Reproducible verification for retained logs (RFC 8785 canonicalisation + OpenTimestamps)

[Colin Winter]

Chris Lamb suggested this list might find the following of general interest, so I am bringing it here for comment.

Reproducible builds remove trust in the builder: anyone re-derives the same artifact from the same source, byte for byte. The same shape applies one layer over, to a retained record. Most record-keeping regimes (the EU AI Act's Article 12 logging is the current example) require that events be recorded and logs retained, but not that a retained log be verifiable, by a party who was not present, as unaltered and existing when claimed. That leaves an integrity obligation resting on trusting the party being audited.

A worked, reproducible mechanism for closing that gap:

- Canonicalise the record byte-exactly (RFC 8785 / JCS), so two independent producers land on identical bytes.
- Hash and Merkle-bind it.
- Anchor the root with OpenTimestamps, confirmed on Bitcoin, verifiable offline with the stock `ots` client, needing nothing from the operator or from us.

Verification is reproducible in the sense this list cares about: the root re-derives from committed bytes, the anchor checks offline against a source nobody owns, and there are independent verifiers in more than one language (Go and Python) that must agree on shared test vectors, or the property is only asserted. Reference implementation, spec, and vectors:

  https://github.com/MarkovianProtocol/tlog-bitcoin-anchor
  https://github.com/MarkovianProtocol/audit-anchor

Scope, honestly: this proves a record existed, unaltered, at a time, checkable by an independent party. It does not prove the record is correct, only its integrity and time. The trusted third party (an RFC 3161 TSA) is removed in favour of an unowned timestamp; the interesting property is fixing time without adding a party to trust.

Where it might touch this list's work: a rebuilder's reproducibility attestation is exactly the kind of record that benefits from being independently verifiable as existing at a time, over a canonicalisation the whole ecosystem agrees on.

Two questions for the list:

1. Is byte-exact canonicalisation the right determinism boundary here, or are there edge cases (numbers, Unicode, nested structures) where RFC 8785 diverges in practice?
2. Is an OpenTimestamps / Bitcoin anchor the right unowned time source, or is there a lighter-weight one the reproducible-builds world already prefers?

Tell me where it breaks.

Colin Winter
Markovian Protocol