Journal des modifications

Ce qui a changé dans EXHIBIT B et quand : le format du reçu, la chaîne, le vérificateur et le site, dans l’ordre où les changements sont sortis. Les entrées s’écrivent quand un changement arrive, elles ne sont pas rétroactives.

Les entrées ci-dessous sont publiées en anglais.

2026-09-08

The live demo, the receipt page, and the browser verifier

The landing page’s six blocks: the live demo with the claim table and the deletion timer, what this cannot do, pricing, who this is not for, and the record in public.
The browser verifier: the same open-source tool, compiled to WebAssembly, with a request counter that holds at zero during verification, and a tamper playground that locates the first changed byte.
The receipt page, opened from a QR: the sealed header, the projection table, the proof status, and — for the creator only — the downloads and the refund.
/verify/ for a receipt someone sent you, the pass page, and the proof pages: the wall, accuracy, cost, hard questions, this changelog and the daily roots.

2026-09-06

Reference lists are sources, and a registry that refuses is not a denial

Every citation list in a document — its bibliography, footnotes, table of authorities, an author’s own publication list — is now a source list: each entry is resolved and fetched on its own, with a separate budget so a long bibliography cannot crowd out the body.
Two members added to the receipt body: claims[].source_of (body or list) so a reader can tell a cited passage from a list entry, and counts.not_checked so a citation the budget never reached is counted, not hidden.
A registry answering 401, 403, 429 or a server error is SOURCE_UNREACHABLE, not NOT_FOUND: a refusal is a fact about the registry, not about the citation.
Legal citations resolve through the registry’s anonymous search with a deterministic per-record match; a reporter the registry does not cover is a safe miss, never a false “does not resolve”.

2026-09-05

The engine, and the checkout

Sessions held in memory only: the document is discarded the moment its citations are read, and everything text-shaped expires with the session.
Ingest for DOCX, PDF and pasted text; locators for DOIs, PMIDs, URLs and case citations by regex only; extraction through a model with a deterministic gate that drops anything not in the document.
EXISTS from two fetch vantages, with a registry lookup for identifiers and an archive request for every fetched source. SAYS anchored to character offsets under a fixed normalisation. HOLDS — two adversarial refuters and a judge — off by default and never sealed.
The seal: a signed, chained receipt, a binding bundle so the creator can re-derive the HMACs from their own document, and the public projection that reveals only domains.
Checkout through the payment provider, the return, the waiting page, refunds granted without argument, the RECORD and PRACTICE passes, and retention by tier: a closed download window never removes a chained receipt from the chain.

2026-09-04

Receipt format v1: canonical form, keys, chain, daily roots

The receipt’s canonical form (a restricted JSON canonicalisation: sorted keys, integers only, fixed escapes), so two implementations hash the same bytes.
ed25519 issuer keys with a monthly id and rotation that does not break historical verification; /keys.json lists every key this install ever signed with.
The hash chain: every receipt carries seq and prev_hash; /chain/head and /chain/verify answer for it, and a nightly walk replays it from genesis.
Daily Merkle roots, cut at 00:05 UTC over the day’s receipts, signed, and published to a public repository; /chain/root/<date> serves the file and /api/receipt/<id>/proof the inclusion proof.
The byte-level specification of the format, with shared test vectors, so the open-source verifier is built from the same contract.

2026-09-03

The site, and the first design decisions

The landing page’s hero, the scope disclaimer in the footer, the route registry, the sitemap and robots.txt, and the head metadata for every static page.
The design direction: an appendix to a signed declaration. Bond-paper light and graphite dark, one accent, red reserved for a verifier failure, body text in a serif and every hash, time and receipt line in a monospace face.
Process configuration, the database, ids, the request-address hash, quotas, the job queue, mail and structured logs — nothing in a log line ever carries a document.