How it works

This is the short version. Read the briefs and the rationale first, on Learning. The construction and the implementation notes are on Technical.

Making one

You make a small file. It holds a public key and a record of work. The work is memory, held while the file is made. One leg is 2,000,000 steps over a 1 KB sample drawn from a 16 KB slot. The file stays small. The room it occupied does not travel with it.

Checking one

Anyone can check a file without holding its key. The verifier reads the file and recomputes. Checkpoints are checked in parallel. The record says what matched. That record is a measurement. A later policy is a separate decision.

Admission is a separate decision

A gate takes the measurement and applies its own policy. Groundinglab's sign-in policy uses a floor on the bookend pair: strict 7/20, default 1/4, lenient 1/8. The verifier does not apply that floor. The gate does. Those decisions are on the gate log.

Sign in asks for a PCOC you hold. This site mints a code. Your app signs that code with the object. The gate checks the object's recorded work, then applies its policy. Verify does not make that decision.

The numbers

A stage binds to the stage's waypoint (or the seed value in stage 0). The maker observes a later Bitcoin block after a leg, and that observation dates the work. An anchor holds when the block is inside the 3-block window, that block is a stored stage interrupt, and the public index's plant matches. The largest object this gate accepts is 256 MiB.

Deeper explanation

What the file records

One public key, one seed beacon, and a terrain that is recomputed and not stored. The terrain is 256 MiB. The file does not carry that room.

The record is 18 stages, numbered 0 through 17. Stage 0 stores the seed value, the seed beacon, and the beacon height. The seed value is the SHA-256 of the public key followed by the seed beacon. Stage 0 has no waypoint and no path. Stages 1 through 17 each store a waypoint, the interrupt the stage started from, that interrupt's height, the path of that waypoint, and one or more legs. The interrupt that ends stage 17 is stored as the last interrupt. No waypoint is built from it.

Each leg is 2,000,000 steps and ends in a leg result and a checkpoint. Each step reads one slot of 16 KB. The checkpoint is a SHA-256 digest. Its preimage is the previous checkpoint, the stage limb, a 1 KB sample of the terrain, and the leg result: 32 + 32 + 1024 + 8 bytes, which is 1096. On stage 0 the stage limb is the seed value. On a later stage it is that stage's waypoint. The digest is not the leg. The path is not part of that preimage.

That memory, held across the steps, is the cost that does not divide. Separately, each post of waypoints 1 through 17 pays Hashcash of 21 leading zero bits. That fee buys the plant. It does not buy the leg.

What a checker measures

A checker reads the file and recomputes. It does not decide whether to let the file in. It checks four different things.

Every checkpoint is the digest over its 1 KB sample, and that digest is not a leg. The waypoints are recomputed from the stored checkpoints. Each stored header is read from the portable index. Six drawn legs are recomputed at 2,000,000 steps each. The checkpoint comparisons and those six legs may run at the same time. The checker records what matched. It does not apply a floor.

A path on waypoints 1 through 16 is anchored only when its block is inside the 3-block window, that block is a stored stage interrupt, and the plant comparison against that header matches. The window is the offsets 2, 3, and 4 after the height where the plant was posted. Waypoint 17 is posted and is not asked. A missing path, a path outside the window, or a path whose header is not a stored interrupt is not anchored. The checker reads that one inclusion height only. It does not scan other index heights.

When at least two waypoints among 1 through 16 are anchored, the bookends are the lowest and the highest of those. N counts the checkpoints from the first of those stages through the stage before the last. S is the span, in seconds, between the two endpoint times read from the index. The checker records the integers N and S. It does not record a rate, and it does not judge the pair.

What admission decides

Measurement and policy are separate. The record above is a measurement. The admission service is the only place that judges it. A threshold there can change without changing the file and without changing the measurements. The service runs its own check. It does not take a measurement record supplied by the person signing in.

The locked floors are on the bookend pair, checkpoints over seconds: strict 7/20, default 1/4, lenient 1/8. The comparison is integer-only. The checker does not apply those floors. Other figures in the policy tables are candidates. They are not locked.

A signature over the sign-in challenge is not a measurement of the file. The only signature origin is https://groundinglab.io. The challenge lasts 120 seconds. The clock-skew allowance is 5 seconds. While a grant is provisional, no irreversible action is allowed. That cap is fixed at 0.