Strata

The checklist

Thirty-two things. Twenty-five work today, none are half-built, four are next, and three are deliberately after a first release.

Every item says what it does not do as readily as what it does, because a status page that flatters the software is worse than no status page. Where something is built but unreachable, or works only from a terminal, it says so in those words.

  1. Working

    Canonical form and content-addressed store

    Format v11, with frozen test vectors. Determinism is permanent: a released canonicaliser is never changed. Italic, bold, strikethrough and underline are all content and all hashed; which of Word’s eighteen underline styles drew the line is not.

    Version 11 was the first change that could have read existing bytes differently. Every canonical byte in every project, every frozen vector and all forty-one corpus tabs were scanned first: none contained a bare delimiter, so for everything that exists v11 and v10 are the same function. The scan is kept as code.

  2. Working

    Checkpoints, restore, and verification

    Every fingerprint is recomputed and checked rather than taken on trust.

  3. Working

    Cut drafts, and comparing two states

    By chapter first, then by word, against a saved state or against text you have not saved yet.

  4. Working

    Round-trip fidelity check

    41 tabs, lossless, through the real editor and the real core. Seven data-loss bugs reached a running build before this existed; all seven passed every test of their day.

  5. Working

    Merkle commitments — tree, leaf encoding, inclusion proofs

    Checked against the DAON wire format’s own executable vectors, RFC 6962 split rather than last-node duplication. But nothing yet produces per-chapter leaves, so a manuscript is committed whole.

  6. Works

    OpenTimestamps witness

    Anchoring works from the application: an anchor button beside each recorded state, on manuscripts only, which asks first because it is the one act here that publishes anything. The round trip closes on its own — a proof arrives as a promise from named calendars, and the application goes back for the Bitcoin attestation when the application next starts. That matters because the promise lives on an operator’s server: the Bitcoin commitment is permanent, but a calendar that goes dark before anyone collects leaves the proof unverifiable forever.

    It collects only for the project you open. Pending proofs in a project you have not opened lately sit and wait. A proof still unredeemed after a week says so rather than being retried in silence, because a sweep that never mentions itself is how you come to believe you are anchored when you are not.

  7. Working

    Cut a manuscript into separately provable pieces

    A manuscript divides at its chapter headings, each chapter becomes a leaf, and the leaves make a tree. Proving one chapter means handing over that chapter and a short proof — the rest of the book stays where it is. On a real 536 KB draft of twenty-two chapters that is 27.6 KB disclosed, about five per cent, and 160 bytes of proof.

    It sits beside the whole-document commitment rather than replacing it. Both describe the same manuscript: one says this is the whole of it, the other says and here is how it divides.

    Which heading level counts as a chapter is yours to state, because the same text split two ways gives two different trees — so a root is only checkable alongside the level that produced it. A manuscript nobody has chaptered divides into one piece, and the tool says so rather than offering a proof that reveals everything.

    Command line only, and nothing yet stores a parts root or anchors one.

  8. Next

    Signing — a record that says whose hand

    Not started. Until it does, a record proves a text existed by a date, not who wrote it. This page will keep saying so until the day it is untrue.

  1. Working

    Editor, outline, and read-only history

    Chapters, scene breaks, and notes and research beside the manuscript.

  2. Working

    Emphasis, strikethrough, underline, images, scene breaks, page breaks, lists

    All content, all hashed. Emphasis is content: he said nothing and he said nothing are different sentences. Strikethrough and underline arrived with format v11 — not as a feature request, but because the importer had been reading only italic and bold, so a struck-through sentence in a Word document arrived as ordinary prose and nothing said so.

  3. Working

    Comments

    Imported with their anchors, placed, answered, resolved.

  4. Working

    Spelling, with a dictionary per book

    The system checker underlines what it does not know; right-click adds a word to this book’s dictionary. Per project rather than per machine on purpose: the operating system’s own “Learn Spelling” writes to your account and would follow an invented place-name into your mail. A manuscript is full of words no dictionary can know, and they are not mistakes.

    The list is a plain file beside the project. It is not hashed, not in the manifest, and adding a word writes no new state — teaching a dictionary is not editing a draft. macOS only so far; the application says so rather than showing a clean page.

  5. Working

    Import from .docx, including comments

    Importer v3.

  6. Working

    Embedded fonts

    Detected, not kept. The name and size are read; the bytes are discarded.

