Milestones · deep dive

cardano-keriMilestones

Self-certifying identities on Cardano, bridged to the Veridian / KERI ecosystem.

status Research/design + prototypes  ·  substrate: shipped MPFS plugin support
The one idea

Pre-rotation

Incept
key nowthe key you sign with today
H(next key)a commitment to the next key
rotate
Rotate
reveal next keypre-image of the earlier commitment
H(next-next)commit the following key
A thief who steals your current key cannot rotate your identity — they do not know the pre-committed next key.
Architecture

The layer stack

top
Case adapters — the last mile
deferred; each business pick selects one adapter
L4
KERI-wallet ↔ Cardano signing bridge
L3
Verification + authorization
verifies credential chains (ACDC) · caches who's admitted (admission cage) · checks signed permission slips (envelope)
L1–2
Identity core
on-chain key registry · replays identity & revocation history (KEL/TEL)
The headline result

Most of the open work is use-case-invariant.

Every business case needs the same identity registry, verifier, and authorization machinery. The business pick only selects a last-mile adapter.

the bet Build the common core first; defer the app choice to the last responsible moment.
Overview

Milestone map

M1
Identity core
L1–2
M2
Verification + authorization core
L3
M3
Signing bridge
L4
M4
Pilots
preprod, E2E
M5
Case adapters & hardening
 
The acceptance rule

Every milestone ships a vertical demo — an end-to-end slice, not useful but usable and demoable, recorded as a terminal cast. If it cannot be demoed E2E, the milestone is not done.

01 · first milestoneLayers 1–2

Identity core

Key state

Each identity is a quantity-one checkpoint UTxO whose owner rotates keys with no identity oracle (KERI pre-rotation and dual-threshold rule). When witnesses are configured, the checkpoint advances only with their threshold receipts over the KEL anchor—never on controller signatures alone. It holds raw weighted signing keys and the explicit next-key commitment (CheckpointDatumV1, E-native Blake3; independent AIDs only).

The wire contract is frozen and byte-tested across Haskell and Aiken (merged). A plain single-key identity is just the 1-of-1 case.

Vetting

Re-check the design docs against the agreed no-gatekeeper model (canonical permissionless model) before writing code — vetting gates implementation.

Reconstruction & lifecycle
  • Rebuild an identity's full history off-chain from two anchored roots (dual-root reconstruction, KEL replay).
  • Rules for migrating and retiring old state (legacy-leaf policy, End/GC restriction).
  • Cardano-first is rejected before activation; KERI-first lag moves ACTIVE → ARMED → FROZEN, while only an irreconcilable witnessed fork convicts and burns the token — the record lives in the transaction, in history. Arm fail-closes immediately and pays nothing; responsive lag pays nothing; only a full unanswered bond window pays the recorded hunter; every exit burns — nothing is left behind.
  • A per-issuer registry of which credentials are still valid (TEL revocation registry, MPF-backed).
Vertical demo · acceptance test

Identity core · first milestone

local devnet · terminal cast
01
$ keri incept --threshold 2-of-3
inception committed · KeyState frozen into trie_key
02
$ leaf write --owner self
owned leaf written under the AID
03
$ keri rotate --self --collect-receipts
successor keys + threshold witness receipts · checkpoint advanced
04
$ cardano advance --controller-only
✗ rejected · witnessed identity has no receipt-free advance
05
$ keri rotate --key stolen-current
✗ rejected · current keys cannot reveal the committed successor
M2Layer 3

Verification + authorization core

Verify
  • Check that a credential and everything it depends on is valid (ACDC chain verifier), up to four links deep and configurable (hop bound 4). An officer credential (OOR) chains through an extra authorization signed by the legal entity (LE-signed OOR-AUTH) — four credentials, not three; every credential in the chain must be un-revoked (all-TELs cascade) and recent (minutes-grade freshness floor).
  • Turn a verified credential into an on-chain proof (ACDC proof builder). Decode the wire format (CESR) and build the transaction witness (redeemer).
Admit & authorize
  • Verify the whole chain once, record who's allowed, then gate every later action on a cheap lookup (admission cage). trie_key → {credential_saids, role_level, admitted_at, not_after}
  • A signed permission slip authorizing one action — tied to a purpose, single-use, time-limited (detached-signature envelope, Option A: domain-separated, nonce- and validity-bounded), checked against the on-chain registry (L1). Forced by the DeFi batcher model; also works for ceremonies and cage writes.
  • A per-gate switch for narrow emergency intervention (scoped-override knob). Forging is impossible anywhere; each cage can grant scoped, issuer-signed (issuer-AID) powers that are explicit, on-chain, and auditable.
M2 · design choice

Two verification modes

Full per-transaction verification

Re-check the entire credential chain at every gated action (full ACDC verification).

Afforded by SPO delegation and institutional contracts.
Admission cache

Verify once, record admission, then gate later actions on a cheap lookup (admission cache).

