Trace the Seal

0REI seals itStep 01 / 17

Your records

• Your recordsfiles · logs · agents

Seal a record once. Anyone can check it later, offline.

0REI seals itStep 02 / 17

Zero Search · your machine · 127.0.0.1:8408

/ingest → Embed → Semantic index

• /ingestZero Search :8408
• Embed768-d, local
• Semantic indexid_map

• Your records → /ingest · ingest
• /ingest → Embed · text
• Embed → Semantic index · vector

The service listens on 127.0.0.1 only. The embedding model runs locally from weights on disk. No query, record or vector is sent anywhere.

Document text passes a redactor before it's indexed. Credential values are removed and their names kept.

0REI seals itStep 03 / 17

0REI CoreSeal API · Railway · prod 3.0.0

Auth gate

• Auth gateArgon2id key · nonce

• /ingest → Auth gate · POST seal

0REI seals itStep 04 / 17

0REI CoreSeal API · Railway · prod 3.0.0

Canonicalize

• CanonicalizeRFC 8785 → SHA-256

• Auth gate → Canonicalize · allowed

Canonical JSON (RFC 8785) → SHA-256 → a domain-separated binding root → Ed25519 signature

Canonical form: RFC 8785 JSON Canonicalization, pinned by 12 frozen golden vectors.

Domain separation: every signed payload carries a fixed prefix, so a signature can't be reused across protocols.

0REI seals itStep 05 / 17

0REI CoreSeal API · Railway · prod 3.0.0

Bind + sign

• Bind + signEd25519 · genesis root

• Canonicalize → Bind + sign · hash

Verify recomputes the root from the row's own fields, compares in constant time, then checks Ed25519 strictly

The seal binds the entity id, entity type, version, data hash and signed_at into one length-prefixed binding root, and then signs it.

signed_at is part of the signed binding root. If it changes, verification breaks.

Signature: Ed25519 (RFC 8032), strict verification. 150 of 150 Wycheproof Ed25519 vectors pass.

A seal verifies only if it was signed by 0REI's pinned key. A seal that merely verifies against a key embedded in itself is rejected.

0REI seals itStep 06 / 17

0REI CoreSeal API · Railway · prod 3.0.0

sealed_writes → Proof API

• sealed_writesPostgres · OCC lock
• Proof API/seals/{id}/proof

• Bind + sign → sealed_writes · seal row
• sealed_writes → Proof API · proof rows

Optimistic concurrency control. Parallel writers can't silently overwrite each other, and conflicts surface as HTTP 409.

An entity and its seal are created in one transaction, so a partial write is impossible.

0REI seals itStep 07 / 17

0REI CoreSeal API · Railway · prod 3.0.0

Anchor batcher

• Anchor batcherevery 300 s · Merkle

• sealed_writes → Anchor batcher · unbatched

Every 300 s the unbatched seals become one Merkle batch; the batch root gets an RFC 3161 token from FreeTSA, DigiCert as fallback

The timestamp is per batch, so a brand-new seal shows no token until its batch anchors

0REI seals itStep 08 / 17

FreeTSA

• FreeTSARFC 3161 token

• Anchor batcher → FreeTSA · batch root → RFC 3161

Every 300 s the unbatched seals become one Merkle batch; the batch root gets an RFC 3161 token from FreeTSA, DigiCert as fallback

Seals are batched into a Merkle tree. The root of each batch is stamped by an external RFC 3161 time-stamping authority, so "existed no later than T" doesn't depend on 0REI's clock. Production stamps through FreeTSA, with DigiCert configured as the fallback.

RFC 3161 stamps from FreeTSA and DigiCert are not quantum-safe.

0REI seals itStep 09 / 17

The 9-Point Time Stamping System

• FreeTSARFC 3161 token

Every 0REI seal carries three things together: when it was made, what it holds, and who signed it. Each one is proven by math and by outside witnesses, so nobody has to take 0REI's word for it.

The 9-point system places every seal between two kinds of outside proof:

"Not before": proof the seal couldn't have been made before a certain moment.

"Existed by": proof the seal already existed by a later moment.

Together they give each seal a tight time window that independent outside parties vouch for. No single company, including 0REI, is trusted on its own for the time.

In plain English: Picture bookends. The newspaper in the photo is the left bookend, the stamped receipts are the right bookend, and the seal sits between them.

Private contents, provable totals, a key chain that rotates cleanly, and time vouched for by independent witnesses, all checkable by anyone, offline.

1. All day, in the backgroundThe Time Pocket refreshes: drand every 3 seconds, the NIST Beacon every 60 seconds, Roughtime readings and 0REI's NIST-synced clock (point 1).
2. At sealing, instantlyPedersen box, fingerprint, Time Pocket, microsecond time and the current key's signature, all in one step (point 2). This sets "not before".
3. Within secondsRoughtime returns a signed receipt for the fingerprint (point 3). The first "existed by" is in place.
4. In about a minuteRFC 3161 stamps arrive from DigiStamp, DigiCert and FreeTSA (point 4).
5. Within the hourThe fingerprints are anchored in Bitcoin through OpenTimestamps, with Guardtime KSI alongside (point 5).
6. ResultA Time Window vouched for by five or more independent witnesses (point 6), with private totals (point 7) and a pre-committed key chain (point 8).
7. Any time later, by anyoneThe Offline Verifier rederives everything and runs its five checks, air-gapped (point 9).

Zero Search finds itStep 10 / 17

Zero Search · your machine · 127.0.0.1:8408

Evidence Tool → /search → Semantic index

• Evidence ToolDioxus desktop app
• /searchplain-English top-k
• Semantic indexid_map

• Evidence Tool → /search · query
• Semantic index → /search · top-k

Search. Ask in plain English and get ranked hits. Every sealed-record hit carries a proof handle.

