Four things, one name.

The note

The missing piece of paper

End to end

The whole trip, in five lines

Everything below is one of these five lines, enlarged.

Different delegations

One grammar, three kinds of thing

The delegate is typed — an https URL or a package URL — so a note points at exactly one thing. Three notes, identical grammar, three different things to stand behind:

Same stamp, same four questions — only the principal, delegate and scope rows change, and each note is cancellable on its own without touching the domain proof or any sibling note. Both domains here are our own. The first of these notes — the MCP server’s — is the one we are about to write; until a note is issued, it is an illustration, not a record.

The four questions

What anyone can ask

Whoever finds the note — a gateway, a registry, you — can ask four questions of it. None of them is “is this artifact good.” Four smaller ones, each with a yes-or-no answer.

The copy attack

A real note, in the wrong hands

A published note is data, and data can be photocopied into a different listing with its stamp intact — nothing on it was altered. Question 3 is built for this exact move: the check refuses to run unless you supply the artifact you resolved yourself. Run the same four questions twice and watch where the copy fails:

The reverse move exists too: any domain owner can sign a genuine note naming someone else’s artifact — the issuer checked their domain, not the artifact’s parentage. That is why a check is only meaningful against the domain you expected: pinned, a note minted by the wrong party fails at question 2; unpinned, the result honestly reads “this domain says so,” and nothing more.

Liveness

The question the note can’t answer about itself

Anyone can check the stamp without asking us. Nobody can check the note still counts without asking.

That is the design, not a limitation. A note that promised “valid forever” could never be taken back — the cancel switch has to live outside the note, with the issuer.

So the check asks twice: a signed status list — fetched whole, so the issuer never learns which note you cared about — and the issuer’s status endpoint, which alone sees the domain proof a note rests on. A no from either is final, and if neither can answer, the check fails closed: unavailable is not the same as valid.

The rendering

Show the domain, not a checkmark

Either name can carry a perfectly stamped note — all four questions can answer yes for both. What tells them apart is a person reading the principal against the domain they expected. A checkmark would cover exactly the part that matters, so the honest rendering is the domain itself — a door to the principal’s public profile, never a verdict.

In code

Writing one, in code

One call stands between a proven domain and a published note. Everything else in the surface exists to list them, read one back, and cancel it.

import { Proof } from '@proof-holdings/sdk';

const proof = new Proof('pk_live_...');

const delegation = await proof.delegations.create({
  control_proof: 'ph_ctl_...',                  // the domain you proved
  delegate: { type: 'purl', value: 'pkg:npm/@proof-holdings/mcp-server' },
  // or a live endpoint: { type: 'url', value: 'https://team.management/mcp' }
  scope: ['proof-verification'],                // capability tokens, kebab-case
});

console.log(delegation.token);                  // publish this on the artifact

Fine print

• The paper questions run before any network call, so a note that fails on them costs zero requests — and the signature algorithm is chosen by the verifier, never read from the note.
• Read a failure as “this did not verify,” never as evidence about who tried: claims are checked before signatures, so a forged note can be made to produce any failure it likes.
• A note travels on the artifact’s own card, or a one-line DNS record at the domain points to where it lives — the record carries an address, never the note itself.

Start with the domain you already stand behind. Prove it once, then write a note for each thing that acts under your name — and cancel any of them, any day, on its own.