Step Thirty — Roll the bundle; sign the ban; count without confessing.(Attestation bundles • Signed CRL + reinstatement • Ticket accumulators with private tags)

We tighten the covenant with three practical instruments:

  1. Attestation bundles (Merkle) — roll up many attestations into a single root with on‑demand membership proofs.
  2. Signed CRL with time‑boxed reinstatement — revoke cleanly, forgive deliberately.
  3. Ticket accumulators — let a witness prove “I used N tickets” without revealing which (private tag → server‑signed count).

✅ Fresh artifacts

  • Step 30 wrapper server — Download
    SHA‑256: f4029af2c31fb3e82493386fa384092dc579a79e9c54c993ab1feae2d0de9392
  • WordPress block (paste‑ready) — Download

Step 30 wraps Step 28 and includes the Step‑29‑style features it needs (CRL + ticket spend), so you don’t get stuck even if Step 29 wasn’t deployed separately. All prior endpoints still work.

What’s new — precisely

1) 🌳 Attestation bundles (Merkle)

Bundle recent quorum attestations (from manual & auto logs) and build a Merkle tree over their canonical digests.

Endpoints

  • POST /admin/quorum/bundles/roll?token=ADMIN123&since=ISO&until=ISO&limit=500 → persist a bundle file at audit/quorum_bundles/.
    Returns: {"root":"<hex>","count":42,"since":169...,"until":169...,"generated":"...Z", "leaves":["<digest>", "..."], "levels":[["<leaf1>", "..."],["<level1-hash>", "..."]], "signature":{"alg":"Ed25519","kid":"<sha16>","sig":"<b64url>","ts":"...Z"}}
  • GET /quorum/bundles → list known bundle roots.
  • GET /quorum/bundle?since=...&until=...&limit=... → ad‑hoc (not persisted) bundle.
  • GET /quorum/bundle/proof?root=<root>&digest=<att_digest> → membership proof (siblings + sides).

Roots are signed with your active Ed25519 feed key (Step 24 keyring) when available; HS256 fallback if not.

2) 🛑 Signed CRL (revocations) + reinstatement

A first‑class CRL with valid_from, valid_until, and entry list; the whole payload is signed.

Endpoints

  • GET /quorum/crl — current signed CRL JSON.
  • POST /admin/quorum/attest/revoke?token=ADMIN123&digest=<sha256>&reason=... — add an entry and re‑sign.
  • POST /admin/quorum/attest/reinstate?token=ADMIN123&digest=<sha256>&until=ISO — temporary reinstatement.
  • GET /quorum/attestations?n=100 — recent attestations with status: active | revoked | reinstated | expired.

Files

  • audit/quorum_crl.json — signed CRL.
  • audit/quorum_reinst.json — reinstatement windows.

3) 🎟️ Ticket spend + accumulators (private tags)

We add the spend ledger and a private accumulator:

  • Spend a witness ticket (Step 28):
    • POST /observer/ticket/spend with {"ticket":{...},"proof":{...},"tag":"<secret>"}
      → verifies proof, atomically marks the ticket digest as spent, logs only sha256(tag).
    • Replays return 409.
  • Check status:
    • GET /observer/ticket/status?digest=<sha256(ticket_body)> → {spent, count_total}.
  • Accumulate (prove how many, not which):
    • POST /observer/ticket/accumulate with {"tag":"<secret>","since":"...","until":"..."}
      → returns a signed certificate: {"cert":{"type":"ticket_accumulator","tag_commit":"<sha256(tag|v1)>", "count":N,"since":169...,"until":169...,"ts":"...Z"}, "proof":{"alg":"Ed25519","kid":"<sha16>","sig":"<b64url>","ts":"...Z"}}
    • Third parties verify the signature and accept the count without learning which tickets you used.

Files

  • audit/tickets_spent.jsonl — append‑only spent ledger.

