You've reached a witness
You probably followed a link from a checkpoint, a receipt, or a post about one. This witness is a SCITT Transparency Service that registers checkpoints under a published consistency policy (SCITT is the IETF architecture in RFC 9943). Here's the whole idea in about five minutes: what a checkpoint is, what this service does and does not show, and how to check any of it yourself — without asking you to trust us.
What is a checkpoint?
A checkpoint is one signed value — a 32-byte root, signed: about 300–500 bytes on the wire — that commits an entire log's history to date. Whoever holds the log can recompute that value from every entry they've recorded; if even one byte of one past entry changed, the checkpoint would no longer match. It's registered when a Transparency Service its owner does not run records it in its own log and returns a Receipt. The Receipt proves the checkpoint is in that log; it does not say the service agrees with what the log contains. That is what turns "trust me, my log is complete" into something a stranger — you — can check.
What this witness shows — and what it never does
A witness is infrastructure, not a verdict. It commits to three things, checkable from the bytes alone:
- Existence — the record was in the log at a point in time.
- Order — where it fell relative to everything else.
- Completeness — a consistency proof between two checkpoints shows whether anything between them was dropped or rewritten: a rewrite would be detectable.
It never says anything about whether the content was true. These are the claims this project will not round up, anywhere — the same wording an auditor reading the spec would use:
- A witnessed record is not a true record. The stamp attests existence/order/completeness, never accuracy.
- A derived verdict is not an adjudicated one.
verifynever grades up — it never reports more assurance than the bytes support: absence ≠ forgery, unsigned ≠ invalid. - Coverage is the range, not the population.
- Registration ≠ Receipt ≠ agreement. Registration is the act. A Receipt is what the service returns: it proves inclusion in that service's log, not agreement with the content. When a checkpoint carries a consistency proof, this service registers it only if the proof shows it extends the last one it registered for the same log; that check is part of its published Registration Policy.
Word-for-word, in three registers — dev, auditor, spec — on the translation page.
The grade you'll see
Not every checkpoint this witness shows you was built the same way, and the label tells you which. These grade labels are this service's own; they are outside SCITT.
| Grade | What it means |
|---|---|
mmr-verified | The log is enrolled with this witness, under a pinned key, as a native CLL log: an accumulator this witness can check consistency proofs against. The signature verified under that key. A checkpoint that carries a consistency proof is registered only if the proof shows it extends the last checkpoint this witness accepted for that log. The label itself does not say a proof was checked; that is reported separately, as the continuity grade continuity-witnessed. This witness does not hold the log's entries and does not rebuild its tree. |
countersigned-observed | The log is enrolled with this witness, under a pinned key, as a foreign log: one whose accumulator this witness cannot check. This witness checked the signature under that key, registered the checkpoint and returned a Receipt, so anyone can compare the checkpoint they were shown with the one in this log. It checks no consistency proof for such a log. |
A checkpoint from a log that is not enrolled carries neither grade. These two are never presented as one guarantee. A countersigned-observed checkpoint is not proof this witness checked the log's consistency; it shows the checkpoint you're looking at is the one registered in this log. The label is the identifier this service emits in its Receipts; despite the word, it is not a second party's countersignature or co-signature.
Run your own
This witness runs on open-source infrastructure — auditable in full, Apache-2.0. You don't have to take this instance's word for anything you can check yourself, and you don't have to use this instance at all: run your own witness in the region you choose, or self-host it inside your own network where nothing but a digest ever leaves. See witness anywhere for the options.
It is built to have no single point of trust, including whoever runs this instance. Other operators running the same service side by side is the design goal: registering the same checkpoint with more than one independently run Transparency Service is better for everyone checking a record, including the operators of any one of them.