Anchors and publisher callbacks

PATENT PENDING — Ma'atara Protocol. Reviewed 21 September 2026.

An anchor records a commitment to an ordered block history. A service receipt does not prove publication on an external ledger. Independently witnessed time requires verification of the actual transaction, network, root and finality.

Prepare with the SDK

Use the released helpers rather than reproducing tree or signing-message construction:

import { buildChainAnchor } from '@maatara/veritas-chain/anchor';

const submission = buildChainAnchor({ blockHashesHex, chainHeight }, proto.hash.sha3String);
const signingInput = proto.buildAnchorPreimage(identity.userId, submission.root, submission.epoch, submission.chains);
const signed = proto.pqc.sign(signingInput.msg_b64u, identity.secretB64u);
if ('error' in signed) throw new Error(signed.error);

proto is the initialized toolkit, identity is the approved unlocked owner session, blockHashesHex is the complete ordered history and chainHeight is its authenticated decimal height. The helper uses height as epoch; do not replace it with a wall-clock timestamp. Bind authenticated height/leaf count and ordering as well as the root. The root alone is not an exact-length commitment. Do not interchange the SDK anchor tree with other Merkle helpers.

The separate signed result is optional client-held evidence. Retain it with its signing input and public key if needed; the owner-mode service does not verify or preserve it.

Submit an owner anchor

For the ordinary single-owner flow, submit to https://api.ma-atara.io/api/anchors:

const response = await fetch('https://api.ma-atara.io/api/anchors', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: mintAuthHeader('chain'),
  },
  body: JSON.stringify({
    ...submission,
    hashAlg: 'sha3-384',
    attestations: [],
  }),
});
if (!response.ok) throw new Error(`Anchor refused: ${response.status}`);

mintAuthHeader follows Quickstart. The body must carry its own issuedAt and expiresAt; these are supplied by buildChainAnchor and are separate from assertion expiry. Owner mode is authorized by the request assertion. It ignores body attestations and stores attestations: []; the receipt is not a preserved, verified owner signature over the submitted root. Keep separately signed evidence clientside. Governance-controlled anchors require the configured policy and verified approvals; this single-owner example is not a policy bypass. Save the response and confirm its recorded state rather than assuming success from submission.

Publisher callback

Publication is an operator integration, not an anonymous endpoint. Authorized publishers record an external transaction using their configured service signer:

POST /api/anchors/publish-callback
X-Maatara-Key-Id: <publisher-key-id>
X-Maatara-Occurred-At: <timestamp>
X-Maatara-Nonce: <one-time-nonce>
X-Maatara-Signature-B64u: <service-signature>
Content-Type: application/json

{ "anchorId": "...", "chain": "eth", "tx": "0x..." }

A callback records publication metadata; it does not make an unverified transaction true. Use the approved publisher signer rather than reconstructing its signing-message layout.

Deployment and verification limits

The checked Aegis configuration names Ethereum Sepolia, a test network. Automatic publication is disabled; Bitcoin publication is not implemented. Query https://aegis.ma-atara.io/api/anchor/status for the current report. A configured contract address is not proof of a recent successful transaction or production mainnet readiness.

Verify signatures and authority with SDK helpers; independently check each claimed transaction against the correct ledger and finality policy. If there is no verified inclusion, describe the time as service-recorded. Preserve evidence of height and ordering with the root.