WITNESS
A record that can be withdrawn was never a record.
Hosted git that witnesses everything you make. This document is the design of that program, taken one layer at a time — ground, invariants, topology, canonical bytes, the four anchors, the receipt, the record, the reading, the dossier, the payload, the market, and the honesty that holds it all in place. It is written to be built from, not admired.
Each layer hands the next one something it cannot make for itself.
The order is not arbitrary and it is not a filing scheme. Canonical bytes exist so the anchors have something honest to sign. The anchors exist so the record is worth reading. The record exists so the reading, the dossier and the deed are worth paying for. Build downward and every layer above you is standing on air; build in order and each acceptance test is a floor you can stand on while you reach for the next one.
The one question that settles every open decision: could a skeptical stranger, with no account and no trust in us, verify this claim themselves? If no, the layer is not finished, however finished it looks.
A repository is a record of a mind changing over time.
Most hosts treat that record as storage. Witness treats it the way a registrar treats a deed: every change hashed, signed, and independently attested, so that years later you can prove — to a buyer, a court, a partner, an acquirer — what existed, and when.
It is five things at once: a git host, a provenance engine, an appraisal house, a secure-delivery channel, and a marketplace. They are one product because each is worth more when the record underneath it is real. Remove the record and you have five mediocre tools; keep it and you have an instrument.
Who it is for: builders with a body of work and no institutional apparatus behind it. Solo founders, small studios, people who shipped something remarkable at two in the morning and have nothing to show for it but a commit log. Witness turns the commit log into the apparatus.
It is not a law firm, a patent office, a valuation authority, or a DRM system — and it says so on the surfaces, not in a footnote.
Comping is a property of the account row — accounts.comped = 1 — evaluated at entitlement-check time. Never a coupon, never a subscription object that can lapse, never a Stripe-side artifact. If Stripe is down, a comped account still has everything.
The test that proves it: stub the billing provider to throw on every call, then assert full entitlements for all five products.
Eight sentences, each with a mechanism that enforces it.
An invariant defended by good intentions is a preference. Every one of these has a place in the codebase where a violation stops the build, fails a test, or refuses to render. If a change would violate one, raise it — do not route around it quietly.
Nothing witnessed is mutated or deleted. Corrections are new rows that supersede, with a pointer to what they supersede.
Every anchor checks out with stock tools and zero calls to any Witness server.
Generated once, sealed into secrets, never written to a file, never logged, never returned by any endpoint.
Anything hashed is canonicalized deterministically first. A hash you cannot reproduce is a number, not a proof.
Imported history is attested by GitHub, not by us. Witnessing starts at import.
Generated prose lives under a forbidden-vocabulary list.
Same brief, same SVG bytes, same hash. No randomness not seeded from the content itself.
Every colour on every surface resolves through a design token.
One worker, no origin, and a cost floor near zero.
Everything runs on Cloudflare. No container, no VPS. This is not taste — it is what keeps the verification story clean, because there is no machine of ours a verifier has to believe in.
TypeScript, strict. Hono for routing. Server-rendered HTML with islands of vanilla JavaScript where interaction is genuinely needed. The product's aesthetic is a printed document that happens to be alive; a three-hundred-kilobyte bundle would contradict the thesis before a word was read.
Storage discipline. D1 holds facts and pointers. R2 holds bytes. Nothing over a hundred kilobytes enters D1, ever.
The one strong-consistency requirement. The Merkle log needs a single writer, so one Durable Object serialises appends and assigns indices. D1 alone cannot give ordering under concurrency, and ordering is the entire value of the log. Everything else in the system may be eventually consistent; this may not.
Use exactly these. A rename is a migration, not a preference — the receipt bundles reference artifact keys by bucket.
One function. Everything anchors through it.
This is the smallest layer and the one most likely to quietly ruin the product. If two code paths canonicalize differently, receipts stop reproducing and nobody finds out for a year. So there is exactly one function, one hash algorithm, and a lint that forbids hashing anywhere else.
