MOD-04 · THE TRUST LAYER

Verification is public. Forever.

Every dataset GEOM publishes is fingerprinted, signed by the oracle key, and anchored on Solana. Anyone — a counterparty, a regulator, an allocator — can prove what GEOM published and when. No key, no account, no permission. A notarized data feed: nothing is issued, deployed, or custodied through it.

Request API access →Verify a dataset

8datasetsUnder signed attestationsha-256 over canonical json

477,503,221Latest anchor · Solana slotMon, 20 Jul 2026 01:04:11 UTC

ED25519Signature schemestandard solana keypair

Anchor currentManifest vs. on-chain statee6da15ac9f629d4d…

How it works

STEP 01 — FINGERPRINT

Hash

Each dataset is canonicalized (keys recursively sorted) and reduced to a SHA-256 digest — a unique fingerprint. Change one digit anywhere and the fingerprint changes completely.

STEP 02 — SIGN

Sign

The oracle key signs GAEA-ATTEST-V2|dataset|version|hash with Ed25519. Verification runs in your own browser — you never have to take this page's word for it.

STEP 03 — ANCHOR

Anchor on Solana

Each publication window, the manifest of all digests is written to the Solana ledger in a signed Memo transaction — a public, permanent timestamp no one can edit, including GEOM.

Live demo — request & verify an attestation

Pick a dataset. The oracle signs its fingerprint on the server; your browser then checks the signature itself, locally.

On-chain proofcurrent

NetworkSolana devnet · slot 477,503,221

MemoGAEA-ANCHOR-V1|e6da15ac9f629d4ddc593d60632c5c2b2486de6d574ccb4df9a2d51efc3de76a

SignerDDBT4er8HAHoHvg7xWHfqBY3sdrDhD7uZJW8SctxD9hY

Transaction3s3pzbBJ…W57gR6JA

View the transaction on Solana Explorer →

Anchored	Cluster	Manifest SHA-256	Status	Transaction
2026-07-20T01:04:11.000Z	devnet	e6da15ac9f629d4ddc593d60632c5c2b2486de6d574ccb4df9a2d51efc3de76a	current	3s3pzbBJ…W57gR6JA
2026-07-19T16:52:05.000Z	devnet	f207816a1a68d8e7f22c6c194a1fa9c8ec0120487337282d240bd5c33a113535	superseded	RygdjPE2…wbYiDhvK
2026-07-19T14:16:51.000Z	devnet	6ec1c28a007f99f6ecffbc1fe167140949e0c191f912c880edae01d23f645809	superseded	5iqfr5v4…uYRz16cG
2026-07-19T14:03:37.000Z	devnet	6ec1c28a007f99f6ecffbc1fe167140949e0c191f912c880edae01d23f645809	superseded	RdmUQjB9…wFA6itmA
2026-07-19T13:34:56.000Z	devnet	b3b560c22c49b01db97da7866f0a8a22f723d43f1c5bf4ff1bc40edec9566e5e	superseded	kp7vac13…D8GN2UtN
2026-07-17T15:50:44.000Z	devnet	997c2b2fbf37763e451fa80c8dfe98ea26b05ce4acb70f1df6e169dd3c0c395f	superseded	gF1LxbA3…Khdw4usD

Current dataset digests

Dataset	Version	SHA-256 (canonical JSON)	Raw
reserves Proven crude oil reserves by country	v0.1.0	72a9bff19c4030931bdab2dbf757cbba0340c92e1e37a75d8b26736e92f44632	/api/datasets/reserves
fields Major oil & gas fields and Arctic energy assets	v0.2.0	04d3248d82dadc3f732c48eea2fcb82566761d358f381f75878bd881f8f37c2f	/api/datasets/fields
tokenized Tokenized oil, minerals & rare-earth RWA registry	v0.2.0	015f48514dd188263f1517aafe665fa5c3d508e5c8ed4513597cd68fce8a086c	/api/datasets/tokenized
market Market structure sample series	v0.1.0	3c8183d60603a682ab4bd8a5008ac1d7db5c824678d1f970dbb72c033cdedf9b	/api/datasets/market
sites Global mineral, rare-earth & nuclear asset registry	v0.1.0	0df77f7d1c9d2cd09318ddb5739ee6b8ac44fc2b7eba6e72a03c0e00ea41e9aa	/api/datasets/sites
plants Global power plants (all fuels)	v0.1.0	1a36985e7126351722f57f4b971e859cd51f1354a219ae242c31bb1dbf2f0cf9	/api/datasets/plants
pipelines Major oil & gas trunk pipelines (approximate routes)	v0.1.0	c960522062f9483dcc02d7ba2b3b065e8f340343a43169885f86bac8fb3b2293	/api/datasets/pipelines
eia U.S. weekly petroleum fundamentals (EIA WPSR)	v2026-07-10	172c8661cdf9ee565b61b6362f6876e579762da036abf322b185b15be6e33ef8	/api/datasets/eia

DEVELOPERS

One shape. Three endpoints. Zero trust required.

