Peer qualification

This is a pilot qualification flow, not a claim that you are an independently verified peer and not E1 evidence. The result is a locally signed self-declaration about your access network; the server adds the ASN/network it observes and applies the published rules.

1. Download the signed kit

The current kit is version 1.0.1. It contains one portable Python helper and a static sphere-probe binary for Linux x86_64 and aarch64/Termux.

Verify before running:

curl -O https://sqhere.org/kit/sphere-peer-kit-1.0.1.tar.gz
curl -O https://sqhere.org/kit/SHA256SUMS
curl -O https://sqhere.org/kit/SHA256SUMS.sig
curl -O https://sqhere.org/peer-kit/peer-kit-release.pub
openssl pkeyutl -verify -rawin -pubin -inkey peer-kit-release.pub \
  -in SHA256SUMS -sigfile SHA256SUMS.sig
sha256sum -c SHA256SUMS
tar xzf sphere-peer-kit-1.0.1.tar.gz

The kit is a signed release, not a promise of production support. The canonical public source repository is still pending (/docs/code/); the archive is a pinned research artifact.

2. Run locally

You need outbound UDP and no root or inbound port. Run sphere-probe serve on a two-address, two-port probe server, then pass its primary and alternate ip:port values to the kit. The alternate is the other address and the next port, as printed by the server.

cd sphere-peer-kit-1.0.1
./qualify.py \
  --primary 203.0.113.10:40000 \
  --alternate 203.0.113.11:40001 \
  --access mobile \
  --provider 'Example Mobile' \
  --data-budget-mib 3300 \
  --access-window 2026-11-12T00:00Z/2026-11-19T00:00Z \
  --independent \
  --output qualification.json

--independent is a self-declaration that you own or control the access network and are not a cloud/VPS or a project-controlled machine. It is not verified. For a fixed line, use --access fixed; a metered mobile line must declare at least 3300 MiB. Do not run the kit on a network you do not control or have permission to use.

Termux

pkg install python openssl-tool curl tar
tar xzf sphere-peer-kit-1.0.1.tar.gz
cd sphere-peer-kit-1.0.1
./qualify.py ...   # aarch64 binary is in bin/linux-aarch64/

Termux needs no root. The bundled aarch64 binary is static; keep the phone on Wi-Fi unless you have explicitly budgeted a mobile test.

Why not Docker bridge networking

A Docker bridge adds a virtual NAT layer between the probe and the access network. It changes the observed mapping and filtering behaviour, so the classified result would describe the container network, not the consumer line. A host-network container does not fix the ownership and observation problem; use the kit directly on the host.

3. Submit

./qualify.py ... --submit https://sqhere.org/api/qualify

Or upload qualification.json through the form below. There is no email, account, home address or human conversation. The envelope is signed with a local Ed25519 key; the private key stays on your machine (default ~/.config/sphere/peer-key.pem, mode 0600).

The endpoint rejects unclassified submissions, cloud/VPS network organizations, duplicate networks, mobile budgets below 3300 MiB, invalid signatures, undeclared independence and more than one submission per public key per hour. A successful response is a pilot candidate, not a verified independent peer.

Data retention and fields

The endpoint receives the signed envelope: class, access type, self-declared provider, optional declared ASN, data budget, independence declaration, access window, probe version and the pseudonymous public key needed to verify the signature. It does not receive an email, account, home address, private key or endpoint key. It does not store the submitter's IP address.

The retained record is: submission id (hash), class, access type, provider, ASN, ASN organization, data budget, access window, probe version and server timestamp. The record expires after 30 days; a rate-limit marker expires after 1 hour and a duplicate-network marker after 30 days. No raw submission, public key or per-submission record is published. Aggregate counts may be published; the exact fields above are the only result fields retained.