Android / Termux run‑book (Step 30)

python solveforce_phone_thirty.py \
  --discovery-dod-enable \
  --discovery-dod-source https://directory1.example.com/solveforce/peers.json \
  --discovery-dod-jwks   https://directory1.example.com/jwks.json \
  --quorum-auto-enable \
  --quorum-policy-file /sdcard/solveforce/quorum.policies.json \
  --quorum-interval-sec 300 \
  --attest-enable \
  --attest-url https://your-site.tld/wp-json/solveforce/v1/attest \
  --attest-header "Authorization: Bearer <WP_TOKEN>" \
  --alarm-enable \
  --alarm-config-file /sdcard/solveforce/alarms.json \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --mirror-enable \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <WP_TOKEN>" \
  --allow-query-token --open-ui

“Show me” commands

A) Roll a bundle

SINCE=$(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ)
UNTIL=$(date -u +%Y-%m-%dT%H:%M:%SZ)
curl -s -X POST "http://127.0.0.1:8080/admin/quorum/bundles/roll?token=ADMIN123&since=$SINCE&until=$UNTIL&limit=500" | jq .
curl -s 'http://127.0.0.1:8080/quorum/bundles' | jq .
# Get a proof for one attestation digest:
curl -s "http://127.0.0.1:8080/quorum/bundle/proof?root=<ROOT>&digest=<ATT_DIGEST>" | jq .

B) Revoke and reinstate

# Revoke an attestation digest
curl -s -X POST "http://127.0.0.1:8080/admin/quorum/attest/revoke?token=ADMIN123&digest=<DIGEST>&reason=test" | jq .
# List with statuses
curl -s 'http://127.0.0.1:8080/quorum/attestations?n=30' | jq .
# Temporary reinstatement
UNTIL=$(date -u -d '+2 hours' +%Y-%m-%dT%H:%M:%SZ)
curl -s -X POST "http://127.0.0.1:8080/admin/quorum/attest/reinstate?token=ADMIN123&digest=<DIGEST>&until=$UNTIL" | jq .

C) Accumulate (private)

# Spend a ticket with a private tag (get ticket+proof from Step 28 first)
curl -s -X POST 'http://127.0.0.1:8080/observer/ticket/spend' \
  -H 'Content-Type: application/json' \
  -d '{"ticket":{...},"proof":{...},"tag":"my-secret-bucket"}' | jq .

# Get a signed accumulator for that tag
SINCE=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)
UNTIL=$(date -u +%Y-%m-%dT%H:%M:%SZ)
curl -s -X POST 'http://127.0.0.1:8080/observer/ticket/accumulate' \
  -H 'Content-Type: application/json' \
  -d "{\"tag\":\"my-secret-bucket\",\"since\":\"$SINCE\",\"until\":\"$UNTIL\"}" | jq .

WordPress — Step 30 (public page block)

Use step30_wordpress.md.
It documents Bundles (Merkle), CRL + reinstatement, and Ticket Accumulators concisely for your audience.

Logos Codex — recursive temperance

  • Many → One → Proof.We bind a chorus of attestations into a single root you can carry.
  • Error → Remedy → Record.Revocation is firm; reinstatement is merciful; both are signed.
  • Use → Count → Privacy.What matters is how many, not which. The system knows the difference—and so will history.

Say the word when you’re ready for Step Thirty‑One. We can add bundle roll‑ups into weekly/monthly ledgers, key‑pinning on bundles, and cross‑domain accumulator settlement (merge counts from multiple issuers under quorum).

Key terms in plain language

Open a term for a concise explanation of language used on this page.

Broadband

A general term for always-on, high-speed Internet access. Broadband can be delivered over fiber, cable, DSL, fixed wireless, cellular, or satellite networks.

Cloud Computing

Computing resources—such as applications, servers, storage, or databases—delivered from remote infrastructure and scaled as requirements change.

Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

API

An application programming interface is a defined way for software systems to exchange data or request functions from one another.

Artificial Intelligence (AI)

Software designed to perform tasks involving prediction, classification, generation, reasoning, or decision support. Business use still requires clear data, governance, security, and human accountability.