Keys and format

GRAIL-PROOF/v1

• Algorithm: SLH-DSA-SHA2-128f (FIPS 205), pure mode, empty context, via @noble/post-quantum 0.5.2.
• Payload: strict schema grail-proof/1; no numbers — amounts, slots and quantities are decimal strings; timestamps UTC YYYY-MM-DDTHH:mm:ss.sssZ.
• Canonical bytes: RFC 8785 (JCS) of the payload, UTF-8.
• Signed message: UTF8("GRAIL-PROOF/v1\n") ‖ canonical bytes. No prehash.
• Envelope: payload, base64url signature (17,088 bytes), base64url SHA-512 digest of canonical bytes (an identifier, not a substitute for the signature), optional embedded public key (untrusted).
• Parsers must reject duplicate keys, lone surrogates, unknown fields and nonfinite numbers.

Offline check

cd tools/grail-proof-verify && npm ci
node verify.mjs --proof proof.json --trusted-key key.json --env production

The tool reads only the files you give it. It uses the trust material you saved, so it can't tell you about a key that was retired or compromised later — check this page for today's key status.

What a valid signature does not mean

It shows PokeGrail issued these exact contents. It does not prove a collectible is authentic, that physical shipping happened, or that wallets, Solana or tokens are quantum-resistant. Timestamps are PokeGrail's own assertion. Wallets and asset custody are unchanged.