How the beacon works

A plain-language description, written in Simplified Technical English. The normative text is PROTOCOL.md; where this page and PROTOCOL.md differ, PROTOCOL.md is correct. Back to the front page.

Simplified Technical English (ASD-STE100) limits the vocabulary and the sentence length. This page keeps the technical names that have no approved substitute: drand, Rekor, OpenTimestamps, commit, reveal, pulse, hash.

1. Purpose

The beacon makes one random number each hour. Any person can verify the number. Nobody can know the number before its release time. Nobody, including the operator, can change the number after its release.

2. Main parts

Part	Function
Entropy source	Makes the quantum random value. Keeps it secret until the reveal.
Time witness	Measures the time with a GPS-locked clock. Signs the time statement.
GNSS witness	Confirms that a GPS receiver has a fresh fix.
Witness	Makes a second, independent signed statement.
Aggregator	Collects the statements. Makes the pulse. Pushes the pulse to the public log.
drand (external)	Supplies a public random value at a known future time.
Timestamp authorities (external)	Sign the time of each commit (RFC 3161).

The hosts, their clocks and their keys are described in HARDWARE.md.

3. Hourly cycle

At the top of the hour, the time witness sends a trigger. The trigger starts the cycle on the aggregator.
The entropy source makes a random value. It sends only a hash of the value (the commitment). It does not send the value.
Each host signs a statement. The aggregator checks each statement.
The aggregator selects a future drand round. The round releases in approximately 40 seconds.
The aggregator makes a commit pulse. The pulse contains the commitment, the drand round number, the signed statements and two timestamp tokens.
The aggregator pushes the commit pulse to the public log.
The drand round releases its public value.
The entropy source releases its secret value. The aggregator makes a reveal pulse.
The final random number comes from the secret value and the drand value together. Thus, neither party alone controls the result.
The aggregator pushes the reveal pulse. The cycle is complete. It takes approximately 85 seconds.

4. Why nobody can cheat

The commitment is public before the drand value exists. Thus, the operator cannot select a value after it sees drand.
drand is public and unpredictable. Thus, the operator cannot calculate the result before the release time.
Each pulse contains the hash of the previous pulse. Thus, a change to an old pulse breaks the chain.
External logs record each pulse: Sigstore Rekor and OpenTimestamps (Bitcoin). Thus, the operator cannot publish two different chains. This is the "split-view" check (TLOG.md).

5. When a cycle fails

The beacon does not hide a failure. It always publishes a signed pulse.

Skip pulse: a dependency refused before the commit. Example: the public log was not reachable. No commit occurred.
Failure pulse: the commit occurred, but the reveal did not. Example: a witness refused because its data was too old. The failure pulse closes the commit. Consumers must treat that commit as failed.

A missing reveal with no failure pulse is a "withheld reveal". The verifier treats it as a fault. See FALLBACK.md.

6. Verification

Two automatic checks run after each push to the log, and also each hour:

verify-chain checks each pulse, each link, each signature, each timestamp token and each drand value.
verify-anchors checks each Rekor and OpenTimestamps record. It also does the split-view check.

Any person can do the same checks with the notbefore command-line tool (USAGE.md), or read the results in VERIFICATIONS.md.

7. What this does not promise

The beacon proves when a value was fixed and that nobody steered it. It does not make the value secret after the reveal, and it does not prove anything about how a consumer uses the value. The full contract, with its limits, is NOTBEFORE.md; every correction is in ERRATA.md.