You can't cut yourself off from your reputation.
No reset button
A permanent, private person binding. Re-registering leads back to your existing identity — not a clean slate.
Legally required erasure remains possible.
Open protocol · Strategy & architecture v1.0
Yourreputation.Yoursforever.
Bitcoin made money impossible to counterfeit. Reputation does the same for the most valuable asset of a human life — the trust you earn over years. Portable across every employer, verifiable by anyone, and never reset by a new phone number.
block#1,284,731
checkpoint_root0x0000000000000000…
validators7 / 7 online
quorum5 of 7 signatures
personal data on-chain0 bytes
You spend years earning trust. Then you change your job, your app or your number — and it vanishes. Reputation makes that history belong to you: provable, portable and protected by the same kind of cryptography that secures Bitcoin.
01The protocol
Not a score. Five verifiable answers.
The essence of Reputation is neither a blockchain nor a single number. It is the ability to answer five questions — each one secured by its own, independent mechanism.
Is it the same person?
Identity continuity separates the human, the account, the keys and time-bound aliases. A new phone number never means a new, empty history.
Identity authority · deduplication
Did the event actually happen?
Organizations sign the fact of a service and who took part in it — before they ever see the review.
ServiceAttestation · ParticipationAttestation
Who judged it, and on what basis?
Every opinion carries its author, method of authentication and strength of evidence. Prestige never overrides relevance.
OpinionStatement · source graph
Has the record stayed unchanged?
Signed bytes, salted commitments and Merkle roots anchored to a federated ledger make any edit detectable.
SHA-256 · Merkle · QBFT
Is the scope honestly described?
Reports state exactly which federated registries were covered, on what date. A partial view is never labelled complete.
Signed manifests · coverage
02Design principles
Bold intentions, with guardrails that make them credible.
Every promise in Reputation comes paired with the boundary that protects it. That is what separates a trust protocol from a rating site.
An opinion doesn't need the subject's approval.
No veto
The person being reviewed is informed, never asked for permission. Acceptance, attribution, publication and scoring are separate gates.
Access, reply and a fair dispute are always guaranteed.
A credible source weighs more.
Evidence over prestige
Weight comes from proof of interaction and a bounded, domain-specific graph of issuer credibility.
Wealth, popularity and employer power never make an opinion true.
A crew's rating touches its people.
Teams, not mobs
Confirmed participants are linked to a shared attestation with explicit attribution weights that sum to one.
One event never becomes a hundred independent reviews.
Everyone can inspect their own history.
You see everything
Full content of every accepted entry is delivered to your private, federated inbox.
No secret scoring because you didn't install an app.
Once written, it never silently disappears.
Permanent, yet correctable
Signatures, Merkle roots, statuses and follow-up decisions form an append-only trail.
Errors are corrected by new, visible decisions — never by hidden edits.
03Identity continuity
One human. One continuous history. No magic ID.
Reputation separates the person, the account, the keys and time-bound aliases. Replacing any one of them never silently changes the others — so starting over is impossible, and hijacking someone else's history is too.
Person binding
Confidential link to one real human. Never published.
Account
An app account. Replaceable without losing history.
Key binding
Which keys were authorised, and when.
Contact binding
Who controlled a phone or e-mail — and in which period.
Verified person
- Evidence
- Trusted eID provider or authenticated document bound to the person.
- Unlocks
- A portable professional profile within the permitted scope.
Missing data or declining extra verification never means bad reputation — only a lower level of identity assurance. Deduplication uses a private HMAC index protected in an HSM, never a plain hash of an ID.
contact: +48 ••• ••• 412ContactBinding · valid_from / valid_to
Person A · 2019 → 2023
Person B · 2024 →
opinion · 2021
old claim · blocked
A phone number is a hint, not a person. A 2021 opinion can reach Person A only if the date falls inside a confirmed alias period and the interaction is proven. The new owner of the number never inherits it.
04Live proof chain
Go ahead. Try to change a review.
This is real cryptography running in your browser. The opinion below was committed with SHA-256, a 32-byte salt and domain separation, then folded into a Merkle tree whose root sits on the federated ledger. Edit a single character and watch the proof collapse.
OpinionStatement · signed bytes
{
"type": "OpinionStatement",
"service_instance_id": "svc_7f3a91",
"attempt_id": 1,
"attribution": "team_participation",
"rating": 5,
"comment": "The crew delivered on time and assembled everything carefully.",
"issued_at": "2026-09-14T10:42:00Z"
}Verifying…
Merkle path resolves to the root finalized by 5 of 7 validators.
Signed bytesSHA-256(signed_bytes)
computing…CommitmentH(domain || salt || inner)
computing…LeafH(0x00 || commitment)
computing…Recomputed rootH(0x01 || node || sibling)
computing…Anchored on-chain rootblock #1,284,702
computing…- signature
- anchor
- issuer_scope
- holder_binding
- freshness
- attribution
Seven successive barriers.
