Claim families
Tenure’s selective disclosure is signed-variant, not zero-knowledge. At issuance the registrar mints the exact value and its derived band and threshold variants together as one claim family — one shared family identifier, consecutive log entries — and the worker later chooses which granularity each verifier sees, without re-asking the employer. This is described plainly as what it is: not ZK.
Why families exist
Section titled “Why families exist”Two problems motivate them:
- Disclosure should be the worker’s dial. A landlord asking “income ≥ $3,200/mo” should see a threshold, not an exact salary. If the worker had to ask the employer to issue a fresh threshold credential for each ask, disclosure would be friction, not a feature.
- Stale variants must not linger. If the exact, band, and threshold credentials were independent objects, a raise could update the band while a stale threshold kept verifying. That is the failure a family prevents: supersession and revocation are atomic at the family level.
Minting a family
Section titled “Minting a family”Minting takes one underlying fact — an exact annual figure, a basis, and an “as of” time — and produces three attestations under one family identifier at three consecutive log sequence numbers:
| Variant | Claim | Derived value |
|---|---|---|
| Exact | Exact income | The exact figure, in integer cents |
| Band | Income band | The $25,000-wide interval containing the exact figure: from the largest $25,000 multiple at or below it, up to but excluding the next |
| Threshold | Income at least | The largest $5,000 step at or below the exact figure |
Band width is $25,000 and threshold granularity is $5,000. All three variants carry the same family identifier, subject key, “as of” time, basis, and any pointer to the family they supersede.
Families are per underlying fact per “as of” time: the income family and the employment-status family supersede on independent cadences. When income changes, a fresh family is minted whose supersession pointer names the prior period’s family.
Resolving currency
Section titled “Resolving currency”At verification, resolving a family’s currency answers a single question: is this the latest unsuperseded family for its fact? The evidence considered:
- any later attestation whose supersession pointer names this family,
- any explicit Family Supersession entry naming this family, and
- revocation commitments covering this family’s members.
The result is one of three states:
| State | Effect |
|---|---|
| Current | The latest unsuperseded family — its members may verify |
| Superseded | A later family or an explicit supersession entry retired it — no member verifies, including a stale threshold. The state names the superseding family |
| Revoked | Every member is revoked |
The crucial property: when a family is superseded, every variant retires at once. A verifier presented with a leftover threshold from an old family resolves its family as superseded and returns the Revoked verdict — a stale threshold can never verify. See Verification.
Atomic retirement
Section titled “Atomic retirement”The atomicity primitive is the Family Supersession log entry. It names the family being retired, the attestation identifiers of every variant being retired with it, an optional pointer to the replacement family (absent for plain retirement), a reason, and its own epoch and log sequence number.
One signed entry retires the exact, band, and threshold variants together and emits one revocation commitment per member. There is no window in which the band has updated but the threshold has not. The verifier requires the entry to be signed by a registrar that appears in the epoch chain.
Not zero-knowledge — and the copy says so
Section titled “Not zero-knowledge — and the copy says so”A band or threshold credential is a signed statement of a coarser fact, not a cryptographic proof that hides the exact value. The exact value still exists — minted as its own variant — and the worker holds it. What selective disclosure buys is that the worker can present only the coarse variant, and the verifier sees only that. The product copy never implies otherwise; BBS+ and zero-knowledge selective disclosure are a later research track, not a v1 promise. See Selective disclosure.