A composite subject — a dossier, a deal, a receipt — hashes a manifest, not a concatenation. The manifest is a JCS object of {type, version, parts:[{name, sha256}]}, and it is stored in ARTIFACTS so a verifier can reconstruct the thing that was signed rather than take our word for its shape.
SHA-256. No second algorithm, no negotiation, no per-subject choice. Where a future needs agility, it gets a new anchor kind and a version field — not a fork in this function.
Unit-test it against fixed vectors committed to the repo. A canonicalizer without vectors is a rumour.
Four independent attestations of one hash — three of them involving somebody other than us.
The phrase quadruple timestamped has to mean something a stranger can check on a laptop with no network access to Witness. Each anchor answers a different question, and the set is strong precisely because the questions are different: did the house sign it, did an independent authority see it, did a public chain record it, and was it in this position in the sequence. The fourth is the one people forget, and it is the one that makes rewriting history impossible rather than merely rude.
The Seal
Ed25519 over the canonical hash. The house's own word, attributable forever.
What is signed is never the bare hash — it is a JCS object of {v, subject_type, subject_id, hash, signed_at, key_id}, stored beside the signature so a verifier reconstructs exactly what was signed. WebCrypto Ed25519; key imported from the secret, never touched. Public half at /.well-known/witness-key.json, an array of keys with valid_from/valid_until from day one. You will not rotate now. You will be very glad the field is there later.
The Authority
RFC 3161. A real token from a time-stamping authority that has never heard of us.
The TimeStampReq is built in DER by hand — there is no ASN.1 library in Workers worth trusting. Set certReq TRUE so the token embeds the chain and verifies standalone; random nonce, checked on response; PKIStatus 0 or 1 only. Store the raw .tsr with the TSA's chain and root beside it — a token you cannot verify in ten years because a CA's website went dark is not an anchor.
Two authorities, not one. Request from both, store both tokens, record which answered and the policy OID. The authority is stronger as a plural and the marginal cost is one HTTP request.
The Chain
OpenTimestamps into Bitcoin. Nobody's permission required, nobody's server load-bearing.
Submit the digest to all four standard calendars — alice, bob, finney, catallaxy. A proof that depends on one calendar staying alive is a proof with a single point of failure. Build a genuine .ots: magic header, version, digest, then the operation tree with real append/prepend/sha256 steps and attestation markers.
The first proof is pending and that is correct — it holds calendar URIs, not a block. The hourly upgrade job fetches the completed path, rewrites the file with a Bitcoin attestation at block N, and records the height. Allow twenty-four hours before calling it a failure.
The Log
RFC 6962, built exactly as Certificate Transparency builds one. This anchor proves order.
Leaf SHA256(0x00 ‖ leaf_data), node SHA256(0x01 ‖ L ‖ R). Do not deviate — the point is that CT tooling and CT reasoning apply unchanged. The LOG Durable Object is the sole appender and assigns the indices; no other code path writes leaves.
The good bit. A signed tree head every five minutes or 256 leaves, and each head is itself sent to the TSA and to Bitcoin. The log's own head is externally anchored, which is the mechanism that stops us from rewriting the log. Inclusion and consistency proofs are public JSON, no auth, forever.
The four do not land together, so the interface never pretends they did. A receipt three minutes old shows two confirmed, one sealing and one pending, with an estimate. Four checkmarks appear when there are four. The maturation is not an embarrassment — it is the evidence the Bitcoin anchor is real, because a fake one would be instant. Say that in one line, on the surface.
Queue consumers with exponential backoff: twelve attempts over forty-eight hours, then state='failed' and an alert. A failed anchor is visible on the receipt. A receipt that quietly shows three anchors where four were promised is the exact failure this company exists to prevent, and it would be committed by omission rather than malice — which is why it needs a test, not a resolution.
The fuzz test: append ten thousand leaves, take heads at random points, assert every pair is consistency-provable and every leaf inclusion-provable.
This bundle is the product. Everything else is presentation.
Every witnessed subject exports a receipt: an archive that contains the subject's manifest, all four attestations, the keys and chains needed to check them, and a page of commands that work offline. It is the deliverable a buyer keeps, the thing a lawyer attaches, the artefact that still functions if Witness is gone.
