Proof of Stateful Integrity (PSI): Signed, Merkle-Committed Receipts for Digital Records

Introduction Automated systems, including software agents, produce records whose later integrity is disputed. Ordinary logs can be edited by anyone with storage access. PSI defines a small receipt that makes later modification of a record detectable and that can be checked without contacting the issuer. PSI is deliberately narrow. It composes existing primitives: JSON Canonicalization Scheme , SHA-256 , Ed25519 , and the Merkle tree hashing of .

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Changes from Revision 01

Title changed; the term "Sovereign" is removed.
Zero-knowledge (Groth16/BN128) proof generation is removed. No such proving system is part of PSI.
"Multi-party computation consensus" is removed. Any policy checks an issuer runs before sealing are application logic and out of scope.
The Merkle construction is replaced by the RFC 6962 profile, and inclusion proofs are no longer claimed.
Claims that PSI demonstrates regulatory compliance are removed.

Terminology

Record:: A JSON value supplied by a submitter.
Record digest:: SHA-256 over the RFC 8785 canonical UTF-8 encoding of the record, as lowercase hexadecimal.
Issuer:: The party that signs receipts.
Receipt:: A signed JSON object defined in .
Ledger:: The issuer's append-only, ordered sequence of record digests.

Receipt Format A receipt is a JSON object with the following members:

schema:: The string "PSI-SEAL/1.0.0".
receipt_id:: An issuer-unique identifier.
decision_hash:: The record digest.
sequence_number:: A non-negative integer, strictly increasing per issuer.
prev_hash:: The decision_hash of the previous ledger entry, or 64 zero characters for the first entry.
merkle_profile:: The string "RFC6962-SHA256".
merkle_root:: Lowercase hex of the tree head computed per .
issued_at:: An RFC 3339 UTC timestamp asserted by the issuer.
key_id:: Identifier of the issuer signing key.
signature:: Ed25519 signature, lowercase hex, computed per .
anchor:: OPTIONAL. An object describing an external timestamp commitment ().

Records SHOULD NOT contain personal or confidential data. Submitters SHOULD send only the record digest to the issuer.

Merkle Tree Profile Leaves are the record digests of ledger entries, in ascending sequence_number order; a leaf's index never changes once assigned. The tree head is computed as the Merkle Tree Hash (MTH) of , using SHA-256: Here d is the 32-byte binary record digest. Odd nodes are not duplicated. This revision defines tree heads only; inclusion and consistency proofs are left to a future revision. Receipts issued before this profile was adopted carry no merkle_profile member and MUST NOT be verified against it.

Signature The signature input is the RFC 8785 canonical encoding of the receipt object with the signature member removed. The issuer signs it with Ed25519. An issuer that cannot produce a valid signature MUST fail the request and MUST NOT emit a receipt with a substitute value. An issuer MAY additionally attach a hash-based signature as defined in a separate post-quantum profile document. Such signatures use one-time keys and MUST be allocated from a strictly increasing counter so that no key is ever used twice. Issuer public keys are published at /.well-known/apex-psi-trust-anchor.json on the issuer's origin as a list of key_id, algorithm, public key, and validity period.

External Anchoring An issuer MAY periodically commit a tree head to a public timestamping system such as OpenTimestamps . The anchor object then carries the system name, the committed root, and the proof data. An anchor shows that the root existed no later than the anchored time; it does not show when a record was created.

Verification A verifier holding a record and a receipt:

Computes the record digest and compares it to decision_hash.
Obtains the public key for key_id from the trust anchor document.
Verifies the Ed25519 signature over the canonical receipt without its signature member.
OPTIONALLY verifies the anchor proof.

Verification returns only: digest match, signature validity, and anchor validity. It never returns a judgement about the truth, legality, or compliance of the record.

Security Considerations

PSI does not validate source data. An issuer will seal a false record as readily as a true one.
A single issuer is a central operator. Receipts show what that issuer signed; they do not make it independent. Ledger tampering by the issuer is detectable only by parties who retain earlier tree heads or anchors.
issued_at is an issuer assertion. Only an external anchor bounds time independently.
Ed25519 is not resistant to large-scale quantum computers. Long-lived evidence SHOULD carry an external anchor and MAY carry a hash-based signature.
Reuse of a one-time hash-based signing key destroys its security; see .
Digests of low-entropy records can be brute-forced. Records SHOULD include a random salt when confidentiality matters.

IANA Considerations This document has no IANA actions.