Crypto proves integrity — not truth. If an issuer signs a lie with a valid key, cryptography cannot see it. That is why evidence of the event, audit and appeal are part of the security model, not a weakness of it.
- 01
The source confirms identity, service and role within its accredited scope.
- 02
The author — or a clearly labelled operator — signs the exact content.
- 03
A commitment is built with domain separation, a 32-byte salt and a hash of the signed bytes.
- 04
Commitments form a Merkle tree; only its root reaches the shared ledger.
- 05
Validators finalize the block; independent observers compare checkpoints.
- 06
Your wallet presents document, proof, status and fresh proof of key control.
- 07
The verifier independently evaluates integrity, authority, freshness, attribution and scope.
05Federated consensus
Seven independent operators. Five signatures. Zero shortcuts.
The ledger runs Besu with QBFT — proven Byzantine fault tolerance, no custom consensus and no speculative token. Click a validator to take it offline, then make it malicious. See exactly how the network behaves.
Finalizing blocks
7 honest validators online. Any two sets of 5 signatures share ≥ 3 members, so at least one is always honest.
honestofflinebyzantine
Validators need independent administration, keys and failure domains — seven servers in one cloud account would not count. Aggregate checkpoints can optionally be anchored externally via OpenTimestamps.
What goes on-chain
protocol_versionWhich interpretation rules applybatch_idRandom 32 bytes, no personal semanticsbatch_rootProof a document belongs to a batchcheckpoint_rootObservers compare historyprevious_checkpointContinuity of publicationpolicy_manifest_hashPins the rules and schemasissuer_registry_rootScoped issuer authority
Only aggregate, 32-byte commitments and technical federation data.
What never touches it
- Names, documents, national identifiers
- Phone numbers, e-mails, aliases
- Opinion content and attachments
- Affiliations and team rosters
- Individual scores and weights
- Dispute files and decisions
Encrypted with AES-256-GCM and a unique key per document, held by separate services with least privilege. People's apps never create public transaction addresses.
06Trust model
Weight comes from evidence, not from power.
Inspired by PageRank and EigenTrust, but deliberately split in two: T measures how credible a source is within a domain, Q measures the quality of experiences with a subject. They are never the same number — so no company can inflate itself through its own employees.
w = E · D · I · g · A · R · K
0.306
E — Eligibility gateRight category, admissible, correct status and attribution
A verified client with a service token can carry high D and a normal g — no long account history required.
Source credibility · per domain
tnext = (1 − λ)·p + λ·CT·t
A contraction in L1 for λ < 1 — one unique fixed point. Self-ratings removed, edge mass capped, new sources get g = 1 instead of a penalty.
Smoothed quality
Q = (κ·μ₀ + Σ wᵢ·xᵢ) / (κ + Σ wᵢ)
No data means “insufficient data” — never a default 100. Recency decays as R = 2^(−age/365).
Team attribution
A two-person crew shares one event at 0.5 + 0.5. The sum never exceeds 1 — one experience is never counted as many.
Manipulation attemptBuilt-in control
Sybil accountsVerified-person deduplication, service tokens, rate limits
Mutual praise farmsDomain graph, no self-ratings, cluster analysis, capped mass
Selective invitationsRegistered denominator of services and audited coverage
Review bombingVelocity limits and coordinated-inflow detection
Double countingEvent + version key, deduplicated across crew, person and firm
07Self-custody of reputation
Your credentials. Your keys. Your career.
Like a Bitcoin wallet, your reputation lives with you — not with a platform. Present exactly what a purpose requires, and nothing more.
Take it anywhere
Leaving a company ends an affiliation — never your past services. Your record stays with you; the new employer gains your competence, not your private history.
Join any organization
Companies attest cooperation automatically via HR or dispatch systems. No clicks per job — and fact, legal basis and public display remain three separate decisions.
A private inbox for everything
Every accepted entry is delivered in full. Signed manifests from every operator show who responded and when — partial reports are never called “complete”.
Unstealable presentation
A screenshot or a copied QR is worthless. Verifiers demand a fresh, audience-bound proof of key control from the actual holder (OpenID4VP).
Reputation walletHolder · V2 verified
holder_binding ✓Northline LogisticsDelivery & assembly · crew lead2021 – 2024 · 418 services
92Atelier MontageFurniture installation2024 – now · 127 services
95Certified: Electrical SEPQualification · valid2023 – 2028 · Issuer accredited
—scope report · 3 operators respondedfresh 00:58
08Disputes, recovery & threats
Permanent does not mean unaccountable.
Without an adjudication layer, a criminal or a careless issuer could irreversibly pin reputation on a victim. So disputes are part of security — with reasons, human owners and a second instance on a different panel.
Technical misattribution
“I wasn't on that job.” Resolved by checking the frozen crew roster.
False fact
A genuine document with a wrong field. The signature proves origin, not every value.
Subjective experience
“I didn't like the service.” Not annulled just because the subject disagrees.
Inadmissible content
Special-category data or criminal allegations follow a dedicated legal track.
AI assists. Humans decide.