Every dataset is the same JSON — a meta block, then the records. Integrating takes a few lines of any language and no credentials.

QUICK START

// GET https://gaea-gray.vercel.app/api/datasets/reserves
// Every GEOM dataset has the same shape: a meta block, then the records.
{
  "meta": {
    "id": "reserves-v1",
    "title": "Proven crude oil reserves by country",
    "unit": "billion barrels",
    "sources": ["OPEC ASB", "U.S. EIA"],
    "version": "0.1.0"
  },
  "countries": [
    {
      "iso": "VE", "name": "Venezuela",
      "reserves": 303, "lat": 8.5, "lng": -66,
      "status": "constrained",
      "note": "Largest proven reserves; output constrained by sanctions"
    },
    { "iso": "SA", "name": "Saudi Arabia", "reserves": 267, ... },
    // ... 21 more records, same keys, no surprises
  ]
}

Verify from your own machine free forever

The demo above runs in this page — but the whole point is that you don't need this page. Anyone with Node.js 18+ can re-check everything GEOM publishes in three steps. No account, no key, no permission.

STEP 01 — LOOK AROUND

Open a terminal. List the published datasets, then fetch one with its signed attestation — plain HTTPS, readable JSON:

curl https://gaea-gray.vercel.app/api/datasets            # all dataset ids + digests
curl https://gaea-gray.vercel.app/api/datasets/reserves   # the raw dataset itself
curl https://gaea-gray.vercel.app/api/attest/reserves     # its signed attestation (Ed25519)

STEP 02 — SET UP (ONCE)

In an empty folder, install the two open-source crypto libraries the verifier uses (the same ones this page uses):

npm install tweetnacl bs58

STEP 03 — VERIFY

Save this as verify.mjs in the same folder and run node verify.mjs reserves. It downloads the data, recomputes the fingerprint, and checks the signature — entirely on your machine:

// verify.mjs — checks a GEOM dataset from your own machine.
// Usage:  node verify.mjs reserves     (any id from /api/datasets, e.g. eia)
import { createHash } from "node:crypto";
import nacl from "tweetnacl";
import bs58 from "bs58";

const base = "https://gaea-gray.vercel.app";
const id = process.argv[2] ?? "reserves";

// 1. Download the raw dataset and its signed attestation
const data = await (await fetch(base + "/api/datasets/" + id)).json();
const att  = await (await fetch(base + "/api/attest/" + id)).json();

// 2. Recompute the SHA-256 fingerprint yourself (canonical JSON:
//    object keys recursively sorted, no whitespace)
const canon = (v) =>
  v === null || typeof v !== "object" ? JSON.stringify(v)
  : Array.isArray(v) ? "[" + v.map(canon).join(",") + "]"
  : "{" + Object.entries(v)
      .filter(([, x]) => x !== undefined)
      .sort(([a], [b]) => (a < b ? -1 : 1))
      .map(([k, x]) => JSON.stringify(k) + ":" + canon(x))
      .join(",") + "}";
const hash = createHash("sha256").update(canon(data), "utf8").digest("hex");
console.log(hash === att.sha256
  ? "OK   hash matches — the data you hold is what was attested"
  : "FAIL hash mismatch — do not trust this data");

// 3. Verify the Ed25519 signature against the oracle's public key
const ok = nacl.sign.detached.verify(
  new TextEncoder().encode(att.message),
  bs58.decode(att.signature),
  bs58.decode(att.signer)
);
console.log(ok
  ? "OK   signature valid — signed by " + att.signer
  : "FAIL invalid signature — do not trust this attestation");

Two OK lines prove the data you downloaded is byte-for-byte what the oracle key signed. To also prove when it was published, compare the manifest hash in the Solana memo transaction above — three checks, zero trust in this server.

API reference public

GET /api/datasets            # all dataset ids + digests
GET /api/datasets/:id        # raw canonical dataset
GET /api/attest/:id          # signed attestation (Ed25519)

Verifying what GEOM published will never sit behind a paywall — public verifiability is the point. These three endpoints are all a verifier needs, from curl, a browser, or any language.

Commercial API access request

High-frequency polling, bulk history, webhook delivery on new attestations and anchors, and third-party co-signature feeds are offered under commercial terms as they ship. Verification stays public; the firehose is the product.

Roadmap: mainnet anchoring per publication window, attestation history API, data-provider co-signatures.

Request API access →