GAL-2 Quickstart

Test the API. Then run the Time Contract locally.

GAL-2 is an application-facing temporal governance layer. Start by verifying your API key against the upstream GAL-2 API, then install the local Time Contract daemon and query http://127.0.0.1:9095/contract.

Important: the upstream API returns governed time. The full GAL-2 Time Contract runs locally as a daemon and exposes the contract fields your application uses before committing time-dependent state.

Live API key test

Test your GAL-2 API key in the browser.

Paste your GAL-2 API key below to call the upstream production API: https://api-v2.gal-2.com/time. The key is not stored by this page. It is used only for this browser request.

This tests the upstream API only. The full application-facing Time Contract is served locally by the daemon at http://127.0.0.1:9095/contract.

Waiting for API key. 
{
  "status": "waiting",
  "message": "Paste a GAL-2 API key and click Test API key."
}

If your browser blocks the request because of CORS, your key may still be valid. Use the curl command below as the reliable fallback: 

curl -s \
  -H "x-api-key: YOUR_GAL2_API_KEY" \
  https://api-v2.gal-2.com/time | python3 -m json.tool
01

Verify the upstream API

Use your GAL-2 API key to test the production API and confirm access to the upstream governed timeline. 

export GAL2_API_KEY="YOUR_GAL2_API_KEY"

curl -s \
  -H "x-api-key: $GAL2_API_KEY" \
  https://api-v2.gal-2.com/time | python3 -m json.tool
02

Query the local Time Contract

After installing and activating the daemon, your application consumes the local contract endpoint. 

curl -s http://127.0.0.1:9095/contract | python3 -m json.tool

Example API response

Inspect the governed time output.

The upstream API confirms that your request reached GAL-2 authority. The exact response can evolve, but the API path is the upstream source used by the local daemon. 

{
  "gal2_time": "2026-05-27T17:34:38.399767Z",
  "utc_time": "2026-05-27T17:34:38.404894Z",
  "drift": {
    "base_ms": -7.83,
    "wobble_ms": 4.134,
    "live_ms": -5.127
  },
  "fractal_factor": 3.761473,
  "source": "fractal+secret(hmac)+ema"
}

The upstream API response includes governed time plus engine metadata. These fields help expose API behavior and runtime conditions, but they are not a metrological UTC certification claim. The full local Time Contract adds application-facing fields such as safe_to_consume, mode, reason, valid_until, monotonic_sequence, and source_lineage.

Free evaluator downloads

Download GAL-2 Time Contract RC5.8 for macOS or Linux.

The evaluator download is free. Activation requires a GAL-2 API key. Without a key and without cache, the daemon is expected to report WARMING, reason warming_no_cache, and safe_to_consume=false.

RC5.8 / 1.2.0-rc.3 is the active evaluator preview. The macOS artifact is a customer-installable package trusted by Apple notarization. The Linux artifact is a Docker ARM64 evaluator bundle with detached GPG signature, corrected internal SHA256SUMS, real API LIVE witness evidence, and verifier boundary checks. IXOYE remains advisory-only and does not affect safe_to_consume.
macOS

Developer ID signed, Apple-notary-trusted package with daemon runtime and IXOYE observer support.

Download for macOS
macOS latest SHA256SUMS
Linux Docker ARM64

Docker ARM64 evaluator bundle with detached GPG signature and corrected public payload.

Download for Linux
Linux latest Linux GPG signature Linux public key
Release README Public index Master index

macOS activation

Install, activate, and test the local daemon.

Download the macOS package, verify SHA256, install the notarized package, add your GAL-2 API key, restart the daemon and IXOYE observer, then query the local endpoints. 

curl -L -O https://gal2-marketplace-assets.s3.amazonaws.com/public/time-contract/v1.2.0-rc5.8/downloads/mac/GAL2_TimeContract_RC58_1_2_0_RC3_macOS_PersonalSigned_LiveIXOYE_VerifierFix_NOTARIZED_STAPLED.pkg
curl -L -O https://gal2-marketplace-assets.s3.amazonaws.com/public/time-contract/v1.2.0-rc5.8/downloads/SHA256SUMS.txt
shasum -a 256 GAL2_TimeContract_RC58_1_2_0_RC3_macOS_PersonalSigned_LiveIXOYE_VerifierFix_NOTARIZED_STAPLED.pkg
grep "mac/GAL2_TimeContract_RC58_1_2_0_RC3_macOS_PersonalSigned_LiveIXOYE_VerifierFix_NOTARIZED_STAPLED.pkg" SHA256SUMS.txt
sudo installer -pkg GAL2_TimeContract_RC58_1_2_0_RC3_macOS_PersonalSigned_LiveIXOYE_VerifierFix_NOTARIZED_STAPLED.pkg -target /
printf "Enter GAL-2 API key: "
stty -echo
IFS= read -r GAL2_API_KEY
stty echo
printf "\n"
sudo mkdir -p /etc/gal2
cat </dev/null
GAL2_API_KEY=$GAL2_API_KEY
GAL2_API_URL=https://api-v2.gal-2.com/time
GAL2_BIND_HOST=127.0.0.1
GAL2_BIND_PORT=9095
GAL2_REQUESTS_LIMIT=100000
EOF
sudo chmod 600 /etc/gal2/daemon.env
sudo chown root:wheel /etc/gal2/daemon.env
unset GAL2_API_KEY
sudo launchctl kickstart -k system/com.gal2.daemon
sudo launchctl kickstart -k system/com.gal2.ixoye.observer
curl -s http://127.0.0.1:9095/status | python3 -m json.tool
curl -s http://127.0.0.1:9095/contract | python3 -m json.tool
curl -s http://127.0.0.1:9095/witness | python3 -m json.tool

Linux Docker ARM64 activation

Load the evaluator image and test the local Time Contract.