Which is why it is built in phase two, before there is a single beautiful screen. A gorgeous product with a hollow receipt is the one failure mode from which there is no recovery — you would be shipping a promise in the shape of a proof.
The strongest thing Witness can say to a stranger is: don't trust us, run these four commands.
Spawn a fresh agent with no context but the archive and VERIFY.md, and no network route to us. If it cannot verify all four, the phase is not done. Log the transcript into the build log — including the parts where it got confused, because those are the documentation bugs.
The push must feel like git. The anchoring happens behind it.
Smart HTTP over /git/:owner/:repo.git — info/refs, git-upload-pack, git-receive-pack. Objects to R2, content-addressed by git's SHA-1 with a SHA-256 sidecar for our anchoring. Store the pack plus an index rather than exploding to loose objects; the cost difference compounds and nothing needs the loose form.
OAuth, then per repo: a tarball for content, paginated commit metadata, refs. Stream the tar and chunk to R2 multipart — do not buffer two gigabytes in a Worker. Long imports run on a queue with a resumable cursor and show real progress, not a spinner with an opinion.
Every imported commit is source='imported'. Witnessing begins at completion, and the record draws that line where a buyer can see it. Webhook sync keeps the mirror current until the user cuts over.
Below: attested by GitHub
The boundary is a gold hairline with a tracked label — the system's rule-with-a-label divider, doing the most load-bearing work on the surface. Four dots is a fully anchored commit; a hollow dot is honest about what has not landed yet. That honesty is what makes everything above the line worth more.
The note is allowed to be delightful. The valuations are not.
Every app gets a tasting, and it produces four things: a note, an identity, a crest, and three valuations. Keeping them in visibly different registers is the whole design. A codebase may have a nose of late-night confidence and unresolved TODOs; a valuation may not have a nose of anything. Different typography, different container, different verbs — a reader must never be one glance away from mistaking taste for arithmetic.
Italic serif throughout, tracked labels, one gold line. The note is the only place in Witness where the house is permitted a joke — and the joke has to carry information the straight sentence could not.
Confidence is moderate because three close comparables exist, all of them in a different distribution channel. Rates sourced from a public survey; the line count is reproducible from the anchored commit.
Manrope labels, figures in italic serif, every number that entered the calculation named and sourced. A number without its inputs shown must not render — the component throws rather than degrading, because a bare figure is the most expensive thing this product could print.
A structured brief — field, ordinary, charges, tinctures, mantling, motto ribbon — from a PRNG seeded with the hash of the repository's canonical identity. The brief is stored; the SVG is derived; both anchored. Tinctures resolve to register tokens, never hex, so a crest in Nocturne and the same crest in Daylight are the same crest wearing different weather.
Render a thousand crests twice and assert byte-identity.
Withheld from most good work, which is what makes it mean anything. Criteria are public, specific, and live in the repository. The mark is anchored separately from its tasting so it can never be quietly revised; a revocation, if it ever happened, would be a new anchored event sitting beside the original, which never disappears.
If the generator awards it more than roughly one in fifteen, the criteria are too loose — say so rather than shipping an inflated currency.
A hallucinated citation is the fastest way to destroy this company. Make one structurally impossible.
The dossier is a thorough reading of what has been built: everything that may be protectable, documented in plain language, with artwork, cited to real files. Its entire credibility rests on one property — that a reader who follows a citation finds exactly what the citation said would be there.
No library that drags a hundred transitive dependencies into an edge runtime. PDF 1.7 with a cross-reference table. Subset-embedded fonts as Type0 / CIDFontType2 with a proper ToUnicode CMap, because a dossier you cannot search is a photograph of a document. Artwork drawn as native content streams, converted from the SVG source rather than rasterised. Deterministic output: creation date taken from the anchor timestamp, fixed object ordering, same findings to the same bytes. And the receipt bundle rides along as a PDF file attachment — the proof travels with the document.
