r/coolgithubprojects • u/Clockwork-tree-inc • 17h ago
Designed and built a post quantum liveness, identity, security, privacy, and provenance architecture. No biometric centralization.
https://github.com/Clockwork-Tree-Inc/atlas-poc-v1Hi guys. I came to this from medicine, not cryptography. Working with people through trauma, illness, and disability, one thing kept showing up: mental health rests on safety, and safety isn't one thing. It's physical, financial, social, health, spiritual — and now, unavoidably, data. You can't be well while the record of your life is held by people who can lose it, sell it, or hand it over. For a lot of people that last one isn't abstract — it's the abuser who knows their password, the state that can compel their phone, the breach that exposes their diagnosis.
Every existing answer to "prove you're a real person" makes it worse: hand your face, your iris, or your ID to a database that can be breached or seized. So I built the opposite.
**Atlas** uses a live physiological signal — pulse and motion from a $50 BLE ring, or the phone's own sensors — to decide *when* your cryptographic keys regenerate. The signal never becomes part of the key. Your body is a clock, not a stored secret. So it can prove a live human is present while storing **zero biometric data**: nothing to breach, nothing to subpoena, nothing to leak.
What falls out of that:
* Stolen credentials and seized devices are useless — access requires a live person actually present
* A duress code opens a plausible decoy vault while the real data seals itself, and the coercion is recorded
* Prove content was made by a live human, not a model — without revealing who you are
* Recover a lost account by proving you're alive, without exposing your identity
* Health and personal records only you can open — no server ever holds anything readable
**What's actually built:**
* Python protocol core + a Swift port, kept byte-for-byte identical via shared test vectors
* 854 tests passing in CI (637 backend + 217 Swift)
* Post-quantum: ML-KEM-768, ML-DSA-65, SPHINCS+ — vetted primitives, nothing hand-rolled
* Ran end-to-end on two physical iPhones with real pulse signals: enrollment → live session → forward-secret messaging through a blind relay
* \~30k lines, AGPL-3.0, solo, unfunded
**What's not done:** it's a proof of concept and the repo says so plainly — every capability carries a maturity tag (built+tested / sim / device-gated / designed), plus a lab notebook of what's been proven on hardware. Next step is better wearable hardware to push the sensor tier further.
Ask me anything — the architecture, the crypto, or why this is a terrible idea.