Daily merkle anchoring of attestations

How jurat rolls every attestation into a daily signed merkle root and anchors it to Base calldata, and how to verify a merkle proof by hand.

Why anchoring exists

A signature proves jurat vouches for a record. A root written to a public chain proves the record existed before a point in time, independently of jurat. Every day, every new attestation is rolled into a merkle tree and the root is signed and published at /v1/anchors, free.

Current status: no root has been written to Base yet. The onchain write is implemented and the anchor wallet holds no gas, so every published root today is jurat's ed25519 signature over a publicly recomputable tree and nothing more. That is useful (it makes tampering with any individual record detectable) but it is not independent of jurat, and it will not be until a root carries a base_tx. Each anchor states its own status, and /v1/anchors reports the count of roots written onchain versus signed only. Nothing on this page should be read as claiming an independence the data does not yet have.

The algorithm, exactly

Leaf: sha256 of the canonical signed object (same canonicalization as the signature: sorted keys, no whitespace).
Order: leaves sorted ascending as hex strings.
Parent: sha256 of the concatenated raw bytes of the two child hashes. An odd leaf is paired with itself.
Root signature: ed25519 over canonical {"date":"YYYY-MM-DD","jurat_anchor":1,"root":"..."}.
Onchain: a zero-value self-send on Base whose calldata is 0x6a757261743a3101 ("jurat:1" tag) followed by the 32-byte root.

Verifying a proof

Every anchored attestation carries an anchored block: its leaf, a merkle proof (a list of steps, each a sibling hash and a position), the root, the root signature, and the Base transaction hash when written. Recompute the leaf from the record, walk the proof, and compare the final hash to the root:

h = leaf
for step in proof:
    pair = (step.hash + h) if step.position == 'left' else (h + step.hash)
    h = sha256(bytes.fromhex(pair_left) + bytes.fromhex(pair_right))
assert h == root

Once the root appears in Base calldata, the attestation provably existed before that block and jurat cannot backdate it without breaking the tree. Until then the tree still catches tampering with any single record inside an already-published root, but a reader is trusting jurat not to have republished the root itself.