> For the complete documentation index, see [llms.txt](https://lashae.gitbook.io/lashae-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lashae.gitbook.io/lashae-docs/the-protocol/shrouded-footprints.md). # shrouded footprints Private proof. The chain sees the shape. Nobody sees the shape unless you hand them the key. *** ## The problem A public footprint says: *I did this thing, here is the link, here is the reflection.* Good for social proof, terrible for anything sensitive — an unshipped patent, a therapy note, an unsigned contract, an addiction milestone, a résumé line you're not ready to show. Traditional "private" mode still trusts the server: LASHAE (or anyone who compromises LASHAE) could read your rows. Shrouded footprints remove that trust. ## The mechanism 1. In your browser, LASHAE mints a random 256-bit key. 2. Your footprint content — title, reflection, proof url — is canonicalised and encrypted with AES-GCM using that key. 3. A **commitment hash** is computed: ``` SHA-256("LASHAE_SHROUD" ␟ base64url(key) ␟ canonical(plaintext)) ``` 4. Only the **ciphertext**, the **iv**, and the **commitment hash** are written to the database. Only the commitment hash is anchored to Solana via the Memo Program. 5. The **key never leaves the tab.** When you land on your receipt, LASHAE rewrites the URL to include the key in the URL fragment (`/f/#k=`). Browsers do not send fragments to servers. You share the receipt link with whoever you want. They open it; their browser reads the fragment; the ciphertext decrypts locally; the commitment is recomputed and verified against the Solana memo. If you share the link with the world, the footprint becomes public. If you share it with one person, only that person can read. If you delete the link, the content is functionally gone — even we cannot recover it. ## What LASHAE can prove without seeing the content * A footprint existed at timestamp T (Solana slot). * It was authored by wallet W (if you anchored with your wallet). * Its content has not changed since T (commitment hash is immutable). * It optionally fulfils a sealed vow (link is public metadata). ## What LASHAE cannot see * The title. * The reflection. * The proof url. * Whether two shrouded footprints are related. ## Verifying a shrouded reveal Given a link `/f/#k=`: ```bash # fetch the row (ciphertext + iv + content_hash + solana_signature) # decrypt AES-GCM(ciphertext, iv, key) → plaintext bytes # recompute canonical(plaintext) and: # sha256("LASHAE_SHROUD" + 0x1f + key + 0x1f + canonical) == content_hash ? # and pull the memo from the Solana signature to confirm it matches content_hash ``` Two independent checks: the crypto (does the key open the box) and the chain (was the sealed box registered on-chain). ## When to shroud * work you will reveal later (product launches, papers, filings) * practices you count for yourself but don't want performed for a feed * proof you want to hand to one witness (a coach, a lawyer, an investor) * a diary entry that still deserves a timestamp ## When not to shroud * when you want blessings and public witness — a shrouded footprint has no title to bless * when you might lose the link (there is no recovery) Shrouded footprints are LASHAE's answer to the trade between **being seen** and **being believed**. You can now be believed without being seen. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://lashae.gitbook.io/lashae-docs/the-protocol/shrouded-footprints.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.