Duedale · the flow-proof platform
Did value reach the
right hands?
For its purpose, under its rules. That one question is the whole of it — for any flow of value, in any market, anywhere.
Duedale proves where value went. It never moves it.
DECLARE
the payer
the purpose, the limits, who may receive, when it ends
PAY
the payer, on their own rails
a reference — Duedale is never in the money path
CONFIRM
the recipient
“it arrived” — the signature that turns a claim into proof
RECONCILE
the book
a signed artifact anyone can check offline, for free
Duedale answers one question for any flow of value: did it reach the right hands, for its purpose, under its rules? It proves where value went — and it never moves it.
Value moves with a purpose — a wage, an invoice, a deposit, a share, a grant.
It arrives, and then nobody can show that it did — least of all the person who received it.
Duedale makes the arrival provable — by both parties, to anyone, without ever touching the money.
The constitution
What it will not do.
A general record of who paid whom is the most surveillance-capable thing anyone could build. These are not policies that can be waived for a large enough customer. They are capabilities that must not exist.
Presentation, never lookup — no interface answers “show me all flows matching X”, for anyone, including an operator, a paying customer or a government.
No central ledger of flows. Records live with their subject and their book.
The book belongs to the establishment — its keys, its node, and it leaves with them.
Two signatures or it is not proof. A one-sided record is a claim.
Arrival, not consumption — Duedale proves value reached the right hands, never what an individual then bought.
Payment first, confirmation after, so confirming is never a condition of being paid and declining is safe.
Only predicates cross a boundary. Raw records travel because the holder attached them, never otherwise.
Separate identifiers per relationship — linkage is something a subject does, never something done to them.
Never built, at any price, regardless of who pays
- A list of people and their flows
- A report naming the individuals who have not confirmed
- Bulk export of subject records to any third party, including a government
- Scores, rankings or comparisons between subjects
- Retention past a book's stated term
- Any restriction on what an individual buys with money they have received
If a deal requires one of these, the deal is refused in writing.
Trust-minimized, not trustless
What the mechanism does — and what it refuses to do.
Signatures and hash-chaining make a small number of things mechanical: a record carrying both parties' signatures cannot be forged by either of them alone, and a book cannot quietly rewrite its own history without the chain showing it. What the mechanism does not do is judge. Duedale does not decide whether a payment was fair, whether the work behind it was any good, or what someone did with the money after it arrived — and the last of those is not a gap to be closed later. It is a capability this platform refuses to build. Trust-minimized, not trustless; privacy-preserving, not anonymous-to-the-regulator.
PROVABLE
value arrived, signed by both sides
By mechanism
DETECTABLE
a book rewriting its own history
By mechanism
NOT OURS
whether it was fair, or any good
By design
Duedale is never in the money path: no custody even transiently, no account that collects, no payment message originated into a rail. Payment happens on the payer's own bank, rail or wallet.
What exists in code
Ed25519
signed records, both sides
@kashscript/whiffin
Hash-chained
append-only signed log — in memory today
@kashscript/whiffin
Offline
a plain-Node CLI checks a report, no service
@kashscript/attest
0 floats
integer minor units, end to end
@duedale/core money domain
Where this stands.
This is a design and a codebase, not a running service. Read the following as the whole of it, because it is:
- There is no customer, no pilot, and no loop that has turned once with a real counterpart.
- Every settlement in the codebase is a simulation, labelled so inside the signed payload.
- The shared surfaces this plugs into — the wallet, the portal, the confirmation channel — are approved design and unbuilt.
- The durable append-only ledger is an open obligation: what runs today is in memory.
- Guest identities are generated server-side with a seven-day cap, so those records are not yet held by their subject.
- No node boundary is built, so nothing here claims to be decentralised.
- The licensing reading — software vendor, not e-money issuer — is owed to a lawyer and has not been confirmed.