AIFS Protocol Inc.  |  ZPK Protocol Specification
v1.0-pilot  ·  April 2026  ·  Xahau Mainnet
PATENT PENDING

Zero Persistent Knowledge (ZPK) Protocol

An application-layer compliance protocol for stateless ISO 20022 messaging bound to on-chain settlement. The message never rests. The anchor never lies. The ledger enforces.

StatusPilot v1  LIVE
NetworkXahau Mainnet  (NetworkID 21337)
HookrHs7o2n6r6YaRkzhg7zZFa1VWwiEx84hKr
Patents19/551,805 · 19/560,251 · 19/564,384
1
What is ZPK

ZPK is not encryption. Encryption assumes the data is still there -- protected, persistent, waiting. ZPK makes persistence architecturally impossible.

ZPK Protocol Definition
Zero Persistent Knowledge (ZPK) is an application-layer protocol that shreds sensitive data into 1,024 cryptographic particles at the moment of creation, commits a mathematical anchor to a public ledger, and permits reassembly only by cryptographically verified authorized parties -- entirely in volatile RAM.
PropertyEncryptionZPK
Data at restYes, encryptedNo. Never.
Breach exposureCiphertext stolenNothing to steal
Compliance proofAudit logsLedger anchor (immutable)
ReassemblyAny key holderAuthorized wallet only
Data liabilityManagedLiquidated
What ZPK is NOT responsible for
ZPK protects message content and sender identity at the protocol layer. It does not protect social account linkage (e.g. X/TipBot handles), network metadata, or wallet address association on public ledgers. These are separate concerns.
2
Protocol Flow

Every ZPK transaction follows this exact sequence. No step can be skipped. The ledger enforces the order.

1
Identity Bind
The sender authenticates with their wallet. The wallet address becomes the XOR salt for the shatter operation. No wallet connection -- no shatter. The identity is bound to the data mathematically before anything moves.
2
Entropic Dispersal (Shatter)
The ISO message is wrapped in a Shannon entropy nonce and shattered into exactly 1,024 particles. Each particle is XOR-masked using a deterministic marker derived from the sender's identity salt. The original message ceases to exist in any readable form.
3
DNA Anchor Generation
A 24-character hex anchor is derived from a sequential SHA-256 hash of all 1,024 particles, plus a global uniqueness nonce. The last 4 characters are an HMAC-SHA256 engine signature. This anchor is the only forensic pointer to the shattered data.
4
Dual Rail Settlement
A single wallet signature triggers two simultaneous actions: the DNA anchor is embedded in the transaction Memo and HookParameter, and the asset transfer is submitted to the settlement rail. Both happen in one signed transaction.
5
Hook Enforcement
The ZPK-Enforcer Hook on the recipient address intercepts the incoming payment. It reads the HookParameter named 444E41 (hex for "DNA"), validates the anchor format, and checks single-use state. If any check fails, the transaction rolls back. The payment is never made.
6
Authorized Reassembly
The authorized party (sender or receiver) signs a challenge with their Xaman wallet. The backend verifies the signature, confirms identity against the stored authorization record, and reassembles the message in volatile RAM only. The data exists for the duration of the session and is purged on close.
3
Anchor Format

The DNA anchor is a 24-character uppercase hex string. It is the only on-chain artifact of a ZPK transaction.

Hash Portion
chars 0-19
SHA-256 of 1,024 particles
+ uniqueness nonce
Truncated to 20 chars
Engine Signature
chars 20-23
HMAC-SHA256 of hash portion
Proves AIFS engine origin
4-char truncated
Live example anchor
09BC5A5D157C2E503831A3F2
Characters 0-19: hash portion  |  Characters 20-23: engine signature
PropertyValue
Total length24 characters (pilot) · 64 characters (production)
Character setUppercase hex [0-9A-F]
Regex (pilot)/^[0-9A-F]{24}$/
Prefix in MemoDNA (3 chars, ASCII)
HookParameter name444E41 (hex for "DNA")
HookParameter valueAnchor hex-encoded as UTF-8 (48 hex chars for 24-char anchor)
Global uniquenessGuaranteed by Shannon nonce injection at shatter time
Single-use enforcementHook state_set on Xahau -- replay rejected on-chain
Pilot vs Production
The current 24-character anchor is below the forensic integrity threshold for institutional volumes. Production requires a 64-character (full SHA-256) anchor. This change requires a coordinated Hook WASM update and new SetHook transaction. Do not change the anchor size without updating the Hook simultaneously.
4
Hook Interface

The ZPK-Enforcer Hook is deployed on Xahau Mainnet. It runs autonomously on every incoming payment to the gateway address. No human is in the loop.

