How it works
A unit in transit receives its document at enrolment, is bound to the object through its physical signature and builds up a history anyone can verify with standard tools, without depending on the registry.
Whoever enrols sends the unit profile (parcel, loaded pallet, mail bag…), the capture class (station, phone with SDK, third-party device or API) and, optionally, dimensions, weight, evidence and an SSCC or other references. Evidence can be uploaded or sent only as SHA-256 fingerprints if the client keeps it. They declare they upload no personal data outside the images.
The registry generates 60 random bits, checks they do not exist and issues the PID with its two check symbols. It returns the owner key (pidk_…) only once: it gives full control over that unit and nothing else. Stations without network use blocks of PIDs reserved in advance by certified devices.
The unit’s “biometrics” are computed: geometry, weight, 3D shape, cardboard texture patches at fixed positions, tape path, label layout, appearance and damage map. A compact object with no personal data: never OCR text or label crops.
Everything goes into a record in canonical JSON (RFC 8785). Its SHA-256 fingerprint is signed by the device (optional, raises the level) and always by the registry (Ed25519), and enters an append-only ledger. Each UTC day closes into a Merkle tree (RFC 6962), a statement signed and chained to the previous day’s, and a Bitcoin anchor via OpenTimestamps.
The ID resolves at its URL, by QR or by API. Anyone sees whether it exists, when it was enrolled, with what class and level, its status, its lineage, the last verified sighting and the fingerprints to verify the record. Never images, dimensions, weight, private references or who enrolled it. A publicly linked SSCC resolves at /00/{SSCC}.
A new capture of the same unit claims the ID and is compared 1:1 with the enrolment signature: match, review or no match, with a score per feature and an explanation. A “no match” is recorded too. It is an operator service.
A unit is a state, not an object. If it is opened, consolidated, split or repacked, a new PID is born linked to its parents, which become “superseded”. The full history is followed through the graph.
Scope
PARCID is the identity of what travels: physical units in transit with no permanent issuer. A thing enters the registry when it meets four conditions at once.
No serial number of its own and no registry that already identifies it.
It is closed, opened, consolidated or repacked along the way.
It passes through different hands: sender, warehouse, carrier, recipient.
From hours to months: born when sealed, gone when delivered.
| Profile | What it is | Scope in v0.1 |
|---|---|---|
parcel | Box, envelope, drum or closed package travelling as one piece | Core: levels 0 to 3, station capture |
pallet_load | A loaded pallet: the stacked, wrapped load, not the wooden pallet | Levels 0 to 2; own features in v0.2 |
container_load | The load stowed inside a shipping container | Levels 0 to 2; own features in v0.2 |
tote | Tote, cage, roll container, barrel: returnable packaging | Levels 0 to 2; own features in v0.2 |
bag | Mail sack, diplomatic pouch or luggage | Levels 0 to 2; own features in v0.2 |
crate | Transport crate for art, instruments or machinery | Levels 0 to 2; own features in v0.2 |
A parcel travels on a pallet and the pallet in a container: the registry identifies the load at each level, not the permanent receptacle. The container already has its BIC code (ISO 6346) and its seal; they come in as links of the PID.
The van or truck gets no PID: it has a VIN and a plate, and the plate identifies a person. It comes in as the unit’s custodian, with an opaque reference, never the plate in clear.
A bag tag is issued for each trip; the suitcase is the same on every one. With the bag profile, the suitcase keeps its PID and the trip’s tag is linked as bag_tag.
PARCID does not identify things in general: it identifies units while they travel, and gives them context with whatever already has its own registry.
Anatomy of a record
With the record, the registry’s public key and the inclusion proof, anyone recomputes the fingerprint, checks the signature, follows the Merkle path up to the day’s root and checks that the daily statement is signed, chained and anchored in Bitcoin.
Assurance levels
No physical feature is unique the way a fingerprint is. Every enrolment states how it was captured and at what level. A unit enrolled at level 1 that passes through a station obtains a level-3 sighting, and its resolution shows the best level reached.
unverifiedAPI enrolment with no device signature and no verified evidence.
signedEd25519 signature with the client key, valid sequence, at least 2 evidence items with hash, dimensions or weight.
attestedThe above + device attestation or certified device + freshness nonce + physical signature with texture patches.
stationThe above on a registered station with normalised geometry, calibrated scale, point cloud and multi-sensor coherence + RFC 3161 timestamp.
| Level | What is uploaded | What it tells apart |
|---|---|---|
| Minimum (L0) | Nothing mandatory except the capture class. Optional: dimensions and weight. | Only the document: useful to link references (an SSCC, a tracking number), not to recognise the unit. |
| Basic (L1) | Dimensions and weight with tolerances, 2 photos (top and perspective) or their hashes, client Ed25519 signature. | Separates the parcel from most of those travelling the same day on the same route. |
| Recommended (L2) | The above + texture patches at 4 fixed positions, tape path, label layout (without its content), device attestation, freshness nonce. | Separates two factory-identical boxes freshly sealed. |
| Station (L3) | The above in normalised geometry (origin 0·0·0, rulers, fixed cameras, own lighting) + point cloud + calibrated scale + multi-sensor coherence. | Comparable across machines and over time: the parcel’s “passport photo booth”. |
Lineage
A box that is closed, opened, unpacked or repacked is not the same unit: they are different states, each with its own PID, linked by records signed by whoever performs the operation. The child is born with its own key.
| Operation | Parents → children | Parents’ status |
|---|---|---|
open | 1 → 1 (the same box, opened and closed again) | superseded |
repack | 1 → 1 (another box) | superseded |
consolidate | N → 1 | all superseded |
split | 1 → N | superseded |
attach | 1 → 1 (the same object gains a higher-level capture) | stays active: it is a sighting, not lineage |
What is not identity
Set by the carrier, reused and copied.
Identifies the logistic unit of a shipment, not the physical unit or its state. It comes in as a first-class key and resolves at /00/{SSCC}.
It is personal data and gets reprinted. It never enters the registry.
What is free and what operators provide