Verderer — a provable record of how public data changes

Correctness under complexity, pointed at public trust. Verderer continuously observes high-value U.S. government environmental pages and datasets, cryptographically attests every observation in a tamper-evident ledger, detects meaningful change (definition swaps, threshold edits, silent dataset shifts — not byte noise), and emits a public, citable, self-verifying record. It is live and running unattended at verderer.satchelhamilton.com.

The problem

An archive is only as trustworthy as the archiver. "Trust us, this is what the page said" is not proof — the operator (or the source) could alter history. The question worth answering isn't "do you have a copy?" but "can a stranger verify the copy is honest, without trusting you?"

Approach — a provable trust spine

• Rust Merkle log (C2SP tlog-tiles — the transparency-log design behind Certificate Transparency, Go's checksum database, and Sigstore) with Ed25519 signed checkpoints published as static tile files, so a verifier recomputes inclusion proofs with no live service.
• Independent time anchors, checked offline. RFC 3161 timestamps from two third-party authorities (DigiCert and FreeTSA) and a Bitcoin-confirmed OpenTimestamps proof that verifies against its own carried block header — roots pinned in the verifier, no anchor trusted on faith.
• Witness cosignatures with quorum verification — no single party (including Verderer) can silently rewrite the log; an independently-run witness refuses to cosign a forked, shrunk, or equivocating log.
• Consistency-proof gossip — verify-consistency proves offline, under a pinned key, that a later checkpoint extends an earlier one, so a rewritten history is caught.
• A downloadable proof bundle that verifies entirely in the browser (WebAssembly, nothing uploaded) — byte-for-byte identical to the native Rust verifier — or fully offline from the command line.

Why it's trustworthy — the point is verifiability, not authority

The whole design refuses to ask for trust. Corrupt any stored leaf and verify reports INVALID; the offline verifier confirms a record against a signed checkpoint trusting neither the source nor Verderer. Change detection spans static pages, JS-rendered tools, and scientific/tabular datasets (CSV/JSON, NetCDF/HDF, zip/xlsx) — down to cross-unit numerics, so 10 ppb equals 0.010 ppm instead of raising a false alarm. Collection is polite by construction (robots.txt, per-host rate limits, conditional GET), and the verifier is open source on purpose — the proofs only mean anything if anyone can build and audit the checker.

One honest boundary, stated plainly: what the cryptography guarantees is integrity, inclusion, consistency, and time — that a given observation is real, in the log, and existed by a certain moment. It does not certify a change's meaning. Severity ("is this edit significant?") is a best-effort, human-reviewable classification, never a proven fact — so Verderer surfaces changes for review rather than declaring intent.

What's technically interesting

Applying transparency-log engineering — the same tamper-evidence tech that secures the web's certificate ecosystem — to civic data integrity, across a Rust trust kernel, a Python collection/diff pipeline (talking to Rust over stdio, no FFI), and an Astro public record with in-browser WASM verification. Every observation is also archived as a standard WARC, so the record interoperates with the volunteer rescue ecosystem (Wayback, End-of-Term, EDGI) instead of being self-referential. The differ and WARC reader are Hypothesis-fuzzed to be total on untrusted bytes (a result or a controlled error, never a crash or hang), and inclusion/consistency proofs are scale-tested to stay O(log n) at 100,000 leaves.

Status — standing watch

The roadmap is complete, and Verderer is a running watchdog with a fully closed trust core. A scheduled job wakes every six hours, observes a curated set of federal targets, appends each attested observation to the append-only log, re-anchors the checkpoint in time, and redeploys the public record — all unattended. It has already earned its keep: it attested its first real in-the-wild change — a medium-severity content edit on the FEMA National Risk Index — surfaced for review with an offline-verifiable proof that the before and after are both genuine. The live log has continued to grow, checkpoint over signed checkpoint, ever since.