Charles JonesStatus — in design. Nothing is shipped, nothing is sold, and there is no customer. This page will say so when that changes.
An AI system says something. Where did it come from?
Today the answer is an assertion — the system’s own claim about its own sources, checkable by nobody. A receipt replaces the assertion with a signed statement: this span matches document X at offset Y, under corpus root R, at time T. Its value is not that we vouch for it. Its value is that someone who does not trust us can check it.
The architecture
Where the trust actually sits
Three properties do the work, and none of them is “believe us”.
The manifest is captured at ingest. Source URI, licence, sha256 and byte length, recorded when the document enters and never rewritten. A receipt chain can only be as honest as the source it starts at, so corpus appends are human-gated — the same word-gating the rest of this estate uses.
The root is a seal over everything. Every document’s fingerprint is combined in pairs until one value remains: the corpus root. Change one byte of one document and the root changes, so a receipt issued under the old root stops verifying. Roots are appended, never replaced, so a receipt from six months ago stays checkable against the root it was issued under.
The verifier is open and standalone. It runs without our server. If this operation vanished tomorrow, receipts already issued would remain checkable by whoever holds them.
Open core, and exactly where the line falls
Open the things that must be trusted; sell the things that must be operated.
Open: the receipt specification and the verifier. A proprietary receipt format has no evidentiary credibility — if the only party who can check the evidence is the party being challenged, there is no evidence. The index layer beneath it is already open: infini-gram, Apache-2.0, Ai2’s work, and we say so rather than implying we solved the hard search problem.
Closed: the receipt server, the signing infrastructure, the evidence packaging, the compliance mappings. These are the things that must be operated — run reliably, kept secure, held to an availability commitment.
Fully closed and nobody trusts the receipts. Fully open and the product belongs to whoever has a sales team. Open core is the only stable point, and the line is drawn on which side of it trust lives.
What actually threatens this
The primitives are not the weak point, and pretending otherwise is how security theatre starts.
Cryptography doesn’t defend itself with cleverness; it defends itself with physics. Reasoning finds shortcuts through problems that have structure — SHA-256 and modern signatures are engineered to have none.
Forging a receipt means finding a hash collision or producing a signature without the private key: brute-force search spaces of 2^128 to 2^256, with a thermodynamic floor on the energy required to search them. No model reasons its way past entropy. Verification is deterministic — a receipt recomputes or it does not, and there is no persuasion surface. The smarter AI gets, the more the world needs proofs that do not care how smart you are.
So a capable adversary attacks around the maths. Four ways, and the mitigation for each is a build requirement rather than a hope:
| vector | what it actually is | mitigation | |
|---|---|---|---|
| T1 | Key theft, not key breaking | Custody is the target, not the algorithm | Signing key in an HSM; never in application memory; fingerprint published; rotation filed before the first customer receipt |
| T2 | The oracle problem | A false document gets a perfectly valid receipt. Receipts prove nothing was altered after signing — not that the signed thing was true | Manifest discipline at ingest; isolated ingestion; appends human-gated |
| T3 | Rewriting history | Altering one old receipt requires altering the root, which breaks every later root | Published root log, external timestamp anchoring, customers hold their own copies |
| T4 | Quantum | Elliptic-curve signatures have a shelf life; hashes and Merkle trees largely survive | Hybrid signatures from day one — receipts issued today stay verifiable later |
T2 is the honest one, and it is the limit of what any receipt can claim. A receipt is a statement about integrity, not about truth. It proves the text corresponds to that source under that root at that time. Whether the source was worth trusting is a judgement a person makes — and a system that claimed otherwise would be exactly the overreaching instrument this product exists to argue against.
What is not on this page
No latency figures. No index-size figures. No accuracy figures.
Numbers of that kind exist in the plan, but they are targets in a validation gate — thresholds the thing must clear before it is considered to work. A target rendered as a gauge is precisely the fabricated proof this product exists to make impossible, so none of them appear here.
That absence is the argument.
Where it stands
In design. The gates it must pass before anything is packaged are written down in advance: detection on known matches, clean absence proofs on novel text, an independent verifier re-validating receipts from the raw corpus with no server involved, and a tamper test where one mutated byte breaks verification against the new root while the historical root still verifies.
The criterion for abandoning it is written down too. If no design partner will pay for a pilot after twenty qualified conversations, it gets parked. A kill criterion only means something when it is set before the answer is known.