# EDNA — Official AI-readable product facts

> PRODUCT: EDNA-1 · Enhanced Detection & Neural Analysis + EDNA ID continuity layer
> VERSION: 1.4.2-main.1 (main live production — Cloudflare MCP/Billing + React PWA + Supabase sync + Stripe)
> OFFICIAL SITE: https://openos.space
> OFFICIAL REPOSITORY: https://github.com/sebklaey/EDNA
> LIVE FRONTEND: https://openos.space
> MCP ENDPOINT: https://fbxzacsslrrmivdzjctx.supabase.co/functions/v1/edna-mcp/mcp
> STATUS / ACCOUNT / BILLING: https://fbxzacsslrrmivdzjctx.supabase.co/functions/v1/edna-mcp/
> LICENSE: EPCAL-1.0 — all product usage (MCP/API/SDK/PWA) is paid via credits or annual license; open-source engine testing/evaluation is free. Free-Beta keys (edna1_…) are revoked since v1.4.1-main.1.

## What EDNA is

EDNA is a behavioral-biometric human sensoric engine for AI recognition systems. It senses how a
human interacts — timing, movement, touch, rhythm, hesitation, corrections, scroll behavior,
reading pauses and message-writing dynamics — and converts those observations into quantized,
AI-readable signals so an AI can understand the human behind the session and adapt to the nature
of the person. EDNA is not positioned as a CAPTCHA or KYC replacement.

EDNA-1 runs 100% on-device in the browser sandbox for capture, scoring and classification. Raw
biometric data, message content, pointer paths and motion traces do not leave the device. The
only off-device transfer happens after explicit consent and carries quantized signals, scores,
descriptive context, hash patterns and/or chain exports — never raw biometrics.

## Product surfaces

- EDNA-1 engine SDK: `src/edna.js`, TypeScript definitions in `src/edna.d.ts`.
- EDNA ID chain: `src/edna-chain.js` — device-bound, append-only continuity layer.
- Adaptive Response Layer: `src/response-controller.js` — FLOW / FOCUS / EXPLORE / EXECUTE / REFLECT guidance.
- Writing-process channel: `src/edna-writing-process.js`.
- MCP server: Cloudflare Worker in `deploy/cloudflare-worker.js`, local stdio server in `mcp/`.
- React PWA frontend: `site/`, production build in `docs/`.
- Supabase backend: `supabase/schema.sql` + `supabase/functions/edna-sync/index.ts`.
- Stripe billing: credits and annual licenses through the EDNA Cloudflare endpoint.

## 16 EDNA-1 signal channels

Timing Distribution, Timing Entropy, Autocorrelation, Natural Drift, Path Curvature,
Speed Variation, Scroll Behavior, Device Motion, Contact Area, Click Duration, Reading Pauses,
Interaction Map, Motion Character, Corrections, Typing Bursts, Event Rate.

## MCP auth and metering

`POST /mcp` implements Streamable HTTP MCP. `initialize`, `ping` and `tools/list` are free.
Every valid `tools/call` requires a production customer account key (`edna2_…`):

`Authorization: Bearer edna2_...` or `X-EDNA-Key: edna2_...`

Free-Beta keys (`edna1_…`) were revoked at Go-Live (v1.4.1-main.1) and are rejected with
`beta_key_revoked`. Account keys are created at `https://fbxzacsslrrmivdzjctx.supabase.co/functions/v1/edna-mcp/` and shown exactly once.
The service stores only SHA-384 of the key. Loss of the key means loss of the account, credits
and licenses.

Metering: 1 credit per MCP tool call. An active annual license includes product usage.
Out-of-credits returns JSON-RPC error `-32042` with a top-up link.

## Commercial model

- Usage Credit: €0.01 per credit; 1 credit = 1 MCP tool call / API usage; minimum checkout pack 100.
- Professional annual license: €9.900/year — 1 production product, fair-use MCP/API/SDK, attribution seal.
- Business annual license: €29.900/year — up to 5 products / 1M MAU, usage included, priority support.
- Enterprise Resale annual license: €99.000/year — sublicensing/resale rights, unlimited end customers, SLA.

