Public protocol · v1.0

The Protocol.

The Quire protocol is a small set of public smart contracts. The credential, the vouching gate, and the signing service all live there, not in a database we control. The site you are reading is one possible UI on top of the protocol. Anyone may build another. This page is the canonical reference.

§ I · The credentialCTOID

Soulbound ERC-721, peer-issued.

Contract: 0x7ebecc5670fc295bdde749a4d3e9ec0832515eb1
Network: Base (8453)
Standard: ERC-721 · non-transferable
Supply: No on-chain cap

Nº 1–49. Issued by the founder during the bootstrap phase.
Nº 50+. Every credential requires three vouches from sitting holders. The contract counts distinct voucher Nºs, not raw transactions.
Permanent. Once issued, a Nº cannot be transferred, sold, or recalled by anyone. The contract owner has a burn function; we commit below not to use it.

§ II · The signing serviceAuthorship

Cryptographic attribution, gated by the credential.

Contract: 0x52590e160adefe11238a90213f7819d7b8484f15
Hashing convention: keccak256(UTF-8 bytes of canonicalize_v1(content))
Gated by: CTOID.tokenIdOf(msg.sender) > 0
Idempotency: One signature per (Nº, hash). Multi-signer per hash.

A signature binds (tokenId, contentHash, url, title, signedAt). The signer is the wallet that holds the Quire credential. The signature is permanent. There is no unsign function by design.

The contract records who signed a hash and in what order, not who authored the work. The earliest signer is shown as the first signer; later ones as co-signers. This is signing order, a factual on-chain record, not a verified authorship claim. Quire attests that a peer-vetted Fellow put their Nº behind a piece; it does not adjudicate who wrote it.

§ III · VerifyingWithout us

Confirm a credential, confirm a signature.

Is this address a CTO?

bash

cast call 0x7ebecc5670fc295bdde749a4d3e9ec0832515eb1 \
  "tokenIdOf(address)(uint256)" \
  <wallet-address> \
  --rpc-url https://mainnet.base.org

Returns the Quire Nº as a uint, or 0 if the wallet holds none.

Who signed this content?

bash

# 1. Hash the content. It must be canonicalized (v1) first, so use the
#    SDK's QuireClient.hash; a raw cast keccak only matches already-canonical text.
HASH=$(cast keccak "$(cat article.txt)")

# 2. Read every signature attached to that hash
cast call 0x52590e160adefe11238a90213f7819d7b8484f15 \
  "signaturesFor(bytes32)((uint256,uint64,string,string)[])" \
  $HASH --rpc-url https://mainnet.base.org

Returns an array of (tokenId, signedAt, url, title) tuples, one per signer. Empty array means the content was never signed by anyone holding a Quire credential.

Same thing, in TypeScript with viem

import { QuireClient } from "@quirecx/sdk";
import { createPublicClient, http } from "viem";
import { base } from "viem/chains";

const client = createPublicClient({ chain: base, transport: http("https://mainnet.base.org") });
// canonicalize (v1) then keccak256, the same as the /sign page. Do not raw-hash.
const contentHash = QuireClient.hash(articleText);

const sigs = await client.readContract({
  address: "0x52590e160adefe11238a90213f7819d7b8484f15",
  abi: AUTHORSHIP_ABI,
  functionName: "signaturesFor",
  args: [contentHash],
});

// sigs is an array of { tokenId, signedAt, url, title }
// If sigs.length > 0, the content was signed by a peer-vetted CTO via Quire.

§ IV · SovereigntyBinding commitments

What we have given up.

