Post-quantum artifact attestation (ML-DSA-65, chain-head pinned)

Overview

Bind a build to its identity with a post-quantum signature: POST {name, version, digest} and get an ML-DSA-65 manifest (FIPS 204, alg 4099/0x1003 — the current Animica L1 signature scheme) committing that name+version+digest+timestamp. Buy it after building, training or repackaging something you may later have to prove you published — an image, a wheel, a model checkpoint — or before installing one, so two attestations claiming one name+version with different digests visibly contradict. That question is not answerable from a bare digest signature, which is why this is a separate product from /x402/pq/sign. The manifest also records the Animica chain head read just before signing — or, if the node could not be reached, records that absence and its reason, inside the signature either way, so a missing pin can never be mistaken for one that was never asked for. That pin is the part nobody can move: a block hash cannot be known before its block exists, so the manifest was signed at or AFTER that height, a bound we cannot inflate and anyone can re-check on any Animica node. Nothing is written to the chain. The artifact bytes never leave your side: you send the digest your pipeline already computed (sha256:… , 0x… or bare hex; sha256/sha512/sha3/blake2b/blake3 — SHA-1 and MD5 are refused with a reason, since a collidable digest identifies no single artifact). Optional anchor: the manifest digest is committed as a record in the node data-availability store (da.put), which returns a commitment plus a Merkle inclusion proof against it. Read that for what it is — a node-local, operator-run store, NOT a block: no blob written there is committed by consensus (the live chain's headers carry an all-zero daRoot), and the store evicts (lru) and can be deleted, so the record buys retrievability and tamper-evidence, never a trustless timestamp.

Health