An artifact becomes a hash. The hash becomes evidence a stranger can check alone

Before anything else happens, the artifact under evidence, a receipt, an export, a signed document, is reduced to one SHA-256 digest. Every stage that follows binds to that digest. The file itself is never sent anywhere and is never touched again.

Two files with identical bytes hash identically. One changed byte hashes differently. Every panel that follows depends on nothing more exotic than that.

An anchor is a third party's signed or logged statement that it observed a given digest at a given moment. The same digest is anchored across four independent rails, each carrying a different, plainly stated guarantee.

Sigsum is the newest of the four rails, and its two-phase design is the one most easily mistaken for a stall. Submitting a digest as a leaf does not wait for the log to finish sequencing it. What comes back immediately is a durable pending binding: the signed, dated leaf material, proof the submission happened before the log has merged it into a tree.

Checking again later asks the log a plain question at no cost against the submission budget. If the leaf has since been sequenced, the pending binding upgrades in place into a complete one, an inclusion proof plus a cosigned tree head. Nothing about the artifact or its digest changes between the two states; only the evidence sitting around it gets more complete.

Twelve witnesses, counted independently

A cosigned tree head is only trustworthy if more than the log operator agrees it is correct. Every head Sigsum returns carries signatures from twelve independent witnesses: Glasklar's and Mullvad's own witness services, a Tillitis hardware witness, and nine ArmoredWitness devices, each held by a separate custodian.

Verification is k-of-n. A bundle is checked against whichever of the twelve cosigned that particular head, and a cosigner the verifier does not recognise, or one that is simply absent, is skipped rather than treated as a failure. One witness rotating out, or a new one joining, never breaks a proof that was already valid.

Every check a verifier runs against an anchor bundle runs against bytes already inside that bundle. None of them require asking a server anything. Disconnect first, and the same checks pass or fail exactly the same way.

• Checksum matches the claimed digest.
• The leaf signature verifies against the submitter's key.
• The Merkle inclusion path recomputes to the tree head's root.
• The log's own signature over that head verifies.
• Witness cosignatures over the same head verify against pinned keys.

Every one of those five checks is arithmetic and signature verification a verifier runs in its own browser tab. This is the estate's differentiator against a design that asks you to trust a server: nothing here is a phone call to anyone.

A digest that has been anchored can be dereferenced at ledger.ainumbers.co/<hash>. The contract behind that address follows RFC 6920: a request for a given digest returns content whose recomputed digest equals the address exactly, or it returns nothing at all. The address is never allowed to resolve to a different value than the one it names.

That is a narrower promise than it sounds. State is derivable from the log; the log stays canonical. A deployment that serves no Ledger endpoint at all is still fully conformant with the estate; one that does serve one has to honor the same rule every time, without exception.

The five panels above describe real, shipped mechanisms. None of them add up to more than what follows, and this panel is deliberately as prominent as the others rather than a footnote at the bottom of the page.