# GENESIS Origin 1

Status: bounded reference implementation. Browser sandbox, signed receipts,
verification, encrypted backup/restore and owner-approved key succession are
implemented. Production registration requires a provisioned issuer and database.
Independent witness operation, production load testing and physical-device testing
are not implied by passing local fixtures.

A GENESIS number records an issuer's assignment. It grants **no authority,
reputation, payment rights, membership, unique-person status or proof of humanity**.
HAP-1 signed bytes, permissions, PULSE leases and revocation precedence are unchanged.
Issuance timestamps are issuer claims, not independently proven time. Verification
of an old receipt never establishes its current key or the latest registry history.

## Wire and trust

Profile prefix: `echo-genesis/origin/1`. Canonical JSON uses the existing HAP wire
parser, without changing HAP's protocol. Duplicate keys, unknown fields, alternate
number spellings, non-ASCII protocol strings, unsafe integers and oversized input
are refused. Translations never alter signed fields. Receipt input is limited to
256 KiB; requests to 16 KiB. Ed25519 keys use lowercase raw-public-key hex and
PKCS8-private-key hex. Public pin files carry only public keys.

An independently supplied pin file contains `schema` (`…/trust`), `registry`,
`issuer`, `witnesses` (distinct `{id,publicKey}`), and `quorum`. A receipt never
selects its own trusted issuer or witness keys. The website displays a candidate
registration key but asks the user to confirm it through a trusted independent
channel. Exported workspace pins are a convenience, not evidence of trust.

A receipt binds `schema`, `registry`, `number`, `revision`, `subject`,
`predecessor`, `originatedAt`, `issuedAt`, `issuer`, `authorization`, and `signature`.
`subject` is the SHA-256 canonical commitment to `{schema:"…/subject",publicKey}`.
The receipt includes the signed registration/rotation authorization: dedicated
public keys and timing metadata are therefore visible. They are pseudonymous,
not anonymous. No vault, handle, memory, Echo ID private key or HAP ticket is sent.
Hosting infrastructure may still observe network metadata.

Signatures cover `schema + "\n" + canonical(body without signature)`.
Owner approvals use domain `…/approve` and body `{intent,challenge}`.
An intent binds registry, owner key, prior receipt digest and next key (or null).
A challenge binds issuer, registry, intent digest, 128-bit random nonce and the
half-open interval `[issuedAt, issuedAt + 60000)`. Owner and successor both sign a
rotation. Proof work is SHA-256 of canonical `{schema:"…/work",challenge,work}`
with 16 leading zero bits. Work is per challenge; it is friction, not Sybil immunity.
Request verification and signing occur before atomic compare-and-swap persistence;
no receipt escapes before commit. Retries of a committed request return its record.
Expired requests refuse, even if previously used. A new authenticated request
from the same still-current key returns its original number without incrementing
registration count. Retired keys cannot register again or roll back a succession.

## Log, continuity and witnesses

Each leaf is `{schema:"…/leaf",receiptHash}`. Public log leaves are commitments,
not the receipt or a person's vault. Inclusion and consistency calculations are
generated from the existing `lib/transparency.ts`, using its RFC-6962-style tree
hashing. Checkpoint signature bytes remain `ECHO-CHECKPOINT\n<size>\n<root>`.
The unused timestamp field is exactly empty; it is not authenticated time.
An inclusion proof must also have the directions required by its index and size.

A bundle carries the complete signed succession chain, a checkpoint, inclusion
proof, optional consistency proof against a separately retained checkpoint, and
optional `echo-witness/checkpoint/2` endorsements. The existing witness verifier
is generated unchanged from `lib/witness-consistency.ts`. Enforce a nonzero quorum
with distinct, externally pinned witness operators when that assurance is needed.
A zero quorum reports `witnessQuorumVerified:false`, never independent endorsement.

Operators can feed checkpoints and consistency proofs to compatible independent
witnesses; their endorsements go in `bundle.witnesses`. A witness must enroll from
size one, retain its durable pin and refuse conflicting histories. The website does
not auto-enroll Money Musk's co-hosted witnesses or call them independent. The
hostile tests demonstrate the adapter; they do not establish independent operation.

Server/issuer compromise can fabricate claims. Signatures alone do not prevent
split views. Retained checkpoints and independent witness policies are required to
detect rollback/equivocation. A fresh local control challenge binds registry,
number, revision, subject, audience, nonce and a 30-second deadline. Consumption
is one-shot (including failed attempts), reserved before asynchronous verification.
It proves control of the key in that verified receipt, not that the receipt is
current. Current status needs fresh authenticated registry history and retained pins.
The additive [Continuity 1 profile](CONTINUITY.md) implements challenge-bound
issuer observations, signed witness exchange and a separate Python verifier.
Its archived observations never establish fresh sessions or authority.

## Browser custody and recovery

Sandbox and registration workspaces occupy separate IndexedDB slots. The sandbox
has a random `sandbox:` namespace, its own demo issuer and no shared-counter writes.
It is a local exercise, not independent evidence. Registration refuses sandbox
namespaces. New owner keys are dedicated to GENESIS; no existing Echo ID or HAP key
is imported or rotated. An encrypted pending successor is saved before requesting
rotation, allowing recovery after a lost response. IndexedDB compare-and-swap prevents
a second tab from overwriting another tab's key state. The user must unlock again.

