The hardest guarantees, demonstrated
Run the mechanisms yourself
Verifiable sortition, unlinkable petitions and multi-custody ledger agreement — the real code, run live over fixed, published inputs. Every result on this page is byte-deterministic and re-derivable by hand from the payload alone. Each demo names its honest residuals: this proves the mechanism's logic, not its production hardening.
Verifiable sortition (§VI.3a)
Three independent contributors publish commitments, then reveal their entropy; the seed is derived from all three, so no single party — not even the state — can steer who is drawn. From that seed, 8 of 24 citizens are drawn, stratified across the four nations, and the draw is re-verified from the published inputs: ✓ re-verification matches
seed fc042c0260cf32d8975570e5b875a63b…
Drawn: ENG-11 ENG-12 ENG-09 ENG-03 NIR-02 SCO-01 SCO-04 WAL-04
How to verify by hand · honest residuals
Recompute each commit as SHA-256 over "BIG-sortition-commit-v1|contributor|nonce", derive the seed by XOR-folding the revealed nonces against the commitments, re-run the draw with the published population and strata — the selection must match byte for byte. Everything needed is in this payload.
- The commit-reveal beacon carries a last-revealer bias: the final contributor can withhold a reveal after seeing the others. Production requires a threshold-BLS or VDF beacon (documented prototype residual).
- The demo population is a 24-member fixture; production stratification runs on the civil registry under the §II identity layer.
Unlinkable petitions (§XIX.5)
31 signatures arrive as pseudonymous nullifiers — the tally never sees who signed. One citizen tried to sign twice: 1 duplicate dropped by nullifier equality alone, leaving 30 unique signatures.
Trigger threshold: met · geographic floor (4 nations): met · cross-petition unlinkability: proven on this run
same citizen, two petitions:
1ce15ff709db04196755e4f6f31b61fe…
3a130c86da2eead52c57a7e6bcacb397…
How to verify by hand · honest residuals
Each nullifier is HMAC-SHA256(citizenSecret, "petition:v1:" + petitionId). The tally de-duplicates by exact nullifier equality (31 submitted, 30 unique), applies the 2% trigger over the 1,000-strong demo electorate, and requires signatures from at least 3 of the 4 nations.
- Sybil-resistance (one person, one secret) is the identity layer’s job — it needs the §II zero-knowledge well-formedness proof, which is not implemented here. This demo proves unlinkability and dedup, not one-person-one-signature.
- Demo secrets are published fixtures so the arithmetic is reproducible; production secrets never leave the citizen’s credential.
Multi-custody ledger agreement (§VIII.4)
5 independent notaries attest the ledger's Merkle root. One is compromised and attests a forked root; one equivocates and attests both. The Byzantine quorum rule (2f+1 matching attestations, f = 1) still reaches agreement — and names the dissenters:
✓ quorum agreed notary-compromised notary-equivocator
agreed root e5fe1f04f630cdff80957829c8e2d9dc…
forked root 682c1347bdd910259394f836a65ed67f… (failed quorum)
How to verify by hand · honest residuals
Hash each entry (SHA-256 leaf), fold the Merkle root, and check the quorum arithmetic: agreement needs 2f+1 = 3 matching attestations from notaries that attested exactly one root. The equivocator counts toward no root; the forked root fails quorum; dissenters are named in the result.
- The notary set here is a fixture and the round is simulated in one process; production notaries are independent institutions exchanging signed attestations (§VIII.4).
- Omission detection (an entry acknowledged but never appearing) runs in the test suite; this demo shows the agreement round only.
The demo endpoints are public and deterministic: /demo/sortition, /demo/petition, /demo/attestation. Same inputs, same bytes, every time — that is what "verifiable" means here.