Principal
A persistent identity for a person, organization, device, service, pseudonym, or AI agent.
Technology / Architecture
One state. Many specialized providers. No implicit authorities.
Actum separates who performs work from who can decide validity. Builders, provers, AI workers, storage providers, and gateways contribute specialized services under one deterministic state transition standard.
01IntentA principal requests an action
→02AuthorityCredentials, capabilities, and policy
→03EvidenceExecution proof or assurance receipt
→04FinalityOne committed global state
Protocol primitives
Assets, attributes, and policies should mean the same thing everywhere.
Credential
A signed claim made by an issuer about a principal, with selective disclosure built in.
Capability
A scoped grant of authority that can narrow through delegation, never expand.
Policy
A deterministic rule defining when an action is permitted, publicly or privately.
Object
A versioned unit of state, ownership, value, identity, data, or a model manifest.
Job
An asynchronous request for expensive computation with declared inputs, budgets, and evidence.
Proof / Receipt
Machine-verifiable evidence explaining why a result should be accepted.
An asset is more than a token-shaped integer
Native definitions bind identity, units, decimals, supply, issuer and controller authority, lifecycle controls, and policy revisions. Conservation, issuance, redemption, freezing, and receipts can be checked by the chain itself.
Prove the predicate, not the person
Verified attributes enter authorization as bounded facts, not public identity records. Credential provenance, freshness, holder binding, audience, action, nonce, and policy remain explicit so zero knowledge cannot inflate assurance.
Authorization is infrastructure
APL is a protocol-native, versioned authorization language with typed predicates, default deny, forbid precedence, bounded obligations, fixed metering, and total evaluation. Consensus consumes a canonical validated policy AST.
One decision survives every boundary
A policy result is joined with authenticated actors, attenuated capabilities, credential and status proofs, exact object versions, declared access, replay barriers, and atomic obligations. The finalized receipt preserves what was checked.
A larger L1 surface must earn its place
First-class semantics reduce contract duplication, integration ambiguity, upgrade hazards, and privacy leakage—but they also enlarge the protocol we must stabilize. Features that cannot justify canonical encoding, versioning, migration, and review belong above consensus.
Three different programming boundaries
APL decides whether an action is authorized. ObjectVM executes small, typed, metered state-transition bytecode after static verification. RISC Zero runs pinned private-proof guest programs and returns a verified public journal. These are deliberately separate security boundaries.
Actum does not accept arbitrary programs merely because a language can compile to RISC-V or target RISC Zero. ObjectVM v1 has its own bounded instruction set. RISC Zero guests are application-specific proof circuits with pinned image identifiers—not general smart contracts and not the consensus VM.
Native identity / VCIssuer integration
Issue portable credentials. Authorize with minimal facts.
VCIssuer supplies the OpenID4VCI issuance edge for profiled SD-JWT VC and mdoc credentials. The holder keeps those credentials off-chain. Actum admits only a bounded, commitment-only verifier result tied to the exact chain, audience, action, nonce, policy, and expiry.
Stable identity, rotating control
A person, organization, device, service, pseudonym, or agent can have a persistent principal independent of controller-key rotation. A finalized did:activechain record exposes its public controller lifecycle; it is not itself a legal identity claim.
Claims stay with the holder
Issuer, schema, subject binding, status, freshness, and assurance remain explicit. Raw PID, mdoc, SD-JWT claims, and stable cross-context identifiers are never written to consensus state.
Identity does not imply authority
Credentials establish accepted facts. Attenuating capabilities describe scoped authority. APL combines both under default-deny rules for one action, preserving the distinction in its receipt.
ActiveBridge / Proof-aware payment SDK
Integrate payment rails without confusing a provider event with finality.
The transport-neutral Rust SDK binds every bounded request body to its signed API authorization and correlates every response to the complete request commitment. HTTP, RPC, and embedded transports can share the same replay, idempotency, and evidence rules.
Authentication opens one exact body
Caller, audience, operation, optional payment intent, sequence, validity, and idempotency are bound to the canonical request bytes. Changed bodies and substituted responses fail before application state advances.
External success is not chain finality
Connector and provider observations retain their assurance class. Finalized and refunded results require ActiveChain proof material and a caller-supplied trusted finality verifier; proof presence alone is not verification.
Retries preserve the original decision
Exact idempotent replay returns a correlated result. Refund accounting, disputes, treasury budgets, sponsorship nonces, and webhook cursors remain bounded and crash-safe in the connector host.
Native cash / Reproducible proof-finalization benchmark
Measure the cryptography, state, proof, and availability work together.
The native cash benchmark does not time an empty transaction loop. Every measured batch verifies real ML-DSA-44 authorizations, advances the authenticated Coin Cell state, generates and verifies a CashAIR STARK, and reconstructs its canonical receipt from Reed-Solomon availability shards.
Post-quantum signatures are inside the measurement
Fixed seeds reproduce the workload, while each exact sender, transfer, nonce, session, and validity window is signed and verified with ML-DSA-44.
Only verified proof work counts
Throughput is counted after the cash transition produces its authenticated post-state and the specialized STARK verifies against the exact trace and public outcome.
Results are machine-readable
JSON output separates authorization, state, proving, verification, and availability timings and records proof, receipt, shard, batch, and trace parameters.
Bounded storage / Developmental implementation
Keep consensus verifiable without making every validator an archive.
Actum separates the bounded data required to validate current state from historical data served by independently assigned archive providers. The implementation is being qualified before public testnet launch; these limits and proofs are developmental, not a claim of a live production storage market.
Bounded validators
A qualified 1 TiB working-set ceiling, deterministic byte accounting, pressure bands, and two certified snapshots keep validator storage finite.
Safe pruning
Finalized segments are pruned only after checkpoint, snapshot, retention, grace-period, and archive evidence is complete.
Decentralized archives
Permissionless providers receive 8-of-12 erasure-coded assignments and answer manifest-bound custody and retrieval challenges.
Renewable state
Prepaid leases can hibernate inactive objects outside hot state and restore them from an authenticated owner copy without changing identity.
Checkpoint sync
Bounded checkpoint packages let new validators and light clients verify certified state without replaying unbounded history.
Witnessed replay roots
Nullifiers, redeemed rewards, and compliance replay journals commit to constant-size roots while callers supply checked membership updates.
Agent interfaces / MCP + A2UI
Connect agents without letting interfaces become permissions.
MCP exposes bounded, typed tools and proof-bearing resources. A2UI can explain an exact canonical intent for human review, while wallet-verified values and native approval remain in control. Every consequential request is still checked against identity, capability scope, policy, budget, nonce, expiry, and replay state.
Open interfaces · explicit authorityDiscover. Read. Propose.
No arbitrary RPC, reusable credentials, generic signing endpoint, or generated UI that can silently widen authority.