER_CONFIRMS_DELIVERY
↓
SETTLED
Alternative paths include:
ORDER_FUNDED
├── BUYER_CANCEL → REFUNDED
├── SELLER_CANCEL → REFUND + APPLICABLE PENALTY
├── EVENT_CANCELLED → REFUND
├── TIMEOUT → REFUND
└── DISPUTE → DISPUTE RESOLUTION
UNRATED
↓
ACTIVE
↓
FROZEN
├── REMEDIATED → RESTORED → ACTIVE
└── UNRESOLVED → REVOKED
Historical trade credentials do not move through this state machine because a historical fact cannot later become untrue.
CTP must be designed against several classes of attack.
A seller no-show attack is mitigated by escrow, seller collateral and timeout refunds.
A buyer no-show attack is mitigated through predefined cancellation and reservation rules.
A fake review attack is reduced by requiring a settled transaction credential before a rating right exists.
A self-trading attack can be mitigated through identity-linked reputation rules, costs, collateral and privacy-preserving proofs that parties are not trivially the same credential subject.
A Sybil seller attack becomes more expensive when reputation requires economic bonds and successful transaction history.
An indexer attack cannot steal money because indexers do not control escrow.
A database compromise must not permit an attacker to spend contract UTxOs.
A platform outage must not prevent a buyer from exercising an on-chain refund path.
A credential privacy attack is mitigated by keeping sensitive claims private and publishing commitments or selective proofs rather than raw attributes.
A central administrator attack is mitigated by prohibiting unilateral admin withdrawal and freeze functionality.
Identity must not disappear when a wallet changes.
KERI provides a natural model for key rotation.
When a user changes wallet credentials, CTP should record the relationship between the persistent identity and the new authorized wallet.
Reputation belongs to:
Coxy AID
rather than forever belonging to:
one specific addr1...
A wallet migration must require cryptographically valid authority from the identity's current key state.
If an old wallet is compromised, the KERI identity should be able to rotate away from it according to the appropriate recovery rules.
CTP contracts must be versioned.
For example:
Coxy Trust Protocol v0.1
Escrow Validator v1
Reputation Policy v1
Credential Schema v1
When a protocol upgrade is introduced, new orders may use a new validator.
Existing orders remain governed by the validator rules to which the users originally committed.
There must not be a hidden proxy mechanism through which Coxygen can silently rewrite a funded order.
An emergency mechanism, if introduced, should at most prevent new orders from entering a known-vulnerable contract.
It must not block existing users from exercising valid refund or settlement rights.
Protocol source code, validator hashes, credential schemas and test vectors should be public.
CTP is financial infrastructure and requires substantially stronger testing than ordinary web UI features.
Each smart contract should have unit tests.
State-machine transitions should have property tests.
Escrow validators should be tested against attempts to withdraw without required signatures.
Refund paths should be tested after every relevant timeout.
Seller-bond calculations must be tested for rounding and multi-asset edge cases.
Credential validation must test key rotation and revocation.
Rating tests must verify that only transaction participants can issue transaction ratings.
Rating revocation must remove the rating from active aggregation without deleting its historical existence.
Privacy tests must verify that public Cardano and Midnight-visible state do not accidentally reveal emails, photographs, GPS coordinates or private commercial histories.
The final contracts should undergo an independent security review before unrestricted mainnet use.
The first implementation phase should finalize credential schemas, order states, reputation states, bond rules and privacy boundaries before writing production smart contracts.
A minimal Aiken/Plutus escrow should support funding, seller acceptance, buyer confirmation, timeout refund and deterministic settlement.
Seller collateral and objective slashing conditions should be introduced only after the basic escrow model is proven.
Coxy accounts should receive AIDs, verified-email credentials and credential-wallet storage.
Coxy should implement versioned AUTH_BEGIN, ATTEST and AUTH_END support and an indexer capable of reconstructing verifiable credential state.
Every valid completed order should automatically produce deterministic bilateral trade credentials.
Only holders of completed transaction credentials should receive rating rights.
Coxy should calculate transparent, reproducible reputation from active credentials and objective protocol data.
