Sandbox · invented parties only
Three seats at one table: a resident, a county department, and the public verifier. Keys for the resident are generated in this browser and never leave it. Department keys are sandbox keys; in a pilot they live in the department's own custody.
A keypair is created on this device with WebCrypto and stored non-extractably in this browser. The identifier is derived from the public key, so nobody can claim it without holding the key.
Issued by a department G-code, non-transferable, anchored to the DID above. Refreshes after each issuance.
Each department is anchored to a namespace root that exists on three public chains. The sandbox key is filled for you; a pilot never serves department keys.
Recorded once, permanently. A second introduction for the same resident and programme is refused, and the first stands.
Every action above returns the receipt it wrote: sequence, hash and the hash it commits to.
A bank, an inspector or a landlord asks one question. The resident signs the verifier's nonce with the key on their device; the answer to that single fact comes back, and the record behind it does not.
Only the department that issued a credential can revoke it, and revocation is itself a receipt — the history is never edited, only extended.
Each receipt's hash is sha256 of the previous hash and the canonical record. The verifier walks the whole chain and names the first sequence where the arithmetic disagrees, if there is one. No login.
| Seq | Event | Actor | Subject | Hash | At |
|---|