What this is / isn’t
This demo is
- Company-stamped, soulbound employment PDA on Solana Devnet.
- Off-chain personal data with an on-chain commitment and Active / Revoked status.
- Employee-controlled selective disclosure through a signed QR.
This demo is not
- A public mint; Company actions require operator unlock.
- A transferable NFT or proof that a badge equals employment.
- Mainnet or a place for sensitive production HR data.
Two layers. (1) Employment PDA — Mint / Reissue / Burn PDA / Check. (2) Optional picture mint is not employment.
Unlock company card creation
This PIN is for the company operator only. It is not Phantom, not the employee, and not Check.
Mint, Reissue, and Burn PDA change the on-chain employment record. Anyone who can open those controls could end or replace a card. Unlock writes an HttpOnly cookie for 8 hours on this browser.
Employee QR and Check work without this PIN. Until you unlock, company forms stay hidden because those actions would only return unauthorized.
Company mint / Reissue / Burn PDA stays hidden until this unlock. Same PIN unlocks Admin. Check and Employee QR do not need it.
Identity
Sealed into the employment card (PDA) after Mint. Print uses the two-face stamp preview on Employee.
Need someone else or another company? Mint. Hire-again after end? Reissue. Typo on the same hire? Update.
Validity
Card appearance (print only — not employment proof)
Colours and the names above tint the printable card. They do not change the PDA or Check result.
Acme Corp
Alice Example
Sales Engineer
ECWallet
The holder address is the employee’s wallet (or a company-provided wallet if they have none). It is not the PIN and not the company payer. Mint / Update / Reissue / Burn PDA act on the Program Derived Address (PDA) — soulbound employment. Mint is a first card or a different person. Update is a typo on the same hire (not Reissue). Burn PDA marks it ended. Reissue is hire-again after Burn PDA, same holder only.
Mint creates the first employment record for this Phantom: off-chain card + on-chain soulbound PDA (Active) + optional display picture.
The company wallet pays and signs on Devnet. The employee Phantom does not confirm the mint.
Use Mint for a first card or a different person / company. Do not use Mint to edit this PDA. Typo on the same hire? Update. Hire-again after Burn PDA? Reissue.
Update is a typo / legal rename / rebrand on the same hire (same wallet, same company). It is never Reissue.
Need someone else or another company? Mint. Hire-again after end? Reissue.
Reissue hires the same wallet again after Burn PDA: new off-chain fields + new commitment on the same PDA.
While the job is Active, Reissue stays off. It is not a name-change path and it does not burn the job for you.
Burn PDA ends employment on-chain (status Revoked). Check then shows ended. The picture mint is not this.
Company signs. The PDA address stays so you can Reissue later.
Unlock Admin
Same operator PIN as Company. Unlocking one unlocks both. Admin is read-only.
Admin
Operator-only. Read-only logs. Burn PDA and Reissue stay in Company actions, not in these tables.
Loading…
1 · Overview
Product version
2 · Employment records On-chain
No off-chain PII. Status is the PDA.
| Source | Wallet | PDA | Company | Status | Updated | Explorer |
|---|---|---|---|---|---|---|
|
Page 1
|
||||||
3 · Chain events On-chain
Reconstructed from issuer state (current records + host picture log), not a full Solana tx log.
| Source | Kind | Wallet | PDA / mint | Signature | Slot | Time | Result | Explorer |
|---|---|---|---|---|---|---|---|---|
|
Page 1
|
||||||||
4 · Host activity Host-local
Logs of wallet cards this host minted. Host-local — not wallet holdings, not the full chain.
| Source | Mint | Wallet | Company | Created | Closed | Explorer |
|---|---|---|---|---|---|---|
|
Page 1
|
||||||
5 · Check telemetry Check telemetry
On-chain log (optional — Explorer and IDs)
Support / debug only. The 64-hex line is the on-chain commitment Check recomputes. It is not a wallet. You can mint, revoke, and Check without opening this.
Employment is a soulbound PDA (cannot transfer). A Collectibles picture, if minted, is decoration. We do not use a transferable NFT as the job — anyone could sell it. Check onchain reads the PDA only.
