How it works

The mechanism in full. The spec is the normative text, and the FAQ answers it in short.

Three things while it runs, one when somebody asks

Three things happen while your software runs, and one happens when somebody asks. Your software records what it did, which it already does. Each entry is hashed together with the one before it, so the entries form a chain. And every so often the current head of that chain, a single 64-character string, is published somewhere you do not control: a git commit, a timestamp authority, a transparency log.

entry 1    link1 = H(claim1, "")
entry 2    link2 = H(claim2, link1)
entry 3    link3 = H(claim3, link2)

head       link3  --published-->  git commit, timestamp, transparency log

Alter or delete anything earlier and every link after it changes. There is no way to edit the middle of a chain and leave the end intact. So when somebody asks for evidence, you export the claims for the window they care about, the digests of any files behind them, the chain coordinates, the anchors, and one signature over the whole document.

The verifier runs it backwards

The verifier runs that backwards, offline. It confirms the signature, recomputes every link from the claim contents, checks that each entry points at the one before it, and matches the anchors against links in the chain. A removed or reordered entry is not merely detected. The verifier names where the break is.

The anchor is what does the work

Notice what the anchor changes. A hash chain on its own only proves internal consistency, and anyone could sit down and build a consistent one this afternoon. Publishing the head as you go is what makes that worthless to a forger: a convincing fake would have required lying from the first entry and publishing the false heads to a third party the entire time. The security is not the cryptography. It is that history cannot be backfilled.

What sits on top of this

That is the accuracy half: nothing was changed or removed. Proving nothing was left out is the other half, and it rides on the same chains as LoomSpan. Every bundle is checked by two verifiers kept honest against each other, and the worked examples show the whole mechanism at real stakes.