Supersession without mutation in the parts ledger
Entries are never amended. A correction writes a new row carrying a pointer to the row it supersedes, so the ledger's history of its own opinions is recoverable. The pattern is applied consistently across three tables, including the one where an in-place update would have been considerably easier.
migrations/0007_ledger.sql · L12–L38 · a4f19c2
src/ledger/__tests__/supersede.test.ts · L8–L64 · a4f19c2
The disclaimer sits in the running header of every page — Manrope 600 at 10px in the muted ink. Not a footnote, not a first-page notice, not a modal dismissed once. This is a design decision and a legal one, and they happen to agree.
Because of one section: the cross-repository synthesis that finds the through-line between projects. That section is the entire justification for the tier, so it has to be genuinely good — a real argument about what this person keeps doing, not a summary of summaries. Enterprise is a contact route, not a price.
Cloudflare holds ciphertext it cannot read, and that is a structural fact rather than a policy.
The bundle is encrypted with AES-256-GCM and a 96-bit IV, using a key generated in the seller's own browser. Ciphertext and IV go to R2. The key is never transmitted — it lives in the URL fragment, and browsers do not send fragments in HTTP requests. The viewer fetches the ciphertext, reads the fragment, and decrypts locally.
The threat model is "we cannot read it," so script substitution must be loud: the viewer's own JavaScript is served with subresource integrity and a strict policy — no inline script, no third-party origin. And a test greps the client bundle for any path that reads the fragment and reaches a network call. It is a crude test. It is also the one that would catch the mistake.
Revoking deletes the ciphertext object and writes revoked_at. The link then decrypts nothing, because there is nothing. This is the only place in the system where the word delete is permitted, and the act itself is recorded as an append-only event.
Encryption and revocation are cryptographically real. No-copy and watermarking are enforced by the viewer — someone determined can photograph a screen. What actually protects you is the ledger: every open is recorded, timestamped and anchored, which makes a leak attributable.
The honest edge is set in the copy, at the point of decision, above the ledger it refers to — not in a tooltip, and not softened. Ship that paragraph exactly as written; it is the sentence that makes the rest of the screen believable.
The deal page is the single artefact that explains the entire company.
A buyer reads one continuous document before paying: the whole witnessed history with the import boundary visible, the dossier, the tasting, and three valuations with their inputs shown. Not tabs. Not an accordion. One scroll, in the order a sceptic would ask the questions, because the sequence is the argument — every claim arrives already carrying the means to check it.
Admission is by review, and exceptional quality only. Being declined costs nothing and touches nothing you hold — no fee, no flag on the repository, no record on any public surface, no effect on the tasting or the mark. A decline writes to one column and nowhere else, and there is a test that asserts no other table was touched. The take is thirty per cent, computed and displayed to both parties before commitment.
There is one button in the system — a tracked word with a generous hit area and no fill. On the deal page the two most important words are Read the record and Verify it yourself, and the second is set in gold. A marketplace that puts Buy in the loudest position is selling a listing; Witness is selling a record, and the interface should be caught agreeing.
Nothing here carries a shadow, a radius, or a badge. The whole page is hairlines, tracked labels, italic figures and air — the same grammar as a printed prospectus, because that is the document this is pretending to be, and the pretence is honest.
On close, a canonical deal record — parties, listing, amount, and the full receipt bundle of everything transferred — is quadruple-anchored. The buyer's proof of purchase is not a page on our website; it is an archive that verifies without us, which is the only kind of proof of purchase worth the name.
Three honest edges, written once and rendered everywhere.
One file holds the edges, and the product surfaces render those exact sentences — not paraphrases. A parity test compares the file to every surface and fails the build if they diverge by a sentence. This is the cheapest possible defence against the slow drift where a caveat gets softer every quarter until it no longer says anything.
Rendered on the payload settings screen, in the copy. Encryption and revocation are real; the viewer's restrictions are a deterrent; the ledger is what protects you.
It cannot say a thing is patentable, protected, or owned. What it genuinely establishes is what existed on a given date — which is real leverage in a dispute or a diligence, and enough.
We cannot retroactively witness a commit from 2021. Prior commits arrive attested by GitHub; witnessing starts at import, and the line is drawn where a buyer can see it.
