Qorlatest release · capture-card recorder for QorTime
HDMI in. Hash chain out.
A lean Windows recorder for your capture card. Every ~2 s segment is SHA-256 chained and checkpointed in QorTime's format. It reads the Madden 27 scorebug, confirms the final from the end-of-game menu, and can submit the match to the official QorTime referee, which re-checks it on its own before it signs anything. If the card freezes or gets replugged, it reopens itself.
01 · Signal to seal
From HDMI to a receipt in six moves.
Scroll to run the pipeline. Each stage is something QorCap actually writes to disk or serves on its local API.
Signal → Seal
The card
Your console's HDMI hits a USB capture card. QorCap opens it over DirectShow and drives ffmpeg as a child process: constant frame rate, hardware H.264 (h264_mf), AAC.
Segments
The stream is cut into fragmented MP4 segments of about 2 seconds, flushed as they're written. A power cut loses at most the last fragment.
The chain
Each segment's exact bytes get a SHA-256, linked to the previous head and appended to manifest.jsonl. Change one byte anywhere and every later link stops matching.
Checkpoints
On segments, score changes and finals, QorCap emits checkpoints in QorTime's format, served at /checkpoints and streamed over SSE, ready for a referee to co-sign.
Receipt
At the whistle it writes a match bundle (bundle.json, clips, receipt.draft.json) and Start Match signs receipt.json on this PC. Signed locally, it verifies as SELF_ATTESTED.
Verify
qorcap verify-bundle rehashes everything and catches any changed byte. For an independent verdict, qorcap submit sends the bundle to the official QorTime referee.
02 · Local API
Watch the chain grow.
QorCap serves a small HTTP API on 127.0.0.1:8788 only. QorTime's agent and referee tooling subscribe to the checkpoint stream over Server-Sent Events.
/statusfps, dup/drop frames, part/checkpointsSSE stream/challengereferee nonce/eventsscore / final from reader/snapshot.jpg4 fps frameSimulated in your browser with real SHA-256 (WebCrypto). The field layout is illustrative, not byte-for-byte QorCap output. No data leaves this page.
- received_wall_ms
- —
- segment_seq_at_receipt
- —
- chain_head_at_receipt
- —
- stamped
- —
SIMULATION The button pattern here is illustrative; QorCap uses a port of QorTime's pattern_for(nonce).
03 · Live official challenges
A nonce, pressed on the pad.
Start the match with --official-challenges and the QorTime referee issues three signed, timed challenges: game start, second half and Q4. Each one appears only when Madden lets you pause, after the kickoff and a play call, never during a kickoff. You answer it at the line, before the snap, with a button pattern on the controller (90 seconds). The pattern can't be known before the referee issues its nonce, and each challenge carries a chain-head anchor showing the earlier video already existed.
Between challenges, QorCap has the referee timestamp the chain head every 60 s (--no-anchors turns it off). Without official challenges the best official result is PARTIAL: the referee can show the bytes are what you recorded, not that they were recorded live.
QorCap's 2026-10-16 sync report lists official challenges on a real DualSense as not yet exercised in a real match. Local challenges still work too: a nonce sent to POST /challenge is checkpointed, and with --stamp it's burned into the video itself.
04 · Scorebug profiles
The scorebug calls the clips.
QorTime's own scorebug reader runs inline on a 4 fps snapshot, and each agreed score change saves a clip from the in-RAM replay ring. When the standard layout isn't on screen, QorCap tries its Monday Night reader; whichever reads becomes the active profile, and the receipt records it as match.scorebug_profile.
madden27_standardsupportedmadden27_monday_nightsupported · v0.3.5Sunday NightuntestedThursday NightuntestedSunday Night and Thursday Night presentations are not verified. They read as layout_unknown, so no score is recorded from them. Other games: none.
SIMULATION Mock scorebug, not real game footage.
- 01Scorebug reads Q4
0:00candidate final - 02Madden end-of-game menu detectedpanel beside FINISH GAME
- 033 consecutive menu frames agree≥ 400 ms
- 04Equals the last scorebug read, or one legal scoring play past itelse unconfirmed
- ◆Final score locked
final_confirmed: true
Illustrative sequence of the rules QorCap applies. No real match data.
