QUOTA

Demo

About

Bronte pistachios are about 0.25% of world pistachio production. The harvest is biennial and small, roughly 2,000 to 3,000 tonnes per cycle. Yet "Bronte" sells worldwide, all year round, every year. The protected designation was created in the late 1990s specifically to stop counterfeiting of the name. It didn't. In 2021 the Carabinieri seized 650kg being sold as Bronte DOP with nothing behind the claim. That seizure is enforcement working: one shipment, one inspection, one case. What nobody can see is the aggregate. How much product claims this origin at any given moment is not a number anyone can compute, because there is no ledger of DOP claims anywhere. Attestation can't fix this, because anyone can always issue one more certificate. QUOTA inverts the approach: instead of certifying, count. A consortium mints exactly one transferable origin unit per certified gram at harvest, as a Hedera token whose maxSupply is the certified harvest and which has no admin key, no wipe key and no pause key. The cap is enforced by network consensus, not by our code. Units move down the supply chain under KYC-gated transfer. Processing burns nothing: input units are retired and derived units minted against a yield ratio ceiling, so 1,000g of in-shell pistachio can become at most 450g of kernel. Units are retired at consumption into an account whose key is derived from a published, reproducible hash, making retirement final and independently verifiable. Policy lives in ENS. A season subname's expiry is the mint window. There is no timer and no closeSeason function, because the authority to mint simply ceases to exist. The cap and yield ratios are resolver text records the contract reads live. Authority is split three ways, and ENS enforces the split rather than our application logic. The consortium owns the denomination. An independent control body appoints and removes issuers but holds no minting right itself and cannot mint a single gram. Issuers can mint but cannot appoint anyone. The split mirrors EU geographical indication law, where an accredited control body verifies producers precisely so that a consortium cannot certify itself. Nobody ever hands over a key. Four refusals, one law. Minting past the cap is rejected by Hedera consensus. Minting without a minting right is refused before any transaction is sent. The control body, which decides who may mint, is refused when it tries to mint itself. And transforming above the yield ceiling reverts on-chain against a ratio read live from ENS. Prevention where possible, detection where not. An off-chain reconciler compares Hedera mint history against Sepolia anchor events and records any unmatched mint as an on-chain finding, indexed by a subgraph and surfaced in the dashboard. We proved it by minting directly on Hedera, bypassing the system entirely. It was caught. Everything is live on testnet. The README documents all four proofs with a real transaction link for each, states what's real and what's demo-scale, and shows how to verify every claim yourself in about 90 seconds. The interactive demo panel runs locally only, because it holds real signing keys; the video walks through it end to end.

How it's made

Four layers across two chains, because no single chain could do all of it. Hedera holds the asset. HTS tokens with FINITE supply, maxSupply set to the certified harvest in grams, plus KYC, freeze and supply keys, and an immutable custom fee for the consortium levy set at creation. No admin key, so nothing can be changed afterwards. Hedera's Asset Tokenization Studio was the obvious choice and we abandoned it: its published SDK has a broken ESM entry point, is documented as monorepo-only, and ships a critical vulnerability. Using @hashgraph/sdk directly turned out better, because the cap became a protocol-level property rather than something we wrote and hoped was correct. Ethereum Sepolia holds QuotaAnchor, a minimal event-and-authorization contract that reads the cap and yield ratios live from ENS resolver text records and checks an EAC role before recording anything. Verified on Etherscan, Blockscout and Sourcify. ENS v2 is the policy layer, not decoration. Season subname expiry is the mint window. Text records are the canonical cap and yield ratios. EAC roles are the delegation mechanism, and they split authority three ways: a control body holds admin rights and can appoint or remove issuers without ever holding a minting right itself. Participant subnames are non-transferable, achieved simply by not granting ROLE_CAN_TRANSFER_ADMIN, which we confirmed by reading the verified registry source rather than guessing. The Graph makes it queryable, with one shared schema across multiple consortia and the same query working for any of them by changing only the consortium id. The genuinely hacky part is the bridge. Subgraph mappings are deterministic sandboxed WASM and cannot call REST, so they can't reach Hedera's mirror node. Reconciliation therefore happens off-chain: a script pulls full mint history from the mirror node, compares it against the full anchor-event history across every contract address this project has ever deployed to, and records unmatched mints as new Sepolia events the subgraph then indexes. The reconciler is the detector; the subgraph makes its findings queryable. We say so explicitly rather than implying the subgraph does something it structurally can't. What we'd most like read is the design history, because almost every decision here was forced by a measurement rather than assumed, and the rejected alternatives are documented with the status codes that killed them. Burning reopens mint headroom, since maxSupply caps circulating supply rather than lifetime issuance, so we retire instead of burn. Freeze is bidirectional and leaves retirement reversible until frozen, so we don't use it for finality. Hedera validates key satisfiability on both create and update, so a genuinely unspendable account is impossible. An empty KeyList returns KEY_REQUIRED, an impossible threshold returns INVALID_ADMIN_KEY. A discarded key was rejected on principle, not evidence, because "we deleted it" is unverifiable. A key derived from a published hash is worse cryptographically and better epistemically, since anyone can reproduce and check it. Auto-association can't bootstrap a KYC-gated token, since KYC requires prior association and association requires a signature. ENS role expiry works by version-shifting rather than an expiry branch. An empirical result contradicted our own source reading, and re-reading found the real mechanism. Admin-tier role bits cannot be granted through ordinary grantRoles at all, because the bit-shift overflows uint256. The only route is register()'s extraRoleBitmap, which grants to exactly one address at registration, so rotating an admin requires unregister and re-register. A final self-audit found the README claiming a full-history retirement-outflow reconciler that was never built. Only an opportunistic tripwire exists. We fixed the documentation rather than quietly building the component, and the asymmetry is now stated plainly. One more, found while assembling the evidence. Our cap-failure script never logged its own transaction ID, because submit was declared inside the try block and was out of scope in the catch. The transaction existed regardless, since Hedera recorded the failure whether or not we printed it, so we paged the mirror node's full mint history for the treasury account, found the single non-SUCCESS result among forty, and opened it on HashScan to confirm the page itself reads TOKEN_MAX_SUPPLY_REACHED before linking it. All four refusals are now independently checkable by someone who runs nothing.