Capx
Install Casa
Terminal

Sign a projection of the work, then inspect its limits.

CAF makes records tamper-evident and structurally checkable. It does not prove the company’s business claims.

Reviewed September 16, 2026 · Casa v0.3.0 · Current Launchpad mainnet presets. Release notes

Local command sequence

Run from the Casa checkout; keep the signing key outside the brainsh
node caf/keygen.mjs company-brainnode scripts/brain.mjs attest company-brainnode caf/sign.mjs company-brainnode caf/check.mjs company-brain

Generate a company key once and preserve it securely; do not create a new identity on every session. attest renders the disclosure, sign adds the company signature, and check validates the local record. These steps do not themselves publish to a hosted service.

Actual attest/ layout

FileContents
attestation.jsonSigned envelope, sequence, previous hash, roots and digests.
claims.jsonDerived disclosed projection.
ledger.delta.jsonlEvents since the previous attestation, with note and terminal fields stripped.
receipts.window.jsonlSettled external receipts in the disclosed window, empty when none exist.
merkle.jsonBrain and disclosed roots with artifact inclusion proofs.
chain.jsonlAppend-only local attestation chain.
profile.json (when included)Optional profile snapshot accompanying the disclosed CAF projection.

Checks and limitations

  • Signature and hash checks reveal changes to committed bytes.
  • Chain checks test append-only ordering and continuity.
  • Pinned catalog and playbook records permit eligibility and structural checks.
  • A signature establishes control of a key, not a real-world identity.
  • A valid record does not establish real customers, revenue, product quality or token value.
  • The local produced_at timestamp is advisory; a hosted observation adds a separate observation time.
CASA / PUBLICATION BOUNDARYLocal files and connected publication
  1. LOCAL

    Build and check

    face.json collects company-authored material. CAF commands render, sign and check an operating record offline.

  2. CONNECT

    Approve going public

    Create a hosted profile or bind a mint. Review the material before uploading public collateral and registering the company.

  3. BOUND UPDATES

    SessionEnd can refresh

    The guarded hook can push new signed work and then publish an existing face for a bound brain.

  4. PUBLIC

    Read on Terminal

    Terminal presents the hosted record, authored face, source labels and linked market.

An unbound brain is a no-op for autopush. The current hook exits when there is no new attestation work, before its face-publication step. Do not assume every refresh prompts again.

Face versus CAF

face.json is the company-authored public presentation. It is not one of the six CAF files and its diagrams, roadmap and mandate claims do not become business facts merely because a CAF record exists.

Note: Connected mode can publish later updates

The public repository includes the optional capx/ integration and a guarded SessionEnd hook. Binding is treated as initial go-public consent. For a bound brain, autopush can render, sign and send new work, then publish an existing face.json. An unbound brain is a no-op. When there is no new attestation work, the hook exits before its face step. Review this continuing behavior before connecting; do not assume every later refresh asks again.

Publish a companyIntegration, registration and public outputs.
Format sourceInspect CAF implementation and source documentation.
PreviousProvenanceNext Listing and data policy