05 · Final read, confirmed
The final is read, not guessed.
The scorebug can vanish before the last play's points are drawn, so QorCap reads the final from Madden's end-of-game menu, with the same template-digit method as QorTime's reader and every digit cross-checked. Only a stable read sets result.method = "end_menu_read" and final_confirmed: true.
A scorebug-only final stays unconfirmed, and Start Match keeps recording up to 120 s for the menu. On online matches the name tags cover the away score, so the menu can only corroborate the scorebug's final, never read a new one. A one-play jump past the last scorebug read needs corroborating evidence (a score-change clip, haptics or inputs near the score). If the live read misses it, Start Match checks the recording's last minutes at stop, and Finalize Last Match can redo it offline.
06 · Submit for Verification
Metadata, then video on request.
A bundle signed only by your laptop is SELF_ATTESTED. To aim for VERIFIED, double-click Submit for Verification, answer y at the end of Start Match, or run qorcap submit. No account is needed: the request is signed with this PC's install key, the same device key that recorded the match.
- 1
QorCap fetches a single-use nonce, solves a small proof-of-work and signs the request and the bundle's manifest hash with the install key.
- 2
It uploads the small metadata only: manifest, checkpoints, inputs, receipts. No video yet.
- 3
The referee re-checks every chain and signature itself, commits to them, then picks segments: the init segment, the last 240 s, segments around each challenge and 16 random ones.
- 4
QorCap uploads those. The referee hashes the bytes against the chain, re-reads the final with QorCap's own readers and re-runs the challenges. Only if every check passes does it countersign.
# from the match folder, or double-click Submit for Verification.cmd # or by hand qorcap submit "<bundle dir>" # --full upload every segment, not a spot-check # --yes skip the confirmation prompt # on success the bundle gains receipt.official.json verify.official.txt # plus the referee's transparency-log entry number # QorCap 0.3.9 and older can no longer submit: # HTTP 426 QorCap 0.3.10 or newer is required
07 · The official referee
One root, kept offline.
The QorTime referee's root key qortime-v1 stays offline. It signs a short-lived delegation for an online key, and that online key does the countersigning. Every countersigned receipt goes into a public, hash-chained transparency log. QorCap checks the delegation and the revocation list locally before it uploads anything.
qortime-v1
Signs delegation certificates and the revocation list. Never online.
≤ 90 days
Scope official-review. Caps the verdict at VERIFIED or PARTIAL. Revocable with one root-signed entry.
Countersigns
Signs only after its own review passes. Refuses to sign outside the cert's window.
Append-only
Each receipt is logged before release. The log head is anchored in the QorTime repo.
Official key, every check passes, and the game-start, second-half and Q4 official challenges re-verify, with enough motion.
Official key, but a check is only partial, a phase has no passed official challenge, or motion is too low.
The referee key isn't on QorTime's allowlist, or is revoked. Every local Start Match receipt lands here.
Any failed check, a missing or forged review, a bad chain signature, or any normal verify failure.
Rules from QorTime's REFEREE_SERVICE.md, REFEREE_KEYS.md and TRUSTED_REFEREES.md. The Python and browser verifiers apply the same rules.
08 · Supporting evidence
Extra signals, labelled.
Alongside the video chain, QorCap records evidence that helps a reviewer, and says plainly what each piece is worth.
Game audio levels
Start Match records 4 s of the card's audio before the match (audio_precheck.json), and Start Match and Finalize measure the recorded audio (audio_check.json). A silent card gets a loud warning with the likely fixes.
Inputs on the video clock
With the DualSense on the PS5 over Bluetooth and USB-plugged into the laptop, QorCap logs its HID reports to inputs.jsonl. Each chunk's hash goes into that segment's checkpoint, so the inputs are part of the chain. Advisory evidence, not proof
Rumble from the IMU
The PS5 sends rumble over Bluetooth, which the laptop can't see, so QorCap watches the pad's gyro and accelerometer for vibration bursts (haptics.jsonl). Advisory evidence, not proof
The input proof's human-likeness score is a hand-set heuristic, and input-video alignment is reported against a chance baseline. Neither shows who held the controller.