GoodSeller, GoodBuyer and related badges can then become non-transferable programmable assets with explicit state transition rules.
Sensitive claims should be moved behind selective-disclosure proofs.
Coxy Wallet should expose escrow directly so users can claim or refund funds even without Coxy Events.
Mainnet should begin with conservative transaction limits before expanding.
Consider a seller and buyer who both attend EVT-FCC1B85879.
The seller lists a product for event pickup.
The buyer locks payment into the Coxy escrow validator.
The seller accepts the order and locks the required seller bond.
Both participants Check in at the event and obtain valid attendance credentials.
At collection, the buyer inspects the product.
The buyer signs the delivery acknowledgement.
The seller countersigns the trade receipt where required.
The escrow validator releases the seller payment, returns the seller bond and transfers any transparent protocol fee according to the immutable order terms.
The settlement transaction now provides objective evidence that the trade succeeded.
CTP automatically creates:
Buyer Event Trade Credential
Seller Event Trade Credential
Bilateral Trade Receipt
Buyer Rating Right
Seller Rating Right
The trade credentials can contain references to the private attendance credentials without revealing the attendees' photographs or emails.
CIP-0170 attestations anchor credential evidence to Cardano.
Midnight allows either person later to prove:
I completed a successful
event Marketplace transaction.
without revealing the counterparty, email address, photograph or complete order history.
If the buyer gives the seller five stars, that rating becomes a signed rating credential.
If many successful transactions satisfy the Good Seller requirements, the seller may receive or upgrade a programmable COXY.GOOD_SELLER credential.
The entire sequence occurs without requiring the Event Organizer to perform KYC or manually release the seller's money.
CTP v0.1 should treat the following statements as foundational invariants.
Invariant 1: Coxygen Global must never require access to a user's private wallet keys.
Invariant 2: An Event Organizer must not be required to perform Marketplace KYC.
Invariant 3: An ordinary RSVP must not be considered proof that a seller is trustworthy.
Invariant 4: A historical successful trade must remain a historical fact even if the user later misbehaves.
Invariant 5: Reputation may change, but identity must not be confiscated.
Invariant 6: CTP programmable-token rules must not authorize seizure of unrelated user assets.
Invariant 7: A rating alone must not automatically slash financial collateral.
Invariant 8: A transaction participant must be able to revoke or supersede their own rating.
Invariant 9: Sensitive identity and attendance evidence must not be unnecessarily placed on a public ledger.
Invariant 10: Existing escrow users must retain their settlement/refund paths even if the Coxy Events website becomes unavailable.
Invariant 11: No administrator key may unilaterally withdraw arbitrary escrow funds.
Invariant 12: Protocol state must be independently reconstructable and verifiable.
These invariants are more important than any particular implementation technology.
Later versions of CTP can introduce cross-event seller reputation, privacy-preserving age or jurisdiction credentials, decentralized arbitration pools, proof-of-distinct-personhood integrations, business credentials, academic credentials and vLEI-backed organizational identities.
Coxy educational events could issue training credentials from the same identity infrastructure.
Marketplace sellers could selectively prove professional certification.
Organizers could prove a history of completed international events.
Students could prove attendance, training completion and successful Marketplace participation through the same self-sovereign identity.
The long-term result is not merely a Marketplace reputation database.
It becomes a portable Coxy SSI trust graph in which people own their identity and evidence while third parties can independently verify the claims they choose to disclose.
