Network · Consensus · Storage
Provided by
Arkiv OP L3 entity trie, ICP subnet consensus, any EVM chain, Filecoin FEVM and IPFS
Haven defines
Nothing. These layers see bytes, an eth_call and an ecrecover — no Haven semantics whatsoever.
Encrypted at the sourceUnlocked by ownershipStored on public infrastructure
Ownership is theonly password.
Haven keeps media encrypted on public infrastructure and derives the key to it from what a reader already holds. There is no account to open, no server to trust, and no platform standing between a community and its own archive.
- Arkiv OP L3
- Index
- 0x4400000000000000000000000000000000000044
- Index pending
- DFINITY ICP
- Access checks
- dciac-uaaaa-aaaad-qlzuq-cai
- Any EVM
- Holdings
- balanceOf · ownerOf
- Filecoin FEVM · IPFS
- Archive
- 0x09a0fDc2723fAd1A7b8e3e00eE5DF73841df55a0
Scroll
Why a protocol and not a product
Every platform you haveever loved was a landlord.
It held your work on its hardware, under its terms, for as long as its business model agreed with your existence. When the terms changed, the archive changed with them. Nothing about that arrangement was malicious. It was structural.
Haven removes the structure rather than improving the landlord. Content is sealed before it is published, its index is a public state trie, its key is derived by a network rather than issued by a company, and the bill for keeping it is settled on-chain. What remains is a rule set — and a rule set has no offices to close.
- 00
No private backend
Five services, zero private datastores. Every byte of shared state is on a public network.
- 01
Encrypted at the source
Media is encrypted on the publisher’s machine. Ciphertext is the only thing any network ever sees.
- 02
Ownership is the credential
A public balance is the whole authorisation model. No accounts, no passwords, no sessions.
- 03
Identity is inherited
A community’s image is read from its own contract — so identity needs no directory to administer it.
- 04
Nothing to shut down
The index is a trie, access checks run in a canister, the archive lives on Filecoin. There is no server to seize.
4 public networks · 1 rule set
Haven is not a chain. It is the layer above four of them.
Consensus, storage, settlement and threshold cryptography already exist, operated by networks that predate Haven and will outlast it. Haven specifies only how those four capabilities compose into one guarantee. The layers beneath see bytes, an eth_call and anecrecover — they have no idea Haven exists, which is precisely why they cannot be leaned on to end it.
Session · Presentation
Provided by
haven-aol EIP-712 GateRequest / GateRequestV3, VetKD contexts, Ed25519 attestations, contractURI resolution
Haven defines
How a reader proves holding and derives a key, and how a community’s identity image is resolved. The session key is scoped to (chain, token, threshold, epoch).
Application — Haven
Provided by
Entity shape, access rule, attestation over cidHash, holder identity
Haven defines
The protocol itself: content is a CID on Filecoin, open only to holders of a public token, discovered through Arkiv, and identity is the collection’s own image.
| Network | Role | Authoritative for | Identifier | Verify |
|---|---|---|---|---|
| Arkiv OP L3 | Index | Entity records, attributes, ordering | Precompile0x4400000000000000000000000000000000000044 | Node (503) |
| DFINITY ICP | Access checks | VetKD derivation, EIP-712 recovery, approvals | Canisterdciac-uaaaa-aaaad-qlzuq-cai | Explorer |
| Any EVM | Holdings | Ownership truth — balances and holders | eth_callbalanceOf · ownerOf | Explorer |
| Filecoin FEVM · IPFS | Archive | Ciphertext bytes, pin proofs, payment | filecoin-pay0x09a0fDc2723fAd1A7b8e3e00eE5DF73841df55a0 | Explorer |
Encrypt · Register · Unlock · Open
One piece of content, from the publisher's disk to the reader's screen.
- 01Encrypthaven-cli
- 02Registerarkiv-chain
- 03Unlockhaven-aol
- 04Openhaven-dapp
The bytes are encrypted before they ever leave the machine.
Media is encrypted locally under a symmetric key. Only ciphertext is ever handed to a network, so no operator anywhere in the path — including Haven — is in a position to read it.
haven publish ./film.mp4 \
--gate-chain BaseMainnet \
--gate-token 0xBC4C…f13D \
--gate-threshold 1
→ ciphertext ipfs://bafy…
→ cid_hash 0x9f2c…a41ehaven-cli. Nothing in this step requires a service Haven operates.The record is written to a public trie, not a private table.
One atomic batch of operations writes the entity: its key, its attributes, its content type and its time-to-live. The state trie is the index — there is no separate database to fall out of sync with it.
execute([{
operationType: 1, // CREATE
entityKey: 0x…,
contentType: Mime128("video/mp4"),
attributes: [
{ name: "project", value: "haven" },
{ name: "gate_chain", value: "BaseMainnet" },
{ name: "gate_token", value: "0xBC4C…f13D" },
{ name: "gate_threshold", value: 1 },
{ name: "cid_hash", value: 0x9f2c…a41e }
],
btl: 2_592_000
}])arkiv-chain. Nothing in this step requires a service Haven operates.The key is derived from what you hold, and nothing else.