01 · No revocation
The contract exposes lockBurn(), a one-way owner-only function that permanently disables the burn mechanism. The founder will call it before transferring ownership at Nº 0050. After that point no Nº can ever be revoked, not by the founder, not by the multisig, not by anyone. The commitment becomes cryptographic. Until lockBurn() is called, any burn is on chain and visible to all.
02 · Ownership transfer at Nº 0050
Once the founding cohort is closed (Nº 0049 issued), administrative ownership of the CTOID contract migrates from the founder to a multisig drawn from the registry. The founder will hold no more authority over the protocol than any other holder. The same discipline covers the vouch threshold: the contract lets its owner change it, and the founder commits to leaving it at three. After the transfer, changing the threshold belongs to the holders through the multisig, in public, like everything else.
03 · Stable convention
The hashing convention (keccak256 of the UTF-8 bytes of canonicalize_v1(content)) will not change. Canonicalization normalizes typography and whitespace so the same prose fingerprints identically from any source; verify with the same function you sign with. Any future change is a new version; v1 signatures stay verifiable under v1, forever.
04 · Open source
The Credential contract, the Authorship contract, and the verifier SDK are MIT-licensed. You may read, audit, fork, or run your own deployment without permission.
05 · Not the canonical view
This website is one possible UI. The chain is the canonical view. If we go dormant, shut down, or get acquired by a stranger, every existing credential and every existing signature remains verifiable by anyone with the contract address and a Base RPC.

The honest limits

A Nº binds a wallet, and a wallet is held by a person the field has vetted. One person, one Nº is enforced by the vouching gate and the keeper’s judgment, not by cryptography: no contract can stop a determined person from being vouched in twice. The register’s meaning rests on the quality of its vetting, and we say so plainly rather than pretend the chain proves personhood.

If a Fellow loses their key, nothing can move or revoke the Nº. That is the price of commitment 01 and the soulbound rule, paid in full. The doctrine is succession, not recovery: the Fellow is vouched in again under a new Nº, and a public succession attestation links the two (Nº X superseded by Nº Y). The old entry stays on the register forever, marked superseded; the new Nº carries the person forward. The attestation schema ships with the register’s public EAS schemas, and this doctrine is fixed before ownership transfers at Nº 0050, so no future keeper can improvise it.

§ V · BuildPublic good

Build your own verifier.

You need three things: the contract address, the ABI (extractable from the deployed bytecode via Etherscan, or copied from the open-source repo), and a Base RPC endpoint. That is the full dependency list. We are not in it.

If you build a competing verifier, a citation tool, a browser extension, an attribution layer for an AI assistant — that is good and we encourage it. The credential is not ours to lock behind a UI.

§ VI · The APINo auth · CORS open

A JSON path, for the impatient.

If hitting the chain yourself is overkill for your use case, we serve a small public JSON API that reads from the same contracts. No auth, no rate limits beyond the reasonable, permissive CORS. All endpoints are GET. Designed for AI assistants, citation tools, browser extensions, and humans with curl. If our site goes down, fall back to §III.

GET/api/work/{hash}

Every signature attached to a content hash.

Request

curl https://quire.cx/api/work/0xfae6...ccef

Response

{
  "hash": "0xfae6...ccef",
  "count": 1,
  "signatures": [
    {
      "tokenId": 1,
      "displayId": "Quire Nº 0001",
      "signedAt": "2026-06-21T16:43:35.000Z",
      "signedAtUnix": 1782060215,
      "url": "https://example.com/article",
      "title": "On boring engineering"
    }
  ]
}

GET/api/cto/{n}

Basic info about a holder: wallet, cohort, profile URL.

Request

curl https://quire.cx/api/cto/1

Response

{
  "tokenId": 1,
  "displayId": "Quire Nº 0001",
  "address": "0xf39F...92266",
  "cohort": "founding",
  "profileUrl": "https://quire.cx/1"
}

GET/api/cto/{n}/works

Every work signed by a given Nº, newest first.

Request

curl https://quire.cx/api/cto/1/works

Response

{
  "tokenId": 1,
  "displayId": "Quire Nº 0001",
  "count": 2,
  "works": [
    { "hash": "0xfae6...", "title": "...", "url": "...", "signedAt": "...", "signedAtUnix": ... }
  ]
}

GET/api/recent?limit=N

Latest signatures across all holders. Default limit 20, max 100.

Request

curl https://quire.cx/api/recent?limit=5

Response

{
  "count": 5,
  "signatures": [
    { "tokenId": 1, "displayId": "Quire Nº 0001", "hash": "...", "title": "...", "url": "...", "signedAt": "...", "signedAtUnix": ... }
  ]
}