Transparency
When anchoring is on, Latent hashes the head of every order's event record into one Merkle root and has outside timestamp authorities sign it, and lists the roots here: roots and leaf hashes only, no order ids. It is not turned on in this deployment.
Anchoring is not turned on here
This deployment has no timestamp authority configured, so no roots are published yet.
Check an order yourself
Both sides of an order can download its receipt from the order page: the event record, the Merkle proof of the order's leaf and the timestamp tokens. With OpenSSL:
- 1. Recompute every event hash: sha256(prev_hash + "|" + canonical JSON of {order_id, unit_id, actor, role, kind, payload, at}), prev_hash empty for the first event.
- 2. Recompute the leaf: sha256(0x00 || "latent-anchor-leaf/1|order|<order_id>|<seq>|<head_hash>"), then fold the proof (RFC 6962) to the root.
- 3. Check that the leaf hash is listed at /api/market/anchors/<anchor_id>/leaves and that the root equals the one you were emailed or saw on the order page.
- 4. Save the token: base64 -d > anchor.tsr
- 5. Extract the TSA certificates: openssl ts -reply -in anchor.tsr -token_out -out token.der openssl pkcs7 -inform DER -in token.der -print_certs -out chain.pem
- 6. Verify against the TSA's root you obtained yourself: openssl ts -verify -digest <root hex> -in anchor.tsr -CAfile <tsa root>.pem -untrusted chain.pem
- 7. Timing: every event's "at" must be earlier than the genTime of the first anchor that covers it. A gap of more than two anchor intervals (2 hours at the default) between an event and that genTime, while /transparency lists anchors in between, is a sign that the event was backdated.
- 8. Keep this receipt. A later receipt for this order must contain these events unchanged. Latent cannot backdate an anchored root; a rewrite after anchoring is visible to anyone who holds an earlier receipt or root.
What this proves: Latent cannot backdate an anchored root. It says nothing about the data itself; the checks on each unit do that.