Summary

  • A 27 October individual Internet-Draft proposes that every version of a service’s terms and policies receive a log seal containing its name, version, URL and SHA-256 of the plain text. The earlier text must stay available at that URL.
  • The same design binds business and agent signing keys to a domain, keeps key history public and asks monitors to retain signed Merkle checkpoints. Together those records make a prior claim attributable and a later rewrite detectable; the reader still decides whether the claim was true or authoritative.

The disappearing previous page

Imagine a customer or an agent finishes a transaction under a service’s published rule. A month later, the current rule page says something different. Which version governed the action? A screenshot may be challenged. An archive run by the service itself can change with the site. A link to today’s terms answers the wrong question.

Furkan Yanteri’s individual Internet-Draft of 27 October puts a precise burden on the operator of a proposed statement system. Section 4.2 says every version of the service’s terms and policies must be sealed. The seal carries a document name, a version identifier, a URL for that version and the SHA-256 digest of its plain text. Every sealed version must remain available at its URL. If the operator edits the old file while retaining the same address, its digest changes. If the operator removes the old file, the record points to a missing exhibit. Either failure is visible to someone who retained the seal.

That is a sharper promise than “we keep a changelog.” A changelog written by the same organization can skip a line. A digest binds a particular byte sequence. A permanent version URL gives a reader the bytes to compare. A public log gives outsiders a record that the binding existed at a particular checkpoint. Each part has a separate job. The log without the old text leaves a fingerprint with no hand to match it. The old text without the log leaves a document that could have been composed yesterday and backdated.

The IETF Datatracker lists this document as an active individual draft, with I-D Exists status. Its claims describe a design, not an IETF-adopted standard or a finding that any named service changed a contract. The draft says a reference implementation is described elsewhere. This source package supplies no independently checked record of a real customer dispute using the complete chain.

A signed sentence still needs a named speaker

The design begins before a policy version enters the log. Section 3.1 specifies a restricted canonical JSON form based on RFC 8785: recursively ordered keys, no disposable whitespace, and values limited to strings, booleans, null, arrays, objects and safe integers. Section 3.2 places that canonical payload beside a public key and an Ed25519 signature. RFC 8032 supplies the signature algorithm. Canonicalization keeps two machines from signing different byte arrangements while calling them the same statement. It does not decide whether the sentence inside is honest.

A public key alone is a serial number for a cryptographic actor. The draft therefore asks a business or agent to bind its key to a domain through a _humancollab DNS TXT record. An HTTPS file may establish the first binding; replacing an established key requires DNS proof. The old key may not be recycled for another domain, and a public history must retain each key with the log index of its first statement. If control of a domain changes, the reader has a trail to examine instead of a timeless “verified business” badge.

This is where the institutional question becomes pointed. DNS control can appoint a key under the proposed scheme. It cannot make every sentence issued under that key accurate, make an agent’s promise a company contract, or decide which person had the power to bind the company. The draft’s own Section 6 gives the reader narrower conclusions: a valid domain binding identifies the domain controller that made a statement; a monitored inclusion record dates its appearance; a contradictory independent source gives the reader grounds to hold the author to account. “Signed” is a provenance label, not a verdict on the world.

The witness must live beyond the service

The proposed log is a Merkle tree with leaf and interior-node hashing aligned to RFC 9162. It serves inclusion and consistency proofs, signs tree-head checkpoints, and timestamps published roots through OpenTimestamps. Monitors check each checkpoint against the last one they saw and keep their own copies. The draft says the operator runs one monitor outside its service infrastructure, and anyone may run another.

The decisive boundary is independent retention. If all copies live under one operator’s control, a neat log interface can become another editable company page. Two valid signed checkpoints with the same tree size and different roots prove that the log showed incompatible histories. That proof exists only if someone kept both views. Timestamping and signatures make a split view more expensive to deny; witnesses make it possible to discover. The witness is not a ceremonial observer at a launch event. It is the party with yesterday’s checkpoint when today’s operator would prefer a cleaner story.

For a disputed rule, a useful case file would join four things: the exact prior plain-text version, its seal with hash and version URL, an inclusion proof against a checkpoint independently retained at the time, and the domain-key history for the actor that issued the statement. The draft does not package that case file as a legal adjudication. It gives technical receipts a reviewer can test. Whether the rule was enforceable, whether a customer saw it, and whether an agent had delegated authority to act remain separate facts. Those questions should be asked with the old wording on the table, not after the operator has made it vanish.

The service still controls its current site. That is ordinary operational power. The contested power is the ability to revise the past while asking everyone else to trust the present page. A versioned seal and an outside witness put a cost on that move. They make “show me the terms as they stood then” a practical demand rather than a negotiation over whose screenshot looks more official.

Sources