A record's integrity digest is computed by whoever wrote the record. It detects an outsider's edit, which is worth having, and it establishes nothing about the writer: anybody able to change the entries can recompute the digest over the changed ones and hand you a file that agrees with itself.

The record below closes that. Its digest is signed by a Time Stamp Authority, under that authority's own key, at a time nobody here chose. Three commands check it. None of them is ours, and none of them needs anything from this site except the two files.

The files

record.jsonl is thirteen entries: a support agent that reads four sources, finds two systems of record disagreeing about a customer's balance, refuses to close the account, and issues a smaller refund that a named person approved. It is a worked example rather than a real customer, and everything in it is invented except the anchor.

anchor.tsr is the timestamp token, as returned by the authority.

Digest	sha256:34bf5a95693e32fe9bb9a8f4975ea1807d309855e9f09bbb0f3d6cb05606b6e8
Authority	http://timestamp.digicert.com
Signed at	2026-09-05T14:31:54Z
Covers	12 entries, named in the record

One: recompute the digest

The digest is over the twelve entries the record's integrity entry names, each written as JSON with its members in order and no spare whitespace, joined by newlines. Nothing here reads the digest; it computes one and you compare.

python3 -c '
import hashlib, json, sys
e = [json.loads(l) for l in open("record.jsonl") if l.strip()]
b = [x for x in e if x["type"] != "integrity"]
c = [json.dumps(x, sort_keys=True, separators=(",", ":")) for x in b]
print(hashlib.sha256("\n".join(c).encode()).hexdigest())'

Two: read what the authority signed

openssl ts -reply -in anchor.tsr -text

The Message data it prints is the same digest. That is the binding: the authority signed this record and not another one.

Three: check the signature against your own roots

Use your system's certificate store, not one we supply. On Debian or Ubuntu it is the path below; on a Mac with Homebrew's OpenSSL it is usually /opt/homebrew/etc/openssl@3/cert.pem.

openssl ts -verify -in anchor.tsr \
  -digest 34bf5a95693e32fe9bb9a8f4975ea1807d309855e9f09bbb0f3d6cb05606b6e8 \
  -CAfile /etc/ssl/certs/ca-certificates.crt

Verification: OK

At that point you have checked, without trusting this site, that a third party signed this exact set of bytes at that time.

What that does and does not establish

It establishes that the record existed in exactly this form at 2026-09-05T14:31:54Z, and that it has not changed since.

It does not establish that the record is true. It does not establish that it is complete. It does not establish that a different record was not produced at the same time and discarded. A timestamp fixes bytes and a time, and a page that let you infer more from it would be making the mistake this project exists to point at.

The record says as much in its own integrity entry, in a does_not_prove member, so a reader who has the file and not this page is told the same thing.

Anchoring your own

The tool is one standard-library file, MIT licensed, with no dependencies. It builds the request by hand rather than asking you to install a certificate library to emit one entry.

python3 testimony_anchor.py record.jsonl >> record.jsonl
python3 testimony_validate.py record.jsonl

Both are in the specification repository. You can also check a record in the browser, which runs the same checks in a second implementation and never uploads anything.

What was wrong here until today

Until 5 September 2026 the validator did not recompute digests. It checked that an integrity entry carried one. A record could reach the top level with a digest of sixty-four zeros, and an anchored record could carry a real, correctly signed token over some entirely different record.

Two further things came out of fixing it. The specification had never said how a digest is computed, so no independent implementer could have recomputed one; that is now written down. And the two implementations of the rule in this author's own repositories had never agreed with each other, because one of them left the default spacing in its JSON. Neither was noticed for as long as nothing checked.

They are recorded here rather than quietly repaired, on the same reasoning the rest of this applies to everybody else: a system that cannot show what it got wrong is asking to be taken on trust.