genesis
The project guarantees that an image was produced by a specific camera body.
Demo
About
Every image sensor carries a permanent, per-body physical fingerprint (PRNU) that imprints on every exposure and cannot exist in an image that never passed through it. We register it and certify origin of the image from the camera body. We first extract a value K thats unique for the camera body. We enrol from the photographer's own files 40+ RAW frames from an archive that already exists, with no manufacturer and no platform involved. The maths behind K: A sensor's photosites differ slightly in how much charge each returns for the same light. That gain error is fixed at manufacture, unique to the die, and it multiplies the signal rather than adding to it. We certify: exposed on camera body X · camera body registered to identity Y · first registered at time T · these derivatives descend from that original. Reference: https://ws2.binghamton.edu/fridrich/Research/full_paper_02.pdf
How it's made
**Imaging core — Python.** `rawpy` (LibRaw) reads Canon CR3 and returns the raw mosaic, split into its four Bayer sublattices, each corrected against its own black level. **Nothing in the fingerprint path demosaics.** Per plane: a wavelet Wiener denoiser (`PyWavelets`, `scipy`) yields the noise residual, a maximum likelihood estimator builds K across 40+ frames, and matching is Peak to Correlation Energy over an FFT cross-correlation. `numpy` throughout. The maths is Fridrich, *Digital Image Forensics Using Sensor Noise*, IEEE SPM 26(2), 2009, cited by equation number in `fingerprint/prnu.py`. **CLI:** `enroll`, `test`, `pair`, `demo`. K stays local as `.npz`; only a SHA-256 commitment leaves the machine. **Contracts — Solidity, Foundry.** `Registry` implements ERC-7053 `commit()` over a camera-body registry: `BodyRecord` carries the fingerprint commitment, owner, ENS node and revocation flag; `ImageRecord` carries pixel hash, perceptual hash, body id, modification level, parent hash and PCE score. Sessions batch as one Merkle root per shoot. **Live on Sepolia**, verified on Etherscan and Blockscout. **ENS — ENSv2 on Sepolia.** `osoro.eth` is the photographer and `cam.osoro.eth` the fleet, both live; a body subname is **created live during the demo**, its resolver records holding the fingerprint commitment, signing key and revocation status. Resolution goes through the **UniversalResolver** — the path a third party takes. A photographer needs no name of their own: `ensNode` may be zero. **The Graph.** The registry has no index on `perceptualHash`, so the subgraph **is** that index — it is what lets a degraded copy find the original it descends from. Live as `genesis` v0.0.4 on real Sepolia events. A Subgraph MCP server exposes the same lookups to agents. **An index is never an authority**: every candidate is read back off chain before anything is claimed. **Chainlink CRE.** The scorer is the trust hole by design — it holds K and you take its word. A confidential workflow removes it: the algorithm is public, K arrives as a Vault DON secret decrypted only inside the enclave, and only a score crosses back. The verifier extracts the residual locally and sends a **256² int8 crop** — **never K**. Three corrections by measurement: the reference is **89 MB** against a **1mb** secret limit, so K is cropped; **512² does not fit**; **Confidential HTTP is not the fallback** (125 kb cap). The cost is documented, not buried — at 256² the weakest frame falls into the null. It runs as a real `cre workflow simulate` per call — about seventeen seconds, deterministic. **`attested` is false**: the simulator is not an enclave and the report is built rather than DON-signed. **Scoring, verify and console.** FastAPI wraps the imaging core. The verify page is one page, no framework, `viem` for chain reads, four verdicts. An eight-screen console drives the demo on localhost and holds the signing key — never deployed.