C0 · Under attested location
This place is 1 of N. The graph is HW / SW / AI Agents.
- The post is bound to this enrolled location, not to a generic computer.
- Hardware, Software, and AI Agents sit on the graph here. Every AI Agent is an enrolled node with Scope attached.
out
C2 · Under thin client · SHA-256
Fingerprint the room and the files. Bind them to this node, this pulse.
- SHA-256 is a fingerprint. Same bytes, same string. Change one bit, the string changes.
- It is run over the room reading and over the software files.
- That string is bound to the enrolled node for that pulse. It does not say who a person is.
C3 · Under posterior · Ed25519 + HTTPS
Sign the record. Seal the truck. No name. No face.
- Ed25519 is the signature. The enrolled key signs the hashes, the node id, and the time.
- The live pin and the field package still use that Ed25519 signature. The Mac lab new row also requires an ML-DSA-87 signature over the same bytes. Ed25519 alone is not that row.
- The Mac lab record path agrees a connection secret with ML-KEM-1024 and X25519. Both halves must succeed. That path is not the live pin.
- That proves which enrolled node claims this record. It is not the HTTPS truck.
- HTTPS is the sealed ride to api.nanomics.io. Ordinary outbound web call. About every 30 seconds.
- Two write doors: POST /v1/sentry/attest and POST /v1/entropy.
- No identifiable information is in that call. No name. No face. No email. No raw photo. No raw audio. Hashes, enrolled key, time, signature.
C4 · Under five-class AND · our server
We check the signature. Stage 1 posterior. Stage 2 five classes.
- The record lands on our server. The thin client does not pre-grade the room.
- First we check Ed25519 against the enrolled key. On the Mac lab new row we also check ML-DSA-87 over the same bytes.
- Stage 1: the posterior gate on this room. That is the 5/5 path. 26 May 2026. Demonstrated. One node.
- Stage 2: Physical + Cryptographic + Logistical + Statistical + Temporal on that same signed pulse.
- Certified only if both stages pass. The client does not write genuine.
C5 · Under reject · return fail
A miss comes back. It does not enter the tree.
- If any class fails, the return is reject.
- That record is not a certified leaf. The ledger does not advance.
C6 · Under stack · each site
Same post from each place. Same no-name rule.
- Site A, B, and C each send their own signed pulse the same way.
- Each HTTPS body still has no name, no face, no email, no raw media.
- We run each site’s posterior on our server, then the stack.
C7 · Under Merkle · store pass
Only a certified record is stored as a leaf.
- A pass returns certified. That leaf may enter the fuse.
- The 9.6 × 10⁻⁸⁴ figure is the stacked posterior, not the truck.
C8 · Under ledger · return + later desk
Verdict back to the site. Desk read is a later hop.
- The site gets certified or reject for that pulse.
- The chain advances only on certified roots.
- A later hop can join certified state to the customer’s SOC desk. That is not how the room reading reaches us.