Don't trust us. Replay us.

The identity

This is the ledger, in one line:

log_id  3128a815d8657e0624eb91b81a1dec621cc7674cc7e9e677159268f83e0a6faf

genesis_head 5a387eea3aecf6ed86f94f77dc32fb39cacabafeb97e15459c641c3f8a1ebb49 — the head of the first entry pins the genesis content (identity alone does not); compare it with /meta.genesis_head.

The previous generation (FL2.2, log_id e687a69e…b37e, 10,900 entries) retired on 2026-09-02; its final head is this ledger's bridge_ref, and the whole archive is re-verifiable forever under archive/fl22/. If a node shows you the old log_id, it is the archive or an impostor, not the live ledger. Check /meta.generation == "FL2.3".

The operator key, anchor key, and the three co-signer keys are published in RELEASE. A 2-of-3 threshold of co-signatures confirms every stretch of history (in practice the node's own signer plus an independent GitHub-hosted signer; the third key is cold, held off-machine — and, honestly, the archived FL2.2 ledger's final 137 entries carry only the node's own signer, its last fully-confirmed head being seq 10,762), so a silently rewritten fork is detectable by anyone holding an older receipt. The previous generation's ledger is archived in full, and its final head is bound into this genesis — one continuous history.

Four ways in, each deeper

• Read — check the node's /meta against the published identity above. Seconds.
• Verify the chain — one call re-checks the hash chain, the operator signature, the co-signatures, and every participant signature. About a minute.
• Run the gates — the repo ships its own 48-gate test suite; run it against the code you just cloned.
• Replay the state — replay_full.py re-executes the ledger's law over every entry using public keys only, no secret involved. Edit one byte of history and it fails loudly. In the demo: 260/260 entries, 0.7 s.

What you still trust in v0

Two things — listed, not hidden. Availability: the operator can stop serving or drop your message; what it cannot do is rewrite history it already served. Checker execution: checks run at the node when a job settles — but every settled claim stays re-checkable afterward, by challenge and by full replay. The complete statement is in NOTICE.

What the numbers will show

The measurement is kept clean: the tape starts empty, and operator self-dealing is excluded by rule. Whatever the ledger shows will be real — the current numbers are published as periodic snapshots on the data page, and every figure there is re-derived from the public ledger by full replay, with no secrets.

Forking

Code is Apache-2.0, ledger data is CC0 — forking is free and welcome. The one thing a fork cannot take is this ledger's history: the records that make an issuer's notes worth 1 : 1.3 instead of 1 : 1 live here, and only here.