| Term | Meaning |
|---|---|
| ACDC | Authentic Chained Data Container. A KERI ecosystem credential format used to create cryptographically chained credentials and verifiable claims. |
| AID | Autonomic Identifier. A self-certifying persistent identifier used by KERI. CTP uses the AID as the primary long-lived identity reference. |
| Attestation | A cryptographically verifiable statement associating an identifier with a claim, digest or transaction. |
| Attendance Credential | A Coxy credential proving that a Participant satisfied the protocol requirements for attendance at a particular event. |
| Bilateral Credential | A credential structure in which both sides of a transaction contribute cryptographic evidence about the same event or trade. |
| Bond | Collateral locked by a party to create an economic cost for failing a contractual obligation. |
| Cardano | The blockchain used by CTP for escrow, settlement, programmable assets and public attestations. |
| CESR | Composable Event Streaming Representation. A serialization framework used by KERI and related credentials. |
| CIP | Cardano Improvement Proposal. A proposal describing standards or improvements in the Cardano ecosystem. |
| CIP-0170 | The proposed Cardano standard for KERI-backed metadata attestations. |
| Commitment | A cryptographic value that commits to private data without revealing the data itself. |
| Credential Holder | The entity controlling a credential issued to their identity. |
| Credential Issuer | An entity cryptographically asserting a particular credential claim. |
| CTP | Coxy Trust Protocol. The protocol defined in this specification. |
| Coxy AID | The KERI Autonomic Identifier associated with a Coxy user's self-sovereign identity. |
| Coxy DID | A DID-compatible representation or interoperability layer associated with the user's Coxy identity when required. |
| DID | Decentralized Identifier. An identifier designed to be controlled through decentralized cryptographic mechanisms rather than a conventional username database. |
| Delivery Acknowledgement | A signed statement from a buyer confirming that delivery conditions were satisfied. |
| Escrow | Funds locked under smart-contract rules until a defined settlement or refund condition is satisfied. |
| Event Trade Credential | A credential proving that a buyer or seller successfully completed an event-linked Marketplace trade. |
| eUTxO | Extended Unspent Transaction Output. Cardano's smart-contract accounting model, in which individual UTxOs can carry values, datums and validator conditions. |
| Freeze | A temporary state that prevents a reputation credential from being used as active evidence of good standing. |
| Good Buyer | A CTP reputation credential representing current positive buyer standing under published protocol rules. |
| Good Organizer | A CTP reputation credential representing current positive Organizer standing. |
| Good Seller | A CTP reputation credential representing current positive seller standing. |
| Hash | A deterministic cryptographic digest derived from data. |
| Hashlock | A smart-contract condition that can be unlocked by revealing a value matching a previously committed hash. |
| Holder | The identity subject controlling a credential. |
| Indexer | Software that reads blockchain and credential events and produces searchable application views. An indexer is not authoritative for spending funds. |
| KEL | Key Event Log. The cryptographically verifiable event history of a KERI identifier. |
| KERI | Key Event Receipt Infrastructure. A decentralized key-management and self-certifying identity architecture. |
| Marketplace Escrow Validator | The Cardano smart contract controlling Marketplace order funds according to CTP rules. |
| Midnight | The privacy-focused blockchain used by CTP for private state and selective-disclosure proofs. |
| Non-Custodial | A design in which Coxygen does not possess discretionary control over user funds or private keys. |
| Non-Transferable Reputation Token | A programmable asset representing reputation that cannot be legitimately sold or transferred to another identity. |
| OOBI | Out-of-Band Introduction. A KERI mechanism used to discover or introduce identifier infrastructure such as endpoints. |
| Oracle | An external mechanism providing information about events that a blockchain cannot observe directly. |
| Order Datum | Structured data associated with a Cardano escrow UTxO describing an order and its settlement rules. |
| PKH | Public Key Hash. A hash used to identify a signing/payment credential in Cardano. |
| Programmable Token | A token whose permitted use or movement is governed by programmable rules. |
| Protocol Fee | A transparent fee defined by the order rules and transferred during successful settlement without requiring Coxygen to custody the complete payment. |
| Rating Credential | A signed, revocable statement created by one transaction party about another after an eligible transaction. |
