ChronoSeal Protocol Specification

This document defines the formal wire protocol, state transitions, cryptographic primitives, and execution invariants of the ChronoSeal attestation system.

Sequence Flow

ChronoSeal operates as a stateful, sequential challenge-response sequence over HTTP/REST between the client browser (WASM/JS) and the native server daemon:

Cryptographic Transitions

1. Handshake Phase (/init)

The client registers a 32-byte Ed25519 verifying key represented as a hex string. The server then performs the following steps:

1. Generates a 32-byte session ID (session_id) and a 16-byte initial salt (S_0).
2. Computes the initial hash chain head:
   H_0 = Blake3(session_id || public_key || S_0)
3. Generates a randomized VM program (between 8 and 16 bytes of opcodes).
4. Creates the initial mutation order program M_1.
5. Persists the initial session record.

2. Heartbeat Progression (/hb)

For each heartbeat step n >= 1, the client submits: prev_hash (H_n-1), timestamp, entropy_data, stack_state (VM stack + instruction pointer), gene_commitment, and the signature.

The server receives the request and executes these validations:

1. Loads the session record from storage, enforcing an optimistic concurrency lock (CAS) to confirm that the database last_hash matches the request prev_hash.
2. Validates the Ed25519 signature against the canonical alphabetical serialization.
3. Re-executes the session's VM opcodes and asserts the client's VM stack_state matches the output.
4. Applies the mutation order M_n to the stored gene buffer, computes the expected commitment:
   C_n = Blake3(CandidateGene || session_id || n)
   Asserts the client's gene_commitment matches.
5. Validates clock alignment: |timestamp_server - timestamp_client| <= max_drift.
6. Advances the cryptographic hash chain head:
   H_n = Blake3(H_n-1 || timestamp || Blake3(entropy_data) || Blake3(S_n) || S_n-1)
7. Rotates the salt to S_n and compiles the next mutation program M_n+1.

VM Instruction Specification

The browser VM executes opcodes sequentially on a 32-bit unsigned integer stack. The supported instruction set consists of:

• 0x00: Pushes the next 4 bytes in the opcode stream onto the stack as a u32 (little-endian).
• 0x01: Wrapping Add (a.wrapping_add(b)). Requires at least 2 stack elements.
• 0x02: Wrapping Sub (a.wrapping_sub(b)). Requires at least 2 stack elements.
• 0x03: Wrapping Mul (a.wrapping_mul(b)). Requires at least 2 stack elements.
• 0x04: Bitwise XOR (a ^ b). Requires at least 2 stack elements.
• 0x05: Bitwise AND (a & b). Requires at least 2 stack elements.
• 0x06: Bitwise OR (a | b). Requires at least 2 stack elements.
• 0x07: Rotate Left (a.rotate_left(b % 32)). Requires at least 2 stack elements.
• 0x08: Unary Bitwise NOT (!a). Requires at least 1 stack element.
• 0x09: Hash Stack. Hashes all stack elements using BLAKE3 and reduces it to a single u32 value, clearing the stack and pushing the result.
• Any other opcode: Terminates VM execution immediately.

Protocol Stability Policy

The public surface of ChronoSeal is frozen at version 1.0. This includes:

• Wire API: The JSON schemas and routes of POST /init and POST /hb.
• State Transition: Hash chain folding, VM opcodes, and gene mutation mechanics.
• CLI & Config: Daemon commands and TOML configuration keys.

Internal details are subject to change without notice. Integrations must not depend on database schemas, Valkey key structures, or internal Rust SDK APIs.