Tenure

Tenure is a confederal protocol for income and employment attestations. An employer signs statements about its own workforce; the worker holds the resulting credential and decides who sees what; a verifier checks it against the employer’s own key. No bureau sits in the middle holding the truth.

The design has one organising commitment: the employer’s keypair is the root of trust. Everything else — the registrar that serialises operations, the portal that renders a verdict, the directory that helps a stranger find an employer — is replaceable infrastructure that a participant can fire without invalidating a single credential already issued.

Status

This documentation describes a design, not a shipped product. The protocol is at the proof-of-concept stage: the model below is what Tenure is built to be and how its parts are intended to fit together. Interfaces are not stable, the implementation is not public, and nothing here should be read as a guarantee of current behaviour.

Where to start

• Protocol overview — the reading order, the invariants that hold everywhere, and the encoding conventions.
• Architecture — the actors, the trust boundaries between them, and what each one is not trusted for.
• Verification — the five checks a credential must pass, and what each one rejects.

The shape of the design

Authority is delegated and bounded. An employer opens an epoch naming the registrar allowed to sign on its behalf, and issues a delegation fixing which claim types that registrar may mint, at what rate, over which range of the log. A signature outside those bounds is invalid — signed, but not authorised.

History is append-only and witnessed. Every operation is an entry in a hash-chained log whose head is signed and published. Two conflicting signed heads for the same position are portable, self-verifying evidence that history was rewritten; anyone can check the proof without trusting whoever presents it.

Disclosure is the worker’s decision. Income is issued as a family of signed variants — an exact figure alongside its band and threshold — so a worker can answer “earns at least this much” without revealing the rest. Superseding the family retires every variant at once, so a stale threshold can never verify.

Verification is a pure function. The chain, the entity attestation, the consent grant, the revocation set, and the current time all arrive as inputs. The same predicate runs in a hosted portal, in a wallet, and in a page served from a static file with no network access — which is what makes a credential outlive the infrastructure that issued it.

What the protocol does not claim

A verified credential proves that the employer signed these statements. It does not prove they are true. Tenure never aggregates statements from two employers, never scores a worker, and never recommends a decision — it presents signed evidence and leaves the judgement to the party who asked for it.