It runs on every model-generated string before persistence, and in CI across all static copy. A violation fails the generation and retries with the offence named in the retry prompt — three attempts, then a visible error. Never silently strip and ship: a stripped sentence hides the fact that the model wanted to overclaim, and that fact is the useful signal. Log every violation so the prompt can be improved from evidence rather than from taste.
patentable · patented · protected by · you own · legally protected · infringes · infringement · trade secret status · copyrighted work of · guarantees · guaranteed · will be worth · certified · legally binding · proves ownership · proves you own
The dossier's opening paragraph carries "what existed on a given date" or an approved variant. The valuations block carries "Ranges, not appraisals."
Marketing copy may say the dossier "documents everything that may be protectable" — that is a statement about the document's subject matter. The generated text may not assert that any specific thing is protectable. The linter enforces the second; a human writes the first. Do not let a well-meaning refactor collapse the two, and do not let the linter loose on the marketing page, where it would sand off a true sentence.
After the dossier phase, and again before deploy, run a pass whose only job is to find one place where the product asserts something stronger than the evidence supports. Every surface, every string, every generated paragraph. Report the findings even when the fix is annoying — especially then, because an annoying fix is exactly the one a busy builder talks themselves out of.
The honesty is not a compliance layer. It is the product's only unfakeable feature.
Witness is set in Haute Lumière. Vendor the tokens verbatim; do not retype a value.
This supersedes the brief's design section. Witness dresses in Haute Lumière — Luminous Prosperity's editorial system — rather than Resonance OS. The three-register instruction survives intact; only the register names change, and the eight invariants are unaffected. Copy tokens/ and styles.css into src/styles/ unmodified, load them with the one-line loader, and build every other stylesheet only out of what is in them. If a value you need is not there, that is a design question for Ammanuel, not a hex literal.
This document is itself the specimen: everything you are reading is the system with nothing added. Sheets on a desk, one shadow, zero radius, hairline cells whose gaps are the rules, tracked Manrope furniture, figures in italic serif, and gold used four or five times a page and never as a fill.
Set on the root element as data-register. Night is a chosen modifier, never a media query — mood belongs to the reader, not the operating system. The other four registers exist in the tokens and may be offered later; do not delete them to "simplify".
If a human would read it aloud, it is serif. Cormorant Garamond carries every voice — headlines at weight 300 above 40px, decks in italic, body at 16.5px over 54 characters, figures in tables in italic. Manrope carries only the furniture a reader ignores: kickers at 10px and .32em, corner tags, folios, table heads, always uppercase, always tracked. The two never cross. The cursor falls into a serif — search and every text input is serif at 32px, and the only sans inputs are short codes.
Substitution, declared: the system owns no monospace, and adding one would make a third family. Code and hashes are set in Manrope 400 with tracking off. If alignment ever becomes load-bearing — a hex dump, a DER trace — raise it rather than importing a face.
Do not begin a phase until the previous one's test passes and you have said so out loud.
Each phase ends with a named acceptance test whose output is pasted into the build log. That log is how a stranger — or a future you — audits this build. The order is deliberately unfashionable: the receipt exists before the first beautiful screen, and the design system arrives at phase six, once there is something true to dress.
Four accounts, one ceremony, and nothing in a committed file.
Everything through the secret store. Nothing in a committed environment file; the local variant is ignored, and a pre-commit hook checks that it still is.
Every phase completion, with the acceptance output and one line on what surprised you. Immediately, if an invariant is under pressure — never route around the spine quietly. Immediately, if the tokens are not on disk. And whenever you find a better way: the brief is the floor, not the ceiling. A sharper deal page, a stronger anchor, a verification story even easier for a stranger — say it. That conversation is part of the build.
Witness exists because a record that can be withdrawn was never a record. Build accordingly.
Haute Lumière — seven registers, two families, one shadow, zero radius. Tokens vendored verbatim; no value in this document was invented.
Code is set in Manrope 400; the system owns no monospace. No photography is used — the plate library is reserved for the issues, where each image appears exactly once.
Web · print · and the builder's copy, which is the only edition that matters until phase thirteen.