The Reality Engine takes a physical environmental signal and carries it, unbroken, from a secure element in the field to a registry-grade proof on chain. Hardware signs at the source. The edge verifies. An independent validator network reaches consensus. Cardano anchors the record. Every link is cryptographic, and every link is inspectable.
Every field node carries a tamper-resistant secure element. Its signing key is generated and burned in at manufacture and is never exportable from the chip. Signing happens inside the secure element, so the signature exists before a reading ever touches a network. There is no software path to forge it.
Each device packet binds identity, policy, time, geography, payload, sequence, firmware, and calibration into a single SHA-256 digest, then signs that digest with device-bound key material. The result is a record the protocol can defend on origin, integrity, continuity, and replay grounds.
Raw signed data is processed at the edge before transmission. The verification stack runs cryptographic, protocol, physical, spatial, temporal, and methodology checks in sequence, and statistical anomaly detection flags readings that are spoofed or physically implausible.
The device signature is validated against the on-chain device registry. An unknown or mismatched key fails immediately.
Schema, policy id, and firmware version are checked against protocol standards for the methodology in force.
Values are bounded against sensor physics and calibration state. A soil probe cannot report an atmospheric impossibility.
Geospatial context is checked against the node's registered H3 cell and neighbors. Location drift is caught at the edge.
The monotonic nonce and timestamp enforce ordering and replay resistance. Gaps and rewinds are flagged.
Outlier detection scores each reading against its own history and its neighbors, surfacing spoofed or drifting signals.
Verified data is broadcast to the Mālama Hex Node network. Each node operates within an H3 geographic cell under a non-exclusive license and validates that the packet matches protocol standards and that the device signature is valid against the on-chain registry. Consensus is geographic, so a single validator cannot falsify unnoticed.
Validators operate under a PONO credential earned through KYB and operational milestones. It is a stake, not a login.
The geographic consensus layer makes single-validator falsification detectable by neighboring nodes, giving the network Byzantine fault tolerance by construction.
Fraudulent attestations trigger PONO revocation and forfeiture of unvested operator rewards, which route to the Genesis Performing Operator Bonus Pool.
Each Hex Node validates both carbon SaveCards and AI compute attestations through the same Proof-of-Truth consensus. The verification path is identical whether the underlying signal is a soil measurement or a rack-level power draw.
Validated readings are batched by region and methodology and bundled into Merkle trees. Full payloads persist in immutable raw storage on Arweave, and only the Merkle root is anchored on Cardano. The on-chain footprint stays constant no matter how much telemetry flows, while auditors can still retrieve a full inclusion proof for any individual record.
SaveCards live on Cardano as the archival, long-horizon custody layer. Execution, staking, and governance run on Base. The two chains do separate jobs and are not bridged at token generation; the protocol does not require them to be.
Software-only measurement asks you to trust a report. Hardware signing lets you verify the measurement. The difference is where the chain of custody begins.
| Property | Software-only MRV | Mālama Reality Engine |
|---|---|---|
| Point of trust | The report, signed after the fact | The reading, signed at the instrument |
| Tamper-evidence | Procedural and reviewable | Cryptographic, breaks on any edit |
| Key custody | Software keys that can be copied | Non-exportable key inside the secure element |
| Verification time | 12 to 24 months | Continuous, real-time |
| Data reliability | Subjective and periodic | Objective and continuous |
| Coverage logic | Convenience-driven | H3 zone-weighted by climate value |
| Auditability | Trust the intermediary | Trust the cryptography, verify on chain |
Register interest to operate validator infrastructure, integrate the SaveCard data primitive, or license hardware-signed environmental data for your application.
Mālama Labs