The clock

A signature proves this key signed these bytes. It does not prove when. The clock is how a later hour can be checked.

Each hour, a hash of each signature is gathered into a tree. The prompt is not in the tree. The receipt is not in the tree. Only those hashes are. The hour is published. Signatures are grouped into hourly slots. A slot is sealed and timestamped only when it has signatures, so quiet hours have no slot. Sealed slots are anchored to Bitcoin via OpenTimestamps. That stamp sits on the hour. It is not a field inside the receipt.

You can paste a receipt on the clock. The browser hashes the signature and checks it against the published first hour.

The live hours are at GET https://api.metrecept.co.uk/v1/public/clock. A leaf is checked under the root of its hour at https://api.metrecept.co.uk/v1/public/clock/inclusion.

The witness

A signature from Metrecept on a root is Metrecept's account. A second office fetches an hour that is no longer open, reads /v1/public/clock/slots/{slot}, recomputes the RFC 6962 root, and signs the slot, the root, and the leaf count with a key it holds. A later different root gets no signature. The signature is a compact JWS, type metrecept-clock-witness+jws, with witness set to clock/v1. It is not a receipt.

That signature says the office fetched the hour and the leaves added up to the published root. It does not say the root was true the first time it was published. Signatures are grouped into hourly slots. A slot is sealed and timestamped only when it has signatures, so quiet hours have no slot.

The first receipt of the genesis hour can be checked in the browser on Receipts.