AI builds chronologies, compares versions and flags missing evidence. It never changes a high-impact status on its own, never judges honesty by writing style, and never follows instructions hidden inside attachments.
Verdicts can't be bought.
No token voting, no fees for a favourable outcome. Proposed targets: acknowledgement within 24 h, ordinary decision within 14 days, appeal window of 30 days. Aggregate decision quality is published.
Lose a key, never your past.
- 2 of 3
- independent channels: second device, offline secret, fresh identity check
- 72 h
- security period after a compromise report, with an independently controlled exception path
- 0
- employers acting as sole custodian of your account
Threat model, stated honestly.
Security is a set of conditional claims, not an adjective. Each release maps threat → control → test → owner → residual risk.
SIM swap / stolen phone
Strong holder binding; recovery independent of SMS
Rating substitution
Signature over exact bytes, commitment and Merkle proof
Wrong person in an opinion
Time-bound aliases, confirmed participation, dispute
Hiding a negative review
Independent receipt, private inbox and signed manifest
Company manipulation
Fact attestation fully separated from opinion
Validator collusion
Independent operators, quorum, observers, checkpoints
Repository leak
Envelope encryption, least privilege, tenant isolation
A fake “AI court”
Human decision, written reasoning, independent appeal
09Process atlas · BPMN 2.0 · Camunda 8
18 executable-grade models. The documentation is the process.
Every rule on this page traces back to a BPMN 2.0 model with Camunda 8 (Zeebe) extensions. Explore each one live: pan the canvas, inspect any task, replay the happy path, and download the original model.
P01IdentityP01_onboarding_i_ciaglosc_tozsamosci.bpmn
Onboarding & identity continuity
01/18
Loading BPMN engine…
Drag to pan · click to inspect
L1Person
L2Identity provider
L3Registry & wallet
Goal
Bind account and key to a person; re-registering never creates a clean history.
Inputs
Identity proof reference, new public key, assurance level.
Outputs
IdentityBinding or a limited profile; referral to P14 when the person already exists.
Control rule
SMS does not prove physical identity. Uncertain matches require manual resolution — never an automatic merge.
Element inspector
Click any task, gateway or event in the model to see its type, lane and Zeebe worker binding.
Worker jobs
- identity.proof
- identity.limit
- identity.resolve
- identity.create
- identity.recovery.request
10Open governance
No single authority. Separated powers by design.
Merging every role into one company would be simpler — and would let it create identities, issue ratings, hide data and judge its own disputes. Reputation splits authority into eight independent roles.
Identity authority
Verifies the person, keeps confidential bindings and key history.
Issue opinions on your behalf or take over your wallet.
Organization
Attests cooperation, service, scope and participants.
Edit a client's words or block delivery because of a rating.
Opinion author
Submits their own statement about a real experience.
Decide alone who the target is or blame an entire staff.
Intake & inbox operator
Checks policy, stores encrypted documents, issues receipts.
Hide a negative entry from the subject or sell removals.
Ledger validator
Agrees on and persists valid registry transactions.
Rule on whether a review is true by consensus alone.
Verifier
Checks proofs, status, holder binding and scope.
Treat an operator's silence as a positive result.
Adjudicator
Makes reasoned decisions on attribution, status and publication.
Turn someone's opinion into words they never said.
Protocol council
Approves versions, accreditations and policies.
Quietly rewrite historical results without a new version.
Apache-2.0Intended code license after dependency review
No tokenNo speculative asset, no token voting, no paid verdicts
Free rightsAccess, reply and correction are never a paid feature
What we promise
- Your history follows you across employers, apps and devices.
- Every accepted entry about you is delivered to you in full.
- Any change to a signed record is cryptographically detectable.
- Every decision has a reason, a human owner and an appeal.
- Anyone can run the open verifier and check a proof package.
What we refuse to build
- A global “human value” score or a public search by phone number.
- A speculative token, token voting or paid verdicts.
- That the blockchain proves every claim is true.
- Eternal availability of every piece of content.
- That AI decides the “true version” of events.
The road to an open standard.
- Now
Strategy & architecture v1.0
Protocol design, threat model, 18 BPMN processes and a retention matrix — ready for independent review.
- Pilot
Adult contractors, confirmed services
Home logistics and installation via Zadbano as first integrator. Source graph runs in observation mode only.
- Federation
Independent operators
Seven QBFT validators across separate organizations, accredited issuers and public observers.
- Open standard
Neutral stewardship
A neutral body maintains the standard, with contractors and clients represented in governance.
11Identity mark
A seal for the most valuable thing you own: your name.
The Reputation mark has no letter and no ornament. It is a seal, a cut gem and one point of light: protection, proof and the person who holds the key.
48 × 48 gridMark / v1
Primary lockupReputationClear space equals the height of one block.
InverseReputationFor partner badges and verified-issuer seals.
ScaleLegible from app icon down to a 16px favicon.
Deep ledger#00172E
Seal navy#002244
Proof cyan#00CEF7
Core signal#FFF500
Paper#EAF6FB