On-chain objects on testnet

Two receipts are minted on Sui by this instance: a manifest receipt when an object is stored, and an incineration certificate when a held document’s key is destroyed. Both resolve on any Sui fullnode, with no account here and no trust in us. This page is their field-level detail.

The ids

These are read from the repository’s own publish records when this page is built, so they are the ids the running instance mints against rather than a copy typed into prose.

	Id
Network	testnet
Manifest package	0x474b88baf47fe0eb21a26e0e07e269755e8122b878e7d7f93b6732041b1ab81d
Incineration package	0x7beda97acf07c60d9839a64166b59d10e3cdc3b42fa955fcc8dd23049910ac44
Credit pool	0x423ccb5f81e003e15ef6768c7d44360933f52f00490515479547413e1404779d
Public registry	0x859f9b6f6886cfa87e5ff602e41cefa21d6c773400803c4817dad357c9b5b475

The credit pool is the shared object a tenant’s prepaid standing is read from — the pool_id that comes back on GET /me. The public registry holds on-chain ownership claims and is not touched by an ordinary store.

Manifest receipt — ManifestNFT

Minted by an ordinary upload. It is the record that says these bytes existed, under this owner, at this point in a chain of versions.

Field	Type	Means
id	UID	The receipt’s own object id on Sui.
manifest_blob_id	String	The Walrus blob holding the file index this receipt covers.
root_hash	String	The Merkle root over the content hashes in that index. For an object uploaded in parts, this is the whole-file anchor.
file_count	u64	How many files the manifest covers.
total_bytes	u64	Their total size.
encrypted	bool	Whether the bytes this receipt covers were stored encrypted.
previous_id	Option<ID>	The receipt this one supersedes. Absent on a first mint; present on every re-commit, which is what makes the lineage a chain rather than a set.
owner	address	The address the receipt was transferred to.
created_at	u64	The Sui epoch at mint.

It is soul-bound. The struct carries key and not store, so it cannot be moved by public_transfer, cannot be used as a dynamic-field payload, and cannot be picked up by another module. A receipt that could be transferred away from what it attests is not a receipt.

Walking the chain from a receipt back through previous_id is Read your receipt on Sui. What the receipt does and does not claim is A storage receipt is not a provenance receipt.

Incineration certificate — IncinerationCertificate

Minted when a custody object’s key is destroyed. The keep-and-prove receipt above has a kill-and-prove companion, with the same discipline.

Field	Type	Means
id	UID	The certificate’s own object id on Sui.
content_hash	String	The sha256 of the plaintext that was destroyed. This is the field to compare against a document you still hold.
manifest_blob_id	String	The Walrus locator of the stored object. It stays a valid locator — the ciphertext is still there.
key_id	String	The identifier of the destroyed key.
kms_backend	String	Which custody the destroyed key was under. On this instance it reads server.
deletion_mode	String	The claim, written on chain verbatim: auditable_vendor_side.
prior_manifest_id	Option<ID>	The ManifestNFT for the same object, when one had been minted by the time the key was destroyed.
attested_by	address	The operator that performed the destruction and attests it.
incinerated_at	u64	The Sui epoch of the destruction.

It is soul-bound too, on the same terms.

Read deletion_mode as the certificate’s own claim boundary, not as decoration. What was destroyed is the key. The encrypted blob persists at its locator until its own lease lapses, and this certificate does not assert that the blob was removed from Walrus. It attests auditable vendor-side deletion — the key material Permafrost held is gone — which is a different and smaller statement than a deletion nobody has to take anyone’s word for.

The certificate carries no tenant field, so the proof is the hash match rather than an identity. The full argument is Deletion by key destruction.

Opening one in an explorer

Every Sui object id resolves at:

https://suiscan.xyz/testnet/object/<object id>

That is the pattern GET /v1/api/verify returns in its explorer_url field, so a keyless verify hands a reader a link they can open without any of this. explorer_url is an empty string when nothing has been minted for that record yet — an empty string rather than a link that would resolve to nothing.

A certificate’s object id and the transaction that minted it come back as certificate_object_id and certificate_tx_digest on the custody surface.

Who owns the receipts here

On this instance the operator’s address is the receipt owner for objects stored here: the auto-mint path signs with the instance’s own key and the receipt transfers to it. The receipt still names the content, the lineage and the epoch, and anyone can resolve it — but the owner field reads as the operator, not as your tenant. That address is not published on this page.

Next

• Read your receipt on Sui — resolving one, front to back.
• Verify a file by hash — the keyless route, and which hash to present.
• What survives Permafrost, and what does not — what the on-chain record is worth without us.