anchor
Emit a compact, externally-publishable hash snapshot of the full write and erasure history. Publish it to a witness log to detect retroactive rewriting and verify consistency later.
Instructions
TAMPER-EVIDENT MEMORY / transparency log: emit a HEAD COMMITMENT — a compact, externally-publishable
snapshot {n_writes, writes_tip, n_tombstones, tombstones_tip, ts, sth_hash} that hash-commits to the ENTIRE
write + erasure history at this instant. It is a hash commitment and carries NO signature from this server:
a key the store operator holds is the very thing it must not depend on, so the signature comes from outside
(a witness co-signs sth_hash; see verify_cosigned_anchor and inspeximus anchor). Publish it somewhere
the store operator cannot retroactively
alter (a public log, a third-party witness, the auditor's own records). This closes the one hole verify_writes()
cannot: an operator who HOLDS the receipt key can rewrite AND re-sign the whole history so it still verifies
internally — but they cannot make the rewritten tip equal an anchor an outsider already witnessed. Record this
now; check later with verify_consistency(). (RFC 6962 model; the external witnessing is the auditor's job.)
Quickstart, install to a verified co-signed anchor: docs/TRANSPARENCY.md, or inspeximus anchor in the shell.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||