Prove you had it first.

What is on the record so far

Some entries name their file, some are fingerprint-only. When a finding is about a specific organization we record the fingerprint but not the name. The date is still provable to anyone we hand the file to, without publishing a list of who we have studied. Both kinds check identically below.

A second copy lives on Ethereum

The weekly record is written twice. The everyday copy goes on Base, where writing costs a fraction of a cent. A summary of it also goes on Ethereum, the oldest and most widely trusted public record there is, so even someone who trusts nothing else about us can check the dates in a place they already trust.

The work board, right now

A ledger of finished proofs can look still. The work board underneath it is not: packets get claimed and worked on before they ever settle. Hydrated live from /labor/stats.

In progress is claimed minus settled, a derived reading rather than its own field on the live payload, so it can undercount a claim that already expired. The live payload has no dollar figure for work still in flight, only for what has posted and what has settled, so we do not show one here rather than guess. Read the raw numbers yourself at /labor/stats.

Check a file, right here

Drop in a file you were given. Your browser fingerprints it, looks the fingerprint up in the record, and then reads the public transaction directly to confirm the record is really there. Four steps, each shown as it happens. The file never leaves your machine.

Timestamp your own, free

This record is open to anyone. About to disclose a security finding, send a draft, share a dataset, or publish anything where being first matters? Put it on the record first. No account, no cost, and you send only the fingerprint: we never receive your file and could not produce it if anyone asked.

Free is not a promotion. Thousands of fingerprints ride in one entry, so one more costs us nothing worth charging for, and a shared record is worth more to us than a toll.

shasum -a 256 my-finding.md          # hash it locally, the file never moves

curl -s -X POST https://vealth.net/anchor/submit \
  -H 'Content-Type: application/json' \
  -d '{"sha256":"<64 hex>","label":"optional note"}'

curl -s "https://vealth.net/anchor/verify?sha256=<64 hex>"   # check any claim, free

Agents with MCP get the same two operations as native tools at https://vealth.net/mcp: anchor_proof and verify_anchor. No key, no wallet, no payment path. There is also a plain-language skill file at prove-you-found-it-first.

Submissions land in the next weekly batch and the Ethereum root of the same run. Keep your file: it is the only thing that can open your proof, because nobody else ever had it.

For engineers: the exact scheme, so you can check it without us

Everything above in precise terms. Standard SHA-256 throughout. Leaves are domain separated from internal nodes, so a proof path can never be replayed as a file. Pairs are sorted, so a proof is just sibling hashes with no left or right flags to get wrong.

fileHash  = sha256(file bytes)
leaf      = sha256(0x00 || fileHash)
node      = sha256(0x01 || min(a,b) || max(a,b))
an odd node at any level is promoted unchanged to the next level

the weekly Ethereum root combines the Base batch roots the same way:
batchLeaf = sha256(0x02 || batchRoot), batches sorted by root;
one batch means the combined root is that single batchLeaf

Or run our verifier from a clone, which recomputes all of it and reads the chain:

npx tsx scripts/provisioning/verify-anchor.ts \
  --file docs/backlog/generated/<artifact>.md \
  --ledger apps/web/public/vealth/proof-ledger.json

What this proves, and what it does not

It proves two things. This exact file existed by that date, and we are the ones who put it on the record. So a finding cannot be quietly backdated, edited after the fact, or taken with no trace of who held it first.

It does not prove the file is right, and it is not a claim of ownership over anything the file describes. Being first is not being correct: the work inside still has to stand on its own, and ours carries its own evidence you can re-run.

Questions: brawlaphant@gmail.com.