background gif
eni6ma

How it works

Protocol

Same REST/JSON service shape. Different authority object: a one-shot twin proof with burn-before-validate.

Traditional APIs accept a bearer token and trust it until expiry. ENI6MA treats the request body as untrusted until a envelope proves that this method, on this endpoint, with this body hash, under this policy, at this tau, with this nonce, may change the world once.

Happy path

  1. Canonicalize the request (method, path/endpoint_id, body digests, policy).
  2. Challenge the circuit binary for a fresh tau-bound challenge.
  3. Respond: produce twin proof material (bearings, proof_hash, shards as required by the variant).
  4. Assemble the envelope and reserve a nonce from the ledger.
  5. Gate burns the nonce before validate-proof, then runs twin validation, then application policy, then the side effect.

Gate check order

Independent checks run before the application side effect:

  • Recompute request_hash: reject on mismatch
  • Check endpoint_id and policy_hash against server constants
  • Anchor / handle active in registry (or local stub)
  • Freshness: |now − tau| within the configured window
  • Burn nonce_uuid before proof validation
  • Validate twin (local binary or registry HTTP)
  • Application policy, then fetch / mutate
Composite binding (conceptual)
request_hash = sha256(
  method || endpoint_id || request_body_hash
  || policy_hash || tau || nonce_uuid
)

Mechanism claims

Every envelope binds method, endpoint_id, request body hash, policy hash, tau, and nonce_uuid into one composite digest.Shippingrequest_hash = sha256(method || endpoint_id || request_body_hash || policy_hash || tau || nonce_uuid).Holds under the reference architecture

The nonce is burned before twin validation, so a failed or replayed submission cannot be spent twice.ShippingGate order spends nonce_uuid prior to validate-proof; spent nonces reject at the nonce stage.Holds under the reference architecture

Authority expires at the end of the request (a captured envelope is a fossil, not a reusable credential).ShippingOne-shot nonce plus request binding; capture does not authorize a second call.Holds under the reference architecture

Protected routes do not rely on a reusable API key, bearer token, or service certificate as the authority object.ValidatedThe gate accepts a per-call envelope; agents and MCP faces are not configured with a bypass secret.Holds under the reference architecture