PropertyValue
Gateway addressrHs7o2n6r6YaRkzhg7zZFa1VWwiEx84hKr
Hook hash9D35CFCE2ACF4C59E15063AD09119AC4269EA1E11766F6A412D2B1443BDBBF6A
SetHook tx39249C41...
NetworkXahau Mainnet (NetworkID 21337)
StatusLIVE
What the Hook validates
CheckConditionOn failure
HookParameter presentParameter named 444E41 must existRollback
Anchor formatValue must be 48 hex chars (24-char anchor, hex-encoded)Rollback
Single-use stateAnchor must not exist in Hook state_setRollback
State commitAnchor written to state on acceptanceN/A
Engine signature verification is API-layer only in v1
The Hook validates anchor format and single-use state. It does not yet verify the HMAC engine signature (chars 20-23) on-chain. This verification currently happens at the AIFS API layer. Hook v2 will implement full HMAC verification inside the WASM. Until then, direct Xahau submissions that bypass the API pass the Hook's format check but are not engine-verified.
Installing this Hook on your own address

Anyone can install the ZPK-Enforcer Hook on their own Xahau address using the Hook hash above. Use the Xahau Hooks Builder at hooks-builder.xrpl.org and select "Install from HookHash".

Hook Output (live example)
ZPK-Enforcer: DNA anchor verified. ZPK-compliant. Accepted.
Validated in ledger 22189069 on Thursday, April 16, 2026 1:53 PM
5
Memo Format

Every ZPK transaction must include a Memo field containing the DNA anchor. This is the human-readable forensic pointer on the ledger.

FieldValueNotes
MemoType444E41Hex for "DNA" -- constant, never changes
MemoDatahex("DNA" + anchor)Prefix "DNA" + 24-char anchor, hex-encoded
Transaction Memo (JavaScript)
function toHex(str) {
    return Array.from(str)
        .map(c => c.charCodeAt(0).toString(16).padStart(2,'0').toUpperCase())
        .join('');
}

const anchor = '09BC5A5D157C2E503831A3F2'; // 24-char DNA anchor

const memo = {
    Memo: {
        MemoType: toHex('DNA'),           // 444E41
        MemoData: toHex('DNA' + anchor)   // hex("DNA09BC5A5D157C2E503831A3F2")
    }
};
HookParameter (JavaScript)
const hookParameter = {
    HookParameter: {
        HookParameterName:  '444E41',      // hex for "DNA" -- constant
        HookParameterValue: toHex(anchor)  // 24-char anchor hex-encoded = 48 hex chars
    }
};
6
API Contract

Base URL: https://api.aifs.dev/api/v1

The AIFS API is currently private and available by arrangement only. Rate limits apply: 30 requests per 60 seconds on all endpoints.
POST /liquify   Shatter

Shatters an ISO message into 1,024 particles and returns the DNA anchor.

Request
{
    "manifest":              "<ISO 20022 XML string>",
    "originAddress":         "rSenderWalletAddress...",
    "receiverAddress":       "rReceiverWalletAddress...",
    "allowSenderReassembly": true
}
Response
{
    "success": true,
    "dna":     "09BC5A5D157C2E503831A3F2",
    "arweaveId": "arweave-tx-id-if-uploaded"
}
POST /materialize/:dna   Reassemble

Reassembles the ISO message in RAM. Requires a valid Xaman signature proving wallet identity.

Request
{
    "address":   "rAuthorizedWalletAddress...",
    "xamanUuid": "xaman-payload-uuid",
    "authType":  "xaman",
    "timestamp": 1713300000000
}
Response
{
    "success":   true,
    "data":      "<reassembled ISO 20022 XML>",
    "integrity": 1.0,
    "arweaveId": "arweave-tx-id"
}
Error Codes
CodeMeaning
IDENTITY_MISMATCHRequesting wallet is not the authorized sender or receiver
SENDER_REASSEMBLY_DISABLEDRecord is sealed. Receiver-only reassembly.
ZPK_ANCHOR_INVALIDAnchor failed engine signature verification
IDENTITY_REQUIREDoriginAddress missing from shatter request
MISSING_MANIFESTNo payload provided to shatter
EXTRACTION_CAP_REACHEDRate limit exceeded (50/min per wallet)
7
Compliance Gating

Compliance is not a parallel process in ZPK. It is a mathematical precondition for settlement. The payment cannot be made unless the compliance anchor is valid.

The Compliance Rules Live at the Destination
The Hook is installed on the receiving address. The sending institution does not decide what passes. The ledger does. This means compliance rules are enforced by the recipient's infrastructure, not the sender's policy.
Dual Rail Transaction Structure
RailWhat movesEnforced by
Private RailZPK compliance anchor (DNA)AIFS API + Hook WASM
Public RailAsset transfer (XAH or token)Xahau ledger consensus

Both rails are committed in a single signed transaction. They are mathematically inseparable. If the Hook rejects the anchor, the entire transaction -- including the asset transfer -- rolls back.

