An observation is only evidence if it can be checked by someone who does not trust the observer. These are the properties that make Wellknown's observations checkable, stated as what exists today. Nothing here is an aspiration; where something is planned, it says so.
Each UTC day's observations are sealed under one Merkle root and the root is signed with an Ed25519 key. Every stored attestation records the key id and the public key that signed it, so a signature is always checked against the key that made it, not against whatever key is current. The key endpoint publishes the current key and every key that has ever signed a stored attestation, with the first and last day each was used:
GET https://wellknown.network/api/v1/attestations/keyRotation is a new key signing from a given day forward. Older attestations stay verifiable against their own key indefinitely. The anchor signature uses a separate ECDSA P-256 key, because the public log's entry type requires a digest signature; it is published with each anchor. What does not exist yet: a cross-signed rotation statement (the old key vouching for the new one) and an explicit revocation record. Both are planned; a reviewer who needs them before ingesting should say so.
Observations are retained indefinitely and are never pruned. The change ledger — status transitions, tool-surface changes, endpoint, ownership, authorization and TLS events — is append-only by construction: rows are added and never updated or deleted. Daily rollups exist for speed; they summarise the raw rows and never replace them. This is stated in the public offers document as well as here.
Each day's signed attestation document is anchored in Sigstore's Rekor transparency log, which Wellknown does not operate. The anchor proves that the document was included in the log at a given index under a checkpoint the log signed, and that it has not been altered or removed since. A single observation can be proven to belong to its day's root, and the root to have been logged; that chain, from one check to the public log, can be checked without trusting Wellknown at any step.
Two limits, stated precisely. The first is scope: what the chain establishes is provenance, not occurrence. The log proves that a document with these contents existed at a given index and has not changed since; it cannot prove that the HTTP exchange the document describes took place. The log makes the record tamper-evident. The observation itself rests on Wellknown having made the check, and a reader who does not extend that trust has to make the check as well; what the record then fixes is what Wellknown claimed to have seen, when it claimed it, and that the claim has not been edited since.
The second is time: Rekor v2 entries carry no per-entry timestamp. The log vouches for inclusion and for order relative to other entries, not for wall-clock time. The timestamps on an anchor are Wellknown's own clock and are labelled as such. An independent timestamp over each checkpoint is planned and will be published alongside the anchor when it exists.
Anchoring began on 2026-09-13. Attestations are signed from 2026-09-09, so the days between are signed but not anchored; a reader who needs a particular day anchored should check that day's anchor endpoint rather than assume it. 10 of 14 signed days are anchored.
The anchors are permanent and independent of Wellknown. What they anchor is a hash, so a verifier also needs the document. Every day's attestation document and anchor proof is mirrored to github.com/sanemavcil/wellknown-attestations, a public repository outside Wellknown's infrastructure, so that verification does not depend on this site being up: one folder per day, two files each, the attestation and the anchor exactly as the API served them. The mirror never rewrites a file it has already written. That is how it is built, not a property the repository proves on its own: it is one account's repository on one platform, and nothing but that account's conduct prevents its history from being rewritten, so a reader has to take its completeness as policy rather than as something they can check. A second copy, on a different platform under a different account, is planned; this paragraph names it on the day it is writing.
If Wellknown ceased operating, the complete public observation history and all attestations would be published under the Creative Commons Attribution 4.0 licence. Account data, claim tokens and anything else that is not already public would not be part of that release.
The anchor endpoint for any completed day returns the canonical document, its digest, the anchor signature and key, the log entry's inclusion proof and the signed checkpoint, with the verification steps spelled out:
GET https://wellknown.network/api/v1/attestations/daily/YYYY-MM-DD/anchorA standalone verifier that needs nothing but Node is at https://wellknown.network/verify-anchor.mjs.