oddly Computed, not curated.
Open a receipt

Trust · certificate transparency

A certificate validates. That is not the same as knowing when the log said it was there.

A certificate transparency log signs its own tree head, on its own clock. oddly reads those heads where their operators publish them, keeps the log's clock beside ours on every row, and seals each reading so a claim about what a log carried can be reopened a year later.

Open a receipt How a receipt works →

The logs, at their operators

Every row is an operator we read logs from, with the number it runs.

    No operator has been read yet, so this list is empty rather than filled from a list of names nobody looked at.

    An operator is not a place, so none of these rows is drawn on a map. A log that changed hands carries both readings on the record forever, and the row above counts it under the operator that runs it now.

    This surface publishes no change count. The estate publishes change facts across every class at once and no public read scopes them to this one, so the only numbers available are somebody else's total and nothing.

    Down to one signed tree head

    Two clocks, and the one that runs ahead is theirs.

    A log signs its own timestamp, so its clock can be seconds ahead of ours. The gap is published with its sign rather than its size, because the flattering reading of a negative gap is that we saw something before it happened, and that reading must never win.

    What the decision rests on today

    A validity check, and nothing behind it.

    Every one of these is believed because of who supplied it, and none of them can be checked after the fact by the person who has to act on it.

    the check

    A certificate that validates today says nothing about what any log carried on the day in question.

    the clock

    A timestamp is whatever the reader's clock said. There is no second clock to hold it against.

    retention

    A retention policy decides what survives the incident. The evidence you need is the evidence most likely to be gone.

    What oddly puts on the record

    The same thing, observed.

    Two clocks on every row: when the log signed it, and when we looked. A root a day. An anchor outside us.

    substrate

    The certificate transparency logs, re-observed on their own cadence at the operators that publish them.

    two clocks

    When the log signed its tree head, and when we looked. A log runs a few seconds ahead of our clock and we show the sign rather than hide it.

    the agent

    The day your agent's actions are observed the same way, its receipts sit under the same roots. Declared, not sold, until it exists.

    The verbs

    Observe. Seal. Publish. Anchor.

    The same four on every surface. A product here is the record read for one decision, never a second machine.

    observe

    Read the source as it is published, and write down both clocks.

    seal

    Hash the row with its predecessor, so no receipt can move without every later one changing.

    publish

    Fold the day's receipts into one root and put it where anyone can read it.

    anchor

    Submit the root to a chain we do not run. From then on, checking us does not involve us.

    One signed tree head, read live

    One log, its own clock, and ours beside it.

    Every slot is read at load. A row reads [unread] when the newest observation on the ledger belongs to another class, because a sample row here would be the one thing this surface exists to refuse.

    observation
    [unread]
    log
    [unread]
    attribute
    [unread]
    value
    [unread]
    source
    [unread]
    the log signed at
    [unread]
    we looked at
    [unread]
    gap, with its sign
    [unread]
    receipt
    [unread]
    day root
    [today's root]
    anchored in block
    [pending]
    confirmed
    [pending]

    A negative gap means the log's own clock was ahead of ours when we read it, which is a fact about a source we do not control and not a fault in the reading. The anchor reads [pending] until a day has been confirmed in a block, because a pending batch has no block height and printing one as anchored would be worse than printing nothing.