What we publish

The hourly seal

A scheduled job named audit-checkpoint runs on the cron pattern 5 * * * * — once an hour, at five minutes past. It reads the head of every sealed stream, combines them into one root, builds a 256-byte statement and signs it. The signing never waits for anything else.

Sequences themselves have no gaps. Each statement's sequence is the previous one's plus one, its periodStart is the previous one's periodEnd, and its previousCombinedRoot is the previous one's combinedRoot. That continuity is checked when the statement is sealed and again by a database trigger.

Five streams, one combined root

The log is five append-only streams, each an RFC 6962 Merkle tree over its own events. A statement commits to all five at once.

Each stream's leaf is salted. A leaf is SHA-256(0x00 || leafSalt || contentHash), where leafSalt is 32 random bytes the database assigns when the event is stored. The salt is the reason a guessed record — "person X connected application Y at time T" — cannot be confirmed against a published root or against a proof somebody else shared.

combinedRoot = SHA-256( 0x02 || H(audit) || H(access) || H(disclosure) || H(receipts) || H(transparency) )

H(stream) = uint8(len(name)) || name (ASCII) || uint64_be(treeSize) || rootHash (32 bytes)

All five are always present. An empty stream is treeSize = 0 with the RFC 6962 empty-tree hash. The 0x02 prefix separates a combined root from a leaf (0x00) and an interior node (0x01), so no one byte string can be read as two different things.

The statement is 256 bytes

A checkpoint statement is the Solidity ABI encoding of eight static words — eight 32-byte fields, no offsets, no length prefix, exactly 256 bytes. Version 1 is the only version, and a decoder refuses any other value or any non-zero padding.

The fingerprint of a checkpoint is SHA-256(statement). It is also the digest that gets signed, which means the fingerprint and the signed message are the same 32 bytes — there is no separate thing to check.

The signature

Keys are listed newest first, one active at a time. A new key retires the previous one, and a retired key can never sign again — sealing refuses with AUDIT_SIGNING_KEY_RETIRED. A configured rotation writes platform.signing_key.rotated into the transparency stream inside the sealing transaction, before the heads are read, so the first statement the new key signs also seals the record of its own arrival.

What is deliberately not published

The public statement carries the combined root and nothing else about the trees underneath it.

• Per-stream roots and tree sizes are private. How many events each stream holds is not a public number. They travel inside a proof, to the holder of that proof, who needs them to recompute the combined root.
• No personal data is ever in a checkpoint. A statement is roots, a sequence, two timestamps and a key fingerprint. Nothing in those 256 bytes names a person, and there is no per-person hash in them either.
• No event content. A leaf is a salted hash. The content it hashes stays in the database, under the ordinary access rules.

This is why the published feed can be genuinely open: there is nothing in it to protect, and an adversary who reads every statement ever issued learns the shape of nothing.