Download the Linux Docker ARM64 evaluator bundle, verify SHA256 and GPG signature, load the Docker image, run it with your own API key, and query the local contract endpoint. 

curl -L -O https://gal2-marketplace-assets.s3.amazonaws.com/public/time-contract/v1.2.0-rc5.8/downloads/linux/GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip
curl -L -O https://gal2-marketplace-assets.s3.amazonaws.com/public/time-contract/v1.2.0-rc5.8/downloads/linux/GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip.asc
curl -L -O https://gal2-marketplace-assets.s3.amazonaws.com/public/time-contract/v1.2.0-rc5.8/downloads/keys/GAL2_RELEASE_SIGNING_PUBLIC_KEY_2F9528A0EE6D77170B6947FF9CAB67A8AFA08B75.asc
curl -L -O https://gal2-marketplace-assets.s3.amazonaws.com/public/time-contract/v1.2.0-rc5.8/downloads/SHA256SUMS.txt
shasum -a 256 GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip
grep "linux/GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip" SHA256SUMS.txt
gpg --import GAL2_RELEASE_SIGNING_PUBLIC_KEY_2F9528A0EE6D77170B6947FF9CAB67A8AFA08B75.asc
gpg --fingerprint 2F9528A0EE6D77170B6947FF9CAB67A8AFA08B75
gpg --verify GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip.asc GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip
mkdir GAL2_RC58_LINUX_EVALUATOR
unzip GAL2_RC58_LINUX_DOCKER_ARM64_EVALUATOR_BUNDLE_REAL_API_VERIFIED_20260615T232743Z.zip -d GAL2_RC58_LINUX_EVALUATOR
cd GAL2_RC58_LINUX_EVALUATOR
gzip -t image/gal2-timecontract_rc58_linux_arm64_verifierfix_boundary_enforced_image.tar.gz
docker load -i image/gal2-timecontract_rc58_linux_arm64_verifierfix_boundary_enforced_image.tar.gz
printf "Enter GAL-2 API key: "
stty -echo
IFS= read -r GAL2_API_KEY
stty echo
printf "\n"
docker run --rm --platform linux/arm64 \
  --name gal2-rc58 \
  -p 127.0.0.1:9095:9095 \
  -e GAL2_API_KEY="$GAL2_API_KEY" \
  -e GAL2_API_URL="https://api-v2.gal-2.com/time" \
  -e GAL2_BIND_HOST="0.0.0.0" \
  -e GAL2_BIND_PORT="9095" \
  -e GAL2_REQUESTS_LIMIT="100000" \
  gal2-timecontract:rc58-linux-arm64-verifierfix

From another terminal, verify the local endpoints: 

curl -s http://127.0.0.1:9095/status | python3 -m json.tool
curl -s http://127.0.0.1:9095/contract | python3 -m json.tool
curl -s http://127.0.0.1:9095/witness | python3 -m json.tool

Expected Time Contract fields

The local contract is the application boundary.

Applications should evaluate the contract before time becomes logs, ordering, expiration, authorization, settlement, workflow state, or committed state. 

{
  "schema": "gal2-daemon-time-contract-v1",
  "version": "1.2.0-contract-rc.3",
  "safe_to_consume": true,
  "mode": "LIVE",
  "health": "green",
  "reason": "fresh_api_sync",
  "valid_until_basis": "last_good_sync_plus_contract_live_valid_sec",
  "monotonic_sequence_semantics": "per_contract_serve",
  "source_lineage": [
    "gal2_api",
    "gal2_daemon_rc3_base",
    "rc4_72h_holdover_policy",
    "rc5_ixoye_witness_contract"
  ],
  "witness_ref": {
    "discovery": "/witness",
    "layer": "IXOYE",
    "role": "out_of_band_attestation",
    "policy": "advisory_only",
    "effect_on_safe_to_consume": "none"
  }
}
Backed by the GAL-2 API. Served locally by the daemon. Checked before commit.

Expected IXOYE witness boundary

IXOYE observes. GAL-2 governs.

IXOYE is advisory-only. It observes contract coherence out-of-band, but it is not a time source, not a fallback source, and does not decide safe_to_consume. 

{
  "schema": "gal2-witness-advisory-v1",
  "policy": "advisory_only",
  "mocked": false,
  "effect_on_safe_to_consume": "none",
  "safe_to_consume_authority": "GAL2_Time_Contract_policy_only",
  "current_daemon_version": "1.2.0-rc.3",
  "current_contract_version": "1.2.0-contract-rc.3",
  "boundary": {
    "ixoye_does_not_decide_safe_to_consume": true,
    "ixoye_is_not_time_source": true,
    "ixoye_is_not_fallback_time_source": true,
    "live_attestation_observes_current_contract": true
  }
}

Claim boundary

Keep your timing stack. Add GAL-2 where time becomes state.

GAL-2 Time Contract is not a replacement for UTC, GNSS, PTP, NTP, TAI, chrony, atomic clocks, grandmasters, timing receivers, or metrology references. It is an application-facing temporal governance layer. It helps software consume governed time, preserve monotonic continuity for contract consumers, hold over when policy allows, rejoin under control, and fail closed when safe consumption can no longer be justified. RC5.8 is a public evaluator preview / enterprise pilot candidate, not final enterprise production certification. RC5.8 inherits the RC4-derived 72-hour holdover policy and includes accelerated / policy-equivalent holdover and rejoin coverage. The prior RC4 evidence includes a real 120-hour Time Contract characterization with the declared 72-hour holdover policy boundary. RC5.8 does not claim a fresh real 72-hour wall-clock holdover run of these exact final artifacts.
Get GAL-2 API key View public validation Read documentation