Strata

The checklist

Twenty-nine things. Seventeen work today, one is half-built, eight are next, and three are deliberately after a first release.

Every item says what it does not do as readily as what it does, because a status page that flatters the software is worse than no status page. Where something is built but unreachable, or works only from a terminal, it says so in those words.

  1. Working

    Canonical form and content-addressed store

    Format v10, with frozen test vectors. Determinism is permanent: a released canonicaliser is never changed.

  2. Working

    Checkpoints, restore, and verification

    Every fingerprint is recomputed and checked rather than taken on trust.

  3. Working

    Cut drafts, and comparing two states

    By chapter first, then by word, against a saved state or against text you have not saved yet.

  4. Working

    Round-trip fidelity check

    41 tabs, lossless, through the real editor and the real core. Seven data-loss bugs reached a running build before this existed; all seven passed every test of their day.

  5. Working

    Merkle commitments — tree, leaf encoding, inclusion proofs

    Checked against the DAON wire format’s own executable vectors, RFC 6962 split rather than last-node duplication. But nothing yet produces per-chapter leaves, so a manuscript is committed whole.

  6. Half-built

    OpenTimestamps witness

    Works, and is verified against real calendars — from the command line only. Anchoring from the application is not built, and it is the act that turns a checkpoint into evidence.

  7. Next

    Cut a manuscript into separately provable pieces

    Until this lands, proving one chapter without revealing the book is a property of the format rather than something the application can do.

  8. Next

    Signing — a record that says whose hand

    Not started. Until it does, a record proves a text existed by a date, not who wrote it. This page will keep saying so until the day it is untrue.

  1. Working

    Editor, outline, and read-only history

    Chapters, scene breaks, and notes and research beside the manuscript.

  2. Working

    Emphasis, images, scene breaks, page breaks, lists

    All content, all hashed. Emphasis is content: he said nothing and he said nothing are different sentences.

  3. Working

    Comments

    Imported with their anchors, placed, answered, resolved.

  4. Working

    Import from .docx, including comments

    Importer v3.

  5. Working

    Embedded fonts

    Detected, not kept. The name and size are read; the bytes are discarded.

  6. Working

    Export — PDF, DOCX, HTML, EPUB, LaTeX

    A whole document or a selection of chapters. Fonts are embedded in the PDF only, and export says so when a passage needs a face the reader may not have.

  7. Working

    Span typeface, alignment, page setup

    Carried in an unhashed sidecar and applied by every export. A typeface covering part of a paragraph is recorded but not yet applied, and export says so.

  8. Working

    Accessibility

    Contrast that runs both ways, larger targets, reduced motion, and paper grain you can switch off because it lowers effective contrast. Built in rather than switched on.

  9. Later

    Citations, footnotes, tables, links

    Not started. Footnotes block whichever audience comes first, so they are the next format work rather than a distant one.

  1. Working

    Desktop application

    Builds and runs. 8.9 MB installed.

  2. Working

    Code signing

    With a stable identity, which is what makes the keychain usable at all — macOS grants keychain access per code signature, so an ad-hoc build re-prompts on every launch.

  3. Next

    Notarisation

    Not done, so a machine that has never seen the application will still warn on first open.

  4. Next

    Native file dialogs, and the updater

    Not started.

  1. Working

    The verification bundle

    A folder, not an archive: the canonical text, the proof, a SHA256SUMS and a page of instructions. Checking it needs sha256sum and the reference OpenTimestamps client — neither of them ours.

  2. Next

    …and reachable from the application

    Built, and the interface calls neither route. There is currently no way to produce a bundle without a terminal, which means this site explains how to check a folder that authors cannot yet make.

  3. Working

    Verifying a bundle we did not produce

    Command line. It can never print “confirmed”: confirming a Bitcoin attestation means fetching a block header, and a program that said so on the strength of bytes handed to it would be attesting to its own input.

  4. Next

    Reporting a bug

    Designed, not built. The reporter composes the report locally and shows it in full before anything is sent; there is no automatic crash reporting and no telemetry of any kind.

  1. Next

    This site, on our own box

    Deployable now: relative paths, self-hosted fonts, no third party contacted by any page, and a test that fails if one ever is.

  2. Next

    The launch list

    Self-hosted, tracking off, address only, deleted on request. Until it exists the signup form has nowhere to post, which is the one thing standing between this site and being worth publishing.

  3. Later

    Licence check and checkout

    A perpetual licence with a year of updates, verified offline. Last, because a licence is a thin file check and belongs after there is an application to put it in.

  1. Deferred

    Sync, mobile, and hosted storage

    Each would put your writing somewhere you are not, which is the thing this is for. Deferred rather than refused, with the reasoning recorded.

Why emphasis came before footnotes

Emphasis is content — he said nothing and he said nothing are different sentences — so it belongs in the hash. Shipping the bold button before the format could represent it would have been a quiet data-loss bug wearing a feature's clothes. The same reasoning promoted images and scene breaks: a figure is the substance of a thesis, and a blank line between two paragraphs of prose is one of the oldest conventions in fiction.

Applying a typeface to a passage is a different case, and an earlier version of this page had it wrong. Codepoints already carry the script — Hebrew is Hebrew whether it is set in Solitreo or square type — so the face is presentation. It travels alongside the document rather than inside the hash, and needs no format change.

What the round-trip check is for

Seven separate data-loss bugs reached a running build before that row existed — headings, soft breaks, emphasis, images, scene breaks, a mis-stripped escape, and every bold span in the corpus. All seven passed every test that existed at the time. All seven were found by a person reading their own prose and noticing something missing.

The shape never varies: the editor cannot parse something, degrades it to plain text, and the next save writes the degraded version. The loss happens one save after the bug, which is why it is invisible. Comparing input to output catches the entire class without having to anticipate the next feature — so the check compares canonical text through the real editor and the real core, and any difference at all is a failure.

What it proves, and what it doesn’t

Detectors guess. This does not guess — which means it also cannot answer the question people most want answered. The full account, with the reasoning, is on How it works; the short version:

✓That the text is unchanged. These exact words are the ones that were recorded. Every fingerprint is recomputed and checked, never taken on trust.
✓That it existed by a date. No later than the moment it was timestamped — against a public clock rather than against our word.
✓That it was built up over time. Across many recorded versions, in an order that cannot be rewritten afterwards. This is continuity of the work: nothing is signed yet, so it is not yet continuity under a proven identity.
×Not that a person wrote it. Text can be pasted in a little at a time. Nothing here tells a writer from a patient machine, and any tool claiming otherwise is guessing.
×Not anything the editor cannot see. It can tell that a paste happened. It cannot tell where the text came from — so the record notes what happened and never guesses why.
Why that omission is deliberate

A field saying “human” or “AI” would become a standard, then an expectation, then a demand — and its absence would start reading as guilt. That pressure lands hardest on the people with the least control over how they work. The format has no such field, and no way to add one.

How someone checks a record without trusting us →