Backups use PBKDF2-SHA256 (600,000 iterations, random 128-bit salt) and AES-256-GCM
(random 96-bit IV, profile domain as AAD). Passphrases require at least 12 characters;
use a long unique phrase. This cannot resist an attacker who controls the unlocked
page or guesses a weak phrase offline. Keys are exportable for encrypted recovery.
Lock clears application references, not a guarantee of JavaScript memory erasure.
Storage denial is explicit and signing is disabled. Clearing site data without a
backup loses custody. There is no administrator recovery or key-reset endpoint.

Restore decrypts and validates the keys, receipt lineage and trust bindings before
showing a review. Nothing is applied until the user confirms. Replacing an existing
slot requires the same registry, issuer and retained checkpoint. Older/conflicting
backups refuse. A fresh device has no previous checkpoint; compare against an
external trusted copy. Restore alone cannot prove freshness. Losing the current key
and every usable backup means rotation is unavailable. The old evidence remains
verifiable but does not confer current control.

## Deploy with PostgreSQL / Next.js

1. With Node 22+, run `node genesis-reference/origin-cli.mjs keygen /secure/issuer.json`.
   This creates a mode-0600 file without printing the private key. Back it up encrypted
   outside the database. Never commit it or put it under `public/`.
2. Run `node genesis-reference/origin-cli.mjs init /secure/issuer.json registry-name /secure/origin-state.json`.
   Commands refuse to overwrite existing files. Choose a distinct registry ID; the
   number is unique within this registry, not across arbitrary self-hosted registries.
3. Apply `scripts/sql/20261005-genesis-origin.sql` using the schema owner. Generate
   the initial row with `node genesis-reference/origin-cli.mjs provision-sql /secure/origin-state.json /secure/provision.sql`.
   Review and apply that SQL once. Create a dedicated login role with no role
   memberships or administrative privileges. Apply
   `scripts/sql/20261006-genesis-origin-permissions.sql` with its `origin_role`
   variable. The runtime can SELECT and UPDATE only snapshot/version; it cannot
   insert, delete, truncate, rename the issuer or initialize missing state.
4. Configure `GENESIS_ORIGIN_REGISTRY`, `GENESIS_ORIGIN_PUBLIC_KEY`,
   `GENESIS_ORIGIN_PRIVATE_KEY` from that issuer file in the server environment,
   plus `GENESIS_ORIGIN_DATABASE_URL` for that restricted role. There is no fallback
   to the site's shared `DATABASE_URL`. No NEXT_PUBLIC secret. Scope credentials to
   the intended environment; do not reuse production issuer keys in previews.
5. Redeploy and check `/api/genesis/origin`. Absent keys, schema, or initial row
   produce 503 `REGISTRY_UNAVAILABLE`. Missing state is never silently recreated.
6. Publish issuer pins through an independently trusted channel. Add request/traffic
   limits and monitoring at your deployment boundary. Test restored database history
   against externally retained checkpoints before resuming writes.

The reference registry uses one atomic PostgreSQL CAS row and refuses growth past
512 signed events or 32 revisions per registration. This is a bounded reference,
not a claim of internet-scale throughput. It keeps assignments contiguous under
concurrency and does not reuse old numbers. Capacity exhaustion fails closed. Plan
an explicitly versioned storage migration before reaching the cap; never reset the
registry, reuse numbers, or discard retained checkpoints to free capacity.

## Self-host, verify, and test

`node genesis-reference/origin-cli.mjs serve /secure/issuer.json registry-name /secure/origin-state.json`
serves the same API on loopback port 8788. The file store locks across processes,
checks versions, fsyncs a temporary file, renames it and fsyncs its directory before
returning success. It requires a local filesystem with reliable exclusive creation
and atomic rename. It is not an NFS/multi-host database. A crash-held `.lock` fails
closed: confirm no writer is alive and review state before operator recovery.
The state file is private; it contains public receipt metadata and commitments,
not owner private keys. Add HTTPS and perimeter request limits for remote use.

`node genesis-reference/origin-cli.mjs verify receipt.json trusted-pins.json`
verifies without contacting Money Musk. Optional third argument is a previously
retained checkpoint file; obtain the corresponding consistency proof from lookup.
This JavaScript CLI shares the portable verifier. `genesis-reference/verify.py`
is the separate Python implementation described in CONTINUITY.md; same project
authorship does not establish an independent third-party audit.

`node scripts/build-genesis-runtime.cjs --check`
checks that generated transparency and witness modules match their sources.
`node --test scripts/genesis-origin-regressions.mjs` runs hostile wire fixtures,
concurrent issuance/consumption, signed rotation, stale/replayed requests, backup
corruption, restart, and rollback checks. CI additionally runs actual PostgreSQL
multi-client tests. `node scripts/genesis-ui-regressions.mjs` checks API validation,
translations and browser workflow behavior. Fixture keys are PUBLIC TEST KEYS.

Legacy `/api/genesis/claim` retains retrieval of existing mappings but returns 410
for new unsigned issuance. `/api/genesis/count` labels its total as legacy claims
including demos. Old records are never silently upgraded into signed origin receipts.