How it works
The phone goes about ordinary life and hears over Bluetooth what is around it: other phones, cars, access points. Out of that accumulates a trace of physical life no one can reproduce: who was near, and for how long. The trace is signed by a key that cannot leave the phone's secure chip; what accumulates is compressed into a fingerprint and anchored on-chain. The key together with the trace is the passport, and it stays on the phone: what goes out is a verifiable attestation of its properties and of the permissions granted to the agent.
Mutual signatures
When two phones on the network come near each other, the encounter is signed by both sides, and each signature attests not only the encounter itself but the state of the other phone's trace. The trace does not merely accumulate, it sets: rewriting the past would mean collecting again the signatures of every phone you have met.
Sybil resistance
Online signals — address, browser fingerprint, behavior — can be bought. A physical history cannot: devices that travel together and see the same things produce nearly identical traces, and the cluster reads as a single participant. Separating the traces means separating the lives. Multiplying agents does not help either: they all point at one trace, and to a service that is one customer.
Hardware attestation
The key is P-256 in Secure Enclave on iOS and StrongBox on Android, attested through a certificate chain to an Apple or Google root: an emulator, a virtual machine and a cloud phone cannot produce it.
Each encounter is signed by both parties and carries a fingerprint of the observable radio environment from each side; relay it between cities and the fingerprints diverge. Epochs collapse into commitments; commitments are batched into a Merkle root; only the timestamp goes on-chain, using EAS for the attestation schema.
Delegation
The phone is the only authenticator. A laptop or a server acts as a client through the same flow as cross-device passkeys: a QR code on the client, approval on the phone, after which the client holds its own session key with a scope and an expiry.
What we know
For a year we built Proof of Humanity on breathing and collected one of the largest longitudinal datasets of breathing audio. The result was negative: within-person variability equals between-person variability — breathing cannot reliably tell people apart. Everyone building proof of humanity on the iris, the palm or the face is making the same mistake: they prove who is in front of you. What must be proven is not who, but that a life happened.