Hashit

What it does

Each file becomes one layer of an envelope: the SHA-256 fingerprint of its exact bytes plus its length. The layers are encoded in strict deterministic CBOR, and the whole envelope is identified by a 34-byte Core ID. Every correct implementation computes the same Core ID from the same files, byte for byte.

Optionally, a hash of the Core ID is sent to two independent timestamp authorities, DigiCert and Sectigo. Their RFC 3161 tokens show that the record existed no later than the time they signed. The tokens are checked against pinned root certificates and kept in a separate .anchors file beside the record.

What a check establishes, and what it does not

It establishes

That the files you hold are byte-for-byte the files that were fingerprinted, and that the record itself is unaltered. With both timestamp tokens valid, that the record existed no later than the anchored time.

It does not establish

That the content is accurate or honest, when the files were created, who made them, or how a court or regulator will treat the record. A fingerprint shows that bytes are unaltered. It says nothing about whether they describe the world correctly.

A record with one valid timestamp token is reported as partially time-anchored, never as fully anchored.

Who it helps

• Government contractors and defense suppliers who handle Controlled Unclassified Information and need to show that a file is unchanged without sending the file anywhere.
• Teams that hand work between people and AI agents and need a checkable record of exactly which bytes were sent and received.
• Anyone who will need to show, later and to a skeptical reader, that a set of files has not been modified.

Why the approach matters

• Content stays put. Fingerprints are computed on the device that holds the files. Only digests are recorded, so Indivisa never holds a copy of sensitive content to protect or leak.
• Determinism is checkable. A strict, frozen encoding means an independent implementation can recompute the Core ID and disagree loudly if anything differs.
• Verification does not depend on Indivisa. Records, timestamp tokens and the format specification are enough to check a record offline, including after a subscription ends or if Indivisa is unavailable.
• Absence is shown. A missing or failed check is reported as missing or failed, never folded into a single green tick.

Current availability

Public source release is planned under Apache-2.0. No date is set yet.

Technical detail

Encoding

Deterministic CBOR per RFC 8949 §4.2.1: definite lengths, shortest-form integers, bytewise key order, no trailing bytes, closed schemas. Envelopes are capped at 256 KiB and 1 to 1,000 layers.

Hash

One hash function, SHA-256, written as a multihash (0x12 0x20 followed by 32 bytes). Domain-separated tags keep Core IDs and layer IDs from colliding with each other.

Time

RFC 3161 not-after anchors from two independent authorities. The device clock is recorded as information only, never as evidence.

Known answers

SHA-256 in the reference kernel and in the browser port each pass 517 of 517 NIST ACVP vectors (FIPS 180-4), run 2026-10-28. ECDSA P-256 and Ed25519 verification pass their ACVP sets. Passing ACVP vectors locally is not CAVP validation.

Independent checks

Separate Python generators, standard library only, rebuild every vector the project produces, and the browser port is differentially tested against the Rust kernel. No independent human security audit has been completed yet.