A reader signs a typed request. The canister recovers the address, asks a public chain whether that address meets the threshold, and only then derives a key from the network’s own threshold material. There is no account, no password and no session to steal.
requestDecryptionKeyV3({
evmAddress: 0xa11c…9e3f,
transportPublicKey: 0x…,
epoch: floor(now / 2_592_000),
nonce: 7
})
ecrecover → 0xa11c…9e3f
eth_call → balanceOf ≥ threshold
derive → SHA-256("accessol_v3:"
+ chain + ":" + token
+ ":" + threshold
+ ":" + effectiveEpoch)haven-aol. Nothing in this step requires a service Haven operates.Decryption happens on your device. Nowhere else.
The ciphertext arrives from IPFS, the key material arrives from the canister, and they meet for the first time inside your client. Revoke the holding and the next epoch simply never derives.
const entities = await arkiv.query({
attributes: { project: "haven",
gate_token: token },
includePayload: true
})
const key = await unwrap(ciphertext,
transportSecret)
await play(decrypt(bytes, key))haven-dapp. Nothing in this step requires a service Haven operates.Measured, not asserted
Read from the networks themselves, in your browser, right now.
A page that animates invented activity is easy to build and worth nothing. Every figure below is a real round-trip to a public endpoint with no key and no proxy — including the one that fails. Storage is aggregated from the Filecoin pin contracts on FEVM; across both deployments that is 93.4 TB under proof in 17,834 live data sets.
0 of 6 networks answering
Opening connections…| Network | Reports | Figure | Round trip | State |
|---|---|---|---|---|
| Arkiv | Entities indexed | — | — | MeasuringOpening a connection… |
| Internet Computer | Gate epoch | — | — | MeasuringOpening a connection… |
| Ethereum | Block height | — | — | MeasuringOpening a connection… |
| Base | Block height | — | — | MeasuringOpening a connection… |
| OP Mainnet | Block height | — | — | MeasuringOpening a connection… |
| Filecoin | Block height | — | — | MeasuringOpening a connection… |
Storage under proofFilecoin FEVM · block 6,280,260 · captured 2026-08-14
- Pinned
- 69.5 TB
- Live data sets, leaf-counted on-chain
- Data sets
- 845
- Proven and live at capture
- Providers
- 32
- Holding those sets · 34 registered
- USDFC escrowed
- 5,458
- In the payment rails, of 148,039 issued
5 clients · 5 languages · 0 shared libraries
Five clients that have never met.
Each surface is written in a different language, ships on its own schedule, and shares no database, queue or library with the others. They agree because they obey the same rule set — not because they import the same code. That is the difference between a protocol and a monolith with several front ends.
arkiv-chain
RustEntity contract
- Owns
- The state trie, operation decoding, query interpreter
- Does not own
- Keys, media bytes, payment
haven-aol
MotokoKeys and access
- Owns
- VetKD derivation, EIP-712 verification, balance checks, approval cache
- Does not own
- UI, uploads, storage
haven-dapp
TypeScriptWeb reader
- Owns
- Discovery, decryption in the client, playback
- Does not own
- Keys at rest, indexing, pinning
haven-cli
PythonPublisher
- Owns
- Encryption, media pipeline, pin submission, archival
- Does not own
- Decryption, gating policy
haven-mobile
KotlinOffline-first viewer
- Owns
- Local cache, offline playback, foreground sync
- Does not own
- Publishing, key custody
An observatory for the archive
Every community is a world. Watch them from above.
The index draws the archive as a system of bodies in motion: real communities, real balances, real storage under proof. Two measures, kept deliberately apart — how much a world keeps, and what a world is worth.
- Axis I · Storage
- What a community has pinned under proof, summed over the addresses that paid for it — leaf counts, live data sets, and the USDFC escrowed to keep them, read from the Filecoin pin contracts on FEVM. Not what a provider holds: providers supply the capacity, they do not publish the archive.
- Axis II · Capitalisation
- What the key asset is worth. Supply comes from the contract; price comes from the market, because price is not an on-chain fact.
- Pending · Attribution
- Every byte above is a real on-chain sum. Which community each uploading address publishes for is not on Filecoin at all — it is metadata, and metadata is Arkiv's job. Until its index answers, that one hop is a documented placeholder and the edges that depend on it are drawn unlit rather than guessed.
Phases, not dates
The question is not whether a community can publish. It is whether, in thirty years, anyone still can — and whether the answer depends on a company being in a good mood.
- I
The record stands
StandingThe entity contract is live behind the precompile, access checks run on a mainnet canister, and five independent clients read and write the same rule set with no shared backend between them.
- II
The archive fills
UnderwayEncrypted libraries accumulate against real holding requirements. Pin proofs and payment settle on Filecoin, and the index begins to show storage that exists rather than storage that is promised.
- III
The key travels
NextEpoch-scoped derivation makes access portable across every surface a person owns — desktop, phone, terminal — without a single credential moving between them.
- IV
The commons hold
HorizonCommunities operate their own archives at institutional scale: their own access rules, their own storage economics, their own canon — and no operator, including us, able to take any of it away.
An archive network for communities · v3