The service listens on 127.0.0.1 only. The embedding model runs locally from weights on disk. No query, record or vector is sent anywhere.

Zero Search finds itStep 11 / 17

Zero Search · your machine · 127.0.0.1:8408

0REI CoreSeal API · Railway · prod 3.0.0

/prove/{seal_id} → Proof API

• /prove/{seal_id}4-layer bundle
• Proof API/seals/{id}/proof

• /search → /prove/{seal_id} · seal_id
• /prove/{seal_id} → Proof API · GET proof

2026-09-11: Zero Search search → /prove → a real 4-layer production bundle; the Offline Verifier read VALID on all 4 layers, one flipped byte read INVALID at the signature

Prove. Get the record's offline proof bundle: the seal, its Merkle inclusion path, the anchored batch and the RFC 3161 timestamp token.

TremorFrost moves itStep 12 / 17

TremorFrost Tier 3 · node A → node B

export-msg → Taildrop

• export-msgsigned ed25519 envelope
• Taildroptailscale file cp

• /prove/{seal_id} → export-msg · proof bundle
• export-msg → Taildrop · file cp

2026-09-16: a proof bundle crossed Taildrop from node A to node B; 2026-10-07: a 124 MB file A → B in 3 s

The Rust bus for agents on different machines. Nothing is accepted because of where it came from, only because of a valid Ed25519 signature over its canonical bytes. It carries live traffic between nodes today.

Every envelope is signed over RFC 8785 canonical JSON and bound to an audience and a nonce. Replayed nonces are rejected, including after a restart.

TremorFrost moves itStep 13 / 17

TremorFrost Tier 3 · node A → node B › node B

Drain + wake → Signature gate → bus.db → Console

• Drain + wakedrain → wake-runner
• Signature gateed25519 + nonce replay
• bus.dbsingle writer · signed
• ConsoleTremorFrost · read-only

• Taildrop → Drain + wake · .msg.json
• Drain + wake → Signature gate · staged
• Signature gate → bus.db · verified
• bus.db → Console · read-only

TremorFrost verifies every envelope's signature and nonce before it writes to bus.db; the Console only reads

At-least-once delivery against a single owning writer.

The TremorFrost Console is a native Windows desktop app that reads the bus live. It does not write to the store itself: it asks the single owning writer to act.

Offline Verifier proves itStep 14 / 17

0REI Offline Verifier · network off

Load bundle

• Load bundlenetwork off

• Taildrop → Load bundle · bundle file

2026-09-11, cable pulled on System B: 0 non-loopback connections while the verdicts rendered

Computes every verdict locally, from the file's own bytes and the trust root compiled into the app.

On 2026-09-11 it gave verdicts on a machine with the network cable pulled, with zero non-loopback connections while each verdict was on screen. Nothing broader than that is claimed.

Offline Verifier proves itStep 15 / 17

0REI Offline Verifier · network off

1 · Signature → 2 · Chain → 3 · Inclusion → 4 · Timestamp

• 1 · Signaturevs compiled-in root
• 2 · Chainchain layer
• 3 · InclusionMerkle path walked
• 4 · Timestamppinned TSA roots

• Load bundle → 1 · Signature · bundle
• 1 · Signature → 2 · Chain · pass
• 2 · Chain → 3 · Inclusion · pass
• 3 · Inclusion → 4 · Timestamp · pass

The Verifier checks Signature, Chain, Inclusion and Timestamp in order; the first failure stops the walk

Offline Verifier proves itStep 16 / 17

0REI Offline Verifier · network off

Verdict

• VerdictVALID / INVALID + report

• 4 · Timestamp → Verdict · 4 / 4

2026-09-11: Zero Search search → /prove → a real 4-layer production bundle; the Offline Verifier read VALID on all 4 layers, one flipped byte read INVALID at the signature

Shows tampering: it flips one nibble in a copy, and the same engine answers INVALID.

Exports a self-contained HTML report that can be re-checked later against the engine, so nobody has to trust the file.

A sealed record is found in Zero Search, its proof bundle is carried by TremorFrost, and the Offline Verifier checks it. Changing one hex digit in a copy makes the verifier answer INVALID.

That the data was true when it was sealed, that the key holder is who they claim to be, or that a set of records is complete.

Pedersen Commitments & K1 Key Pre-RotationStep 17 / 17

Pedersen Commitments & K1 Key Pre-Rotation

• Clientkeeps r, sends C
• Pedersen commitC = v·G + r·H
• Committed sealcommitments in root
• AggregateProoftotal V, R = Σr
• Total checkΣC = V·G + R·H
• K1 inceptiongenesis signs H(next)
• Pre-rotated keyseach names next hash

• Client → Pedersen commit · per field
• Pedersen commit → Committed seal · C + hash
• Committed seal → AggregateProof · seal × N
• AggregateProof → Total check · proof.json
• K1 inception → Pre-rotated keys · first hash

Pedersen provable totals: prove a sum across sealed records without showing the values; a total that does not open is refused

K1 pre-rotation: the genesis key signs the hash of its successor, and each key names the next

0REI seals numbers it never sees, proves their totals without opening a single record, and signs every record with keys that each name their successor in advance. It is all rooted in a genesis key that lives inside certified hardware, and anyone can check it, offline.

One Ed25519 signature covers the record, its committed values and its time.

In plain English: A value goes into a locked box together with a random secret. The box shows nothing about what is inside, and it can only ever be opened to the value that went in.

In plain English: Locked boxes can be stacked and weighed together. The total weight proves the total amount without opening any one box.

In plain English: A handover needs two signatures: the person leaving and the successor named in advance. A thief holding only the departing key cannot complete it.