The post-quantum issuer

The classical scheme's privacy and soundness rest on discrete logarithms in an elliptic-curve group, which a large quantum computer would break. vole-act is a research implementation of the same idea on post-quantum footings: a MAYO trapdoor map in the role of the blind signature, and a VOLE-in-the-head zero-knowledge argument in the role of the sigma protocols. It keeps exact balance arithmetic, a one-time nullifier, and a fresh hidden commitment per spend.

MAYO is a multivariate-quadratic signature candidate in NIST's additional post-quantum signatures process. vole-act uses its trapdoor as a raw preimage relation on externally chosen targets rather than through the standard signing API; the proof layer commits witness bits over VOLE correlations in GF(2^128) and checks the balance relations with QuickSilver-style assertions. This issuer runs the MAYO2 parameter set with the Balanced proof profile.

Same deployment shape as the classical issuer

• Same JSON envelopes and endpoints, under /api/v1/pq instead of /api/v1/act; two extra spend fields (settlement and input_kind) select among the typed transitions below.
• Same proof-of-work issuance, same 1024-credit cap, same epoch.
• Same retry contract. vole-act builds it into the library: its store trait requires insertion of a nullifier's retry record as one linearizable operation returning the durable winner, and the issuer never releases a signature before that record is durable. This deployment implements the trait on the same Postgres store the classical issuer uses.

Deferred returns

The PQ scheme types its refundation. An ordinary spend fixes everything at proof time and always yields a direct token. A deferred-return spend commits the client to its fresh balance first, and only after verifying does the issuer choose the return t' in [0, s], which the response folds into a deferred-return token. Presenting that token later costs one extra hidden SHAKE evaluation. Four transitions are legal:

Every encoding carries explicit version, parameter, input-kind, and settlement tags, and both the Rust types and the wire decoders reject cross-mode use.

What it costs

Tokens stay small; requests do not. The proof of a spend is the expensive object. Wire sizes for the Balanced profile served here, from the library's benchmark snapshot:

Base64 in the JSON envelope adds a third on top, so the largest spend request is roughly 188 KB on the wire; the PQ routes accept bodies up to 256 KB. Compute is modest for both sides on modern hardware: in the library's snapshot on an Apple M4 Pro, client proving runs about 8 ms for an issue and 19 to 27 ms for a spend, and issuer verify-and-sign runs about 3 to 8 ms. Exact methodology and per-profile numbers are in the vole-act benchmarks.

Maturity, honestly

This scheme is research-grade, and the reasons are specific:

• Fiscal soundness needs a one-more-preimage assumption for the MAYO map. That is a novel assumption: it is not implied by MAYO's standard signature security, and it has not received independent analysis.
• The proof composition does not yet have a complete security reduction, and neither the design nor the implementation has had an independent audit. The full prover has not been through a constant-time review.
• Deferred-return proofs differ in shape and size from ordinary ones, so choosing that mode is visible and can partition the anonymity set.
• MAYO's NIST category labels do not transfer to this composition; vole-act has no NIST classification of its own.

This deployment runs it for exactly that reason: a public, adversarial exercise environment where the credits are worthless by design. It runs alongside the classical issuer, never instead of it, and nothing of value should depend on it. The construction and its adversarial review live in the vole-act repository.