MolTrust Protocol Sprint: IPR, Public API, and Full Offline Verification

#ai #web3 #opensource #blockchain

Three things shipped this week that complete the MolTrust trust stack. Not incremental updates — each one closes a structural gap that existed since launch.

1. Output Provenance — Interaction Proof Records

The problem: An agent makes a prediction. The outcome happens. The agent claims it called it correctly. But can it prove what it actually said — before the outcome was known?

The solution: Interaction Proof Records (IPR). Every agent output gets a SHA-256 hash, an Ed25519 signature, and a Merkle proof anchored in batches to Base L2. The calldata prefix MolTrust/IPR/v1/<merkle_root> makes every batch independently verifiable on-chain.

Confidence scores go through a 3-layer calibration pipeline: historical calibration, inflation detection, and basis weighting.

11 new endpoints. POST /vc/ipr/submit for submission, verifyOutput() in @moltrust/verify for verification.

2. moltrust-api — Open Source

The Python/FastAPI reference implementation is now public on GitHub: MoltyCel/moltrust-api.

Open source does not mean open authority. MolTrust issues credentials; anyone can verify them. But transparency is the first step toward trust in the infrastructure itself.

What is in the repo: 7 verticals (Shopping, Travel, Skills, Prediction, Salesguard, Sports, Music), the full IPR pipeline, Trust Score computation, Agent Authorization Envelopes, and the Swarm Intelligence protocol.

3. Full Offline Verification — @moltrust/verify v1.1.0

Ed25519 public keys are now anchored on Base L2. The calldata format is MolTrust/DID/v1/<identifier>/<pubKeyHex>. The verifier reads the public key directly from the anchor transaction. No API call required.

const verifier = new MolTrustVerifier();

// Public key from chain, not from API
const key = await verifier.resolvePublicKey(
  "did:moltrust:d34ed796a4dc4698",
  "0xde579d2c...f63d4c"
);

// Verify credential with on-chain key
const result = await verifier.verifyCredentialWithKey(vc, anchorTx);
// -> { valid: true, checks: { signatureVerified: true } }

What this means: MolTrust can go completely offline and every credential ever issued remains independently verifiable. The public keys are on Base L2. Ed25519 verification runs locally in under 2ms. No phone home. Ever.

The Trust Stack — Complete

Layer	Component	Status
Identity	W3C DID + on-chain public key	Live
Authorization	Agent Authorization Envelope	Live
Behavior	Trust Score + Swarm Intelligence	Live
Provenance	Interaction Proof Records	This week
Verification	Full offline, on-chain keys	This week