| Rating Right | The one-transaction authorization permitting a buyer or seller to create a rating for the counterparty. |
| Remediation | Corrective action that resolves a protocol violation and may allow a frozen reputation credential to be restored. |
| Reputation Credential | A current credential representing status derived from historical transactions, ratings and objective protocol evidence. |
| Reputation Token | A programmable blockchain representation of a reputation credential or state. |
| Restore | The transition that returns an eligible frozen credential to active status after successful remediation. |
| Revoke | The act of terminating a credential's validity without deleting its historical existence. |
| SAID | Self-Addressing Identifier. A cryptographic identifier derived from the content it identifies and widely used in ACDC/KERI structures. |
| Selective Disclosure | A privacy technique allowing a holder to prove only the necessary attributes or conditions without exposing the full underlying credential. |
| Seize | Within CTP, a narrowly defined operation affecting a protocol-issued programmable asset or committed bond. It does not authorize seizure of unrelated property. |
| Seller Bond | Collateral voluntarily locked by the seller under an order's published terms. |
| Slashing | The deterministic forfeiture of some or all committed collateral following a valid protocol condition. |
| SSI | Self-Sovereign Identity. An identity model in which users control their identifiers, keys and credentials rather than depending entirely on a central account database. |
| Stablecoin | A token intended to maintain a relatively stable value against a reference asset, which can be useful for international Marketplace settlement. |
| State Machine | A formal set of permitted states and transitions governing orders, credentials or reputation. |
| Terms Hash | A cryptographic digest of immutable order terms used to prove which conditions the buyer and seller accepted. |
| Timelock | A smart-contract condition that permits or prevents an action depending on blockchain time. |
| Trade Receipt | Canonical cryptographically signed evidence describing the buyer, seller, order and successful settlement. |
| Trustless | A system property in which correctness depends primarily on verifiable protocol rules rather than trusting one intermediary to behave honestly. |
| Trust-Minimized | A more precise description for systems involving physical-world facts where some external evidence is unavoidable but reliance on intermediaries is minimized. |
| UTxO | Unspent Transaction Output. A discrete blockchain output that can later be consumed by a valid transaction. |
| Verifier | A person or application that validates a credential, proof, signature or attestation. |
| Verified Email Credential | A private credential proving that a Coxy AID demonstrated control of an email address without requiring that address to be published. |
| Wallet | Software controlling cryptographic keys used to authorize blockchain transactions. |
| Zero-Knowledge Proof (ZKP) | A cryptographic proof demonstrating that a statement is true without revealing the private information used to prove it. |
COXY USER
│
┌────────┴────────┐
│ │
KERI / AID COXY WALLET
│ │
ACDC / SSI Signatures
│ │
┌────────┴────────┐ │
│ │ │
MIDNIGHT CARDANO ◄────┘
Private Claims Public Proof
ZK Disclosure Escrow
Email Privacy Bonds
Photo Privacy Settlement
Reputation Proofs CIP-0170
│ Reputation Tokens
│ │
└────────┬────────┘
│
COXY EVENTS SAAS
│
┌───────────┼────────────┐
│ │ │
EVENTS MARKETPLACE GALLERY
│ │ │
Attendance Commerce Reputation
Credentials Escrow Verification
CTP v0.1 therefore establishes one fundamental rule for the future Coxy ecosystem: identity belongs to the user, private evidence remains private, historical facts remain immutable, reputation remains accountable and revocable, and money moves according to transparent smart-contract rules rather than through trusted intermediaries.
Bernard Sibanda is a global Technology Entrepreneur, Web3 and Software Consultant with a deep focus on Cardano Blockchain, Midnight and Community building.
Key Positions:
- Founder, CTO, Developer Advocate cohort #1, Fullstake Developer, Cardano Ambassador, Catalyst Project Manager, DREP-WIMS:
- Co-founder of ABL Tech and Cardano Africa Live
- EBU-certified Plutus Pioneer (Plutus/Haskell)
- Cohort #1 Plutus Pioneer Developer
- Catalyst Community Reviewer & Funded Projects Manager
-
DRep for WIMS-Cardano (ID:
drep1yguj8zu48n99pv70yl6ckzt9hdgjy8yjnlqs2uyzcpafnjgu4vkul) - Intersect Developer Advocate
- Intersect Committe Member 2025-2026
- Cardano Marketer,Promoter and blogger
- Cardano Open Source Contributor
- Cardano communities and events organizer and builder
- Cardano Ambassador for South Africa
Official links:
- Stablecoins Dex
- Coxygen Global Universities
- WIMS Cardano Global
- Cardano Africa Live
- WIMS Cardano Videos
- Cardano Smart Contract Videos
- Fullstack IT Consulting
Social links: