protocol design · in progress

Provenance for code

The formal strand behind Etch — treating authorship as something that should be checkable the way a checksum is, and asking how little you have to trust to make that true.

Problem

Git history is testimony, not proof. Commits can be rebased, amended, and forged. As machines write more of the code, the question of who wrote what gets both harder and more consequential — and there's no artifact you can point to that settles it.

Approach

Make authorship checkable, and shrink what you have to trust. Content-addressed, signed authorship claims that verify as a pure function — no authority in the loop — with the trusted surface kept small enough to audit.

Findings

Spec stabilizing in public. This is the design-research strand; the engineering strand ships as [Etch](/work/etch). The open questions below outlive any single write-up.

The question.

What does it actually take for a claim of authorship to be checkable — locally, instantly, without trusting the person making the claim? The research half of Etch starts there, before any code: it treats provenance as a verification problem, not a database problem.

The design constraint that makes it interesting is minimality. How small can the trusted surface get before verification stops meaning anything? Every dependency you add to the checker is something a verifier has to trust — so the interesting version of the problem pushes that surface toward zero.

A claim of authorship should be checkable the way a checksum is checkable — locally, instantly, without trusting the person making the claim.
— design note, etch spec draft

Where it stands.

The engineering strand ships as the [Etch case study](/work/etch) — a Rust core, ed25519-signed content-addressed claims, edge-deployed verification. This page is the research strand: the questions underneath the implementation, written down in public as the spec stabilizes.

The spec is being written in the open. The load-bearing work is making it precise enough that someone else can implement a verifier from it without asking questions.