09 · Tamper demo
Flip one byte. Break the chain.
These are six tiny "segments" hashed live in your browser. Tap any byte to flip it, then watch verify-bundle find the exact break. Gold means sealed and matching.
10 · Why not OBS
Freezes are survivable now.
The usual failure: a cheap capture card's driver hangs, and the recorder sits on a frozen device forever. QorCap runs ffmpeg as a child process, so a hung driver can only freeze ffmpeg, never QorCap. A watchdog kills the child after 4 s without data and reopens the card. The recording continues in video.part2.mp4, and the chain carries on across parts.
Typical recorder
- Hangs with the driver
- Replug often needs restart
- No integrity record
- Big general-purpose install
QorCap
- Watchdog kills & reopens
- Polls for replugged card
- Chain continues across parts
- One small exe + ffmpeg
11 · How it fits QorTime
QorCap records. QorTime signs.
QorCap is the capture half. It produces evidence; QorTime's referee re-checks it and signs, and anyone can check the result on the QorTime verifier. More on the QorTime site and in the QorTime repo.
QorCap and QorTime share one contracts registry. The canonical copy lives in QorTime's schema/contracts/ (compat.json plus JSON Schemas), and QorCap vendors a byte-identical copy in contracts/ with SHA256SUMS and CONTRACTS_PIN. Tests on both sides fail on drift. Each release zip bundles a pinned QorTime copy, and the official referee accepts submissions only from QorCap 0.3.10 or newer. Details in the sync report.
12 · Quickstart
Double-click Start Match.
Unzip, plug the PS5 into the USB3.0 Video card, double-click Start Match. On its initial run it downloads ffmpeg and sets up Python by itself. One window shows the score, clock, segments and clips; it stops when the final is read from the end-of-game menu (or press Enter), signs the receipt, verifies it, offers to submit it and opens the match folder. No card handy? Double-click Test Without Card.
Trust level: a receipt signed only on your PC is SELF_ATTESTED. It proves the video wasn't changed after recording, not who held the controller. For an official verdict, submit it to the QorTime referee.
# 1. unzip the release zip (e.g. to C:\QorCap) # 2. PS5 HDMI -> USB3.0 Video card -> blue USB 3 port # 3. double-click (add --official-challenges to aim for VERIFIED) Start Match.cmd # the window ends with RESULT: SELF_ATTESTED Video check: OK - every video byte matches the hash chain Submit for Verification: ... Submit now? [y/N] # later, from any match folder Submit for Verification.cmd # no card? dry run with a test pattern Test Without Card.cmd
13 · Honest limits
What it doesn't prove.
QorCap is evidence about footage, not about people. Here is exactly where the line is.
Integrity & timing
Which exact video bytes, in what order, seen when. With official challenges and anchors, the official referee ties the chain to real time.
Who is playing
No proof of player identity. Inputs and haptics show a controller plugged into this laptop was in use, not who held it.
Software keys
Install keys are software Ed25519 keys with no hardware attestation. They bind a submission to the recorder and deter floods; they don't prove a genuine device.
Spot-check
By default the referee inspects the tail, the challenge windows and 16 random segments. A laptop missing a fraction f of segments passes the random part with probability (1−f)16. Unsampled content isn't inspected. --full uploads everything.
Pre-capture edits
Footage fabricated or edited before QorCap hashed it, outside anchored windows, isn't detected. The local countersignatures on your PC don't prove liveness.
Windows only
Windows x64, DirectShow, tuned on one generic "USB3.0 Video" card. Madden 27 only; Sunday Night and Thursday Night scorebugs are untested.
Heuristics
The human-likeness score and haptic thresholds are hand-set, not trained. The referee re-checks input hashes and counts, but doesn't re-run that model.
No chain, no token
Nothing goes on a blockchain. The "chain" is a SHA-256 hash chain in local files; the referee's transparency log is a hash-chained file it publishes.
Simulations, labelled
Every live-looking demo here runs in your browser. No stats, no testimonials, no real match data.