helloorigo.com/trust
Verification material
Chronicle's integrity evidence uses a signed root and a verifier whose trust anchors the reader chooses. The registry, build hashes, and open specifications below let someone inspect the claim independently of any single export or verifier build.
Publisher key registry
The keys Chronicle's witness publication signs with. A signed root statement attributed to a key not listed here is not accountable to anyone; see step 2 of the contract below. There is one key and no rotation has occurred yet; a retired key stays listed rather than being removed, per ADR-0026 §13.
| Key ID | Algorithm | Public key |
|---|---|---|
| origo-witness-alpha-1 | Ed25519 | bda03f42419746a33958f59561ea79de20d9e39d99c7c8b8f2a6e2b39a43cb8c |
| origo-witness-cloud-alpha-1 | Ed25519 | f44ff579c4f1220fc2979db5782df554159a92565aecace8028df62310d13136 |
Verifier build hashes
The SHA-256 of every published build of the offline verifier bundled beside a Chronicle export. Superseded builds stay listed, never removed, so an export delivered with an older build still has something to check it against.
| Status | SHA-256 | Published | Note |
|---|---|---|---|
| current | 8dcd54d2a360966b9ef07ca64249ed588fb48a01351e3c876cee6038377e8bde | 2026-09-30 | Adds independent v2 audio-source verification and rejects live exports missing an original file (#738), while preserving v1 verification. |
| superseded | d6e32a4fe5275bc0c1d4f2e006a304e205acab5fed697d12616e2ad499b06d6c | 2026-09-11 – 2026-09-29 | Adds the Cloud Alpha environment's first public witness key; verification logic is unchanged. |
| superseded | 8f98d32c2d9d1e69c07cd237cb47b3cbec71f2014a9ace354da996410749c45d | 2026-09-05 – 2026-09-11 | Application directory moved from apps/genesis to apps/origo-web (#617); only path references baked into comments changed, no verification logic changed. |
| superseded | 29b687d65dbe4381174f2a316ecaa4e942ad00affed04686e089f0a584f0eb04 | 2026-09-04 – 2026-09-05 | Declared-no-evidence renders neutral, distinguishable from a genuine read failure (#591); no other verification logic changed. |
| superseded | f407b45c17b02567504de8cb5cfe0ccef6a70608941b0db3dc10a4cbbcec5730 | 2026-09-04 – 2026-09-04 | Points the verifier's own attribution note at the published registry (#575); no verification logic changed. |
| superseded | 6ae4fb8bc32a1c319e1418ffa9561f5fc4a02ba2575cff838b0469b64c0e0329 | 2026-09-03 – 2026-09-04 | First build bundled with the Chronicle operator export (#571/#573). |
The integrity-evidence-v1 contract
The full specification the verifier checks a bundle against: what each of its seven steps means, what counts as an accepted key or timestamp authority, and what the evidence proves and does not. Anyone building an independent verifier builds it from this document.
/trust/integrity-evidence-v1.md
Source semantics: /trust/source-record-v1.md
Audio source v2 contracts
These open specifications define the original audio source, its chain commitment and receipt, and its protected per-entry export. They are published for independent implementation. Current runtimes do not yet emit v2 audio sources or evidence.
Machine-readable schemas and their referenced v1 receipt schema:
Pocket Chronicle import format v1
The accepted specification for importing encrypted Pocket v1 exports or JSON thought lists on iPhone. The importer is in development; publishing this format does not mean it is available in a released app.
The example contains invented test thoughts marked as synthetic. Imported origin and declared synthetic content remain distinct from capture observed on the iPhone. The contract also defines size limits, duplicate handling, preview and confirmation, and rules that JSON Schema alone cannot enforce. Import validation runs locally using bundled rules; this page provides reference files.