LoomSeal overview

The problem

Anything can be generated now, which means trusting the source is no longer a plan.

When anything can be generated — screenshots, logs, dashboards, a whole convincing history — the scarce thing isn't the artifact, it's a claim a stranger can check without trusting the source. Vaults, SSO, and “trusted” databases all reduce to trust the operator. That's exactly the assumption AI just made worthless.

Which matters because sooner or later somebody asks you to prove something.

A customer asks whether you patched what you said you patched, when you said you did.

An auditor asks who changed production the day it broke, and whether the log was edited.

A regulator asks for evidence of a control you have supposedly run for two years.

A buyer's security team asks you to prove your change process, not describe it.

So you go and pull the logs, and somewhere on the way to the meeting it lands on you that your logs are a table in a database you control. You know you did not edit them. You have no way to show it.

That is the gap LoomSeal closes, and it closes it by answering the three things a skeptic always says.

“You made this up.”

The file is signed by the machine that produced it. Change one byte anywhere in it and the signature fails.

“You deleted the parts that made you look bad.”

Every entry carries the hash of the one before it. Remove or reorder a single line and every link after it stops recomputing, and the verifier tells you exactly which one broke.

“You wrote this last night.”

The head of the chain was published outside your reach long before anyone asked. Those entries existed before that anchor did, or the anchor would not match.

None of that is new cryptography. It is three ordinary ideas stacked so that the person holding the file never has to take your word for anything.

What actually happens

Software writes a record, the record is sealed as it lands, and the history ends up as one file anyone can check.

First, the misconception worth clearing: LoomSeal doesn't watch your files, your folders, or your documents, and nothing is scanning for changes. Software that adopts the format writes its own records through it as it works, and the seal covers those records and nothing else. Here is the whole life of one record, from the moment software writes it to the moment a stranger checks it.

1. Software writes a record

A deploy tool finishes a release and writes an entry: who ran it, what changed, when. It is ordinary logging in a shape the format defines.

2. The record is sealed as it lands

Each entry is hashed together with the one before it and signed the moment it is written, not scanned later. Alter or remove one afterward and the chain arithmetic stops adding up.

3. The history becomes one file

When somebody needs evidence, the tool exports the history as a bundle: one ordinary JSON file. Email it, attach it to a ticket, archive it, hand it to an auditor.

4. Anyone checks it anywhere

A free verifier reads the file and gives a verdict: signed, chained, anchored, or the name of what broke. There is a CLI, a Python reference implementation, and a verifier that runs entirely in the browser.

Played out end to end: the deploy tool has been writing who, what, and when through the format all quarter. An auditor asks for the change history, so somebody exports bundle.json and attaches it to the ticket. The auditor drags the file into the browser verifier on a laptop with the WiFi off, and it answers VERIFIED: signed, chained, anchored. No account, no vendor, and not one question for the team that sent it.

And if you open the bundle in an editor and change anything at all, verification fails. That is the point. The file matches the history that was sealed as it was written, or the verifier says exactly where it stopped matching. The whole mechanism, the chain and the anchors and the verifier running it backwards, is on how it works.

Verify one right now

Sixty seconds from clone to verdict.

Sending it is the dull part, which is the point. One JSON file, small enough to email. The recipient runs a free, open-source verifier, offline, with no account and nothing installed from you, and a few seconds later they have a yes or a no.

No terminal required, either. The same check runs in the browser at loomseal.com/verify, entirely on the recipient's machine, and it works offline once the page has loaded.

go install github.com/kordloom/loomseal@latest
git clone https://github.com/kordloom/loomseal
cd loomseal
loomseal verify examples/audit.loomseal.json --evidence examples/evidence

bundle     lsb_example_0001 from loomseal-demo 0.1.0
subject    fleet demo-yard
signature  ok, key sha256:f8840a25992b58b823321187e1c44d36ee1a748023034a46d26ea93419edaf07
chain      loomseal-chain-v1, full, 2 claims, head matched true
anchors    1 matched by coordinates, 0 proof(s) carried, 0 verified
evidence   1 verified, 0 missing, 0 referenced only
VERIFIED   signed, chained (full), anchored by reference

Real output, reproducible from the public repository. The verifier is built on the Go standard library alone, so every line that touches a verdict is readable in an afternoon.

Overview