  7. Working

    Export — PDF, DOCX, HTML, EPUB, LaTeX

    A whole document or a selection of chapters. Fonts are embedded in the PDF only, and export says so when a passage needs a face the reader may not have.

  8. Working

    Span typeface, alignment, page setup

    Carried in an unhashed sidecar and applied by every export. A typeface covering part of a paragraph is recorded but not yet applied, and export says so.

    One deliberate exception: LaTeX does not align a heading. A \section takes its alignment from the document class, and a centred-but-still-numbered section is typeset wrongly by most of them, so the export reports it rather than producing something subtly broken. PDF and DOCX centre headings as you set them.

  9. Working

    Research boards

    Cards on a page, arranged however you find useful, with as many boards as you like — and one card can sit on several without being copied. A card is made of blocks: text, a list, a picture, a gallery. Pictures are dropped or pasted straight on, and go into the same store the manuscript’s figures use, so the same photograph in a chapter and on a board is one file.

    Nothing on a board is hashed, checkpointed, or part of a draft. Moving a card cannot change what a document is, which is exactly why links and pictures work here and not yet in the manuscript.

    Arranging works with a mouse, a finger, or the keyboard alone — a card is picked up with Space, moved with the arrows, and put back with Escape, and its position is announced as something a person can act on rather than as coordinates. What is not built: no way to draw a line between two cards, and no search across them yet, so a board is somewhere to put things rather than somewhere to find them.

  10. Working

    Accessibility

    Contrast that runs both ways, larger targets, reduced motion, and paper grain you can switch off because it lowers effective contrast. Built in rather than switched on.

  11. Later

    Citations, footnotes, tables, links

    Not started in the manuscript format. Footnotes block whichever audience comes first, so they are the next format work rather than a distant one.

    Links already work on research boards, and that is not an inconsistency: a card is not hashed, so a link there is an ordinary field rather than a change to the thing every implementation has to agree about.

  1. Working

    Desktop application — macOS

    Builds, runs, signed with a Developer ID and notarised by Apple, so it opens on a machine that has never seen it without a warning. 52 MB installed. This is the platform it is developed and used on every day.

  2. Working

    Code signing

    With a stable identity, which is what makes the keychain usable at all — macOS grants keychain access per code signature, so an ad-hoc build re-prompts on every launch.

  3. Next

    Windows and Linux

    Intended, and not yet honestly claimable. The core already knows where files belong on all three — APPDATA on Windows, XDG_DATA_HOME on Linux — and the toolchain can produce builds for both. What it cannot do is run them: this is written on one machine, and that machine is a Mac.

    A build nobody has ever launched is not a supported platform, whatever the download page says. When they ship they will say plainly which of the three has been run by a person and which has only been compiled — because the editor draws in a different browser engine on each one, and that is exactly where an untested build breaks.

    • macOSSupported

      developed and used here every day

    • WindowsIntended

      the core already knows it; the build is untested

    • LinuxIntended

      same, and the engine differs most here

    What it needs

    • An Apple Silicon Mac, macOS 11 or later — which is every Mac Apple has shipped since November 2020. There is no Intel build, and there is not going to be one: it would be a version nobody here can run, and an untested build is not support.
    • About 9 MB installed. A project costs roughly its manuscript plus its history — a 460,000-word one with seventy recorded states is about 14 MB.
    • Nothing else to install. The typesetting engine that renders PDFs (Typst, Apache-2.0) ships inside the application — no second download, no command line, and the version is pinned to the one the exporter was tested against rather than whatever happens to be on your machine.
    • Memory: not yet measured, so not yet claimed. Everything here is developed on a machine with plenty, and "runs comfortably in 8 GB" is a sentence that has to be earned with a number before it is printed.
  4. Working

    Notarisation

    Submitted to Apple, and the ticket is stapled to the application — so it opens on a stranger’s machine with no warning and no right-click-to-open ritual. The bundled typesetting engine is signed and hardened alongside it, which is the part that usually fails.

  5. Next

    Native file dialogs, and the updater

    Half of the first: choosing a folder — to export into, or to check a bundle in — opens the system’s own picker, so it sees your aliases, your tags and your iCloud folders. Naming the file is still our dialog rather than a system save sheet.

    The updater is not started. Today an update means downloading the application again.