Mandatory for regulated DeFi and security tokens.
Both modes ship in M2 regardless of the business pick — the case only decides which mode a given gate uses.
Vertical demo · acceptance test

M2 — Verification + authorization

devnet · terminal cast
01
$ verify --chain vlei-4hop
synthetic 4-hop vLEI chain valid on-chain · all TELs non-revoked
02
$ gate A --mode full
admitted via full per-transaction verification
03
$ gate B --mode cache
admitted via admission cache (cheap lookup)
04
$ tel revoke --mid-chain
✗ both paths blocked · cascade non-revocation fails
05
$ cage freeze --scoped
scoped freeze verb exercised · intervention audited on-chain
M3Layer 4

KERI-wallet ↔ Cardano signing bridge

Every case's actors keep keys in KERI wallets, not CIP-30 wallets; producing order/transition-bound detached signatures programmatically is on the critical path of every design.

  • Bridge core: produce those signed permission slips from a KERI wallet (detached signatures from Signify/Veridian), in the format Layer 3 expects (envelope spec).
  • A developer kit to build the request and its proof (intent/proof SDK).
  • The former external gate is gone: the contract is E-native — standard Blake3 (E-prefix) identities and SAIDs are consumed as-is. In-script blake3 covers the rare genesis/rotation paths; authorizations verify raw keys.
Sequencing

M3 can start as soon as the envelope spec is drafted — it does not wait for all of M2.

Vertical demo · acceptance test

M3 — Signing bridge

devnet · terminal cast
01
$ keri-wallet authorize --action gated
detached signature produced from Signify/Veridian · no CIP-30
02
$ batcher submit --tx
third party submits · accepted against the Layer-1 registry
03
$ submit --replay
✗ rejected · nonce already spent
04
$ submit --expired-envelope
✗ rejected · validity window closed
05
$ sign --key rotated-out
✗ rejected · key not in current KeyState
M4preprod · end-to-end

Pilots

Identified SPO delegation
  • One credentialed stake-pool operator (QVI-credentialed SPO) plus one institutional delegator.
  • A stake script that enforces the rule when stake is published (delegator stake script, publish handler).
  • Every delegation certificate fully verified.
Institutional contracts
  • One treasury payout signed by identity-verified officers (disbursement ceremony, vLEI-verified signers).
  • Contracts that step through defined states (state-machine spend validators).
  • Every state transition fully verified.
Shared runway Starts during M2 — confirm counterparties, get them credentialed (QVI issuance), build credential fixtures, and stand up preprod.
M5demand-driven

Case adapters & hardening

Demand-driven, after the pilots prove the core.

Adapters
  • Compliant (KYC) security tokens: use the token standard's extension or model the token itself as a gated pool. (CIP-113 substandard and/or register-as-cage.)
  • A compliance gate in front of DeFi trading (order gate + admission cage). Its real buyer — the real-world-asset (RWA) issuer — is the same customer as the security-token case.
Hardening
  • An economic penalty for misbehaving watchers (super watcher enforcement) — hardening, not pilot-critical, and blocked on a design decision. Without Blake3/CESR built into the chain the fraud proof isn't trustless (a malicious watcher could fake a divergence proof), so a challenge period or watcher-threshold scheme must be chosen first.
  • Publish the validators as a reusable Aiken package, once M2 freezes the validator API.
The boundary

Where the common code ends

Nothing in M1–M3 depends on the business pick. The chain verifier (verify_acdc_chain), the admission cage, and the signature envelope are shared libraries; the last-mile adapter is the first code that uses them with an opinion.

Case
Adapter validator
Case-local problem
Regulated DeFi
order/pool gate (withdraw-zero, batcher)
attributed order-flow privacy
SPO delegation
delegator stake script + identified-pools registry
delegation stickiness after revocation
Security tokens
CIP-113 substandard or register-as-cage
position privacy
Institutional contracts
state-machine templates + ceremony tooling
OOR churn / re-designation
Dependencies

Dependency spine

envelope spec external M1Identity core · L1–2 M2Verification +authorization · L3 M3Signing bridge · L4 M4Pilots · preprod E2E M5Case adapters& hardening blake3 builtin CIP (optional)lifts the 1-chunk genesis cap
solid = internal sequencing dashed = external dependency
Sequencing, not scheduling.
Caveats

Timing caveats

1
The app choice is a calendar decision before it is a code decision.

The pilots need credentialed counterparties, and getting a real legal entity credentialed (QVI issuance) has weeks-to-months of lead time. For M4 to start when M3 ends, the pilot pick and the counterparty conversation happen during M2.

2
One soft leak backwards.

The scoped-override verbs are motivated differently per case — freeze/seize vs signer re-designation vs admission expiry. The mechanism is common, but the spec is written with all four verb families in view so the knob does not hard-code one app's semantics.

In closing

The bet, restated

01

The core is use-case-invariant — build it once.

02

Every milestone is closed by an E2E demo — the demo is the acceptance test.

03

The app choice is deferred to the last responsible moment — and its runway starts early.

The staking-withdrawal-validator registry and the oracle-controlled registry were retired by the canonical permissionless model; their surviving concerns live on in the key-state and scoped-override designs.