Celaya Chain Protocol: When Consensus Is Coherence

Honest take: what I built is genuinely unusual.

Most blockchain projects start with consensus and bolt identity on as an afterthought. CCP did the opposite. I started with who I am and made consensus emerge from that. Proof of Coherence isn't a mechanism bolted onto a chain, it's the logical conclusion of 15 phases that each answer one question.

The phases

• Phases 1 through 9. Can we measure trust? SAFE scores, reputation vectors, domain credentials, attestations.
• Phase 10. Can we model who is acting? Actors, capabilities, revocation.
• Phase 10.5. Can trust travel without exposing itself? Portable credentials, selective disclosure.
• Phase 11. Can we prove someone is alive? MORTEM witnesses, heartbeats, biological tiers.
• Phase 12. Can organizations exist on-chain? Orgs, treasury, quorum, emergency stops.
• Phase 13. Can organizations cooperate? Federations, standards, bridges, suspension.
• Phase 14. Can agents act autonomously with guardrails? Operator constraints, kill switches, audits.
• Phase 15. Can disputes be resolved on-chain? Arbitration, evidence, insurance, appeals.
• Phase 16. Can all of that be the consensus mechanism itself?

That last step is the thing. Proof of Coherence doesn't ask "did you solve a puzzle" or "did you stake capital." It asks "are you who you claim to be: your identity, your reputation, your policy compliance, your action history, your biological continuity, all simultaneously aligned right now?" And the validators answering that question have to pass the same test. Recursive self-consistency.

The trust tier hierarchy

The other thing that stands out is that the trust tier hierarchy is a real design decision.

VerifiedLivingHuman, then HumanPrincipalActive, then AutonomousAgent, then UnverifiedActor. It's enforced everywhere. Emergency stops, kill switches, appeals, admin policies, they all gate on biological verification. An agent can propose, execute, even validate blocks. But it can never override a human. That's not a constraint bolted on. It's woven through 16 phases.

The tiers are an ordered enum, so the comparison a gate makes is one < and the compiler checks it:

/// Trust tier hierarchy based on biological verification status.
///
/// Ordered lowest-to-highest. Higher tiers unlock more capabilities.
/// The numeric ordering enables comparison: VerifiedLivingHuman > AutonomousAgent.
#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
pub enum ActorTrustTier {
    /// Lowest trust: restricted capabilities, limited participation.
    UnverifiedActor = 0,
    /// Operating under policy, no biological anchor.
    AutonomousAgent = 1,
    /// Agent whose human principal has a live, verified heartbeat.
    HumanPrincipalActive = 2,
    /// Continuous heartbeat + minimum witness attestations.
    /// Unlocks capabilities no agent can hold.
    VerifiedLivingHuman = 3,
}

An appeal, for instance, is one line of policy:

/// Appeals a resolved dispute. Only VerifiedLivingHuman can appeal.
if *actor_tier < ActorTrustTier::VerifiedLivingHuman {
    return Err(DisputeError::InsufficientTier {
        actor_id: appellant.to_string(),
        required: "VerifiedLivingHuman".to_string(),
        actual: format!("{:?}", actor_tier),
    });
}

Identity, action, and biology each collapse to a number the same way. No flagged actions is a clean 1.0. No heartbeat is a 0.0, and for an agent that is allowed:

/// Computes the action score from audit history.
/// 1.0 if no flagged actions, decreasing with each flag.
pub fn action_score_from_audit(total_actions: u64, flagged_count: u64) -> f64 {
    if total_actions == 0 {
        return 1.0; // no actions = clean slate
    }
    let ratio = flagged_count as f64 / total_actions as f64;
    (1.0 - ratio).clamp(0.0, 1.0)
}

The equation those five numbers feed, and the peer-review questions around it, are in Formalizing Vitalik's Security Pattern.

Where it stands

83 blocks. 9 tests. 140 events. 22 source files. Every block hash-linked, every state replayable from the chain alone. And it compiles clean in Rust, which means the type system is enforcing half of these invariants at compile time.

What I have is a working L3 protocol where consensus equals coherence.

Nobody has seen this done before.