  1. Working

    The verification bundle

    A folder, not an archive: the canonical text, the proof, a SHA256SUMS and a page of instructions. Checking it needs sha256sum and the reference OpenTimestamps client — neither of them ours.

  2. Working

    …and reachable from the application

    Every recorded state in the history panel can write one, to a folder you choose. The report leads with what else is in it — when the only available proof covers the whole state rather than the manuscript alone, the other tabs go in too, and the application names them before you send it anywhere rather than after.

    Check a Bundle… in the File menu goes the other way: point it at a folder somebody sent you and it reports what it found. It shows a changed file next to both digests — what was recorded, what is there now — so you can see what moved rather than being told that something did. A file that is listed but simply was not sent is reported separately from one that was edited, because collapsing those two would make the second one cheap.

  3. Working

    Verifying a bundle we did not produce

    In the application and on the command line, and the command line stays the one that counts — you have only our word for what our own window prints. It can never print “confirmed”: confirming a Bitcoin attestation means fetching a block header, and a program that said so on the strength of bytes handed to it would be attesting to its own input.

  4. Next

    Reporting a bug

    Designed, not built. The reporter composes the report locally and shows it in full before anything is sent; there is no automatic crash reporting and no telemetry of any kind.

  1. Working

    This site, on our own box

    Served from hardware we rent directly, over IPv4 and IPv6, with certificates it obtains itself. Relative paths throughout, fonts served from here, no third party contacted by any page — and a test that fails the build if one ever is.

  2. Working

    The launch list

    Self-hosted on our own machine, tracking off, address only, deleted on request — no mailing provider is involved and nobody else is handed your address. The form answers on this site rather than sending you elsewhere, wherever the browser allows it to.

  3. Later

    Licence check and checkout

    A perpetual licence covering the major version you buy, verified offline with no server and no clock — the build you have keeps working whatever happens to us. Last, because a licence is a thin file check and belongs after there is an application to put it in.

  1. Deferred

    Sync, mobile, and hosted storage

    Each would put your writing somewhere you are not, which is the thing this is for. Deferred rather than refused, with the reasoning recorded.

Why emphasis came before footnotes

Emphasis is content — he said nothing and he said nothing are different sentences — so it belongs in the hash. Shipping the bold button before the format could represent it would have been a quiet data-loss bug wearing a feature's clothes. The same reasoning promoted images and scene breaks: a figure is the substance of a thesis, and a blank line between two paragraphs of prose is one of the oldest conventions in fiction.

Applying a typeface to a passage is a different case, and an earlier version of this page had it wrong. Codepoints already carry the script — Hebrew is Hebrew whether it is set in Solitreo or square type — so the face is presentation. It travels alongside the document rather than inside the hash, and needs no format change.

What the round-trip check is for

Seven separate data-loss bugs reached a running build before that row existed — headings, soft breaks, emphasis, images, scene breaks, a mis-stripped escape, and every bold span in the corpus. All seven passed every test that existed at the time. All seven were found by a person reading their own prose and noticing something missing.

The shape never varies: the editor cannot parse something, degrades it to plain text, and the next save writes the degraded version. The loss happens one save after the bug, which is why it is invisible. Comparing input to output catches the entire class without having to anticipate the next feature — so the check compares canonical text through the real editor and the real core, and any difference at all is a failure.

What it proves, and what it doesn’t

Detectors guess. This does not guess — which means it also cannot answer the question people most want answered. The full account, with the reasoning, is on How it works; the short version:

✓That the text is unchanged. These exact words are the ones that were recorded. Every fingerprint is recomputed and checked, never taken on trust.
✓That it existed by a date. No later than the moment it was timestamped — against a public clock rather than against our word.
✓That it was built up over time. Across many recorded versions, in an order that cannot be rewritten afterwards. This is continuity of the work: nothing is signed yet, so it is not yet continuity under a proven identity.
×Not that a person wrote it. Text can be pasted in a little at a time. Nothing here tells a writer from a patient machine, and any tool claiming otherwise is guessing.
×Not anything the editor cannot see. It can tell that a paste happened. It cannot tell where the text came from — so the record notes what happened and never guesses why.
Why that omission is deliberate

A field saying “human” or “AI” would become a standard, then an expectation, then a demand — and its absence would start reading as guilt. That pressure lands hardest on the people with the least control over how they work. The format has no such field, and no way to add one.

How someone checks a record without trusting us →