The right of un-erasability.
What enters the Canon is never silently changed or removed. Revisions are added beside the original, never over it.
THE PERMANENT INK PROTOCOL · PIP-1
An open standard that gives every piece of writing a name made from the writing itself. Change a single comma and the name changes. No account. No platform. Nothing to rent.
The name of the words above
pip1:t:pip1:t:8186c5e1db209ab3aa29f88d8073f264a30fa2c54120369503044183e19f96ba
Computed by the rules in the Yellow Paper. Change one comma and it becomes a different string. Try it →
01 — THE PROBLEM
A book on a shelf survives because it needs nothing. A page on the internet needs everything.
The site closes. The company is sold. The bill goes unpaid, and the words go with it.
A sentence is edited and no one is told. The old version is gone, and nobody can prove it ever existed.
A link points to a place, not to a thing. When the place changes, the link breaks, or worse, leads somewhere else.
Who wrote this? The answer lives in a database owned by a party that may not exist in fifty years.
Ink answers the last three with mathematics. For the first, it hands over to the storage networks built on top.
02 — THE IDEA
Today, an address tells you where something lives. Ours tells you what it is.
We take your words and boil them down to a short fingerprint. That fingerprint becomes the name. The same words give the same name, on any computer, in any year. Different words give a different name.
pip1:t:8186c5e1…96ba
Can’t change without changing itself.
Same words, same name.
One comma, a different name.
Anyone can check, offline.
We call it content addressing. You don’t need to remember that.
03 — SEE IT
This runs in your browser. Nothing you type leaves this page.
Editors disagree about invisible things. Pretend your file came from somewhere else.
pip1:t:8186c5e1db209ab3aa29f88d8073f264a30fa2c54120369503044183e19f96ba
0 of 64 digits changed · 48 bytes · 1 chunk
This is a working copy of the Yellow Paper’s text-naming rules (sections 4 and 5). It skips one check, the Unicode 18.0.0 list of assigned characters, which the reference implementation performs.
04 — HOW IT WORKS
Editors disagree about line endings, invisible marks and how accents are stored. We settle those arguments, and only those. What you wrote is never touched.
ef bb bf 43 61 66 65 cc 81 0d 0a → 43 61 66 c3 a9 0a
Café, saved three different ways, becomes one set of bytes.
The text is cut into small pieces and folded into a tree of fingerprints. The top of the tree is its name, so even a single paragraph can be proven to belong.
pip1:t:8186c5e1…96ba — 48 bytes · 1 chunk
A small plain-text record lists the title, licence, sources you cite, earlier versions and who the authors are. It gets its own name. Change one line and that name changes too.
pip-manifest 1 profile pip-1 title Test Manuscript text pip1:t:8186c5e1…96ba 48 author pip1:k:2b27c5d4…130b
From the Yellow Paper’s test manifest. Identifiers shortened.
Authors sign the record with the post-quantum standards NIST published in 2024. A signature says one key approved this exact record, in a stated role.
role 01 · ml-dsa-87 · signature 4,627 bytes
Then anyone, anywhere, can check all of it with nothing but the files.
05 — SIGNATURES
Today’s signatures are expected to fall to a large enough quantum computer. A signature on a manuscript should mean something for centuries. So we use only the new post-quantum standards.
Built on lattices.
FIPS 204ML-DSA-87 · Category 54,627-byte signatureBuilt on hashes alone.
FIPS 205SHAKE-256s · Category 529,792-byte signatureDifferent mathematics. If one family ever weakens, the other still stands. Sign with both, and a forger would have to break both.
Honestly: both families lean on the same hash permutation, Keccak. The Yellow Paper says so, and describes how a work is renewed if that ever weakens.
Not used: RSA · ECDSA · EdDSA · ML-DSA-44
06 — CITATIONS
When you cite a work, you cite its name. If anyone serves different words under that name, the check fails.
cite:pip1:t:9e13e0cc…f413#b=0-5
You can point at an exact passage, and prove it is there.
A citation can still point to something nobody has kept. That is a problem of finding, not of truth. Ink can tell you what is missing. It can’t summon it.
07 — LIMITS
We’d rather tell you now.
08 — BEYOND THE INK
Everything above this line is specified. Everything below is a proposal. We mark the difference every time.
Long-term copies, paid for once through an endowment, kept by many independent nodes.
If everything is permanent, so is spam. Guilds of readers decide what enters the Canon.
A quiet reader with no ads, no popups and no hidden ranking.
Small archive boxes anyone can run. Text is tiny.
09 — THE CONSTITUTION
DRAFT PRINCIPLES · TO BE RATIFIED BY A FOUNDING COHORT
What enters the Canon is never silently changed or removed. Revisions are added beside the original, never over it.
A writer’s signed claim of authorship travels with the work, wherever it is copied.
No reading app owns the library. If one turns bad, anyone can build another over the same books.
Writers decide in advance who inherits their work, or whether it passes to the public domain.
Discovery runs on open, explainable rules, never on a hidden engagement algorithm.
Proposed. To be ratified by a founding cohort of writers, scientists and essayists.
10 — ROADMAP
No dates. We will not promise what we have not built.
11 — HELP US BREAK IT
Version 1.0 is not final. Before it is, three things have to happen, and each needs people who are not us.
Write an independent version in another language. See whether you get our numbers.
Cryptographers: attack the domain separation, the tree, the signed message and the renewal design.
Compare the ML-DSA test vectors with a second implementation and with NIST’s validation data.
There are three more open items in section 14.3 of the Yellow Paper.
Permanent ink. Open to everyone.