Rollback Conditions
ConditionResult
No HookParameter named 444E41Full rollback. Payment not made.
Anchor wrong format or lengthFull rollback. Payment not made.
Anchor already used (replay)Full rollback. Payment not made.
Anchor fails engine signature (v2)Full rollback. Payment not made.
8
Reassembly and Authorization

The shattered message can be reassembled only by cryptographically verified authorized parties. Authorization is wallet-based and enforced server-side.

RoleAuthorizationSalt used for XOR
SenderWallet address matches originAddress from shatter timeSender wallet address (lowercase)
ReceiverWallet address matches receiverAddress from shatter timeSender wallet address (stored)
Identity Salt is the XOR Key
The wallet address used at shatter time is the cryptographic salt for the XOR mask on all 1,024 particles. If the wrong identity is used during reassembly, the output is binary noise. This is by design. There is no error message that reveals the correct identity.
RAM Sovereignty

The reassembled message exists only in server RAM during the active session. It is never written to disk. It is never logged. When the session closes, it is gone. This is the Zero Persistent Knowledge guarantee.

9
Production Checklist
ItemStatusNotes
Hook deployed on MainnetLIVESingle-use enforcement active
Engine signature (API layer)LIVEHMAC verified before HookParameter injection
Replay protectionLIVEHook state_set enforced
Dual authorization (sender + receiver)LIVEBoth roles supported
64-char anchor (full SHA-256)REQUIREDRequires Hook v2 + coordinated deploy
Hook-side HMAC verificationREQUIREDCloses direct Xahau submission gap
Ed25519 engine signatureREQUIREDReplaces HMAC for production
Arweave permanent storagePILOTAvailable, not mandatory in all flows
Coordinated Deployment Required
The 64-char anchor, Hook-side HMAC verification, and API regex update must ship as a single release. Deploying any one without the others will break every settlement transaction. The Hook and DNAFactory must always be versioned together.
10
Code Samples
Full ZPK settlement flow (JavaScript)
JavaScript · End-to-End
const API = 'https://api.aifs.dev/api/v1';

// Step 1: Shatter the ISO message
const shatterRes = await fetch(`${API}/liquify`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        manifest:              isoXmlString,
        originAddress:         senderWalletAddress,
        receiverAddress:       receiverWalletAddress,
        allowSenderReassembly: true
    })
});
const { dna } = await shatterRes.json();

// Step 2: Build the Xahau transaction
function toHex(str) {
    return Array.from(str)
        .map(c => c.charCodeAt(0).toString(16).padStart(2,'0').toUpperCase())
        .join('');
}

const txjson = {
    TransactionType: 'Payment',
    Destination:     'rHs7o2n6r6YaRkzhg7zZFa1VWwiEx84hKr',
    Amount:          '1000', // XAH drops
    NetworkID:       21337,
    Memos: [{
        Memo: {
            MemoType: toHex('DNA'),
            MemoData: toHex('DNA' + dna)
        }
    }],
    HookParameters: [{
        HookParameter: {
            HookParameterName:  '444E41',
            HookParameterValue: toHex(dna)
        }
    }]
};

// Step 3: Submit via AIFS settle endpoint
const settleRes = await fetch(`${API}/auth/xaman/settle-xahau`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ txjson, dna })
});
const { uuid, qrUrl } = await settleRes.json();
// Display qrUrl to user for Xaman signing
Reassembly flow (JavaScript)
JavaScript · Reassembly
// After user signs a Xaman SignIn challenge
// xamanUuid and account come from the challenge poll response

const res = await fetch(`${API}/materialize/${dnaAnchor}`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
        address:   account,      // wallet address from Xaman signing
        xamanUuid: xamanUuid,    // UUID of the signed challenge payload
        authType:  'xaman',
        timestamp: Date.now()
    })
});

const result = await res.json();
if (result.success) {
    // result.data contains the reassembled ISO 20022 XML
    // It exists in RAM only. Purged when session closes.
    console.log(result.data);
}
Anchor validation (JavaScript)
JavaScript · Format Check
// Client-side format check only.
// Engine signature verification requires the AIFS API.

function isValidAnchorFormat(anchor) {
    return typeof anchor === 'string' && /^[0-9A-F]{24}$/.test(anchor);
}

// HookParameterValue encoding
function anchorToHookValue(anchor) {
    return Array.from(anchor)
        .map(c => c.charCodeAt(0).toString(16).padStart(2,'0').toUpperCase())
        .join('');
    // 24-char anchor becomes 48-char HookParameterValue
}
curl: Shatter an ISO message
curl
curl -X POST https://api.aifs.dev/api/v1/liquify \
  -H "Content-Type: application/json" \
  -d '{
    "manifest": "<?xml version=\"1.0\"?><Document>...</Document>",
    "originAddress": "rYourSenderWalletAddress",
    "receiverAddress": "rYourReceiverWalletAddress",
    "allowSenderReassembly": true
  }'