Ma'atara Core — integration model
PATENT PENDING — Ma'atara Protocol. Reviewed 21 September 2026.
Ma'atara provides key-attributable provenance and encrypted product records. Use the SDK and supported service contracts to create and verify evidence. Internal identity derivation, signature-message layouts, fingerprint construction and novel protocol algorithms are outside this public guide.
Identity and custody
Native identity is bound to the owner's signing key and signed lifecycle. Use SDK binding helpers and approved identity flows. Presenting a key does not create an account or bypass lifecycle checks. Resolvers and storage providers do not become identity authorities.
Human sign-in and app sessions do not replace native signed authorization. Protected requests need fresh assertions for the exact destination audience. Device authorization additionally checks attestation, origin, capability, revocation and epoch.
Private keys and plaintext stay in approved endpoint custody. Browser/WASM custody does not imply hardware non-extractability; a compromised endpoint can expose unlocked content and keys.
Native algorithms
| Purpose | Choice |
|---|---|
| Signatures | ML-DSA-65, FIPS 204 |
| Key encapsulation | ML-KEM-768, FIPS 203 |
| Digests | SHA3-384, FIPS 202 |
| Content encryption | AES-256-GCM |
Use exact native wire labels. Interoperability profiles retain their specified primitives within named, versioned boundaries. Algorithm use is not product or implementation certification.
Records and evidence
The portable SDK supports native Veritas v4. Current Core code includes native v4 reads and appends; older v3-only descriptions are obsolete. Preserve the endpoint's declared record profile and use its supported SDK/transport contract. Do not relabel stored records.
Verification separately checks shape, signature, authority lineage, completeness and freshness. A valid signature alone cannot establish the last three. Storage can withhold records; independent freshness evidence remains a separate requirement.
Notes v2 encrypts content while exposing limited routing/protocol metadata. This does not hide traffic patterns or public provenance evidence. Optional AI chat is a disclosed plaintext-egress exception to the selected model provider. Attempting to journal a commitment does not guarantee durable recording of every turn.
Availability boundaries
Toolkit pairwise and hybrid channels remain experimental with production profiles disabled. The independent witness implementation is experimental, not a production-operated service. Delegation-aware root rotation is gated separately from configured device verification. Temporary legacy account healing is retired (HTTP 410).
A service-recorded anchor is distinct from public-ledger inclusion. Do not claim independently witnessed time without verifying the network, transaction and finality.