Methodology › Attestations

Attestations

Every night, the day's append-only records are reduced to one hash and signed. The hash is published here the same night, so “we do not rewrite history” is something you can check rather than something we say.

Published roots

Newest first. Each root covers the records that had arrived when it was taken — the Covers column says which.

Nothing has been attested yet. The first root appears the night after the first record.

A day attested after it closed covers all of it. One attested while it was still being written to covers that much and says so, and can later be superseded by a root covering the whole day — the earlier row stays, because what it proved is still true. Days on which nothing was recorded have no attestation at all: a root over nothing says only that we had a quiet day, signed.

How to check one

Take a day's document — it carries the root, the counts, the signature and the exact bytes that were signed:
/attestations/2026-08-22.json
Verify the signature against the public key below. Ed25519, base64, detached — ten lines in any language, and no certificate authority involved.
Take the rows the root covers: records dated to that day which had arrived by the document's
covers.through
— the instant it was taken. A root cannot speak for a record written after it, and filtering by the wrong set is the one mistake that looks exactly like a rewrite.
Rebuild the root from those records. Hash each one:
sha256(0x00 ‖ canonical)
Pair them:
sha256(0x01 ‖ left ‖ right)
Then promote an odd node unchanged, and compare.

The two prefixes are not decoration: without them a leaf can be presented as a pair of children and the tree becomes forgeable in exactly the way it exists to prevent.

Signing key

ALGORITHM

ed25519

PUBLIC KEY

4gMr6yAh91IOXn45RiDEvl78H4VUubfDDjAcUgF6RN4=

Key id ec7ca16f1626c3d5

Leaf recipe v2

Fields joined with a pipe, tables in this order, rows by ascending id. Every one of those choices is arbitrary and load-bearing, which is why the recipe is versioned on each attestation.

supply_snapshots

id · token · day · total supply (base units) · float supply (base units) · source · captured_at

metric_revisions

id · token · day · revision · figures_hash · computed_at

vesting_schedules

id · token · version · effective_from · sha256(schedule) · captured_at

Rows covered: Records dated to the day that had arrived by the attestation's computed_at, judged by each table's own arrival column.

What is covered: the readings, the figure revisions, the archived project pages and the vesting versions — every table the database refuses to let us update. Tables that are current-state by design are deliberately outside it: attesting a row that is meant to be replaced would produce a receipt that fails honestly every night and teaches everyone to ignore it.