A line for every step, and each one holds the last.

Daily roots, anchored

Recomputing it yourself

For each line: digest = SHA-256 of the payload as canonical JSON (keys sorted at every depth, compact); entry_hash = SHA-256 of prev_hash + ':' + digest + ':' + kind + ':' + at (ISO 8601 UTC with milliseconds). The first line's prev_hash is 64 zeros. A stretch of the log that does not start at the first line is carried forward to the daily root that covers its last line, which must be reached exactly. A root is the entry_hash of the log's last line when the Night anchored it. Its proof is a detached OpenTimestamps file whose committed digest is the root itself — its 32 bytes, hex-decoded, not hashed again — that is, a timestamp of the line's string prev_hash:digest:kind:at, whose SHA-256 is the root. Verify it with the public client, without us: `ots verify -d <root_hash> <proof.ots>`.

The roots are at /api/lumen/v1/register/roots. A protocol's signed report, with its own anchor, is at /api/lumen/v1/register/<id>; the verifier checks its signature in your browser. Every day the instrument's own state is committed in this chain too: the evolution, day by day.

Auditing it like Certificate Transparency

The log is also a Merkle tree in the shape of Certificate Transparency (RFC 9162 §2.1, SHA-256). Its leaves are the log's lines in index order — leaf 0 is the first line; line numbers may skip, positions never do — and a line's leaf is the 32 bytes of its entry_hash, hex-decoded, so its leaf hash is SHA-256(0x00 || those 32 bytes) and a node is SHA-256(0x01 || left || right). A checkpoint is a C2SP signed note in the tlog-checkpoint format: three lines, each ending with a newline — the origin omnel.selione.ai/log, the tree size in decimal, the root in base64 — then a blank line, then the line '— omnel.selione.ai/log ' followed by the base64 of a 4-byte key ID and the 64-byte Ed25519 signature of those three lines. The key ID is the first 4 bytes of SHA-256('omnel.selione.ai/log' || 0x0A || 0x01 || the 32-byte public key); the public key is the one every signed report carries (the last 32 bytes of its SPKI form), and the verifier key a client pins is 'omnel.selione.ai/log+<key ID in hex>+<base64 of 0x01 || public key>'. Inclusion and consistency proofs are RFC 9162 §2.1.3.2 and §2.1.4.2: any CT library verifies them. Each night a checkpoint is signed with the day's root: its tree ends at that root's line, and its own root is anchored on OpenTimestamps the way the day's root is — the proof commits the Merkle root's 32 bytes, not hashed again (`ots verify -d <root_hash> <proof.ots>`). Keep the last checkpoint you verified: a later one must be joined to it by a consistency proof. Two signed checkpoints that no consistency proof joins are a fork, and the two notes are the evidence.

The newest signed checkpoint is at /api/lumen/v1/register/checkpoint (?format=note for the note alone, ?size= for an earlier one); an inclusion proof at /api/lumen/v1/register/proof/inclusion?idx=<line>&size=<size>, a consistency proof at /api/lumen/v1/register/proof/consistency?from=<size>&to=<size>. The verifier key to pin: omnel.selione.ai/log+10dc08d3+AWfF9+0VImjkBj+VDEqbUyVJZh2F6b/3LqXRVeTJ8lhd.

The open verifier is one file for Node 20 or later, with no dependency. node omnel-verify.mjs chain selione.ai downloads the whole log and recomputes the chain, every daily root and every checkpoint from it; checkpoint, inclusion <line>, consistency <size> and ots <day> check one thing each. It keeps the last checkpoint it verified and calls a fork when the next one does not extend it. What it cannot prove alone: that everyone is shown the same log — only checkpoints compared between several people can — and the Bitcoin block itself, which ots verify checks.

Witnesses. Each checkpoint is served with its witnesses' cosignatures appended after the log's own signature line. A witness is a separate machine with its own key: it keeps the last checkpoint it cosigned, refuses a new one that a consistency proof does not join to it, keeps its own copy of every line and refuses to sign while any line it holds has changed, and only then signs. A cosignature line is '— <witness name> ' followed by the base64 of a 4-byte key ID, an 8-byte big-endian POSIX time and a 64-byte Ed25519 signature (C2SP tlog-cosignature, signature type 0x04). The signature covers the line 'cosignature/v1', the line 'time ' and that time in decimal, then the checkpoint's three lines exactly as the log signed them, each line ending with a newline. The key ID is the first 4 bytes of SHA-256(witness name || 0x0A || 0x04 || the 32-byte public key), and the witness key a client pins is '<witness name>+<key ID in hex>+<base64 of 0x04 || public key>'. A client that pins only the log's key (omnel.selione.ai/log) ignores these lines; a client that also pins witness keys can require a number of them, and refuse a checkpoint that only the log vouches for. The witness keys to pin:

• omnel.selione.ai/witness/1+3562f553+BGNkkZMmMzcx1EABLyqN6pkQ7Gg0erXnrqc72LcI2anj — Selione — our own witness, on a machine of its own at another host than the site, with a key that never leaves it. It is not independent of us: it guards against a compromised site or base, not against its operator.

node omnel-verify.mjs checkpoint selione.ai --witness <witness key> --min-witnesses 1 refuses the newest checkpoint unless that witness cosigned it. Witnesses run by other organisations, on their own machines, are the next step: until then a witness here guards against a compromised site, not against us.