Constitutional Data.

provenance2 signatures

Canonical message

phioradata.v1 | scope | sha256(data) | nonce | timestamp

Separated exactly by | . The separator is part of the specification. Changing it means bumping the version. sha256 is 64 lowercase hex characters, nonce is 32 hex, timestamp is Unix seconds.

Two signatures

1. Contributor. Your Ed25519 key signs the canonical message on your device, before the file is sent. The sha256 in that message is the hash of the raw file, the exact bytes you actually saw and approved, not something processed by the server. The private key is generated and stored in your browser and never sent to us; that's what makes this signature mean something.
2. Service. PHIORA DATA signs the 64 raw bytes of your signature, and only after PII cleanup is complete and a reviewer has approved it. A counter-signature applied any earlier would mean the receipt claims data "has already passed review" when no one has actually seen it.

What is attested

• Data was uploaded with recorded consent for that scope.
• The registered key owner approved those exact bytes. Their signature was created before the data left their device.
• The upload passed PII cleanup and admin review before the receipt was issued.

What is NOT attested

• That the human side of a conversation was written by a human. We do not yet have authorship classification, so our receipts carry no such score and should not be read as if they did.
• Who the person behind the key is. What's proven is the key, not the identity.
• That the assistant's side is not human-written.
• That the data is free of personal information before cleanup.
• That points have financial value.

Verify it yourself

The issuer's Ed25519 public key is published at https://srv1944250.hstgr.cloud/.well-known/phioradata-pubkey.json, complete with a precise definition of what each party signs, so third-party verifiers never have to guess at the encoding.

The receipt for an approved dataset can be fetched at /api/provenance/<dataset_id>. Inside it, attestation.signature is verified against attestation.publicKey over attestation.canonicalMessage, and attestation.counterSignature is verified against attestation.serviceKey over the 64 raw bytes of the contributor's signature. Both are pure Ed25519. Receipts for datasets that haven't been approved are not published.

The issuer's legacy secp256k1 signature is still included in the receipt and can be checked with ecrecover against the address at https://srv1944250.hstgr.cloud/.well-known/phioradata.json. That's the EVM/on-chain path, not part of Constitutional Data's two signatures.

Approved datasets are also recorded as a soulbound receipt on Robinhood Chain if you register a wallet address in Settings. Without a wallet, the product still runs entirely off-chain.