Portable Trust Cell · PTC
A Portable Trust Cell is a minimal, passive, signed object. It packages protected information together with the evidence, history and rules a completely separate implementation needs to verify and recover it, long after the original vendor is gone.
Six layers
Anatomy
Unlike a “smart container”, the cell never runs embedded scripts and never invents legal authority. A tiny, openly specified interpreter, which anyone can implement, evaluates it. Select a part to see what it does.
01 · The gatekeeper
Screens every input before anything inside the cell sees it.
02 · What the asset is
A logical identifier that stays the same wherever and however the bytes are stored.
03 · How it got here
An authenticated, append-only lineage of everything that happened to the asset.
04 · The only way in
A closed vocabulary of typed inputs. The cell is passive and can’t fetch anything itself; evidence has to be presented to it.
RecoveryAuthorization from an industry governance layer.05 · What it can do
A finite set of deterministic operations, so there’s no runaway computation.
inspectRead public descriptors and metadata, never the encrypted payload.verifyCheck signatures, hash commitments, trust anchors and evidence chains.walkTraverse linked cells within fixed bounds.reconstructReassemble ciphertext from fragments or a key from shares.evaluateCheck authorization evidence against the committed policy.supersedeAppend an authorized new version or custody transfer.exportProduce a standalone package for offline preservation.Even with enough key shares to rebuild the key, Behavior will not decrypt until valid authorization is presented.
06 · Families of records
Lets a child cell build on its parent without execution risk.
One input, one verdict
Each input is checked against rules the cell has already committed to. A single failed check, whether a mismatched signature, an expired timestamp or a corrupted share, leaves the cell exactly as it was and returns an explicit reason.
Format, type, version and size checks.
Accepted only if it is one of the known input types.
Applies the fixed, versioned transition rules.
All checks pass committed to Memory.
Any check fails nothing committed; reason code returned.
statet+1 = Transition(statet, typed_inputt, fixed_rulesv)
Fork detection
If someone signs two conflicting updates from the same earlier state, the lineage visibly splits. The interpreter can prove the split happened. It can’t decide which branch the law recognizes, and it won’t guess.
INVALIDREQUIRES_EXTERNAL_AUTHORITYRecoverable ≠ authorized for release
CertiLink keeps four statements about a record separate. A verifier must never silently turn signed into true, a valid hash into authorized, or recoverable into legally releasable.
Checked offline, by math
Do the recovered bytes match the commitment?
Which keys, parties or systems signed and recorded it?
A completed online notarization is not a court ruling that a will is valid. An offline device can’t learn about a revocation, a death determination or an injunction it has never been shown.
The offline drill · eStateSafe
The acceptance test CertiLink has designed around a real estate record. Every system that created it is shut down, and an independent implementation on an isolated machine has to rebuild the exact original and report what it can and can’t verify.
An estate document is created and its exact source bytes are cryptographically frozen.
Where legally appropriate, executed through a remote online notarization provider; otherwise synthetic fixtures.
Evidence signed, document encrypted under a per-version key, lineage bound.
Ciphertext spread across separate media and operators; the recovery secret split across independent control domains.
A standalone package with specifications, key history, proofs, policies and interpreter source.
eStateSafe, CertiLink, databases, identity providers, cloud credentials and the network are all cut off.
An independent implementation rebuilds the original bytes, evaluates authorization separately and reports claim by claim.
Corrupted copies and shares, removed domains, forged approvals, stale lineage. Every failure has to be caught.
Results benchmarked against matched baseline designs at equivalent resources and cost.
Must succeed with no access to
This is the drill’s design. Independent offline exact-byte recovery is a Tier-2 research goal and has not yet been demonstrated.
Go deeper
The film walks through a cell surviving a failure and a custody handover. The research page covers the survivability quorum, the hypotheses, and how the work will be tested.