# PivoHub on Each

> Each launch partner. Catalogue: starter catalogue until access to the PivoHub API. 

## Key facts
- The brand check is done by Each, with a fuzzy search of the PivoHub catalogue.
- The catalogue (brands, products, communities) is a starter catalogue until access to the PivoHub API.
- A brand claim stays "claim pending" until the brand's PivoHub account confirms it; it is not proof of ownership.
- "Proven" = backed by a verifiable signed proof; "declared" = stated without proof (e.g. an affiliation).
- A passkey proves who confirmed, not that the gesture happened.
- Brands: checking, claiming, reading and verifying proofs is free; brand plans, pricing to come.
- Public vs private, refusals and delays: see the FAQ.

## Brands
- Brasserie Exemple du Nord (Québec)
- Cidrerie Exemple du Verger (Québec)
- Distillerie Exemple de la Rivière (Québec)

## Products
- Blonde de démonstration · 473 ml · Brasserie Exemple du Nord
- IPA de démonstration · 473 ml · Brasserie Exemple du Nord
- Cidre sec de démonstration · 750 ml · Cidrerie Exemple du Verger
- Gin de démonstration · 750 ml · Distillerie Exemple de la Rivière

## Communities
- Local product fans
- Partner retailers
- Tasting events

## Public proofs
Affiliated people: 0
- No public proof yet. Affiliations are declared; proofs come only from gestures confirmed with a passkey.

Note: An affiliation is "declared": the person says they belong to the community, with no signed proof. Proofs come only from gestures confirmed with a passkey. So a person can be affiliated without any proof yet.

## Is your brand already here?
GET https://test.each.app/v1/pivohub/brands/check?name={name}: fuzzy search in the sample catalogue; if found, claim it with one passkey-confirmed gesture, then it stays "claim pending" until the brand's PivoHub account confirms it.

## How proofs are signed
- kid: each-test-2026-10-a · keys: https://test.each.app/.well-known/each-keys
- The signature covers the UTF-8 bytes of the canonical JSON of the "proof" object: keys sorted alphabetically at every level, no whitespace, arrays kept in order.
1. GET https://test.each.app/v1/proofs/{id}: you get "proof", "signature" (alg, kid, value) and "keys_url".
2. GET https://test.each.app/.well-known/each-keys and take the key whose "kid" equals signature.kid (EC P-256 JWK, x and y).
3. Serialize the "proof" object as canonical JSON (sorted keys, no whitespace), UTF-8 encode it.
4. Decode signature.value (base64url) to 64 bytes.
5. Verify with ECDSA P-256 + SHA-256 (e.g. crypto.subtle.verify). True = issued by Each and unaltered.
6. Shortcut: GET https://test.each.app/v1/proofs/{id}/verify (server-checked) or the page https://test.each.app/verifier/{id} (checked in your browser).

## FAQ
### Who confirms a brand claim, and how long does it take?
The brand's PivoHub account. The delay is unknown: for now, confirmation is simulated and always stays "claim pending".

### What happens if a claim is refused?
Not defined yet. The signed claim proof stays (the log is append-only) but never counts as proof of ownership; a refused status is planned, not built yet.

### How do you stop someone from confirming a fake gesture?
Honestly: today it cannot be prevented. A passkey proves WHO confirmed, not that the gesture happened. An Each proof says "this person states this and confirmed it themselves". Writes and gestures are rate-limited. Planned: brand validation, witnesses, moderation and stronger limits. No guarantee that the gesture is true.

JSON: https://test.each.app/en/m/pivohub.json
Français: https://test.each.app/m/pivohub/llms.txt