Logs of wallet cards this host minted
Not what is still in the web3 wallet. Mint log from this issuer (when we created the Token-2022 card), not Phantom’s list. Each row says if that mint is still in the holder wallet. Reissue of the same wallet + company reuses the mint — no new tile if it still exists. Close picture is operator-only (unlock). It does not Burn PDA or end employment.
Not offered (and not employment proof): Apple/Google Wallet pass, NFC tap, bulk org issue, work-email IdP, Open Badges / LinkedIn display, IPFS media. Check uses the Solana PDA + signed QR only.
Bot / Comet contract: E2E_COMET_SCENARIOS.md · last Playwright
4 · Internal company scanner Privileged full VC + salts. Unlock required. Public Check never sees salts.
External (tab 3 / Check) = QR + chain status only — door / visitor path. Internal (this) = company copy of the whole credential including salts. Not for the door scanner.
Full credential (salts — company only, not the door)
Share your card
Same Phantom the company minted. Tick what to show, then Generate QR (Phantom signs if any field is ticked). Ticks change the preview only — sign again to refresh the QR.
Preview (what they see)
Name, role, and org update as you tick. Dashed QR is placement only — a real scan QR appears after Generate QR.
Front
Organization if ticked
Status only until you tick fields
Trust the stamp. Badge ≠ employment proof.
Back (below the front) — wallet left, QR right, full width
Company-stamped card
Trust the stamp — not the NFT
Badge ≠ proof of employment
Ticks changed — Generate QR and sign again. This picture is the old payload.
Your contacts (not sealed on the PDA)
Email, phone, and LinkedIn live here. They are not the job record. Tick Disclose, then sign, to share them.
Employment check
Check answers: is this person still employed at this company, according to the chain?
Paste or scan a QR. We read the Solana PDA. Active → currently employed. Revoked → employment ended on that date. A picture in Phantom is not this answer.
If the QR is a selective presentation, we also show only the fields the employee chose and signed. Merkle openings prove those fields match the on-chain commitment. You do not need the company PIN.
- Paste JSON, upload a QR image, or start the camera — or Load live sample (no PIN).
- Check reads on-chain Active / Revoked and the commitment.
- A selective QR also lists disclosed fields. Raw JSON and Merkle paths are under Advanced.
Prove stub: GET /api/v1/zk (honk/circuit/bb false). POST /api/v1/prove → 501 zk_prover_not_enabled. Keep signed-merkle-v1. No fake proofs. No honk / UltraHonk circuit on this host. kind honk is rejected as unsupported_proof_system.
Bots / no Phantom: Load live sample then Check — reads Devnet status + commitment. No PIN.
This person is no longer employed here. Scanning this QR again still says ended until the company Reissues. The picture in Phantom is not this answer.
They are employed here right now. The picture in Phantom or the print colours are not this answer.
Disclosed attributes
Advanced — Merkle openings + raw result
Openings are the cryptographic proof that disclosed values match the chain commitment. Door staff can ignore this and use the headline + disclosed list above.
Merkle openings
signed-merkle-v1 bytes (what was signed)
UTF-8 of canonical JSON (sorted keys, no signature).
Phantom signMessage over those bytes. Site icon (Catalyxt logo) comes from this page’s favicon.
Learn — ask for name / email (optional)
Why: A Minimal QR only says employed / ended. It never carries a name. If the door also wants a name or email, you send a request first. The employee chooses to sign those fields. Check still reads employment from the chain either way.
Three different JSONs — do not mix the boxes:
zkec-req = shopping list (this box).
zkec-pres = signed QR the employee brings back (paste at the top, then Check).
zkec-claim = receipt after Check (the fold below).
- Tick what you want to see. Click Ask Employee for these fields.
- Employee: Generate QR (Phantom signs the ticks). Then Open Check.
- You land back on Check with the signed proof already filled — employed / ended plus the fields.
That opens Employee. They can add ticks, then Generate QR (Phantom). Then Open Check.
JSON (only if you must copy by hand)
Learn — re-check a saved receipt After Check on a selective QR, Copy signed claim. That file is zkec-claim. Paste it here later to ask the chain again. Revoke still wins.
Why: Yesterday you saved a claim. Today you want to know if they are still employed,
without scanning a new QR. Paste that saved zkec-claim and Re-check. The chain is the answer.
If you paste the shopping-list JSON from above (zkec-req), we will say
wrong box. That list goes to Employee → Apply, not here.