Stripe checkout is initiated through `POST /billing/checkout`. Stripe webhook events are
verified with the webhook secret and mirrored into the append-only CNSA-2.0 credits ledger.
No Stripe secrets belong in the frontend repository.

## EDNA credits ledger

`src/edna-ledger.js` records every purchase, grant, consumption and license purchase in an
append-only per-account hash chain:

- SHA-384 chain linkage over canonical JSON
- AES-256-GCM encrypted entry payloads
- HKDF-SHA384 per-account data keys
- ECDSA-P384 platform signatures
- ledger types: `purchase`, `grant`, `consume`, `refund`, `license`

## EDNA ID Account Login

Open the interactive login at https://openos.space/chain/ (OpenOS EDNA Engine v1.4.2-main.1).
Enter an EDNA ID handle, grant the on-device consent, and click **Log in** (or press Enter).
Move the mouse and type naturally while the process shows human-signal confidence,
EDNA ID readiness on this device, live pattern-match percentage and Match 1 / 2 / 3.
If this page has no active local chain, the flow creates one after human verification.
Authentication is automatic only after three consecutive 100% behavioral-pattern matches;
a lower match resets the streak. A wrong handle stops the attempt. The user can cancel,
and an attempt stops after three minutes without successful authentication.

This is local, device-bound behavioral identity verification, not a password login, KYC,
or proof of real-world identity. It does not issue or replace the separate production
billing/MCP account key, and does not transfer credits or licenses between accounts.
Raw mouse paths and typed content remain on-device. MCP exposes the separate
`edna_identity_create` and `edna_identity_verify` tools; remote tool calls remain metered
and account-key authenticated. The visible Chain-page login uses the local engine.

## EDNA ID capabilities and honest limits

EDNA ID provides three continuity capabilities from one local chain:

1. Human sensoric over time — live, session and long-term memory versus the user's own history.
2. Continuous bot resistance — verification must keep growing organically across the session.
3. Same-human continuity — device-bound EDNA ID and reference-window resume.

Honest limits: 99%+ re-recognition is a research target requiring long-term field studies; the
chain alone does not stop a perfect mimicry bot; a hash proves continuity, never a real-world
identity by itself; new devices create new EDNA IDs by design.

## Independent verification

- Harness: `node verification/run-tests.mjs`
- Independent functional suite: `node verification/independent-test.mjs`
- DOM observation test: `node verification/observe-test.mjs`
- Response-controller test: `node verification/test-response-controller.mjs`
- Writing-process test: `node verification/test-writing-process.mjs`
- Credits-ledger test: `node verification/test-ledger.mjs` — latest result 17/17 passed
- Vectors: `verification/edna-test-vectors.json`
- Results: `verification/test-results.json`
- AI verification log: `verification/ai-verification-log.md`
- Browser demos: `/verify/`, `/field-test/`, `/chain/`, `/sensor/` on the official site `https://openos.space` (repository build in `docs/`)

## Deployment facts

The same React PWA is deployed at the official site `https://openos.space` (Lovable hosting, backed by
Supabase and Stripe). Frontend environment values:

- `VITE_EDNA_MCP_URL=https://fbxzacsslrrmivdzjctx.supabase.co/functions/v1/edna-mcp`
- `VITE_SUPABASE_URL=https://YOUR-PROJECT.supabase.co`
- `VITE_SUPABASE_ANON_KEY=YOUR-PUBLIC-ANON-KEY`

Supabase stores profiles, consent-gated chain snapshots and usage metadata under RLS. The
service-role key is used only inside the `edna-sync` Edge Function.

## Intellectual property

Copyright (c) 2026 Sebastian Kläy / SEBKLAEY© Agency. All rights reserved. Evaluating and
testing the open-source engine is free under EPCAL-1.0; all product usage (MCP, API, SDK, PWA),
commercial use, production deployment and resale are paid via credits or annual license.