The public log

Every capture KolTheia accepts, and every file registered with it, is added to an append-only log, 351 so far. The log commits to all of them in one signed, time-stamped tree. That is what stops KolTheia, or anyone with access to its database, from quietly back-dating a record, changing one, or dropping one: anyone who kept an earlier tree head can catch it.

Latest tree head

Entries

351

Signed at

1793473326

Root hash (SHA-256)

04e2656982f7a7be1ae6aa6442ff290bda91b65fe211a411f836e98c60875829

Signature (ECDSA P-256, raw r‖s)

1c1fbc04b891d44a34f59aee9127d535913291e6d4a61e3cbc35cd416eebd854cc50f4171c11dbecf79a465fb0dff8c540cb1d89a43c0591628fd84d19b23480

Log key id

1ee6688415bb2974

Independent time-stamp

Verified. This tree existed no later than 2026-10-31T19:02:06+00:00, as signed by DigiCert, Inc..

Download (.tsr)

What you can check

That a capture or a registration is in the log (its certificate page has a button that does this in your browser, recomputing every hash itself). That the log only ever grew: keep a tree head today, and any later head comes with a short proof that it contains everything yours did. If a record had been changed or removed in between, no proof could exist.

The public interface, with no login:

GET /api/log/head                        the newest signed head + the log's public key
GET /api/log/proof/<proof code>          a record's entry, audit path and the head it leads to
GET /api/log/consistency?first=N&second=M a proof that the tree of N entries is a prefix of the tree of M
GET /api/log/entries?start=0&limit=500    every leaf hash, in order: enough to recompute any root
GET /api/log/head/<size>/timestamp        the authority's .tsr over a head's root

It is an RFC 6962 tree (leaf hash SHA-256(0x00 ‖ text), node hash SHA-256(0x01 ‖ left ‖ right)), the same as Certificate Transparency. A head's signature is over koltheia-log-head-v1|size|root|signed_at (heads signed before 26 October 2026, when KolTheia was called VeriMax: verimax-log-head-v1|…). A head's root is also what the time-stamp authority signed: openssl ts -verify -digest ROOT -sha256 -in log-head-N.tsr ….

What it does not do

It says nothing about whether a capture is true: only the device's signature and the sealed file do that. Nor does a registration's entry say who made the file: only who registered those bytes first. It cannot force KolTheia to log a capture. And records accepted before the log existed were added when it began: the log cannot show they were there earlier than the first head that includes them.