ETHOnline 2026 · the first reference implementation of Catenor Protocol

Possession ≠
current eligibility.

Tokenized assets prove who holds them. Catenor proves who may be paid today.

Replay the demo Run history & evidence
One DID. Every door. One identity, and only the doors its current authority opens. Decorative loop (AI-generated footage with titles). Not demo evidence; the evidence is one click away.
24/24demo stages verified ok
5executions of the deployed Chainlink CRE Confidential Workflow
6Hedera testnet transactions, all SUCCESS
0signature requests for the ineligible investor
The thesis

Entitled isn’t eligible.

  1. 0of 4 HBAR
    Bart is entitled to 4 HBAR, and is paid 0. He still holds his 400 units and a valid credential. He was sanctioned after he invested; no transaction was built for him and no signature was requested.
  2. 6HBAR
    Lisa is paid 6. One payout on Hedera testnet, signed by a Privy wallet that can pay only Lisa or Bart, up to 20 HBAR.
  3. TEE
    Decided inside a TEE, from today’s evidence. The deployed Chainlink Confidential Workflow re-read the current Sumsub sandbox review in its enclave and planned PAY 6 / HOLD 4. Only decisions, facts and commitments leave the enclave.
See the TEE decision Walk through the whole run
The stack

Four technologies.
One job each.

Catenor

Identity and scoped authority.

Every actor has its own did:catenor; a wallet is only an account bound to it. Every action needs explicit, scoped authority, and delegation never exceeds the delegator.

Chainlink CRE

Confidential, current eligibility.

A deployed Confidential Workflow reads today’s identity evidence inside a TEE and decides. Only facts, decisions and commitments leave the enclave.

Privy

Which key can sign what.
  • Signature wallets: messages only, never money.
  • SPV wallet: the ATS Factory and its own equity.
  • Agent wallet: only Lisa or Bart, ≤ 20 HBAR.
  • Investor wallets: receive-only.

Hedera ATS

The asset lifecycle, verifiable by anyone.

Asset Tokenization Studio on testnet: deploy the equity, issue 600 + 400 units, set the dividend, pay out. Six transactions, each on HashScan.

Wallets are accounts.Credentials are claims.Authority is scoped.Identity persists.
Videos

Watch the run.

Both are narrated in the maintainer’s own voice, with no speed-up. The players load from YouTube only when you press play.

Demo 3:32

Watch on YouTube ↗

The replay console, narrated: the whole run in ten steps, from the Trust Domain to Bart’s HOLD.

Technical walkthrough 3:25

Watch on YouTube ↗

The real terminals and dashboards behind the run, and the prompts behind the build.

Verify it yourself

Don’t trust the page.
Check each system.

Every number here comes from the recorded run c1-202609121659. The evidence page has one tab per system, with IDs, screenshots and live on-chain checks.

Chainlink CRE 5 executions of the deployed Confidential Workflow, all SUCCESS: workflow and execution IDs, dashboards, the Vault DON secrets. CRE evidence › Privy Every wallet with its exact Privy policy JSON, and 0 signature requests for the investor on hold. Privy evidence › Hedera ATS 6 testnet transactions with HashScan links, plus a Mirror Node check you can run from your browser. Hedera evidence › Catenor The audit hash chain (79 events, valid), the Trust Anchor and the authority chains, re-verified. Catenor evidence ›
Code & runbook
luizoamorim/catenor-one

The implementation, the numbered clean-room scripts and the evidence per sponsor.
Protocol
luizoamorim/catenor

Catenor Protocol Draft v0.1, the specification Catenor One implements.
Protocol site
catenor.xyz

Identity, credentials, authority and policy, explained.

No credentials needed to re-read the Hedera side: scripts/demo/91-verify-hedera.sh uses only the public JSON-RPC relay and the Mirror Node.