Step Thirty‑One — Pin the keys; roll the ledgers; settle the counts.(Bundle ledgers • Key pinning & verification • Cross‑domain accumulator settlement)

We lift Step‑30’s proofs into long‑form order and make interop safe:

  1. Bundle ledgers (weekly/monthly) — chain signed roll‑ups of bundle roots for a time window.
  2. Key pinning & verification — manage a local pins file (by KID → pubkey) and verify remote bundles/ledgers against it.
  3. Cross‑domain accumulator settlement — accept accumulator certificates from multiple issuers, verify, and sign a settlement receipt.

✅ Fresh artifacts

  • Step 31 wrapper server — Download
    SHA‑256: b1504dbfb701f6383433bfd61f0cf2c6037edd460215354eae961c68897e0272
  • WordPress block (paste‑ready) — Download

Step 31 wraps Step 30 (which wrapped 28→29 features), and thus everything from Steps 18…30 still works.

What’s new — precisely

📚 Bundle ledgers (weekly/monthly)
  • Roll up persisted bundle roots (from Step 30) over a [since, until] window.
  • The ledger header is hashed to a ledger root and signed, with prev linking to the prior ledger (per period).

Endpoints

  • POST /admin/quorum/ledger/roll?token=…&period=weekly|monthly&since=ISO&until=ISO → writes to audit/quorum_ledger/<period>/.
  • GET /quorum/ledger.list?period=weekly → list saved ledgers.
  • GET /quorum/ledger.head?period=weekly → latest for the period.
  • GET /quorum/ledger?root=<root> → fetch a specific ledger.
  • POST /quorum/ledger/verify with body: {"ledger": { ... }, "deep": true} verifies signature and (if deep) verifies each referenced bundle that exists locally.

2) 🔐 Key pinning & verification

Maintain a pins file (--pins-file, default audit/pins.json) of trusted public keys for:

  • bundle_pubkeys, ledger_pubkeys, settlement_pubkeys (map: kid → x where x is Ed25519 pubkey base64url).

Endpoints

  • GET /quorum/pins — show pins.
  • Admin:
    • POST /admin/quorum/pins/add?token=…&kind=bundle|ledger|settlement&kid=<kid>&x=<pub_b64url>
    • POST /admin/quorum/pins/remove?token=…&kind=…&kid=<kid>
  • POST /quorum/bundle/verify with { "bundle": {…} } — verifies signature using pinned key (or the bundle’s embedded x).
  • POST /quorum/ledger/verify with { "ledger": {…}, "deep": false } — verifies ledger signature (and optionally bundle signatures).

If a signature contains an x field, it’s used directly; otherwise we look up kid in your pins. If neither is available, verification fails (no_pub_for_kid).

3) 🤝 Cross‑domain accumulator settlement

Aggregate ticket accumulator certs (Step 30) across multiple issuers; verify each signature against pinned settlement keys; enforce policy; and produce a signed settlement receipt.

Endpoint

  • POST /settlement/accumulators { "certs": [ {"issuer": "issuer-a", "cert": { ... }, "proof": { "alg":"Ed25519","kid":"...","sig":"...","x":"..." }}, {"issuer": "issuer-b", "cert": { ... }, "proof": { ... }} ], "policy": { "min_issuers": 2, "max_age_sec": 604800, "dedupe": true } } Returns { "ok": true, "total": 123, "issuers": {"issuer-a": 45, "issuer-b": 78}, "valid": [ ... ], "invalid": [ ... ], "receipt": { "body": {"type":"accumulator_settlement","total":123,"issuers":{...},"policy":{...},"ts":"...Z"}, "signature": {"alg":"Ed25519","kid":"<sha16>","sig":"<b64url>","ts":"...Z"} } }
  • GET /settlement/tail?n=50 — tail of settlement events.

Pins to use: store issuers’ pubkeys under settlement_pubkeys via /admin/quorum/pins/add.

Android / Termux run‑book (Step 31)

# Optional: set a pins file with trusted remote issuers
echo '{"bundle_pubkeys":{},"ledger_pubkeys":{},"settlement_pubkeys":{}}' > /sdcard/solveforce/pins.json

python solveforce_phone_thirtyone.py \
  --pins-file /sdcard/solveforce/pins.json \
  --discovery-dod-enable \
  --discovery-dod-source https://directory1.example.com/solveforce/peers.json \
  --discovery-dod-jwks   https://directory1.example.com/jwks.json \
  --quorum-auto-enable \
  --quorum-policy-file /sdcard/solveforce/quorum.policies.json \
  --attest-enable \
  --attest-url https://your-site.tld/wp-json/solveforce/v1/attest \
  --attest-header "Authorization: Bearer <WP_TOKEN>" \
  --alarm-enable \
  --alarm-config-file /sdcard/solveforce/alarms.json \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --mirror-enable \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <WP_TOKEN>" \
  --allow-query-token --open-ui

“Show me” commands

A) Create a weekly ledger over the last 7 days

SINCE=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)
UNTIL=$(date -u +%Y-%m-%dT%H:%M:%SZ)
curl -s -X POST "http://127.0.0.1:8080/admin/quorum/ledger/roll?token=ADMIN123&period=weekly&since=$SINCE&until=$UNTIL" | jq .
curl -s 'http://127.0.0.1:8080/quorum/ledger.head?period=weekly' | jq .

B) Pin a remote key and verify

# Add a remote issuer's ledger key (kid + base64url pub)
curl -s -X POST "http://127.0.0.1:8080/admin/quorum/pins/add?token=ADMIN123&kind=ledger&kid=<KID>&x=<PUB_B64URL>" | jq .
# Verify a posted ledger object
curl -s -X POST 'http://127.0.0.1:8080/quorum/ledger/verify' \
  -H 'Content-Type: application/json' -d '{"ledger":{...},"deep":false}' | jq .

C) Settle accumulators from two issuers

curl -s -X POST 'http://127.0.0.1:8080/settlement/accumulators' \
  -H 'Content-Type: application/json' \
  -d '{"certs":[{"issuer":"issuer-a","cert":{...},"proof":{...}},{"issuer":"issuer-b","cert":{...},"proof":{...}}],
       "policy":{"min_issuers":2,"max_age_sec":604800,"dedupe":true}}' | jq .
curl -s 'http://127.0.0.1:8080/settlement/tail?n=20' | jq .

WordPress — Step 31 (public page block)

Use step31_wordpress.md — it explains Bundle Ledgers, Pinning & Verification, and Cross‑Domain Settlement in public‑facing terms.

Logos Codex — recursive stewardship

  • Roots → Ledger → Lineage.We don’t just prove; we remember in ordered rolls.
  • Keys → Pins → Prudence.Trust is specific; we spell it in pubkeys, not vibes.
  • Many → Sum → Receipt.Across domains, we agree on how many and bind it with a signature.

If you want Step Thirty‑Two, we can add multi‑issuer quorum on ledgers (M‑of‑N signatures on each period), bundle inclusion proofs served as JWZ/JWS, and a settlement clearing that pays out credits based on signed receipts.

Key terms in plain language

Open a term for a concise explanation of language used on this page.

Broadband

A general term for always-on, high-speed Internet access. Broadband can be delivered over fiber, cable, DSL, fixed wireless, cellular, or satellite networks.

Cloud Computing

Computing resources—such as applications, servers, storage, or databases—delivered from remote infrastructure and scaled as requirements change.

Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

API

An application programming interface is a defined way for software systems to exchange data or request functions from one another.

Artificial Intelligence (AI)

Software designed to perform tasks involving prediction, classification, generation, reasoning, or decision support. Business use still requires clear data, governance, security, and human accountability.