Provenance: what was published when, and how to check it yourself

Every six hours the watch signs a list of the sha256 of every file it publishes, of its own code, the commit it ran from, and the head of a hash-chained event log. The run is committed. Nothing on this page asks to be trusted: each line has a command that replays it.

Last signed run	2026-10-15T19:14:42Z
Files hashed in that run	1022
Code files hashed	94
Repository commit signed over	`2b1f0b808c86`
Head of the event-log chain	`7b50c8dc640f54b86b1ea3f07f4fe1978d24f38f713d337a7a023afa48a1b8d2`
Signing key (Ed25519, public)	`11baca3ef6a69de4901c185f6cbbd3f93318fbb74f9961a8d39aead841adf409`
On-chain pushes, first to last	2026-09-23 16:16 UTC to 2026-10-13 03:26 UTC

Replay it, from a fresh clone

git clone https://github.com/RealSpap/authority-risk-oracle-showcase
cd authority-risk-oracle-showcase
pip install pynacl
python3 scripts/audit_public.py                 # downloads the published run, checks hashes, chain and signature
python3 scripts/audit_public.py --ref COMMIT    # the same for any past run: every run is a commit
python3 scripts/verify_chain.py --events watch/events.jsonl   # every line of the log commits to the previous one
python3 scripts/sign_run.py --watch watch --verify   # the Ed25519 signature of the manifest

Without pynacl the audit ends with exit code 3 and says it is incomplete: it never reports a pass it did not check. Compare the signing key above with the one pinned in the dashboard: a signature only proves the files match what that key signed.

Third-party clocks

A date we write ourselves proves nothing. Three things carry a date we do not control: the block timestamp of every score pushed to an oracle (read it with getScore; each contract page has the exact call under "Reproduce this read yourself"), the transaction that anchors a commitment on Zcash testnet (listed in the deployed oracles table), and the contracts' own creation on their explorers.

What each proof is worth

The signed manifest proves the published files are the ones that key signed at that run. It does not say who holds the key.
The chained event log proves no line was changed or removed after the fact. It starts on 10 October 2026: before that date it proves nothing.
Git commit dates are set by whoever commits. The public history was also rewritten on 30 September 2026 (a clean-up of the history), so a commit date before 10 October dates a snapshot, not the work.
Priority. We do not claim to be first from these dates. The on-chain pushes and the contract creations are the evidence that survives a rewrite.

Not an audit, not investment advice. Back to the dashboard.