Launching in stages
Run a witness. Keep us honest.
Every key a Morse phone trusts comes from one log. Witnesses check each new version of it and sign only what extends the last. Run one on a small server, stake a bond, and get paid for every version you sign.
It never takes our word for anything.
Every 15 seconds your witness asks Morse for the newest version of the key log, and checks it before it signs.
- Our signature. Every version has to be signed by the directory’s own key.
- Nothing rewritten. A short proof has to show the new version contains the last one you signed, entry for entry. The log only ever grows.
- No going back. Your witness keeps the last version it signed, and never signs an older one or a different one in its place.
- Nothing personal. A version is a number, a size and a fingerprint. Your witness never sees a message, a username or a wallet.
A lie leaves a name on it.
Phones only accept a version that most of the pinned witnesses signed. Two majorities always share someone, so showing two people different logs takes a witness who signed both, and those two signatures are the proof.
- Anyone can post it. The proof is checked on-chain. The bond is slashed, 10% goes to whoever posted it, and the rest is locked or burned. None of it is ever paid to Morse.
- Three lies count. Two versions the same size with different contents, one entry that reads differently in two versions, or a log that runs backwards.
- Downtime never does. A version you miss costs its pay, not your bond.
What you put down. What you get.
A witness is a small job with a real stake. Here is where the terms start.
- The bond. $10,000 in USDC, and the Morse token once it launches. It grows with your pay, so a lie always costs at least two years of it.
- The pay. At least $300 a month in USDC through the network’s first year, then a share of 20% of every credit sold.
- Showing up. Pay follows attendance: full when your signature is on time for 95% of versions, nothing at 80% or less.
- Leaving. Ask to unbond and your bond comes back 30 days later, after the window for proving a lie has closed.
- Running it. A small server or two, about $10 to $40 a month. Morse pays the chain fees for your signatures.
Who we’re looking for.
Witnesses only work if they don’t answer to us. So we look for operators who are unlike each other, and unlike Morse.
- Your own organisation
A separate legal entity with a named person we can reach. One witness per entity, spread across jurisdictions.
- Your own servers
Nothing shared with Morse’s cloud accounts. Your witness asks for new versions itself, so Morse never needs a way in.
- Your own key
Made on your own hardware, ideally a hardware security module or a KMS with Ed25519. We never see it.
- 99.5% uptime
An active and a standby server get you there, and we page you after ten minutes of silence.
Good fits: operators of transparency-log witnesses, Solana validators, privacy organisations and universities.
From application to trusted
- ApplyTell us who you are and where your witness would run.
- Make your keyOn your own hardware. Sign a statement pinning it, and we publish your witness’s ID, key, operator, jurisdiction and software.
- Bond and runStake your bond and sign for one full week before any release can pin you.
- PinnedThe next Morse release trusts your key, and phones start counting your signature.
Keep Morse honest.
Applications are public issues on GitHub, because the list of witnesses is public too. Never post a key or anything private: we ask for what we need once we talk.
Operator questions.
What running a witness is like, including when things go wrong.
Can I lose my bond by going offline?
No. Only a signed lie touches your bond. Downtime costs pay, and if you’re on time for less than 95% of versions two weeks running, the next release stops pinning you.
What if my server is hacked?
Whoever holds your key can sign a lie with it, and your bond pays for it all the same. That’s why the key belongs in a hardware security module. Tell us at once and a hotfix release stops trusting it.
What if I restore an old backup?
Your witness won’t start without a last version it can trust, so a stale backup refuses to sign instead of signing a fork by accident.
Do I have to run Morse’s software?
No. Every version is also published as a C2SP checkpoint, so existing transparency-log witness software can sign it unchanged, and at least one pinned witness runs software Morse didn’t write. Morse’s own witness is a reproducible build: rebuild it and compare.
Could Morse outvote the witnesses?
No. Morse runs exactly one witness, bonded and slashable like any other, and the thresholds are set so it can never reach a majority, alone or with the directory.
Each app release names the witnesses phones trust. What’s on-chain decides who can bond and whose bond is slashed, never which keys a phone accepts.
Which chain is it on?
Solana. It checks Ed25519 signatures natively, which keeps proving a lie cheap. Bonds start in USDC and move to the Morse token.
What happens if Solana goes down?
Nothing that stops messaging. Your witness keeps signing, versions are posted once the chain is back, and phones only show a quiet warning after two hours without a public record.